Loading...
2014-080 FDLE-Crirrdna4 Justice User Agreement CRIMINAL JUSTICE USER AGREEMENT This Agreement,is entered into between theflarada Department of Law Enforcement (hereinafter referred to as FDLE),an agency-of the State of Florida with headquarters at 2331 Pups Road,Tallahassee,Florida and the Clermont Police Department with headquarters at 865 West Montrose St,Clermont,FL 3471,4 with the.pii OR) of: FL0350300 , (hater referrs dior as-the.User). Whereat,FDLE is authorized'by taw to•operate and regulate the Florida Criminal Justice Network(hereinafter CJNet)as anintra-agency infor tation.and dam-sharing network form by the state's-criminal justice agencies; Whereas,FDLE is authorized by law to_estabt and operate the Florida Crime Information Center(hereinafter PCIG,lor the extihange of information relating to crimes, criminals and criminal activity; Whereas,FOLE participates in the National Crime Information Center (hereinafter MCC),a service of the United States Department of Justice,the interstahrldentffication Index(hereinafter HO,-the Federal Bureau ofi nvesligation's(hereinafter FBI)Law EnforoementOnitne'(hereinafer LEO),the•FBrs National Data Exchange(hereinafter NDEx)and the International Justice and Public Safety-Network(hereinafter-Niels),and servesas Florida's Criminal Justice information Services(CAS)Systems Agency(CSA) for theinb3rstate transmission of Criminal Justice information(CJl)to and from agencies in Florida and agencies in the-c nental United States,Alaska,Hawaii, U.S.Virgin Islands,Canada and Puerto Rico; Whereas,the FDLE Director o€'Criminal Justice information Services Is recognized by the FBI atthe,CAS-Systems-Officer(CSO)1orthe State of Florida,responsbe for administering and ensuring stateVdde-compliance with the FSi CJIS Security Policy (CSP)► Whereas,the User requires access to intrastate and interstate CJI systems provided by FDLE through The CJNet -order to effectively-diseharge its public : Whereas,<FDLE facilitates locatiawenforcementand other criminal justice agencies' requests top artcipate-in the information services provided orrCJNet,provided the User agrees to abide by applicable federal and state laws;administrative coder and all policies, ptoc dk res and regulations related to these systems. FDLE retains full control over the management and operation of CJNet and FCIC. April 14,2014 Page 10117 FDLE Criminal Justice User Agreement Therefore, in consideration of the mutual benefits to be derived from this Agreement, the FDLE and the User do hereby agree as follows: This User Agreement is designed for criminal justice agencies within Florida that have either direct or indirect access to FCIC/CJNet. If the User does not perform a specific function, the provisions regarding that function will not apply to the User. SECTION I FCIC/NCIC/CJNET FDLE REQUIREMENTS FDLE is duly authorized and agrees to ensure access to the criminal justice information services provided on CJNet and adhere to the following: 1. Serve as the CSA for the State of Florida and provide the User with access to CJI as is available in the FCIC/NCIC and III systems and NLETS through CJNet, and to serve as the means of exchanging CJI between the User and other criminal justice agencies on CJNet. 2. Provide the opportunity for CJIS certification/re-certification and CJIS Security Awareness training. 3. Provide the User with information concerning privacy and security requirements imposed by state and federal policies, laws, rules and regulations. All references herein to policies, operating procedures, operating instructions, operating manuals and technical memoranda with which adherence is required may be found on the CJNet CJIS Resource Center web page. 4. Provide state criminal history record check services for non-criminal justice purposes as provided by law. 5. Act as the central state repository; provide identification, record keeping, and exchange of Criminal History Record Information (CHRI) services. 6. Facilitate access, using CJNet, to other information applications or systems that the User may be authorized to access. SECTION II FCIC/NCIC/CJNET USER REQUIREMENTS By accepting access as set forth above, the User agrees to adhere to the following to ensure continuation of access: 1. USE OF THE SYSTEM: Use of the CJNet and any system accessed via the CJNet is restricted to the administration of criminal justice or as otherwise specifically authorized or required by statute. Information obtained from the FCIC/NCIC files, or computer interfaces to other state or federal systems, by means of access granted through CJNet, can only be used for authorized purposes in compliance with FCIC/NCIC and III rules, regulations and operating procedures, and state and federal law. It is the responsibility of the User to ensure access to CJNet is for authorized purposes only, and to regulate proper use of the April 14,2014 Page 2 of 17 FDLE Criminal Justice User Agreement network and information at all times. The User shall establish appropriate written standards, which may be incorporated with existing codes of conduct, for disciplining violators of this and any incorporated policy. Accessing information and systems provided via CJNet for other than authorized purposes is deemed misuse. The User shall notify the CSO of any sustained/confirmed cases of misuse by using the CJS Systems Misuse Reporting Form found on the CJNet CJIS Resource Center web page. In cases of sustained/confirmed misuse, the User shall identify disciplinary actions and the corrective actions taken to prevent future incidents. FDLE reserves the right to deny CJI access to individuals who have sustained cases of misuse. 