Contractor Access to Information from Interstate Identification Index

• Court: Department of Justice Office of Legal Counsel
• Decided: August 15, 1996
• Status: Published

Opinion

Contractor Access to Information from Interstate Identification Index

The Office o f Personnel Management and other agencies have authority to disclose criminal history records information to private contractors performing background investigations o f government em ­ ployees or prospective employees.

OPM and other agencies also have authority to permit those contractors to have controlled on-line access to criminal history records o f individuals subject to background investigations through the Interstate Identification Index system.

A u g u st 15, 1996

M e m o r a n d u m O p in io n f o r t h e D e p u t y A t t o r n e y G e n e r a l

This responds to your request for our opinion concerning whether private con­ tractors retained by the Office of Personnel Management (“ OPM” ) to conduct or assist in conducting background investigations of government employees (or prospective employees) may be granted access to the criminal history records of those employees that are maintained in the Interstate Identification Index system (“ III” ). In particular, you have asked (1) whether OPM may provide designated contractors with particular information gleaned by OPM from III system records that OPM concludes will assist the contractor in performing background investiga­ tions; or, more expansively, (2) whether the contractors may themselves be granted direct on-line access to all III records necessary to perform the required back­ ground investigations. Based upon the factual circumstances outlined below, we conclude that both of the proposed arrangements would be lawful. Our conclusion with respect to the second alternative is based on the understanding that direct contractor access to the III system will be subject to effective mechanisms to guard against exceed­ ing authorized access, including contractual restrictions and systems for moni­ toring the identity of records accessed by contractor personnel through the III system.

I. BACKGROUND

A.

OPM is one of several agencies responsible for conducting background inves­ tigations on federal employees and prospective federal employees for two general purposes: (1) authorizing employee access to classified information and (2) deter­ mining a person’s suitability for federal employment or for particular categories of federal employment. See 5 U.S.C. §3301; Exec. Order No. 10450, 3 C.F.R. 936 (1949-1953), Exec. Order No. 10577, 3 C.F.R. 218 (1954-1958), and Exec.

299 Opinions o f the Office o f Legal Counsel in Volume 20

Order No. 11222, 3 C.F.R. 306 (1964-1965). Under 5 C.F.R. pt. 731 (1996) (“ Suitability” ), OPM is also authorized to deny federal appointments when nec­ essary to “ promote the efficiency of the [civil] service.” Id. §731.201. Among the factors to be considered as grounds for disqualification under that regulation are criminal or dishonest behavior and abuse of narcotics or alcohol. Id. §731.202. OPM’s background investigation workload has increased substantially over the past ten years. The extent of that workload, the quality and cost of the background investigations, and the measures OPM has taken to improve its performance have been the subject of congressional attention and legislation. In 1985, for example, Senate hearings explored federal government security clearance programs in gen­ eral, and OPM’s background investigation practices in particular, in considerable depth. See F ederal Government Security Clearance Programs: Hearings Before the Perm anent Subcomm. on Investigations o f the Senate Comm, on Governmental Affairs, 99th Cong. (1985) (“ 1985 Hearings” ). In those hearings, OPM reported that it had begun to use outside contractors to expand and enhance its background investigation capabilities. Id. at 198, 256. Those hearings also showed that the State Department, at that time, was already using retired federal investigators as private contractors to perform background investigations previously performed for the State Department by OPM. Id. at 287. The hearing record reveals that Con­ gress was not only aware that certain background investigations were being “ con­ tracted out,” but that Congress was actively exploring the benefits of expanded contracting out for other civilian agencies. Id.

B.

As part of the background investigation process, it is necessary for an inves­ tigating agenc[y] to have access to the criminal history record (“ CHR” ) of the subject.1 For many years, CHRs have been collected, maintained, and exchanged on a nationwide basis under the auspices of the Federal Bureau of Investigation (“ FBI” ) in cooperation with federal, state, and local law enforcement agencies. Statutory authority for the creation, maintenance, and use of that system is set forth in 28 U.S.C. §534. That statute directs the Attorney General, inter alia, to “ acquire, collect, classify, and preserve identification, criminal identification, crime, and other records” and to “ exchange such records and information with, and for the official use of, authorized officials of the Federal Government, the States, cities, and penal and other institutions.” Id. § 534(a)(1), (4). The FBI has complied with this mandate by acquiring CHR information (as well as related identifying information, such as fingerprint cards) from the states. The states have provided this information to the FBI and derived reciprocal benefit by drawing upon the FBI’s national repository of such record information for their 1 As OPM stated in the 1985 Senate hearings, “ [i]t is obvious that State and local law enforcement checks are an essential and irreplaceable component o f an y background investigation.” 1985 Hearings at 271.

