United States Department of Justice Implementing Privacy Policy in Justice Information Sharing: A Technical Framework John Ruegg, Chair, Global Technical Privacy Task Team and Dr. Alan Harbitter, IJIS Institute 10/31/2007

United States Department of Justice Topics Approach Overview Privacy Policy Technical Framework and Components Applying the Framework to a Simple Use Case Implementing the Framework Task Progress Summary

United States Department of Justice Underlying Principles and Assumptions Do not invent new technology Focus on the domain-specific components required for interoperability (e.g., standards, specific metadata) For now, focus on access rather than collection Assume that there is a written policy in place Briefly, we are going to –Identify technologies to translate written privacy policy in machine-readable form –Define the pieces necessary to link justice information systems to that policy

United States Department of Justice Global Privacy Task Team Approach 1.Review the Global Privacy and Information Quality Working Group “Privacy Policy Development Guide and Implementation Templates” for Business Requirements 2.Draft Technical Requirements from Business Requirements 3.Validate Technical Requirements against sample use cases

United States Department of Justice Global Privacy Task Team Approach (continued) 4.Define a Technical Framework for Implementing Privacy Policy 5.Identify metadata to support electronic privacy policy implementations 6.Review vendor products, market maturity for designing and deploying policy services 7.Provide a Summary of Design/Implementation Guidelines, Technical Framework, Standards, and Recommendations for Next Steps

United States Department of Justice Technical Framework Audit trail Environmental conditions Written policy Obligations Actions: release, modify, access, delete, … Response message Content metadata Electronic policy statements (dynamic, federated) PEP PDP Request message Identity credentials PEP: Policy Enforcement Point PDP: Policy Decision Point

United States Department of Justice Electronic Policy Rules General authorization policy rule –Perform outcomes in response to requests by user categories to perform actions on data categories under conditions for valid business purpose(s) subject to prior agreement to [optional] obligations (metadata in bold italics)

United States Department of Justice Example Electronic Privacy Policy Rule Specific to justice applications –Allow (oc) law enforcement ORIs (uc) to perform Updates (a) on criminal history records (dc) under the condition where the ORI is the record owner (c) for criminal history reporting (p) requiring logging of actions (o) uc:User categories a:Actions dc:Data categories c:Conditions p:Purposes o:Obligations Oc:Outcome

United States Department of Justice Simple Use Case: A Cross-Jurisdictional Traffic Stop

United States Department of Justice More Implementation Considerations Level of authorization granularity impacts cost and complexity –Coarse-grained authorization—user categories including attributes such as user role, user certifications, user organization/membership, … are evaluated to grant/deny access to an application/database/portal –Fine-grained authorization—user categories and data categories are evaluated to restrict access to specific records within a database or specific functions within an application Industry support –There are commercial products available to implement each component of the framework

United States Department of Justice More Implementation Considerations (continued) Open standards support –WS-Federation built upon WS-Policy Framework WS-Trust WS-SecureConversation WS-Security –WS-MetaDataExchange –XACML (Policy Assertion Language (PAL)) –WS-SecurityPolicy Domain-specific vocabulary –NIEM/GJXDM privacy and data quality metadata additions

United States Department of Justice Implementation Cost Considerations Balance cost, risk, and complexity –Human MOU with no technical implementation standards –Low-hanging fruit such as encryption of portable media (memory sticks, laptops, etc.) –Larger investment and support required for fine- grained than for coarse-grained authorization

United States Department of Justice It’s Not All Technology Training and outreach Legal research of laws governing privacy and disclosure requirements Establishment of information stewards and policy decision makers –Confidentiality of personal information –Appropriate Use Practices –Appropriate dissemination policy –Physical security measures –Procedural measures –Policy on portable devices/media –Separation of security administration roles

United States Department of Justice Global Tech Privacy Team Status Update First draft report delivery—June 2007 Global Working Groups, GESC, and IJIS reviews— July/August 2007 Final draft—executive review and ready for release in fall 2007 Follow-up and next steps—currently under consideration by GAC GESC: Global Executive Steering Committee IJIS: Integrated Justice Information System Institute

United States Department of Justice Next Steps Action items and assignments –Privacy Policy Pilot Projects Global Security Working Group (GSWG) Global Privacy Information Quality Working Group (GPIQWG) –Continued integration with Justice Reference Architecture (JRA) Global Infrastructure Standards Working Group (GISWG) –Mature metadata and integrate with NIEM/GJXDM/GFIPM XML Structure Task Force (XSTF)

United States Department of Justice Recommendations Adopt the Privacy Policy Technical Framework Adopt the common set of standards and metadata that are specific to the justice domain and aligned with current initiatives Develop a transition strategy for moving to enterprise electronic policy services

United States Department of Justice Questions?

United States Department of Justice GAC Recommendations 1.Adopt Implementing Privacy Policy in Justice Information Sharing: A Technical Framework 2.Recommend as resource Implementing Privacy Policy in Justice Information Sharing: A Technical Framework Executive Summary Flyer 3.Recommend as resource Global Federated Identity and Privilege Management Executive Summary Flyer