1.1 If the User provides an interface between FDLE and other criminal justice agencies, the serviced agencies) shall abide by all of the provisions of this agreement. Serviced agencies that access CJNet, FCIC/NCIC and/or related applications by interfacing through the User shall, likewise, abide by all provisions of this agreement. Additionally, the User and the serviced agency shall enter into an interagency agreement when access to CJNet/FCIC/NCIC is provided by the User to a serviced agency. 1.2 MESSAGES: Only law enforcement and other criminal justice messages shall be sent over and through the CJNet and FCIC/NCIC. All messages shall be treated as privileged unless otherwise indicated. The User should be prudent in use of regional and statewide broadcast message requests. All messages shall use plain English language in the message. 1.3 COMPLIANCE: The User shall access FCIC/NCIC and other CJNet applications in strict compliance with applicable CJNet, FCIC, NCIC, III and Nlets policies including, but not limited to, policies, practices and procedures relating to: 1.3.1 TIMELINESS: FCIC/NCIC records shall be entered, modified, located, cleared, and canceled promptly in order to ensure system accuracy and effectiveness. If the User performs FCIC/NCIC updates for other agencies, the User shall comply with timeliness requirements for the records entered for the serviced agencies as well. 1.3.2 HOTTILE ENTRIES: In order to make entries into the FCIC/NCIC hot files, the User shall have personnel dedicated to maintain a 24- hour, seven-day a week FCIC/NCIC operation. 1.3.2.1 If the User enters records into FCIC/NCIC for another agency, the User shall execute an interagency agreement with each serviced agency outlining each agency's responsibilities April 14,2014 Page 3 of 17 FDLE Cnminal Justice User Agreement 1 3.2.2 Adult Warrants, Missing Persons and all property records of the FCIC Hot File records, entered by state and local agencies, will be made available to the public on the Internet via the FCIC Public Access System (PAS), unless explicitly flagged by the User for exclusion. 1.3.3 QUALITY ASSURANCE: Appropriate and reasonable quality assurance procedures shall be in place, including second party verification during entry, to ensure all entries in FCIC/NCIC are complete, accurate, and valid. 1.3.4 VALIDATION: The User shall validate all records that the User has entered into the system for accuracy and retention. To be-in compliance with FCIC/NCIC rules, regulations and operating procedures, the User shall ensure each record is modified to confirm the successful validation of each record on file in FCIC/NCIC. Failure to modify a record to indicate validation may result in its removal from the file. The User shall develop its own written validation procedures specifying the steps taken by the User to complete record validation. 1.3.5 HIT CONFIRMATION: The User shall comply with FCIC/NCIC rules, regulations and operating procedures by responding to the hit confirmations in a timely manner(within ten minutes or one-hour depending on priority). 1.3.6 DISSEMINATION: Information obtained from the FCIC/NCIC hot files, CJNet or computer interfaces to other state or federal systems, by means of access granted pursuant to Section 943.0525, F.S., shall only be used for the administration of criminal justice. 1.3.6.1 Upon receipt of a public record request for CJI, the User shall confer with FDLE regarding the appropriate response. It is the responsibility of the User to ensure that access to the CJNet is for authorized criminal justice purposes only, and to regulate proper access to and use of the network and information at all times. 1.3.6.2 The User will disseminate CHRI obtained or derived from federal records or systems only to criminal justice agencies and only for the administration of criminal justice. The administration of criminal justice includes criminal justice employment screening. 1.3.6.3 The User, if functioning in the capacity of a pretrial release program or providing CHRI for a pretrial release program, may disseminate Florida public record information only, in compliance with Section 907.043 (3), Apnl 14,2014 Page 4 of 17 FDLE Cnminal Justice User Agreement F S., which requires "[e]ach pretrial release program [to] prepare a register displaying information that is relevant to the defendants released through such a program The authority to disseminate information for this purpose shall be restricted to county probation services offices and those criminal justice entities providing the probation offices with information obtained via the FCIC message switch for the administration of criminal justice. 