Contract 2020-035A#2020-35-A
MEMORANDUM OF UNDERSTANDING
BETWEEN
THE WINDERMERE POLICE DEPARTMENT
ud, 11
THE CLERMONT POLICE DEPARTMENT FOR PARTICIPATION WITHIN
THE NATIONAL DATA EXCHANGE (N-DEX) AND THE FLORIDA INTEGRATED NETWORK
FOR DATA EXCHANGE AND RETRIEVAL (FINDER)
SECTION I: INTRODUCTION
A. PARTIES TO THIS AGREEMENT
The parties to this agreement are the CLERMONT POLICE DEPARTMENT ("Participating
Agency") and the WINDERMERE POLICE DEPARTMENT (WPD) in its role as the "Lead
Criminal Justice Agency' (LCJA) with respect to the access, use and contribution of data to the
National Data Exchange (N-DEx) System by the Florida law enforcement agencies which
participate in FINDER ("Participating Agencies"). Both parties have entered into Criminal
Justice User Agreements with FDLE and are required to abide by the current FBI Criminal
Justice Information System (CJIS) Security Policy (CSP) for access to state and national
Criminal Justice Information (CJI) as defined by the CSP.
B. N-DEx AND CJIS BACKGROUND
The FBI's Law Enforcement N-DEx is a national law enforcement and criminal justice
information sharing system designed to assist agencies nationwide in solving crime and fighting
terrorism. Access to N-DEx is restricted to Criminal Justice Agencies.
The N-DEx Policy and Operating Manual ("N-DEx Policy Manual") provides the minimum set of
policy and procedural requirements for participating in N-DEx. The current version of the N-DEx
Policy Manual is numbered 5.0, dated September 21, 2018, but may be amended by the FBI
CJIS Advisory Policy Board (APB), in which event the latest version is controlling.
Security requirements for participation in N-DEx are found in the FBI CJIS Security Policy
version 5.7 (August 16, 2018) ("CJIS Security Policy"), but may be amended by the FBI CJIS
Advisory Policy Board (APB), in which event the latest version is controlling, and with which all
participating agencies and users must comply. Copies of both Policies are attached to this
agreement (see Appendix A).
C. BACKGROUND AND EXPLANATION OF WPD's ROLE AS LEAD CRIMINAL JUSTICE
AGENCY (LCJA)
N-DEx is managed by the FBI CJIS Division under a long-standing "shared management"
partnership with the states' Criminal Justice Information Services (CJIS) Systems Officers
(CSO). Under this shared management concept, the state governments, through the CSOs, are
responsible for implementing, managing, and auditing compliance with the N-DEx policy
requirements by participating agencies and users within their states. Accordingly, the CSOs
work directly with regional information sharing systems and lead criminal justice agencies, such
as WPD, to assure that the submission, access and use of data within N-DEx satisfies the
standards established by the N-DEx Policy Manual and the FBI CJIS Security Policy.
The N-DEx Policy Manual permits the CSO, while retaining responsibility for management of
participation in N-DEx within his or her state, to delegate certain functions to single agencies or
regional information sharing systems. Consequently, the WPD has entered into an agreement
with Florida's CSO regarding the contribution of data and access to N-DEx by FINDER's
participating agencies.
Page 2 of 12
It is the intent of the "Agreement between Florida Department of Law Enforcement, Criminal
Justice Information Systems Officer, and the Windermere Police Department for Contribution of
FINDER Data and Access to N-DEx" (hereinafter the "LCJAAgreement") that:
1. By way of memorandum of understanding (MOU), WPD will assure that all
Participating Agencies are familiar with the requirements of the LCJA Agreement
between WPD and the CSO, and that Participating Agencies understand that they
must comply with all present and future requirements of the N-DEx Policy Manual
and the FBI CJIS Security Policy, and with FDLE CJIS, in the Participating Agency's
submission, access, and use of N-DEx information. The MOU will supplement, but
not supersede, the existing CJIS User Agreement between the CSO and
Participating Agencies.
2. Participating Agencies will access N-DEx records directly through FINDER and
submit their contributing data to N-DEx via FINDER and through a Florida Regional
LInX project.
