MEMORANDUM OF UNDERSTANDING BETWEEN THE FEDERAL BUREAU OF INVESTIGATION CRIMINAL JUSTICE INFORMATION SERVICES DIVISION AND INDIANA BUREAU OF MOTOR VEHICLES CONCERNING THE SEARCH OF FBI PHOTOS AGAINST THE INDIANA BUREAU OF MOTOR VEHICLES FACIAL RECOGNITION REPOSITORY I. PURPOSE The purpose of this Memorandum of Understanding (MOU) is to document the agreed responsibilities and functions of the Parties with respect to conducting searches of the Indiana Bureau of Motor Vehicles (BMV) facial recognition (FR) repository, which contains driver's license (DL) and identification (ID) card photos. These searches will be performed for the purpose of comparing Federal Bureau of Investigation (FBI) investigative photos against photos housed in the BMV FR repository to obtain information that will advance active FBI investigations, apprehend wanted fugitives or known or suspected terrorists, and locate missing persons nationwide. II. PARTIES A. The FBI, Criminal Justice Information Services (CJIS) Division, Biometric Services Section (BSS), FACE Services Unit provides investigative support to FBI field offices and headquarters divisions. The CJIS Division's Assistant Director is the FBl's point of contact (POC) for this MOU. For day-to-day operations of the activities described within this MOU, the FBI POC is the FACE Services Unit's management and its Management and Program Analysts. B. The BMV is created pursuant to Indiana Code ("IC") §9-14-7-1. The BMV is responsible for maintaining all records related to or concerning credentials issued by the BMV under IC 9-24, including applications and information submitted by applicants, pursuant to IC §9-14-12-2(5). The BMV's Director of Fraud & Security Enforcement Division is the BMV's POC for this MOU. Ill. AUTHORITIES A. The FBI enters into this MOU pursuant to Title 28, United States Code (U.S.C.), Sections 533 and 534; Title 28, Code of Federal Regulations, § 0.85, and 18 U.S.C. § 2721. 1 Indiana BMV 102910 GULaw Privacy FR B. The BMV is authorized to share DL and ID card information with the FBI pursuant to IC §9-14-12-8, IC §9-14-13 and 18 U.S.C. §2721. IV. BACKGROUND INFORMATION The FACE Services Unit provides a FR service in which authorized FBI personnel submit a photo (probe) of a subject of interest in an active FBI investigation. These probe photos are searched against databases authorized for use by the FBI, which results in a photo gallery of potential matches (candidates). The FACE Services Unit performs comparisons of candidate photos against the probe photo to determine a candidate's value as an investigative lead. If a most-likely candidate is found, it is provided to the requesting FBI personnel. This service does not provide positive identification, but rather, an investigative lead and analysis to support that lead. Under the terms of this MOU, the BMV will search the FBI-submitted probe to the BMV FR repository, and candidates produced as a result of the search will be sent by the BMV to the FACE Services Unit. The number of candidates provided to the FACE Services Unit is dependent upon the searching threshold set by the BMV. V. SPECIFIC RESPONSIBILITIES A. The FBI will: 1. Submit probe photos via Law Enforcement Online (LEO)-to-LEO e-mail to the BMV for the purpose of comparing the probe photos with photos in the BMV FR repository. The LEO is accredited and approved by the FBI for Sensitive-but-Unclassified law enforcement information. 2. Manually analyze, compare, and evaluate the returned candidate photo gallery against the probe photo to determine the existence of a mostlikely candidate. 3. Request additional biographical information associated with each photo determined to be a most-likely candidate via a secure communication according to the requirements of BMV. email 4. Submit the photo(s) of any most-likely candidate(s) to be searched against the FBl's Next Generation Identification Interstate Photo System in order to locate any additional photos and associated arrest information relating to the most-likely candidate(s) and/or identify additional potential candidates. The results of this search will be compared and analyzed against the original probe photo(s). Once the analysis is complete, the most-likely candidate photo(s), along with any associated information, will be provided to the requesting FBI personnel as an investigative lead. 2 Indiana BMV 102911 GULaw Privacy FR 5. Store photo images and information associated with any most-likely candidate(s) in the FBI case management system for record keeping purposes. 6. Immediately destroy all other photos and information not associated with a most-likely candidate. B. The BMV will: 1. Apply for a LEO e-mail account through the LEO Operations Unit. 2. Search FACE Services Unit-submitted probe photos against the BMVFR Repository. 