1.3.7 RETENTION: CHRI which the User maintains, whether retrieved from III or Florida's criminal history record system, shall be kept in a secure records environment to prevent unauthorized access. Retention of CHRI is governed by the record retention schedule for law enforcement published by the Florida Department of State, GS2. 1.3.7.1 Retention of criminal history records, whether retrieved from III or the state system, for extended periods may be appropriate when the time sensitivity of the specific record is important. 1.3.7.2 When, in the sound judgment of the User, retention of criminal history records, whether retrieved from III or the state system, is no longer required, final disposition will be accomplished in a secure manner in compliance with state law, FCIC/NCIC and III rules, regulations and operating procedures to preclude unauthorized access. 1.3.7.3 Because CHRI may become outdated at any time, a current criminal history record check should be performed whenever CHRI is used or relied upon by the User. Entry or retention of criminal history records in a separate or local database would be inconsistent with this principle, and is therefore discouraged. The retention of criminal history records, whether retrieved from III or the state system, in a secondary (non-FDLE) database is not authorized by law. 1.3.8 CRIMINAL HISTORY TRANSMISSION: Any electronic device that uses wireless or radio technology to transmit voice data may be used for the transmission of CHRI only when an officer determines there is an immediate need for this information to further an investigation or there is a situation affecting the safety of an officer or the public. 1.3.8.1 A facsimile machine may be used to transmit criminal history information between criminal justice agencies, provided both agencies have an NCIC Originating Agency Identifier(ORI) and are authorized to receive April 14,2014 Page 5 of 17 FDLE Criminal Justice User Agreement criminal history information. Appropriate measures shall be taken to prevent unauthorized viewing or receipt by unauthorized persons 1.3.9 TRANSACTION LOGGING: Each interface agency accessing FCIC/NCIC and III systems shall ensure that an automated transaction log is maintained. The FCIC/NCIC portion of this log shall be maintained for a minimum of twelve months, and the III portion shall be maintained for a minimum of four years. 1.3.9.1 Automated transaction logging is a feature included in the application software provided by FDLE, and local agencies are encouraged to retain these-logs for future reference. Users purchasing or developing an interface to FCIC shall ensure transaction logging is an included feature. 1.3.9.2 The automated transaction log shall identify: the operator on all transactions, the agency authorizing all transactions, the requester and secondary recipient for all criminal history transactions. This information can be captured at log-on and can be a name, badge number, serial number, or other unique identifier. 1.3.9.3 The User may only disseminate CHRI to another authorized recipient and shall maintain a record of any dissemination of state or federal criminal history information. This record shall reflect at a minimum: (1) date of release; (2) to whom the information relates; (3) to whom the information was released; (4)the State Identification (SID) and/or the FBI number(s); (5) the purpose code and (6)the reason for which the information was requested. 1.3.10 INFORMATION ACCESS: The User shall allow only properly screened (as per Section III, paragraph 2 of this User Agreement), authorized personnel performing a criminal justice function who have received proper security awareness training to have access to information contained within the CJNet, FCIC/NCIC or other state or federal criminal justice information system accessed through the FCIC message switch, FBI CJIS Wide Area Network or Internet. The User will also provide assistance to other criminal justice agencies not equipped with direct FCIC access in compliance with FCIC/NCIC and III rules, regulations and operating procedures, but only to the extent that such assistance is not otherwise prohibited. April 14,2014 Page 6 of 17 FDLE Cnminal Justice User Agreement 1.3.10.1 The User shall ensure that all personnel who initiate a transaction to the FCIC message switch are current in CJIS certification. 1.3.10.2 Each individual user shall be properly authenticated prior to initiating a transaction to or requesting information from FCIC or other CJNet application. 1.3.10.3 The User shall ensure that persons allowed to complete CJIS certification are at least 18 years of age and are U.S. citizens or have a valid immigration status/visa. 1.3.10.4 FDLE reserves the right to deny FCIC, CJNet or related programs/ systems access to any individual based on valid, articulable concerns for the security and integrity of FCIC, CJNet or related programs/ systems. 1.3.11 WORKSTATION: FDLE is not responsible for the workstation acquisition, maintenance, operation, repair, supplies or workstation operation personnel costs. The User shall immediately notify the FDLE Customer Support Center, should an FCIC/NCIC workstation or device, associated with an FCIC/NCIC entry(ies), malfunction or become inoperable. All costs associated with returning the workstation to operation, other than CJNet costs, shall be the User's responsibility. FDLE will assist with executing trouble-shooting procedures. 