SECTION II: WPD and PARTICIPATING AGENCY OBLIGATIONS
A. WPD's OBLIGATIONS AS LEAD CRIMINAL JUSTICE AGENCY (LCJA)
Pursuant to the LCJAAgreement, WPD accepts specific and delegated responsibilities to
oversee N-DEx contributions and access via FINDER by Participating Agencies. These
responsibilities include:
1. As designated lead agency, WPD shall:
a. Maintain a list of vendor employees having unescorted logical or physical
access to CJI;
b. Submit fingerprint -based background checks as required by the CJIS
Security Policy for each vendor employee and will retain the fingerprint record
for comparison against future arrests;
c. Will promptly make notification in the event of an arrest of a vendor employee
or any event resulting in denial of access by the FDLE CSO;
d. Ensure each vendor employee has completed the appropriate level of
security awareness training;
e. Incorporate the Security Addendum in the contract between WPD and
LETTR/FINDER and maintain the certification page for each vendor
employee;
f. Maintain documents required for audit purposes.
2. By way of memorandum of understanding (MOU), assure that all Participating
Agencies are familiar with the requirements of the Agreement between WPD and the
CSO, and that Participating Agencies understand that they must comply with all
present and future requirements of the N-DEx Policy Manual and CJIS Security
Policy in their submission, access, and use of N-DEx information.
3. Limit participation in N-DEx to those law enforcement agencies possessing 9th
character ORIs of 0 - 9 (numeric values), e.g., police, sheriff, etc., as prescribed in
the N-DEx Policy Manual. If access is requested by an agency not meeting the
above -mentioned requirements, access shall not be granted until the CSO has been
notified and approval has been granted.
Page 3 of 12
4. By way of MOU, require that Participating Agencies conduct an annual audit of all of
their users of N-DEx to include confirming that those users are eligible to participate
in N-DEx; and notify the CSO of all users, upon request or as needed to maintain
currency and completeness of the list of users.
5. By way of MOU, require each Participating Agency to designate and notify WPD and
the CSO of an N-DEx Agency Coordinator (NAC), who will serve as the Participating
Agency's point of contact for matters relating to N-DEx, including monitoring the
Participating Agency's compliance with N-DEx system policies, as identified herein.
The Participating Agency may change its NAC at any time, but must notify WPD and
the CSO in writing of the change. WPD shall maintain a current listing of all NACs
within its region.
6. Ensure that FINDER captures N-DEx users' activities (logging") and will prepare
reports upon the request of the CSO and/or FBI N-DEx Program Office regarding N-
DEx transaction reports processed through FINDER (see Section III, C., N-DEx
Logging).
7. Upon discovery of any misuse of information (including but not limited to
unauthorized or improper access, use, or dissemination) by any users or
Participating Agencies granted access to the N-DEx records, WPD will notify the
CSO and the relevant Participating Agency's NAC so that appropriate remedial or
disciplinary action may be taken. Sanctions for misuse of the records may include
denial of access to the records, as well as other penalties established by law.
8. By way of MOU, WPD will require the Participating Agencies to assure that only
users who have been authorized to access N-DEx records do so; that persons no
longer needing or authorized access to the records for any reason (including but not
limited to position change, disciplinary action, or termination) are denied access; and
that the WPD be notified of N-DEx user changes at the Participating Agency.
a. Participating Agencies are required to conduct a fingerprint -based criminal
history record check on specified persons with access to N-DEx under the
same submission and screening criteria as used for access to Criminal
Justice Information under the CJIS Security Policy. If an appropriate
fingerprint -based criminal history record check has already been
accomplished for access to NCIC/FCIC/III, N-DEx eligibility may be
determined by the CSO from the results of that previous check.
b. The Participating Agency shall notify WPD, who shall notify the CSO, when a
current or potential user is found to have an arrest history, to include all
pertinent circumstances. Granting or denying access is the responsibility of
the CSO, as provided in the CJIS Security Policy. Guidelines for carving out
this responsibility may be accessed on the CJNet under the CJIS Resource
Center.