300 Contractor Access to Information from Interstate Identification Index

own law enforcement purposes. In more recent years, the FBI has sought to im­ prove and streamline this system by approving the development and implementa­ tion of the Interstate Identification Index, a computerized and more decentralized system of CHR exchange maintained in cooperation with the National Crime In­ formation Center (“ NCIC” ) and participating states. As explained to us by the FBI, the III system consists of three basic parts: (1) the National Identification Index; (2) the National Fingerprint File; and (3) the actual criminal record repositories of the participating federal, state, and local agencies. The National Identification Index is essentially an electronic locator sys­ tem for the federal and state criminal history records of individuals. The system database is maintained by the FBI and accessed by participants through a web of computer linkups. The National Fingerprint File (“ NFF” ) consists of a system of fingerprint records provided by participating governments and maintained by the FBI. The NFF serves to provide positive identification of the subjects of such records. Finally, the criminal record repositories maintain and make available the actual criminal history records of individuals. The federal-state exchange of criminal history records pursuant to 28 U.S.C. §534 was originally and primarily intended for criminal law enforcement pur­ poses. See United States Dept, o f Justice v. Reporters Comm. For Freedom o f Press, 489 U.S. 749, 752 (1989). Although many states would also provide such records to federal agencies for background investigation purposes (i.e., non-crimi- nal justice purposes) on a voluntary basis, the 1985 hearings showed that some states refused to do so, either as a matter of policy or due to state laws limiting access to such information. See H.R. Conf. Rep. No. 99-373, at 24-25 (1985), reprinted in 1985 U.S.C.C.A.N. 959, 967-68 (“ Conf. Rep.” ). As a result, Con­ gress enacted 5 U.S.C. §9101, which now provides a m andatory mechanism for federal agencies performing background investigations to obtain CHR information from state and local (as well as federal) law enforcement agencies.

C.

OPM has entered into a contract with a company called US Investigations Serv­ ices, Inc. (“ USIS” ) to obtain assistance in performing personnel background in­ vestigations. The contract provides that USIS “ will conduct background investiga­ tions nationwide on Federal Government applicants, employees, and contract em­ ployees performing sensitive work.” USIS Contract at 50. The contract also con­ tains a variety of provisions restricting the use and disclosure of background infor­ mation made available under the contract, including a clause prohibiting the con-

301 Opinions o f the Office o f Legal Counsel in Volume 20

tractor from disclosing such information for any purpose other than fulfilling its obligations under the contract.2 We have been asked to consider the legality of two possible arrangements that OPM might pursue with its contractor. Under one arrangement, OPM would pro­ vide contractor personnel with only particular items of information from a sub­ ject’s CHR (including items obtained by OPM personnel from the III system) to enable the contractor to resolve particular questions raised by a subject’s CHR. For example, the contractor might be provided information concerning a particular criminal charge against the subject and assigned the task of ascertaining its ulti­ mate disposition. Under the second alternative, OPM would provide its contractors with direct on-line access to the III records and would leave it to the contractors to perform all aspects of the background investigations, albeit under OPM’s ultimate super­ vision. Under this arrangement, although contractor personnel would be authorized to access only the III records o f designated investigation subjects and would be subject to a variety of sanctions for exceeding authorized access, their actual on­ line access would extend to the system as a whole.3 At the same time, we under­ stand that any attempt by users to access unauthorized records on the III system would be recorded by the system’s monitoring mechanisms and readily subject to detection.

U. ANALYSIS

1. A uthorized D isclosure of CH R Information.

In 1985, Congress enacted what is now 5 U.S.C. §9101 as part of the Intel­ ligence Authorization Act for FY 1986, Pub. L. No. 99-169, tit. VIII, §801 (a), 99 Stat. 1002, 1008 (1985). That legislation provided the Department of Defense, OPM, and the Central Intelligence Agency (the FBI and State Department were included under subsequent amendments) with the right to obtain federal, state, and local criminal history record information for purposes of determining the eligi­ bility of personnel for (1) access to classified information; and (2) assignment to or retention in sensitive national security duties. As relevant here, the operative portion of this statute now provides: 2 Paragraph H .18 o f the contract, for exam ple, provides: “ Except as otherwise provided herein, any information m ade available to the Contractor by the G overnm ent shall be used only for the purpose o f carrying out the provisions o f this contract and shall not be divulged o r m ade known in any manner to any persons except as may be necessary in the perform ance o f the contract.” Id. at 83. 3 W e have been advised by O PM that it is not technically feasible to arrange for contractor personnel to be granted com puter access only to the full III criminal history records o f designated investigation subjects without being granted access to the III system as a whole. That is, the system apparently does not permit retrieval of the complete CHR on a subject by means o f a limited access password that w ould confine the user's HI access solely to the records o f that individual subject.