1.4 Interface Operations: For systems implemented after December 31, 2008, the User shall ensure that all automated interfaces that programmatically (i.e., without human intervention) generate transactions to the FCIC message switch are restricted to no more than one transaction per second per interface. 2. AUDITS: The User shall permit an FDLE appointed inspection team to conduct inquiries with regard to any allegations or potential security violations, as well as for routine audits. 2.1 FDLE conducts regularly scheduled compliance and technical-security audits of every agency accessing the CJNet to ensure network security, conformity with state law, and compliance with all applicable FDLE, CJNet, FCIC/NCIC and III rules, regulations and operating procedures. Compliance and technical security audits may be conducted at other than regularly scheduled times. 3. TRAINING: The User is responsible for complying with training requirements established in CSP and the rules, regulations, and policies established by FCIC/NCIC, Ill, FDLE and other CJNet applications. The User is responsible for Apnl 14,2014 Page 7 of 17 FDLE Criminal Justice User Agreement remaining current in the applications, procedures, and policies and ensuring personnel attend these training sessions. 3.1 All User personnel who access CJI for the administration of criminal justice shall complete security awareness training, including but not limited to criminal justice officials, e.g., Police Chiefs, Sheriffs, Judges, State Attorneys, etc. 3.2 Only operators who have successfully completed CJIS certification shall be allowed to have unsupervised access to the FCIC/NCIC system. 3.3 FCIC/NCIC operators who are in their initial six months of assignment may be permitted supervised access to FCIC/NCIC. Operators shall successfully complete CJIS certification within six months of appointment or assignment to duties requiring direct access to FCIC/NCIC. 3.4 The User shall require all personnel who are authorized to initiate a transaction to the FCIC message switch to successfully complete CJIS Certification. The User agrees to remove from FCIC/NCIC access any employee who fails to achieve required certification standards, whose certification has expired, whose certification is otherwise rescinded or as directed by FDLE. 3.5 The User shall require all information technology(IT) personnel, including any vendor or contracted staff who will in the course of their contracted criminal justice support duties initiate a transaction to the FCIC message switch, to successfully complete CJIS certification. 3.6 The User shall maintain training records for all personnel with access to CJI, i.e., CJIS certification and security awareness training. 3.7 The User shall require all IT personnel, including any vendor, responsible for maintaining/supporting any IT component used to process, store or transmit any unencrypted CJI, to successfully complete and maintain in current status the CJIS security awareness training provided by FDLE. 4. RELOCATION: Should the User desire to relocate the data circuit(s)and/or equipment connected to CJNet, the User shall provide FDLE written-notice 90 days in advance of the projected move. All costs associated with the relocation of the equipment and the data circuit(s), including delays in work order dates, will be borne by the User unless FDLE has funding to make changes without charge. The repair and cost of any damages resulting from such relocation will be the User's responsibility. 4.1 The User shall also provide 90 days advance notice when requesting additional access to FCIC. April 14,2014 Page 8 of 17 FDLE Criminal Justice User Agreement 5. LIABILITY: The User understands that the FDLE, its officers, and employees shall not be liable in any claim, demand, action, suit, or proceeding, including, but not limited to, any suit in law or in equity, for damages by reason of, or arising out of, any false arrest or imprisonment or for any loss, cost, expense or damages resulting from or arising out of the acts, omissions, or detrimental reliance of the personnel of the User in entering, removing, or relying upon information transmitted through CJNet or in the FCIC/NCIC and NLETS information systems. 6. CRIMINAL HISTORY RECORDS: FDLE is authorized to establish a statewide biometric identification system and an intrastate system for the communication of information relating to crimes, criminals and criminal activity. To support the creation and maintenance of the criminal history files, the User, as appropriate, shall: 6.1 Provide for inclusion in criminal history records information systems, adult and juvenile criminal fingerprints on all felony arrests; adult criminal fingerprints on all misdemeanors and comparable ordinance violation arrests; and juvenile fingerprints on misdemeanor arrests specified at Section 943.051, F.S. The submission of other juvenile misdemeanor arrest fingerprints is optional. 