CJIS Governing Board Meeting October 16, 2014, 1:30 pm Division of Criminal Justice, 300 Corporate Place, Rocky Hill, CT 06067 CJIS Governing Board Members and Designees in attendance Michael P. Lawlor, Co-Chair, Under Secretary, Office of Policy and Management; Judge Elliot Solomon, Designee, Deputy Chief Court Administrator, Judicial; Hakima Bey-Coon, Designee, Office of the Victim Advocate; Brian Carlow, Designee, Division of Public Defender Services; Cheryl Cepelak, Designee, Department of Corrections; Melody Currey, Commissioner, Department of Motor Vehicles; Kevin Kane, Chief State’s Attorney, Division of Criminal Justice; Richard C. Mulhall, Chief, Connecticut Police Chiefs Association; Mark Raymond, Designee, CIO, Department of Administrative Services, Bureau of Enterprise Systems and Technology; and Richard Sparaco, Designee, Board of Pardons and Parole. Other attendees Sue Brown (DPDS), Karen Buffkin (OPM), Celia Siefert (JUD), Bob Cosgrove (DOC), Frank DiMatteo (DPDS), Chris Duryea (JUD), Jacob Kozak (DPDS), Karl Lewis (DOC), Jason Rosa (DESPP), John Russotto (DCJ), Terry Schnure, Celia Siefert (JUD), Pete Smith (Rome, Smith, & Lutz ), Tanya Stauffer (AIC), and Antoinette Webster (DESPP). CJIS staff and contractors Phil Conen (Xerox), Patty Meglio, Mark Morin, Charlie Polizzi, Sean Thakkar, Elizabeth Ugolik and David Wright (Xerox). I. Welcome and Introduction • • • Mike Lawlor, Governing Board Co-Chair, brought the meeting to order at 1:58 pm and welcomed everyone. Mr. Lawlor introduced Judge Elliot Solomon who is the designee for Judge Carroll. Mr. Lawlor said that Commissioner Schriro was detained at a press conference in New Haven and could not attend the meeting today. II. Minutes of Previous Meeting • Mr. Lawlor asked for any additions or corrections to the minutes of the previous meeting held on July 17, 2014. Ms. Hakima Bey-Coon asked for a correction on page one to her title, from BOPP to OVA, and Mr. Kevin Kane asked that an addition be made to page five, paragraph five, “The use of the forms were not approved.” A motion was made to approve the minutes (with these modifications) by Mr. Mark Raymond and seconded by Ms. Melody Currey. The minutes were approved unanimously. III. FBI Update • Mr. Lawlor explained that Commissioner Schriro had a phone conversation with the FBI on the CJIS compliance policy. Mr. Kane was on the call and provided the update. They were happy to know that they will be receiving a package consisting of the Management Control Agreement (MCA) the project description and topology. They questioned if the statute had remained the same since there were concerns in their letter and the response was that the statute was same and the issues were addressed in the MCA. Mr. Lawlor mentioned that some of these documents are being approved by the Board today. He asked Mr. Kane if he thought that they would get to this soon and Mr. Kane said that it sounded like they were hopeful and might expect to take their first look at it in a couple of weeks of receiving the package. Mr. Lawlor said that should there be any statutory language that requires a change, there is about three months before the Legislature is in session, which would give us ample time to request changes. IV. Xerox Contract Amendment • • • • Ms. Karen Buffkin explained that since the last Governing Board Meeting, they had reached agreements on all issues except for SharePoint licensing. The issue is that the current number of SharePoint licenses is inadequate for the requirements. Discussions with Microsoft and Xerox have been productive, but there is no resolution to report at this time. Mr. Raymond said that they will need to revisit the agreement and adjust the delivery schedule, once this issue is resolved. Mr. Lawlor asked Ms. Buffkin if, once this issue is resolved, the Board will need to convene to approve the contract. Ms. Buffkin said that it depends on the outcome of the resolution. Mr. Kane asked if the schedule will be delayed until the FBI gives their approval. Mr. Lawlor said that since it will be six to eight months before CISS is available to agencies other than law enforcement, it probably would not affect the schedule. V. CJIS Project Update - Presentation • • • • • • • • Mr. Thakkar reviewed the details of the agenda (slide 2). Mr. Thakkar provided the overview of the Governance Committee’s Issue Log (slides 3 and 4). Mr. Thakkar spoke about the State ID and mentioned that they received the statement of work from 3M who host the application for AFIS. On the durational project manager position, Mr. Thakkar said that they are still working on this. The prospects are limited and it was mentioned that they may need to expand the search or increase our visibility. He also said that they may have a person in consideration, but they are not sure yet. Ms. Buffkin said that they are working with DAS to determine if the qualifications or job specifications need to be changed. She also said that it is hard to find good candidates due to the demand in the current marketplace for people with technical backgrounds. Mr. Kane wanted to know the impact of not having a person in place. Mr. Thakkar said that because the amendment is not done, it will not affect the project. Mr. Thakkar spoke about the eighteen open positions and mentioned that one person was hired. One position was open but no one applied for the position. We may need to re-examine the qualifications in order to get interest in this position. Mr. Thakkar reviewed what CISS is and how it works to help those who are new in the audience (slide 5). Mr. Thakkar introduced the two new project managers, Mark Morin and Charlie Polizzi (slides 6 and 7).  