Implementing Privacy Policy in Justice Information Sharing: A Technical Framework

1. Implementing Privacy Policy in Justice Information Sharing: A Technical Framework John Ruegg, Chair, Global Technical Privacy Task Team and Dr. Alan Harbitter, IJIS Institute 10/31/2007

2. Topics • Approach Overview • Privacy Policy Technical Framework and Components • Applying the Framework to a Simple Use Case • Implementing the Framework • Task Progress Summary

3. Underlying Principles and Assumptions • Do not invent new technology • Focus on the domain-specific components required for interoperability (e.g., standards, specific metadata) • For now, focus on access rather than collection • Assume that there is a written policy in place • Briefly, we are going to • Identify technologies to translate written privacy policy in machine-readable form • Define the pieces necessary to link justice information systems to that policy

4. Response message Content metadata Request message Identity credentials PEP PDP Audit trail Obligations Electronic policy statements (dynamic, federated) Written policy Environmental conditions Technical Framework Actions: release, modify, access, delete, … PEP: Policy Enforcement Point PDP: Policy Decision Point

5. Example Electronic Privacy Policy Rule • Specific to justice applications • Allow (oc)law enforcement ORIs (uc) to perform Updates (a) on criminal history records (dc) under the condition where the ORI is the record owner(c) for criminal history reporting(p) requiring logging of actions (o) uc: User categories a: Actions dc: Data categories c: Conditions p: Purposes o: Obligations Oc: Outcome

6. Simple Use Case: A Cross-Jurisdictional Traffic Stop

7. Implementation Cost Considerations • Balance cost, risk, and complexity • Human MOU with no technical implementation standards • Low-hanging fruit such as encryption of portable media (memory sticks, laptops, etc.) • Larger investment and support required for fine-grained than for coarse-grained authorization

8. It’s Not All Technology • Training and outreach • Legal research of laws governing privacy and disclosure requirements • Establishment of information stewards and policy decision makers • Confidentiality of personal information • Appropriate Use Practices • Appropriate dissemination policy • Physical security measures • Procedural measures • Policy on portable devices/media • Separation of security administration roles

9. Global Tech Privacy Team Status Update • First draft report delivery—June 2007 • Global Working Groups, GESC, and IJIS reviews— July/August 2007 • Final draft—executive review and ready for release in fall 2007 • Follow-up and next steps—currently under consideration by GAC GESC: Global Executive Steering Committee IJIS: Integrated Justice Information System Institute

10. Next Steps • Action items and assignments • Privacy Policy Pilot Projects • Global Security Working Group (GSWG) • Global Privacy Information Quality Working Group (GPIQWG) • Continued integration with Justice Reference Architecture (JRA) • Global Infrastructure Standards Working Group (GISWG) • Mature metadata and integrate with NIEM/GJXDM/GFIPM • XML Structure Task Force (XSTF)

11. Recommendations • Adopt the Privacy Policy Technical Framework • Adopt the common set of standards and metadata that are specific to the justice domain and aligned with current initiatives • Develop a transition strategy for moving to enterprise electronic policy services

12. Questions?

13. GAC Recommendations • Adopt Implementing Privacy Policy in Justice Information Sharing: A Technical Framework • Recommend as resource Implementing Privacy Policy in Justice Information Sharing: A Technical Framework Executive Summary Flyer • Recommend as resource Global Federated Identity and Privilege Management Executive Summary Flyer