Page 4 of 12
9. WPD shall assure that all users (persons having physical or logical access) are
trained biennially on N-DEx policies and requirements, as identified herein,
emphasizing data use restrictions.
a. Such training will include, at a minimum, the N-DEx Policy computer -based
training (CBT) module provided to WPD by the CSO or training may be given
by incorporating the requirements of the CBT module into existing training.
b. Should additional training requirements be established by the FBI CAS APB,
the CSO and WPD will cooperate in fulfilling such requirements.
c. Appropriate basic security awareness training shall be required for all
FINDER users having access to N-DEx. If a user has successfully completed
CJIS FCIC certification, as determined by the CSO, this may substitute for
the basic security awareness training. This training will be a biennial
requirement.
d. WPD agrees to maintain and provide a list of persons who have been trained,
and any other relevant reports related to training, upon request of the CSO or
N-DEx Program Office.
B. PARTICIPATING AGENCY OBLIGATIONS
1 . The Participating Agency agrees to comply with all present and future requirements of
the N-DEx Policy Manual and CAS Security Policy in their submission, access, and use
of N-DEx information.
2. The Participating Agency will ensure that only users who have been authorized to
access N-DEx records are able to do so; that persons no longer needing or authorized
access to the records for any reason (including but not limited to position change,
disciplinary action, or termination) are denied access; and that the WPD be notified of N-
DEx user changes at the Participating Agency.
a. The Participating Agency agrees to conduct a fingerprint -based criminal
history record check on specified persons with access to N-DEx as described
in Section II. A. 8., above.
b. The Participating Agency agrees to notify WPD when a current or potential N-
DEx user is found to have an arrest history, as described in Section II. A. 8.,
above.
3. The Participating Agency will ensure that all users (persons having physical or logical
access) are trained biennially on N-DEx policies and requirements, as described in
Section II. A. 9., above.
Page 5 of 12
4. The Participating Agency agrees to designate and notify WPD and the CSO of an N-DEx
Agency Coordinator (NAC), who will serve as the Participating Agency's point of contact
for matters relating to N-DEx, including monitoring the Participating Agency's compliance
with N-DEx system policies, as identified herein. The Participating Agency may change
its NAC at any time, but must notify WPD and the CSO in writing of the change.
The NAC will be responsible for the following functions, as identified in the N-DEx Policy
Manual and required by the CSO:
a. Supervisory authority over the operation of N-DEx at the Agency
b. Training on N-DEx policies
C. Authorized use/dissemination of N-DEx information
d. Attending and participating in the N-DEx audit process
e. Maintaining agency -level records pertaining to N-DEx users and notifying the
CSO of any changes
f. Reporting violations or incidents of attempts to compromise N-DEx, FINDER, or
information contained within the systems immediately to WPD and the CSO.
g. Assuring completion of fingerprint based criminal history checks on all N-DEx
users and notifying the CSO if an arrest history is found.
h. Assuring along with the Agency Source Data Administrator (SDA), as described
in the N-DEx Policy Manual, that the configurable information sharing controls
are set according to Agency requirements.
i. Assuring Agency adherence to the N-DEx Policy Manual, CJIS Security Policy,
and this Agreement.
SECTION III: ACCESS, DISCLOSURE, AND USE OF N-DEx INFORMATION
A. N-DEx USE — GENERALLY
Participating Agency may access N-DEx records through FINDER under this Agreement only for
the purposes specified in the Acceptable Use section of the N-DEx Policy Manual. All search
requests to N-DEx shall have the appropriate use codes selected when searching N-DEx.
Dissemination and use of information in the N-DEx system are governed by the restrictions set
out in the User Identifier Requirement section of the N-DEx Policy Manual.
For data shared with the FBI's National Data Exchange (N-DEx) system, contributing agencies
will, unless otherwise authorized as provided herein, use the version of the FBI ORI Sharing
Template in use by the State of Florida, which restricts full data access to law enforcement
agencies only, and provides "pointer" information to other criminal justice entities (i.e., an
indication that information is held by a contributing agency, but not the content of that
information). Contributing Agencies will retain full control over access to their data within N-DEx
and have the ability to configure additional access restrictions via the FBI ORI Sharing
Template. If a contributing agency prefers to modify the FBI ORI Sharing Template with respect
to access restrictions of the Agency's data stored in N-DEx, access to the Template for that
purpose will be granted by contacting the N-DEx Program Office at the FBI.