6.2 Provide security for CHRI and systems that process or store CHRI, and security training for personnel who receive, handle or have access to CHRI. 6.3 Screen all personnel who will have direct access to CHRI and reject for employment personnel who have violated or appear unwilling or incapable of abiding by the requirements outlined in this agreement. 6.4 Defer to FDLE on any determination as to what purposes qualify for criminal justice versus non-criminal justice designation, as well as with respect to other purposes that may be authorized by law. 6.5 As authorized by Florida Statutes and/or federal regulations, the User may share state CHRI. Dissemination of information requires compliance with all applicable statutes, FCIC/NCIC and III rules, regulations and operating procedures, including logging. Agencies shall maintain the restriction on dissemination applicable to such record information, including but not limited to confidentiality or exemption from Section 119.07(1), F.S., as provided by law. 6.6 Provide security and establish policies to prevent unauthorized access to or dissemination of sealed records, or unauthorized notification of expunged records. 7. As FALCON is a CJI system, the User shall adhere to all policies regarding access, use and dissemination of CHRI. The User shall comply with all training and other appropriate requirements associated with its criminal justice status. The April 14,2014 Page 9 of 17 FDLE Criminal Justice User Agreement User shall review FALCON subscriptions to determine whether the User is still authorized to receive criminal history record information on an individual. The User shall indicate the continued authorizing relationship with that individual, i.e., the person is still employed, volunteering, etc., or is currently the subject of investigation or under supervision by the User. CHRI received as a result of a FALCON subscription may be disseminated for criminal justice purposes, and is subject to the same legal and policy restrictions associated with CHRI. SECTION III SECURITY REQUIREMENTS 1. The User shall comply with the CSP and the rules, regulations, policies and procedures established for CJNet, FCIC/NCIC, Ill and NLETS, which include but are not limited to System Security, Personnel Security, Physical Security, User Authorization, Technical Security, Dissemination of Information Obtained from the Systems, and Destruction of Records. By accepting access as set forth above, the User agrees to adhere to the following security policies in order to ensure continuation of that access: 2. PERSONNEL BACKGROUND SCREENING: At a minimum, the User shall conduct a state and national fingerprint-based records check on 1)all personnel who are authorized to access state and/or national CJI data or systems, 2) IT personnel who maintain/support information technology components used to process, transmit or store unencrypted CJI, and 3)other personnel, including but not limited to support personnel, contractors and custodial staff, with unescorted physical or logical access to physically secure locations, as defined in the CSP and/or IT components used to process, transmit or store unencrypted CJI. The User is strongly encouraged to screen the applicant by other available means, e.g., local court records, in addition to the fingerprint-based record check. 2.1 The User shall submit applicant fingerprints of persons described in Section III, paragraph 2, for positive comparison against the state and national criminal history and for searching of the Hot Files. 2.2 The results of the fingerprint-based record check shall be reviewed prior to granting access to CJI or components used to process/store CJI, including access for IT support. The User may conduct a preliminary on-line criminal justice employment check using Purpose code "J"for this purpose. 2.2.1 If a record of any kind exists, the User shall consult the FDLE Guidelines for CJIS Access and notify the CSO for review. Upon notification from the User, the CSO shall review the matter to determine if access is appropriate and officially notify the User in writing of the CSO's decision regarding access. 2.2.2 Once the original background screening has been completed, if the User learns that an employee with access to CJI, including any personnel as identified in Section III, paragraph 2, has a criminal April 14,2014 Page 10 of 17 FDLE Criminal Justice User Agreement history or pending charge(s), the User shall consult the FDLE Guidelines for CJIS Access and notify the CSO. The CSO shall review the facts and circumstances and notify the User in writing regarding access to CJI. 2.2.3 The User shall have a written policy for discipline of personnel who 1) access CJNet and/or CJI for purposes that are not authorized, 2) disclose information to unauthorized individuals, or 3) violate FCIC/NCIC or III rules, regulations or operating procedures. 2.3 As the CSA for the State of Florida, the FDLE reserves the right to deny individual user access to any system or related program that is used to process, transmit or store CJI based on valid, articulable-concerns for the security and integrity of the information and/or related systems. 