3. Use reasonable efforts to return electronic photos and DL/1D card number of all candidates to the FACE Services Unit via LEO e-mail in a timely and prompt manner. Under no circumstances will the BMV be obligated to hire additional personnel to perform services pursuant to this MOU. Furthermore, the BMV retains the right to prioritize the work of the Fraud Security and Enforcement Division, the division of the BMV that will have responsibility for performing services pursuant to this MOU. 4. Upon request, return additional biographical information associated with each photo determined by the FACE Services Unit to be a most-likely candidate. 5. Ensure that only authorized BMV personnel will handle requests submitted by the FBI. Authorized BMV personnel refer to personnel who are currently trained to perform FR queries against the BMV FR repository for law enforcement purposes. Names of these predetermined personnel will be submitted to the FACE Services Unit for the purpose of establishing and maintaining communications with those BMV personnel. VI. PROTECTION OF FBI INFORMATION The probe photos submitted by the FACE Services Unit constitute federal information on loan from the FBI that must be returned to the FBI upon request and which may only be utilized with the FBl's express, written consent. Federal law governing access to federal information supersedes conflicting state laws. These probe photos are exempt from disclosure under the Freedom of Information Act. To further the protection of FBI information: A. The probe photo images and data received from the FACE Services Unit shall not be further disseminated or used, including electronic transmission by any internal or external BMV system, except as necessary to effectuate this agreement. 3 Indiana BMV 102912 GULaw Privacy FR B. No logs of FBI requests shall be kept or notations made on an individual's record or elsewhere regarding information provided to the FBI. C. The sharing and/or dissemination of any information associated with the FACE Services Unit's requests beyond authorized personnel is prohibited. D. All probe photo images and data submitted by the FACE Services Unit shall be destroyed once the search has been completed and the response has been sent to the FACE Services Unit via LEO. E. Upon receipt of a request for FBI information provided under this MOU, BMV will immediately notify the FACE Services Unit. VII. PRIVACY AND SECURITY A. The information exchanged under this MOU may identify U.S. persons whose information is protected by both state and federal laws, specifically, the Privacy Act of 1974 found at 5 U.S.C. § 552a and the Driver's Privacy Protection Act of 1994 found at 18 U.S.C. § 2721 and IC 9-14-12 and IC 914-13. The FBI will ensure that all such information is handled lawfully pursuant to the provisions thereof. The BMV will comply with its own state privacy laws. B. For purposes of this MOU, Personally Identifiable Information (PII) is defined as information which can be used to distinguish or trace an individual's identity, including any personal information which is linked or linkable to a specific individual. Examples of PII are name, social security number, date of birth, place of birth, citizenship, mother's maiden name, face images, fingerprints, and other biometrics. Furthermore, within PII is personal information and highly restricted personal information. According to IC §9-146-6 and 18 U.S.C. § 2725(3), Personal information (Personal Information) means information that identifies an individual, including an individual's digital photograph or image, social security number, driver's license or identification document number, or name. According to IC §9-14-6-5 and 18 U.S.C. § 2725(4), highly restricted personal information (Highly Restricted Personal Information) means information that identifies an individual digital photograph or image, social security number, or medical or disability information. C. Each party that discloses PII or Personal Information, including Highly Restricted Personal Information, is responsible for making reasonable efforts to ensure that the information disclosed is accurate, complete, timely, and relevant. D. Each party will immediately report to the other party each instance in which information received from the other party is used, disclosed, or accessed in an unauthorized manner (including any information losses or breaches). 