302 Contractor Access to Information from Interstate Identification Index

Upon request by the [OPM or the FBI], criminal justice agencies shall make available criminal history record information regarding individuals under investigation by [OPM or the FBI] for the pur­ pose of determining eligibility for (A) access to classified informa­ tion or (B) assignment to or retention in sensitive national security duties.

5 U.S.C. § 9101(b)(1). The “ criminal justice agencies” required to provide the information include federal, state, and local agencies engaged in the administration of criminal justice. Id. §9101(a)(l). The “ criminal history record information” covered by the statute consists of

information collected by criminal justice agencies on individuals consisting of identifiable descriptions and notations of arrests, in­ dictments, informations, or other formal criminal charges, and any disposition arising therefrom, sentencing, correction supervision, and release.

Id. § 9101(a)(2). This defmition encompasses CHR information contained in the III system.4

Section 9101 provides separate authorization for the controlled use and disclo­ sure of the subject CHR information by the recipient agency, as follows:

Criminal history record information received under this section shall be disclosed o r used only for the purposes set forth in para­ graph (b)(1) or for national security or criminal justice purposes authorized by law, and such information shall be made available to the individual who is the subject of such information upon re­ quest.

Id. § 9101(d) (emphasis added). The text of §9101 thus indicates that some disclo­ sure of CHR information to individuals outside the agency by the recipient agen­ cies is contemplated and permitted. In particular, use of the term “ disclosure” would amount to mere surplusage, and make little sense, if construed to refer only to disclosure to employees within the recipient agency. See Zeigler Coal Co. v. Kleppe, 536 F.2d 398, 406 (D.C. Cir. 1976) (statute should not be construed in a manner that renders some provisions superfluous). The recipient agency’s “ use” of the information necessarily encompasses its “ disclosure” to the agency employees who handle and review it. Use of the broader phrase “ disclosed or 4 It is also o u r understanding, based on descriptions o f the III system provided to us by the FBI, that information made available through the in system is limited to the categories o f information covered by §9101(a)(2)’s definition o f "crim inal history record information.”

303 Opinions o f the Office o f Legal Counsel in Volume 20

used” thus indicates that Congress contemplated and authorized disclosure of the CHR information in contexts apart from the internal use of it by agency employ­ ees. See also 5 U.S.C. § 9101(b)(3)(A) (providing for indemnification of state and local governments for damages resulting from “ disclosure or use” by OPM or the FBI of CHR information initially received from the state or local government). The disclosures authorized by § 9101(d) are limited to those that serve certain national security or criminal justice purposes or “ the purposes set forth in para­ graph (b)(1)” — that is, the performance of background investigations to deter­ mine eligibility for access to classified information or suitability for sensitive posi­ tions. Disclosure of CHR information to private contractors retained to perform background investigations constitutes such a disclosure. The legislative history of §9101, moreover, further supports the conclusion that Congress intended to authorize the disclosure of CHR information to private con­ tractors. Congress conducted extensive hearings in 1985 on problems arising out of the federal government’s background investigation and security clearance proc­ ess. It was those hearings that revealed that state and local governments were frequently refusing to make CHR information available to federal background in­ vestigators, thereby leading to the enactment of 5 U.S.C. §9101. See S. Rep. No. 99-136, at 2 (1985). The 1985 hearings also established that OPM and the State Department had already begun to utilize outside contractors to help reduce their growing backlogs of background investigation work. 1985 Hearings at 198, 256- 57, 287-90. As then OPM Director Donald Devine testified in explaining one of the key measures taken by OPM to deal with its increased background inves­ tigation workload:

[M]ost importantly in a major change [of] policy, we have been moving to a concept of a corps of permanent investigators con­ sisting of OPM employees supplem ented by an expanding con­ tractor relationship with outside investigators, many of them pre­ vious OPM investigations [sic]. This measure is the only way we can meet the recurring surges and declines in work load without significant disruptions.