October 16 Governing Board Meeting Minutes Page 2  • • • • • • • Mr. Thakkar opened the discussion on the FBI Document next (slides 8-10). It will be the document that will go with the MCA to the FBI. Ms. Antoinette Webster asked about the recent changes. Mr. Thakkar said they were located in the back of the document under Revision History. Mr. Raymond said that DAS/BEST handles a lot of information from a lot of different agencies, but they don’t access it or interpret the data. He recommended that CISS FOIA requests should operate the same way. He said requests for information should be pushed back to the agencies and they should handle any requests. Mr. Thakkar agreed. Ms. Currey put forth a motion to remove the last sentence on page eight. Ms. Cepelak seconded it. Mr. Kane questioned how a FOIA request would be handled if sent to him as the executive director of the system. Mr. Thakkar said that it would be passed on to the originating agency and that CJIS would send a notice to the requestor advising them of the action taken in a timely manner. Mr. Lawlor suggested that the Board would adopt a policy for FOIA requests and said that a standard letter could be written and the language approved by the Board that would direct inquiries to the agency with the system of record. This letter would be sent within four business days of the receipt of the inquiry. Ms. Buffkin agreed and said that Mr. Thakkar should not be put in the position to gather the information just to submit the letter to the agency head. Mr. Kane agreed that it seems like the solution. Mr. Carlow mentioned that it does not preclude the requestor to continue to request information from CJIS. If it becomes a problem, the next step would be the statutory exemption. Mr. Thakkar said the Governance Committee or the Board could give him the guidance on that. Mr. John Russotto said that the FBI letter addressed this issue. Mr. Lawlor said that we may ask the legislature for an exemption, as long as it’s not public information. He said that it’s important to get the FBI’s posture on this. Ms. Currey made a motion to remove the last sentence on page eight. Mr. Mark Raymond seconded it. The vote was passed unanimously to remove the last sentence on page eight. Mr. Lawlor asked for a move to approve the FBI Document. Mr. Kane made a motion to approve the FBI Document, as amended, and Mr. Raymond seconded the motion. Mr. Lawlor and Mr. Thakkar, per the request of Mr. Kane, explained the history of the FBI Document, how the new document was created and who was involved. Ms. Currey said thank you to them and to Mr. Jim Harris for reviewing the document with a fine tooth comb. It has addressed her concerns. Ms. BeyCoon asked about the agencies listed on page 9 of the FBI Document, whether they were those who input information. The page lists the criminal justice and non-criminal justice agencies that will have access to CISS. Mr. Thakkar said that only those agencies that have access to FBI information today will have access to this FBI information in CISS. OBTS only has the FBI number, no other information. Mr. Lawlor asked for the vote to approve, and once taken, all approved to accept the document. Mr. Thakkar moved on to the FBI Security Policy 5.3 (slides 11 and 12). He reiterated that this policy only applies to those who have access to FBI information today. It was made clear by Mr. Russotto that we cannot change anything, since it is the FBI policy. Their policy governs access to criminal justice agencies and only criminal justice agencies would have access to this information. It does not mean that they get access to FBI information. Mr. Kane stated that we have no choice but to comply with the FBI Security Policy and Mr. Thakkar agreed. If there is a breach of this policy, CJIS will notify the Governance Committee, Governing Board, and the CSO. Mr. Russotto mentioned that the FBI requires us to have certain training and that the IT systems must be up to date and secure in order to comply as well. Mr. Lawlor called for a vote, Mr. Raymond made a motion and Ms. Currey seconded the motion to accept the FBI Security Document 5.3. The motion passed unanimously.  