4 Indiana BMV 102913 GULaw Privacy FR VIII. E. All transmissions of probe photos submitted by the FACE Services Unit to the BMV and responses returned to the FACE Services Unit will be made through a LEO-to-LEO e-mail connection. F. The BMV will ensure user accounts and authorities granted to its personnel are maintained in a current and secure "need-to-know" status. G. The FACE Services Unit will use the information provided by BMV only for lawful and authorized purposes. H. Each party shall be responsible for the safeguarding of any equipment used by it to access records under this MOU, and shall limit access to authorized users and to members within each chain of command who have been properly instructed as to their duties and responsibilities under this MOU, on a need to know the information basis. I. Each party shall implement procedures to ensure that such equipment is located in a secure area and to prevent information, including any printed copies of records, from being viewed by individuals not authorized to use the equipment and/or not authorized to have access to this information. EFFECT OF THIS AGREEMENT A. This MOU is not intended, and should not be construed, to create any right or benefit, substantive or procedural, enforceable by law or otherwise against any of the parties, their parent agencies, the United States, the State of Indiana or the officers, employees, agents, or other associated personnel thereof. The parties will seek to resolve any disputes regarding this MOU by mutual consultation. B. This MOU is not an obligation or commitment of funds, nor a basis for transfer of funds, but rather is a basic statement of the understanding between the parties of the matters described herein. Unless otherwise agreed in writing, each party shall bear its own costs in relation to this MOU. Expenditures by each party will be subject to its budgetary processes and to the availability of funds and resources pursuant to applicable laws, regulations, and policies. The parties expressly acknowledge that the language in this MOU in no way implies that funds will be made available for such expenditures. C. This MOU does not constitute an agreement for any party to assume or waive any liability or claim under any applicable law. D. This MOU does not change or limit any legal discovery obligations that otherwise apply in any particular case. 5 Indiana BMV 102914 GULaw Privacy FR IX. E. Each party is responsible for ensuring that information it discloses was not knowingly obtained or maintained in violation of any law or policy applicable to the disclosing party, and that information is only made available to the receiving party as may be permitted by law, regulation, policy, or procedure applicable to the disclosing party. F. Each party will provide appropriate training regarding the responsibilities under this MOU to individuals whose responsibilities are covered by the provisions of this MOU. EFFECTIVE DATE, MODIFICATION, AND TERMINATION A. This agreement shall be effective when executed by all of the parties and will continue in effect until terminated. This agreement may be modified at any time by written consent of all parties. B. This MOU may be terminated, with respect to any party, at any time upon written notice of withdrawal to all other parties. Any party desiring to withdraw from this MOU will endeavor to provide such written notification to all parties at least thirty (30) days prior to withdrawal. This MOU will be reviewed annually to ensure that the terms remain current, complete, and relevant. C. When the Director of the State Budget Agency for the State of Indiana makes a written determination that funds are not appropriated or otherwise available to support continuation of performance of this MOU, this Contract shall be canceled. A determination by the Director of State Budget Agency that funds are not appropriated or otherwise available to support continuation of performance shall be final and conclusive. D. This MOU, in nine distinct sections, is the exclusive statement of the parties with respect to its subject matter and supersedes any and all prior agreement, negotiations, representations, and/or proposals, written or verbal, relating to its subject matter. THE REMAINDER OF THIS PAGE HAS BEEN INTENTIALL Y LEFT BLANK. 6 Indiana BMV 102915 GULaw Privacy FR In Witness Whereof, the BMV and the FBI, CJIS Division have, through duly authorized representatives, entered into this MOU. Each of the Parties, having read and understood the foregoing terms of this MOU, do by their respective signatures dated below hereby agree to the terms thereof. The signatory for each of the Parties represents that he or she is duly authorized to execute this MOU on behalf of their respective agency and has obtained all the necessary or applicable approvals to make this MOU fully binding upon their respective agency when his or her signature is affixed. FOR THE FEDERAL BUREAU OF INVESTIGATION 10(2.roft1 Doug~ Assistant Director Criminal Justice Information Services Division Date FOR THE INDIANA BUREAU OF MOTOR VEHICLES Peter L. Lacy, Commissioner Indiana Bureau of Motor Vehicles Date FORTHESTATEBUDGETAGENCY Jason Dudich, Director L~, 7 Indiana BMV 102916 GULaw Privacy FR