Id. at 198 (emphasis added). Senators at the hearing revealed not only their aware­ ness that agencies were “ contracting out” background investigation work, but their considerable interest in the potential cost savings that might be achieved through that practice. Id. at 202 (remarks of Senator Nunn, who observed, “ [W]e heard testimony yesterday that the State Department had contracted out their in­ vestigative services at a cost of approximately $900 per personnel case.” ); id. at 287-88 (additional written Committee questions and OPM responses submitted for the record, including the following question from the Committee: “ Should other civilian agencies contract out [their background investigations] like the State

304 Contractor Access to Information from Interstate Identification Index

Department to get the same quality [of] work cheaper and faster than with OPM?” ). It is therefore evident that when Congress enacted §9101, it fully understood and accepted the fact that personnel background investigations conducted by OPM and the State Department were sometimes “ contracted out” to private firms or individuals. That understanding provides relevant perspective as to what Congress had in mind when it provided that recipient agencies could “ disclose” criminal history record information for authorized background investigation purposes.5 In this context, it would appear that Congress intended to authorize OPM and other agencies to continue their practice of, at least at times, using contractors to per­ form background investigations and, correspondingly, to permit those contractors to have access to the necessary CHR information.6

2. Controlled On-Line Access to III System.

We also conclude that OPM’s proposal to provide certain contractor personnel with controlled on-line access to the III system in order to review the criminal history records of individuals subject to background investigations is consistent with the requirements and restrictions of §9101. Such access, properly controlled to prevent unauthorized inquiries, simply constitutes another form of authorized disclosure under § 9101(d). It should be recognized, however, that allowing con­ tractor personnel to have direct access to the HI system could pose an increased risk of abuse and litigation. If contractors were permitted unrestricted access to the III system as a whole, it might reasonably be argued that such access is functionally equivalent to the disclosure to the contractors of all records accessible on the system. Such whole­ sale disclosure would plainly exceed the sort permitted under §9101, which is (for present purposes) limited to disclosure for the purpose of conducting required background investigations of government employees or prospective employees. As we understand it, however, the arrangement that OPM has negotiated with USIS 5 The Conference Report on the legislation provides little additional insight on the meaning o f the authorized disclosure provision o f 5 U.S.C. §9101(d). Conf. Rep. at 29, reprinted in 1985 U.S.C.C.A.N. at 972-73. Insofar as pertinent here, it merely reiterates the point that disclosures o f CHR information permitted under the statute must be limited to those furthering the statutory purposes. We should note, however, that a reference in the C on­ ference Report to a “ specific need" as a predicate for disclosure o f CHR information refers only to certain special disclosures “ for national security o r criminal justice purposes,” as specified in § 9101(d). Id. T hat "specific need” qualification does not relate or apply to disclosures made for the basic purpose o f conducting background investiga­ tions pursuant to § 9 1 0 1(b)(1). 6 The Privacy Act, o f course, precludes an agency from disclosing "a n y record which is contained in a system o f records . . . to any person . . . except . . . w ith the prior written consent o f t ) the individual to whom the record pertains, unless” a particular exemption applies. 5 U.S.C. §552a(b). Here, we understand that all those who will be subject to background checks conducted by USIS employees will first sign releases, authorizing the disclosure o f CHR information to a "representative” o f OPM . To avoid any confusion regarding the scope of the release, and to minimize the risk o f litigation, we strongly recommend that OPM modify the release to clarify that the CHR information will be disclosed to an independent contractor retained to assist in performing background investiga­ tions. In addition, the risk o f litigation would also be reduced by the issuance o f a relevant routine use notification. See id. at §552a(b)(3).