2.4 The User shall ensure the appropriate ORI is used for submission of applicant fingerprints. Fingerprints submitted for positions associated with the administration of criminal justice or as required by the CSP, shall include the User's criminal justice ORI. Fingerprints submitted for any other positions not related to the administration of criminal justice or required by the CSP shall include the appropriate and approved non-criminal justice ORI. 3. PHYSICAL SECURITY: The User shall identify facilities, areas, rooms, etc. where CJI is accessed, processed and/or stored to determine physical security requirements as identified in the CSP. The User may designate a facility, area, room, etc., either a physically secure location or a secured area, as defined in the CSP, provided the appropriate requirements are met. Access shall be limited to persons needing access for completion of required duties. The User shall have a written policy that ensures and implements security measures, secures devices that access FCIC/NCIC/CJNet and prevents unauthorized use or viewing of information on these devices. The use of password protected screen blanking software is recommended for devices that access FCIC/NCIC when the operator may leave the computer unsupervised. FDLE reserves the right to object to equipment location, security measures, qualifications and number of personnel who will be accessing FCIC/NCIC and to suspend or withhold service until such matters are corrected to FDLE's reasonable satisfaction. 4. ADMINISTRATIVE SECURITY: The User shall designate individual agency contacts, as described below, to assist the User and FDLE in ensuring compliance with this Agreement. Training for these positions is provided by FDLE, and the User shall ensure that its designee is keenly aware of the duties and responsibilities of each of the following positions. FDLE reserves the right to object to the Users appointment of a TAC, LASO, LAI or AAA based on valid, articulable concerns for the security and integrity of FCIC, CJNet or related programs/systems. The User shall provide FDLE with up-to-date contact information for these positions. April 14,2014 Page 11 of 17 FDLE Cnminal Justice User Agreement 4.1 TERMINAL AGENCY COORDINATOR: The User shall designate a Terminal Agency Coordinator (TAC) to ensure compliance with FCIC/NCIC and III rules, regulations and operating procedures, and to facilitate communication between FDLE and the User. The TAC shall maintain a current CJIS Certification. TACs shall attend TAC training within six (6) months of being assigned to the position, and as often, as required by FDLE, thereafter. 4.2 LOCAL AGENCY SECURITY OFFICER: The User shall designate a Local Agency Security Officer(LASO) to ensure compliance with the CSP. Within six months of assignment to the position, the LASO is encouraged to complete any appropriate LASO training made available by FDLE, including CJIS security awareness training. 4.3 In addition to TAC and LASO, there are other points of contact and positions necessary to manage applications and facilitate communication between the User and FDLE. These positions are identified on the Agency CJIS Contact Form, which may be found on the CJNet CJIS Resource Center website under CJIS Forms and Publications. 5. MANAGEMENT CONTROL AGREEMENTS: In situations where data processing/information services, law enforcement dispatch functions or human resources functions are provided by a non-criminal justice governmental entity, the User shall enter into a management control agreement as required by the CSP. In situations where governmental structure or hierarchy does not support or permit an agreement between the parties involved, a directive which includes all of the provisions for a management control agreement identified in the CSP may be substituted. 6. INTERAGENCY AGREEMENTS: The User shall execute an Interagency Agreement with any other criminal justice agency to which criminal justice information services are outsourced, including but not limited to information technology related functions. The User shall consult with FDLE to determine if a given function requires an Interagency Agreement. 7. TECHNICAL SECURITY 7.1 Remote access services to CJI, including, but not limited to access to FCIC/NCIC and CJNet via the User's Network, will be permitted provided the User establishes appropriate security measures to ensure compliance with all rules, regulations, procedures, and the CSP. 7.2 All FCIC/NCIC/III data transmitted over any public network segment shall be encrypted as required by the CSP. This requirement also applies to any private data circuit that is shared with non-criminal justice users and/or is not under the direct security control of a criminal justice agency. April 14,2014 Page 12 of 17 FDLE Criminal Justice User Agreement 7.3 The User shall maintain, in current status, and provide upon request by FDLE a complete topological drawing, which depicts the User's network configuration as connected to CJNet. As required by the CSP, this documentation shall clearly indicate all network connections, service agencies and interfaces to other information systems. 