Page 6 of 12
B. USE FOR CRIMINAL JUSTICE EMPLOYMENT SCREENING
Participating agencies may use N-DEx to conduct criminal justice employment background
checks, including the screening of employees or applicants of other agencies over which
participating agencies maintain management control, provided the correct use code "J" is
selected and the User follows official FBI CJIS policy regarding Notice and Consent, Redress
and Use Code J, as explained in the N-DEx Policy Manual. Specific requirements associated
with the use of N-DEx to conduct criminal justice employment background checks are detailed
in Appendix B.
C. N-DEx LOGGING
1. The N-DEx system monitors successful and unsuccessful N-DEx logon attempts, file
access, correlations, and type of transaction, regardless of the means of access.
2. WPD will prepare reports upon the request of the CSO and/or FBI N-DEx Program
Office regarding N-DEx transaction reports processed through FINDER. All transaction
files shall be protected to prevent unauthorized changes or destruction.
3. The "Search Reason" for all N-DEx searches must be entered and will be captured by
FINDER and provided in transaction reports.
4. If a query is performed on behalf of another user or Participating Agency, the unique
information associated with the request for assistance shall be captured by FINDER in
the transaction report, and provided to the CSO upon request.
5. FINDER will capture both the user and the receiving agency identity as a result of the
sign -on User ID and user's assigned Agency ORI. The data entered in these fields will
be reviewed as part of the triennial FDLE CJIS audit to assess compliance with
standards for appropriate use and dissemination of N-DEx information.
D. AUDITING
The FBI will include N-DEx system use audits in its triennial audits of FDLE as the CJIS
Systems Agency (CSA). In addition, FDLE will include N-DEx audits in its normal triennial
CJIS audits of each participating agency.
1. Both the FBI CJIS Division and the CSO may audit N-DEx use through FINDER at the
agency and regional level. In addition, the FBI CJIS Division and the CSO may review
any available WPD Self -Audit Reports as a further means of auditing compliance with N-
DEx policies and requirements.
2. All such audits of N-DEx access through FINDER will be "system use" audits to assess
the Participating Agency's understanding of and compliance with N-DEx policies and
requirements, as well as that of WPD. The audits may also review the frequency of
submissions of data to N-DEx. Such N-DEx audits will not include data quality (e.g.,
completeness and accuracy) reviews for records contributed to N-DEx by the
Participating Agency. Rather, the CSO expects WPD and FINDER will conduct periodic
data quality reviews.
Page 7 of 12
SECTION IV: EFFECTIVE DATE/DURATION/TERMINATION
A. EFFECTIVE DATE
This MOU shall become effective when signed by the duly authorized representatives of the
Participating Agency and the Windermere Police Department.
B. DURATION
This MOU shall continue in force indefinitely for so long as it continues to advance the Parties'
purposes, contingent upon approval and availability of necessary funding.
C. TERMINATION
At any time either Party may provide ninety (90) calendar days' prior written notice to the other
of its intent to withdraw from this MOU.
SECTION V: NOTICE AND CONTACT
A. All notices provided under or pursuant to this MOU shall be in writing, delivered either by
hand -delivery; by email with read receipt requested; or by first class, certified mail, return
receipt requested, to the representatives identified below at the addresses set forth below.
B. The name and address of WPD's representative responsible for the administration of this
MOU is:
Name: Chief David Ogden
Address: Windermere Police Department
620 Main Street
Email:
FL 34786
windermere.fl.us
The name and address of the representative of the Participating Agency responsible for the
administration of this MOU is:
Name:
Address:
Email:
Page 8 of 12
SECTION VI: SIGNATORY PAGE
TERMS AND CONDITIONS OF THIS MOU AGREED TO BY:
THE WINDERMERE POLICE DEPARTMENT:
Signature:
Date: June 6, 2019
Name: David Ogden
Title: Chief of.Police
THE PARTICIPATING AGFNc'.Y-
Signature:
Date:
Name:
Title:
Pol i
Agency: CLERMONT POLICE DEPARTMENT
Page 9 of 12
APPENDIX A
POLICY MANUALS
The current version of the N-DEx Policy and Operating Manual is Version 5.0 dated
September 21, 2018, but may be amended by the FBI CJIS Advisory Policy Board, in which
event the latest version is controlling.
See https://www.fbi.gov/file-repository/policy-and-operating manualgdf/view
The current version of the FBI CAS Security Policy is Version 5.7 dated August 16, 2018, but
may be amended by the FBI CJIS Advisory Policy Board, in which event the latest version is
controlling.