305 Opinions o f the Office o f Legal Counsel in Volume 20

does not go this far. On the contrary, there are numerous contractual, legal, and practical mechanisms to deter and sanction unauthorized exploitation of III access in these circumstances. The USIS contract includes at least four clauses (para­ graphs H.14, H.18, and H.20-21) prohibiting or sanctioning unauthorized use of confidential information accessed under the contract by the contractor or its em­ ployees. OPM is also authorized to revoke a contract employee’s access authoriza­ tion and to bar him from work on the contract in the event of “ misconduct . . . affecting the integrity of an investigative product under the contract” (paragraph H.24)— which would likely include unauthorized examination of non-subject CHR’s on the III system. USIS Contract at 85. Moreover, continuous system mon­ itoring and recording of the particular records accessed on the III system provides an added deterrent against such abuse. By comparing the record subjects that con­ tract personnel are authorized to examine by OPM against those that they actually examine (as recorded by the monitoring system), unauthorized examinations would be readily detectable. Finally, abuse of access to III records could also subject the perpetrator to criminal prosecution under some circumstances.7 Such restrictions provide the kind of limitations on access to sensitive records that have been upheld as adequate in comparable contexts. See, e.g., Whalen v. Roe, 429 U.S. 589, 598-602 (1977) (measures to preserve confidence of state drug prescription registry held sufficient to negate claims that potential for public disclosure would violate privacy rights); H odge v. Jones, 31 F.3d 157, 165-66 (4th Cir.), cert, denied, 513 U.S. 1018 (1994) (Maryland statutory procedures held adequately to limit access to child abuse information records, and thus ‘‘tangential possibility” of public disclosure through such theoretical means as improperly motivated state employees or fortuitous computer hackers did not implicate a con­ stitutional privacy right). Here, we believe the above-described restrictions provide adequate assurance that the contractor’s access to III records will be limited to the background investigation purposes authorized by 5 U.S.C. § 9101(b)(1).

Finally, our conclusion that §9101 authorizes the sort of disclosures con­ templated by the OPM/USIS contract is not inconsistent with prior opinions of this office that have concluded that certain disclosures of CHR information to private entities were not authorized by the governing law. See Memorandum for William Webster, Director, Federal Bureau of Investigation, from Robert B. Shanks, Deputy Assistant Attorney General, Office of Legal Counsel, Re: Missing Children A ct (Apr. 24, 1984) (concluding that certain CHR information on missing persons could not be provided to private organizations); Memorandum for Joseph H. Davis, Assistant Director, Legal Counsel Division, Federal Bureau of Investiga­

7 For exam ple, the Privacy Act provides misdemeanor sanctions for “ [a]ny person w ho knowingly and willfully requests o r obtains any record concerning an individual from an agency under false pretenses.” 5 U.S.C. §552a(i)(3).

306 Contractor Access to Information from Interstate Identification Index

tion, from William P. Barr, Assistant Attorney General, Office of Legal Counsel, Re: Proposal by F ederally Chartered or Insured Financial Institutions to D issem i­ nate FBI Criminal H istory Record Information to CARCO Group, Inc. (Sept. 1, 1989) (concluding that secondary dissemination of CHR information by authorized private users— banks and securities firms— to other private entities who were in a contractual relationship with the authorized private user was not permitted); Memorandum to Files, from Mary C. Lawton, Deputy Assistant Attorney General, Office of Legal Counsel, Re: Railroad Police Access to FBI Criminal Identifica­ tion Records (June 22, 1978) (concluding that a local criminal justice agency may not provide private railroad police with criminal history information obtained from the FBI). None of these prior opinions involved the question whether disclosure was au­ thorized under §9101, but rather each turned on the distinct question whether disclosure was permitted under 28 U.S.C. §534. In short, each of these prior opin­ ions rests on the premise that §534 only authorizes the “ exchange” of informa­ tion between governmental officials, and that governmental officials who receive information pursuant to § 534 may not disseminate the information to private enti­ ties.8 Here, in contrast, we conclude that the disclosures at issue are authorized under §9101, and §534 does not purport to limit the dissemination of information authorized under a separate statute. Moreover, to the extent any inconsistency might arguably exist between the two statutes, §534 must yield to §9101. Insofar as conflicts between two statutes cannot be reconciled by construction, “ the most recent and more specific congres­ sional pronouncement will prevail over a prior, more generalized statute.” Natural Resources Defense Council, Inc. v. EPA, 824 F.2d 1258, 1278 (1st Cir. 1987), citing 2A C. Sands, Sutherland on Statutes and Statutory Construction §51.02 (4th ed. 1984). Section 9101 was enacted in 1985 to establish specific provisions for designated federal agencies to obtain CHR information from the states on a mandatory basis for purposes of conducting background investigations. Its enact­ ment was necessitated in part by the fact that the more general provisions for exchange of CHR information previously provided by §534 (enacted in 1966, Pub. L. No. 89-554, §4(c), 80 Stat. 616) did not require the states to provide such information for background investigation purposes. As the more recently en­ acted and more specific provision, therefore, the disclosure provision of §9101 would prevail over § 534 insofar as a conflict exists.

CHRISTOPHER H. SCHROEDER Acting A ssistant A ttorney General Office o f Legal Counsel

8 Because we conclude that §9101 authorizes the disclosures at issue here, we need not (and do not) consider whether §534 might also authorize these disclosures.