MEMORANDUM OF UNDERSTANDING BETWEEN THE FEDERAL BUREAU OF INVESTIGATION CRIMINAL JUSTICE INFORMATION SERVICES DIVISION AND THE UTAH DEPARTMENT OF PUBLIC SAFETY CONCERNING THE SEARCH OF PROBE PHOTOS AGAINST THE UTAH DEPARTMENT OF PUBLIC SAFETY PHOTO REPOSITORY I. PURPOSE The purpose of this Memorandum of Understanding (MOU) is to document the agreed responsibilities and functions of the Parties with respect to conducting searches of the Utah Department of Public Safety (DPS) facial recognition (FR) photo repository, which contains mug shots, corrections photos and drivers' license (DL) photos. These searches will be performed for the purpose of comparing FBI Facial Analysis, Comparison, and Evaluation (FACE) Services Unit probe photos against photos housed in the Utah DPS's FR photo repository and obtaining information that will advance active FBI investigations, apprehend wanted fugitives or known or suspected terrorists, and locate missing persons nationwide. A probe photo refers to the photo of the subject of an active FBI investigation that is submitted for search against a photo repository. The anticipated result of that search will be a photo gallery of potential matches. These potential matches (candidates) will be forwarded to the FBI, along with any associated information stored with the photo in the Utah DPS FR system. The FBI FACE Services Unit will then perform comparisons of the candidate photo(s) against the probe photo(s) to determine their value as investigative leads. II. PARTIES A. The FBI, Criminal Justice Information Services (CJIS) Division, Biometric Services Section (BSS), FACE Services Unit provides investigative support to FBI field offices and headquarters divisions. The CJIS Division, through its Assistant Director, is the FBl's point of contact (POC) for this MOU. For certain day-to-day operations of the activities described by this MOU, the FBl's POC with the Utah DPS will be the FACE Services' Management Unit and its Management and Program Analysts. B. The Utah DPS provides a variety of public safety services such as law enforcement, communications, criminal identification, regulatory licer,sing, Utah SIAC 108842 GULaw Privacy FR criminal and arson investigation, forensic analysis, training, safety education and emergency management. For the purposes of this MOU, the Utah DPS POC is the Commissioner of the Utah DPS. For certain day-to-day operations of the activities described by this MOU, the FACE Services Unit will contact the Utah DPS POC Major Jeff Carr. Ill. AUTHORITIES A. The FBI enters into this MOU pursuant to Title 28, United States Code (U.S.C.) Sections 533 and 534; Title 28, Code of Federal Regulations Section 0.85; Title 42, U.S.C. Section 3771; and Title 18, U.S.C. Chapter 123. B. The State of Utah is authorized to share DL information with the FBI for authorized law enforcement purposes pursuant to Title 18, U.S.C. Section 2721 (b)(1 ). C. The Utah DPS enters into this MOU pursuant to the Governmental Records Access and Management Act; Utah Code Ann. 63G-2-206. IV. BACKGROUND INFORMATION A. The FACE Services Unit provides a facial recognition service in which FBI Special Agents, or other authorized FBI personnel, submit to the FBI CJIS Division a photo of the subject of an active FBI investigation. These probe photos are compared to photographs in databases authorized for use by the FBI (i.e., FR databases maintained by state motor vehicle departments/agencies, law enforcement, or other government agencies). In this case, a probe photo is sent to the Utah DPS. The Utah DPS compares the probe photo to its database, and candidates produced as a result of the search are sent by the Utah DPS to the FACE Services Unit. The FACE Services Unit compares Utah DPS candidate list against the submitted probe in an effort to narrow down .to the one or two most-likely candidates. These candidates are then provided to the requesting FBI contributor for use as an investigative lead. The number of candidates produced and provided to the FACE Services Unit as a result of these searches is dependent upon the searching threshold set by the individual agency. B. The intent of this service is not to provide a positive identification, but to provide the FBI Special Agent with an investigative lead and analysis to support that lead. The FBI will utilize the Utah DPS FR photo repository to supplement information provided by existing FBI photo database searches. 