7.4 The User shall ensure only authorized criminal justice agencies or agencies authorized by FDLE are permitted access to the CJNet via the User's CJNet connection. 7.5 The User shall ensure all devices with connectivity to CJNet employ virus protection, anti-spam and anti-spyware software and such software shall be maintained in accordance with the software vendor's published updates. 7.6 CJI, including but not limited to information obtained from the FCIC message switch and CJNet, may only be accessed via computers or interface devices owned by the User or by the contracted entity. Vendors under contract with the User to perform the administration of criminal justice may be allowed to use their own devices for access provided all requirements of the FBI CJIS Security Addendum are satisfied. 7.7 The User shall ensure that CJNet-only devices have a Windows or network type password to prevent unauthorized access. 7.8 Provided appropriate security precautions are in place, and upon approval from the FDLE Network Administration staff, the User may employ wireless network connectivity(for example the 802.11 wireless networking protocol). 8. COMPUTER SECURITY INCIDENT RESPONSE CAPABILITY: The User shall have a written policy documenting the actions to be taken in response to a possible computer security incident. The policy shall include identifying, reporting, investigating and recovery from computer security incidents. The User shall immediately notify the CSO of any suspected compromise of the CJNet. 9. SECURITY AUTHORITY: All policies, procedures and operating instructions contained in the CSP and FCIC/NCIC, Ill and NLETS documents, operating manuals and technical memoranda, are hereby incorporated into and made a part of this agreement, except to the extent that they are inconsistent herewith or legally superseded by higher authority. 10. CLIENT SOFTWARE LICENSE: The FCIC Client Software (eAgent) license from Diverse Computing, Incorporated is located in the Help menu of the eAgent client software. The FCIC Client Software (eAgent) license is made a part of and incorporated by reference into this User Agreement and shall be binding on the User upon acceptance of the software. The User is allowed up to one hundred (100) eAgent Subswitch mnemonics. The User is not permitted to install eAgent, as provided by FDLE, on laptops for use in a mobile environment, including tablets, netbooks and other"handheld" devices. The User is not permitted to use the eAgent client software as an interface to the FCIC message switch for another application. April 14,2014 Page 13 of 17 FDLE Cnminal Justice User Agreement 11. PRIVATE VENDORS: Private vendors which, under contract with the User, are permitted access to information systems that process CJI, shall abide by all aspects of the FBI CJIS Security Addendum. 11.1 The contract between the User and the vendor shall incorporate the FBI CJIS Security Addendum to ensure adequate security of CJI. 11.2 The User shall ensure all vendor employees are appropriately screened prior to granting the vendor employees access to CJI. Vendor employee fingerprints submitted by the User to FDLE as required by the CSP shall be taken/rolled/printed by a recognized law enforcement agency or an FDLE approved third party vendor. NOTE: A vendor may not fingerprint its own employees. 11.3 The User shall maintain the Security Addendum Certification form for each member of the vendor staff with access to information systems that processes CJI. 11.4 The User shall ensure all vendor employees with access to CJI have received the appropriate security awareness training via the CJIS Online application and are in current status. 11.5 The User shall ensure private vendors permitted such access are aware of the provisions of Section 817.5681, F.S. regarding breach of security of personal information. 11.6 The User shall contact FDLE for review prior to entering into a contract or agreement with a private vendor in the course of which state or national CJI is processed, stored or transferred from the User's physically secure location to a vendor owned or operated facility(s) (e.g., cloud services.) 11.7 The User shall maintain and keep current a list of all vendor employees who have been authorized access to CJI. 12. USERNAMES and PASSWORDS/AUTHENTICATION: The User shall ensure that all personnel, including IT support and vendors, who initiate a transaction to the FCIC message switch have a separate and distinct username and password/ authentication for the software/interface used to initiate the transaction. 12.1 The User shall ensure that all User-operated interfaces, including but not limited to computer aided dispatch systems, record management systems, jail management systems and mobile data systems with the FCIC message switch or other systems that contain CJI, follow the password requirements as outlined in the CSP. 12.2 Individual users shall refrain from sharing passwords and/or other authenticators, including but not limited to smart cards, tokens, public key Apnl 14,2014 Page 14 of 17 FDLE Cnminal Justice User Agreement infrastructure (PKI) certificates, etc., used to access CJI or CJNet related systems. 