See https://www.fbi.aov/services/ciis/ciis-security-policy resource -center
To request a paper or PDF copy of either or both manuals, please direct an email to:
N-DEXSupportCaDtown.windermere fl us
Page 10 of 12
APPENDIX B
USE OF N-DEx FOR CRIMINAL JUSTICE EMPLOYMENT SCREENING
For agencies using N-DEx to conduct Criminal Justice Employment Screening, one of the
following statements, at a minimum, must appear on the User's Notice and Consent form to the
applicant for employment:*
Notice and Consent:
General Statement:
The [Participating Agency's] acquisition, retention, and sharing of information related to your
employment application is generally authorized under 28 C.F.R. section 20.33 and F.S. s.
943.053(3) (a) and Ch. 119. The purpose for requesting this information is to conduct a
complete background investigation pertaining to your fitness to serve as a [employee type].
This background investigation may include inquiries pertaining to your [employment],
[education], [medical history], [credit history], [criminal history] and any information relevant to
your character and reputation. By signing this form, you are acknowledging that you have
received notice and have provided consent for [Participating Agency] to use this information to
conduct such a background investigation, which may include the searching of [N-DEx], [criminal
justice databases], [private databases], and [public databases].
Specific N-DEx Statement:
I authorize any employee or representative of [Participating Agency] to search N-DEx to obtain
information regarding my qualifications and fitness to serve as a [employee type]. I understand
that N-DEx is an electronic repository of information from federal, state, local, tribal, and
regional criminal justice entities. This national information sharing system permits users to
search and analyze data from the entire criminal justice cycle, including crime incident and
investigation reports; arrest, booking, and incarceration reports; and probation and parole
information. This release is executed with full knowledge, understanding, and consent that any
information discovered in N-DEx may be used for the official purpose of conducting a complete
employment background investigation. I also understand that any information found in N-DEx
will not be disclosed to any other person or agency unless authorized and consistent with
applicable law. I release [Participating Agency] from any liability or damage that may result from
the use of information obtained from N-DEx.
Redress:
If employment is denied solely due to information obtained from N-DEx, and the applicant
challenges the accuracy or completeness of those records, Participating Agency (the denying
agency) shall provide the applicant with the contact information of the agency contributing
(owning) the information underlying the decision to deny. After receiving a written request from
the applicant challenging the accuracy or completeness of the record used to deny employment,
the contributing (record -owning) agency shall then review the relevant information and advise
the applicant in writing whether it has confirmed the accuracy or completeness of its records or
whether the records will be corrected. If the applicant does not receive a response from the
contributing (record -owning) agency within 30 days from the date of the applicant's written
request, the applicant may contact the FBI CJIS Division N-DEx Unit, 1000 Custer Hollow Rd,
Clarksburg, WV 26306. The FBI shall forward the challenge to the contributing (record -owning)
agency for verification or correction. The contributing (record -owning) agency shall then review
the relevant information and advise the applicant in writing whether it has verified its records or
whether the records will be corrected. Agencies should inform applicants of the applicant's
responsibility to provide any corrected information to the Participating Agency (denying agency)
Page 11 of 12
that may assist the contributing (record -owning) agency in its research on behalf of the
applicant.
An applicant wishing to challenge the accuracy or completeness of his or her Florida criminal
history record, if one exists, may also use the procedures for personal review set forth in F.S. s.
943.056 and F.A.C. Rule 11C-8.001.
Use Code "J":
All use of N-DEx for criminal justice employment background investigations shall require Use
Code "J." Agencies that contribute records to N-DEx shall be permitted and enabled to reject
Use Code "J" requests. When N-DEx is searched as part of a criminal justice employment
background investigation, the fact that the search was conducted must be documented in the
applicant's file. If information accessed through N-DEx is viewed and used during the criminal
justice employment background investigation, the Participating Agency must document in the
applicant's file: (1) that the Participating Agency (requesting agency) received advanced
authorization for the use of the information for employment purposes from the contributing
(record -owning) agency and (2) that the Participating Agency (requesting agency) has
confirmed the accuracy of the information with the contributing (record -owning) agency.
*Items in brackets may be filled in or deleted as appropriate.
Page 12 of 12