2 Utah SIAC 108843 GULaw Privacy FR V. SPECIFIC RESPONSIBILITIES A. The FBI will: 1. Submit probe photos, via Law Enforcement Online (LEO)-to-LEO e-mail, to the Utah DPS for the purposes of comparing the probe photos with photos in the Utah DPS FR photo repository. The LEO is accredited and approved by the FBI for Sensitive-but-Unclassified law enforcement information. 2. Manually analyze, compare, and evaluate the returned candidate photo gallery against the probe photo to determine the most-likely candidate. 3. If necessary, request additional biographical information associated with each photo determined to be a most-likely candidate via a secure email communication. 4. Submit the photo(s) of the most-likely candidate(s) to be searched against the Next Generation Identification Interstate Photo System in order to: a. Locate any additional photos and associated information relating to the "most likely" candidate(s). b. Identify additional potential candidates and associated information . .The results of this search will be compared and analyzed against the original probe photo(s). Once the analysis is complete, the one or two most-likely candidate photos, along with their associated information, will be provided to the requesting FBI Special Agent as an investigative lead. 5. Store photo images and text associated with the DL of the most-likely candidate(s) to the probe in the FBI case management system for record keeping purposes. 6. Immediately destroy all other gallery photos and associated information. 3 Utah SIAC 108844 GULaw Privacy FR 8. The Utah DPS will: 1. Apply for a LEO e-mail account through the LEO Operations Unit. 2. Compare the FACE Services Unit-submitted probe photo against the Utah DPS FR photo repository. 3. Return electronic photos of all possible candidates to the FACE Services Unit via LEO e-mail. 4. Upon request, return additional biographical information associated with each photo determined to be a most-likely candidate. 5. Ensure that only authorized Utah DPS personnel will handle requests submitted by the FBI CJIS Division. Authorized Utah DPS personnel refer to personnel who are currently trained to perform FR queries against the Utah DPS FR photo repository for law enforcement purposes. Names of these predetermined Utah DPS personnel will be submitted to the FBI CJIS Division for the purpose of the FACE Services Unit establishing and maintaining communications contact with those Utah DPS personnel who will be providing services to the FACE Services Unit. 6. Destroy all probe photo images, and any associated data submitted from the FACE Services Unit, once the search has been completed and the response has been sent to the FACE Services Unit via LEO. 7. Ensure that photos received from the FACE Services Unit will not be electronically transmitted by any internal or external Utah DPS systems except as necessary to effectuate this agreement. 8. Prohibit the sharing and/or dissemination of any information associated with FBI FACE Services' requests beyond the authorized Utah DPS personnel unless required by Utah state law. If sharing or dissemination is required, the Utah DPS will notify FBI FACE Services Unit as soon as possible and before the release of the information. VI. PRIVACY AND SECURITY A. The information involved in the MOU may identify U.S. persons, whose information is protected by the Privacy Act of 1974. The FBI will ensure that all such information will be handled lawfully pursuant to the provisions thereof. Conversely, the Utah DPS will comply with its own state's privacy laws. 4 Utah SIAC 108845 GULaw Privacy FR B. For purposes of this MOU, Personally Identifiable Information (PII) is defined as information which can be used to distinguish or trace an individual's identity, including any personal information which is linked or linkable to a specific individual. Examples of PII are name, social security number, date of birth, place of birth, citizenship, mother's maiden name, and photographs, fingerprints, and other biometrics. C. Each party that discloses PII is responsible for making reasonable efforts to ensure that the information disclosed is accurate, complete, timely, and relevant. D. Each party will immediately report to the other party each instance in which information received from the other party is used, disclosed, or accessed in an unauthorized manner (including any information losses or breaches). E. All transmissions of probes submitted by the FACE Services Unit to the Utah DPS and responses returned to the FACE Services Unit will be made through a LEO-to-LEO e-mail connection. F. The Utah DPS will ensure user accounts and authorities granted to its personnel are maintained