12.3 Individual users shall refrain from using another individual's account or session for the purpose of accessing CJI or other CJNet applications. 12.4 Individual users shall refrain from caching credentials/passwords for access to systems/applications used to process or store CJI. 12.5 All personnel with access to any system or application that processes or stores CJI for maintenance or administration purposes shall be uniquely identified. 13. INDIVIDUAL USER ACCESS: The User shall deactivate individual user access to eAgent and/or other FCIC interfaces, other CJNet applications and other state/federal systems containing CJI, including but not limited to LEO and/or NDEx, upon separation, reassignment or termination of duties, provided individual user access is no longer required for the administration of criminal justice. 14. OFF SITE STORAGE/PROCESSING OF CJI: The User shall contact and receive approval from the CSO prior to entering into an agreement with a noncriminal justice governmental agency for off-site storage or processing of CJI (often referred to as cloud computing or cloud services.) SECTION IV MISCELLANEOUS REQUIREMENTS 1. FDLE has received funding from the United States Department of Justice and is subject to and must demand intrastate users of its criminal history record services adhere to US Code (28 U.S.C. section 534), State Statute (Chapter 943 F.S.), Code of Federal Regulations (28 C.F.R. Part 20), Florida Administrative Code (Chapter 11C-6, F.A.C.), FCIC/NCIC and III rules, regulations and operating procedures which this agreement incorporates both present and future. 2. PENALTIES AND LIABILITIES: Any non-compliance with the terms of this Agreement concerning the use and dissemination of criminal history information may subject the User's officers or employees to a fine not to exceed $11,000 as provided for in the Code of Federal Regulations, Title 28, Section 20.25, and/or discontinuance of service. Moreover, certain offenses against system security and the information contained therein are crimes under Florida Statutes and can result in criminal prosecution. 3. PROVISIONS INCORPORATED: The User shall be bound by applicable federal and state laws, federal regulations and the rules of FDLE to the same extent that the User would be if such provisions were fully set out herein. Moreover, this Agreement incorporates both present and future law, regulations and rules. April 14,2014 Page 15 of 17 FDLE Cnminal Justice User Agreement 4. TERMINATION: Either party may terminate this Agreement, with or without cause, upon providing advanced written notice of 45 days. Termination for cause includes, but is not limited to, any change in the law that affects either party's ability to substantially perform as provided in this Agreement. Should the aforementioned circumstances arise, either party may terminate or ask to modify the Agreement accordingly. 4.1 FDLE reserves the right to terminate service, without notice, upon presentation of reasonable and credible evidence that the User is violating this Agreement or any pertinent federal or state law, regulation or rule. 5. MODIFICATIONS: Modifications to the provisions in this Agreement shall be valid only through execution of a formal written amendment. 6. ACCOUNTABILITY: To the extent provided by the laws of Florida, and without waiving any defenses or immunities to which the User may be entitled, the User agrees to be responsible for the negligent acts or omissions of its personnel arising out of or involving any information contained in, received from, entered into or through CJNet, FCIC/NCIC, Ill and NLETS. 7. ACKNOWLEDGEMENT: The User hereby acknowledges the duties and responsibilities as set out in this Agreement. The User acknowledges that these duties and responsibilities have been developed and approved by FDLE to ensure the reliability, confidentiality, completeness, and accuracy of all records contained in or obtained by means of the CJNet, including the FCIC/NCIC System. The User further acknowledges that failure to comply with these duties and responsibilities may subject its access to various sanctions as approved by the FBI Criminal Justice Information Services Advisory Policy Board. These sanctions may include termination of NCIC services to the User. The User may appeal these sanctions through the CSA. 8. TERM OF AGREEMENT: This agreement will remain in force until it is determined by FDLE that a new agreement is required. The User should initiate the execution of a new agreement when a change of agency chief executive or official occurs. April 14,2014 Page 16 of 17 FD)l.E criminal Justice User Agreement IN WITNESS HEREOF, the parties hereto have caused this agreement to be executed by the proper officers and officials. NAME OF THE USER AGENCY Clermont Police Department USER CHIEF EXECUTIVE or OFFICIAL Charles L. Broadway TITLE Chief of Police eiz (PLEASE PRINT) (SIGNATURE) DATE 9 ' �5 l WITNESS.C t � TITLE - L .+�. ��►. c��C FLORIDA DEPARTMENT OF LAW ENFORCEMENT BY Jennifer Cook Pritt TITLE Director (PL E PRINT) t r (SIGNATURE) DATE 61 e241 t`t WITNESS Nt'Y-In ,il CiarN TITLE ff� h April 14,2014 Page 17 of 17