October 16 Governing Board Meeting Minutes Page 3  • • • • • • • • • • Mr. Thakkar explained the CT CJIS Security Policy document (slides 13-16). Mr. Kane asked that the statutes be sent out to everyone to remind everyone about it. Mr. Lawlor suggested that it might be good to provide some training on the rules for security. Mr. Thakkar replied that everyone who will use CISS must first pass certification training that Xerox is putting together. For CISS staff, Mr. Thakkar said that CJIS employees are subject to background checks and they also sign nondisclosure agreements with the state and with Judicial. The security for each employee is limited to the work that they do. Mr. Thakkar will bring the NDAs and the statutes to the next CJIS Governance Meeting. Ms. Cepelak asked if there were any changes to the document that might need to be revisited. Mr. Thakkar said the Governance Committee just approved it and then sent it to the Governing Board for their comments. Mr. Lawlor called for a vote to accept the CT CJIS Security Policy document, Mr. Kane made a motion and Ms. Cepelak seconded the motion. The motion was carried, the vote being unanimous in favor. Mr. Thakkar went over the background of the OBTS issue and the pros and cons (slides 17-20). The next topic was the vote to continue to support the Offender Based Tracking System (OBTS) until CISS can take over. There was some discussion on usage. Mr. Raymond mentioned that it appears that there are more users than originally thought. Ms. Currey said that there are two parts to her agency. One part wants it, the other does not. Ms. Bey-Coon said OVA relies on it as well. Mr. Lawlor said that there are two parts to the OBTS issue. The first is whether to keep it alive for the time being (not forever), and second, whether the data should be folded into CISS once it is up and running. Mr. Thakkar replied that the vote today is only for keeping and supporting OBTS until CISS takes over. Mr. Lawlor said if it is added, there will be a cost associated with it, but we need not make that decision now. Mr. Lawlor asked Xerox if they can defer that decision until a later date. Mr. David Wright said that the decision to keep OBTS running in conjunction with CISS can be deferred to a later date in a separate document. Mr. Lawlor called for a vote to keep OBTS until it can be replaced by CISS. Ms. Bey-Coon made the motion and Mr. Raymond seconded the motion. A vote was taken. There were eight Yes votes, one No vote, and one Abstain vote. The motion was passed. Mr. Lawlor brought up the topic of the CJIS Legislative Report. He said that Mr. Kane asked whether CJIS wrote the report. He explained that after speaking to Judge Carroll, the decision was to postpone the report until after the FBI Security Policy and the Xerox Contract Amendment were resolved. The thought was that at the time it was nearly resolved and they should wait to add this information to the report. Though Mr. Thakkar had been in contact with the legislature about progress on the CJIS projects and the co-chairs had sent an update on the Attorney General’s (AG’s) letter to the AG’s office, the legislative report was not sent out. Mr. Kane asked for a draft of it by the second week in November. Mr. Lawlor said that he would ask for a draft of a late version of the July report, and another one at the end of December. Mr. Lawlor also said that the CJIS Website has more information than he has seen for most other projects. Mr. Thakkar went on to talk about the budget (slide 21). He said that it was on schedule and that CJIS was reimbursed by CCSU in August for their work with the Traffic Stop Profiling. The next discussion began with an introduction on the new Project Health Check vendor, Qualis (slides 22-26). Mr. Thakkar said that the Project Health Check report would be similar to the previous reports, but would also include more assessments. Qualis would also produce a scorecard after taking a survey each quarter. A representative from Qualis will attend the next Governing Board Meeting and present their report. Qualis will create a baseline report that they will present to  October 16 Governing Board Meeting Minutes Page 4  • VI. CJIS in November, which will be shared with the Governing Board. Mr. Thakkar presented the differences between an Independent Verification and Validation (IV&V) and a Project Health Check. Ms. Currey asked if the risks will be presented the same and Mr. Thakkar replied that they would. Mr. Raymond asked if solutions to the risks would be presented. Mr. Thakkar said that they would and explained that CJIS would work with both the agency and Qualis on the mitigation strategy. Mr. Thakkar also explained that the baseline report will contain interviews, sixty-two criteria (two more than MTG gave), and a questionnaire, which is unlike the report presented by MTG. Qualis will start the measurement without historical information, thus it becomes a baseline from which future reports are compared. Governing Board Voting Members • • • • • • • • • • VII. • VIII. • Michael P. Lawlor Judge Elliot Solomon Hakima Bey-Coon Brian Carlow Cheryl Cepelak Melody Currey Kevin Kane Richard C. Mulhall Mark Raymond Richard Sparaco Other Business Mr. Lawlor announced that next Governing Board meeting dates as shown on the agenda. He also thanked Judge Solomon for attending, and thanked Mr. Thakkar and his staff for their efforts. Adjournment There being no further business, the meeting adjourned at 3:17 pm.  October 16 Governing Board Meeting Minutes Page 5 