in a current and secure "need-to-know" status. G. Both FBI requests and Utah DPS responses will contain PII, and LEO e-mail is approved and authorized to ensure security of information contained in these transmissions. H. All hardcopy facial images determined by the FACE Services Unit not to be a most-likely candidate, along with all associated textual information, will be disposed via confidential trash. All electronic facial images, including those saved on thumb drives, deter~ined by the FACE Services Unit not to be a most-likely candidate, along with all associated textual information, will be deleted. I. Photo images of the most-likely candidate will be retained by the FACE Services Unit in the FBI case management system. All others will be destroyed by the FACE Services Unit. J. The information and/or documents provided by Utah DPS to the FACE Services Unit will contain PII about persons retained in the Utah DPS FR system. The FACE Services Unit will use this information for lawful/authorized purposes only. K. Each party shall be responsible for the safeguarding of any equipment used by it to access records and shall limit access to authorized users with a need to know the information and who have been properly instructed as to their duties and responsibilities under this MOU. 5 Utah SIAC 108846 GULaw Privacy FR L. VII. Each party shall implement procedures to ensure that such equipment is located in a secure area and to prevent information, including any printed copies of records, from being viewed by individuals not authorized to use the equipment and from being viewed by individuals not authorized to see or have access to this information. EFFECT OF THIS AGREEMENT A. This MOU is not intended, and should not be construed, to create any right or benefit, substantive or procedural, enforceable by law or otherwise against any of the parties, their parent agencies, the U.S., or the officers, employees, agents, or other associated personnel thereof. The parties will seek to resolve any disputes regarding this MOU by mutual consultation. B. This MOU is not an obligation or commitment of funds, nor a basis for transfer of funds, but rather is a basic statement of the understanding between the parties of the matters described herein. Unless otherwise agreed in writing, each party shall bear its own costs in relation to this MOU. Expenditures by each party will be subject to its budgetary processes and to the ava.ilability of funds and resources pursuant to applicable laws, regulations, and policies. The parties expressly acknowledge that the language in this MOU in no way implies that funds will be made available for such expenditures. C. This MOU does not constitute an agreement for any party to assume or waive any liability or claim under any applicable law. D. Each party is responsible for ensuring that information it discloses was not knowingly obtained or maintained in violation of any law or policy applicable to the disclosing party, and that information is only made available to the receiving party as may be permitted by laws, regulations, policies, or procedures applicable to the disclosing party. E. Each party will provide appropriate training regarding the responsibilities under this MOU to individuals whose information-sharing activities are cov~red by the provisions of this MOU. 6 Utah SIAC 108847 GULaw Privacy FR VIII. EFFECTIVE DATE, MODIFICATION, AND TERMINATION A. This agreement shall be effective when executed by all of the parties and will continue in effect until terminated. This agreement may be modified at any time by written consent of all parties. B. This MOU may be terminated, with respect to any party, at any time upon written notice of withdrawal to all other parties. Any party desiring to withdraw from this MOU will endeavor to provide such written notification to all parties at least thirty (30) days prior to withdrawal. This MOU will be reviewed annually to ensure that the terms remain current, complete, and relevant. C. This MOU, in eight distinct sections, is the exclusive statement of the parties with respect to its subject matter and supersedes any and all prior agreement, negotiations, representations, and/or proposals, written or verbal, relating to its subject matter. 7 Utah SIAC 108848 GULaw Privacy FR FOR THE FEDERAL BUREAU OF INVESTIGATION David Cuthbertson Assistant Director Criminal Justice Information Services Division FOR THE UTAH DEPARTMENT OF PUBLIC SAFETY I-- 014,ti/13 Date Davenport Co missioner Utah Department of Public Safety 8 Utah SIAC 108849 GULaw Privacy FR