Medical and Public Health Law Site
Opinions of the Office of Legal Counsent - DOJ
CONTRACTOR ACCESS TO INFORMATION FROM INTERSTATE IDENTIFICATION INDEX
The Office of Personnel Management and other agencies have authority to disclose criminal history records information to private contractors performing background investigations of government employees or prospective employees.
OPM and other agencies also have authority to permit those contractors to have controlled on-line access to criminal history records of individuals subject to background investigations through the Interstate Identification Index system.
August 15, 1996
MEMORANDUM OPINION FOR THE DEPUTY ATTORNEY GENERAL
This responds to your request for our opinion concerning whether private contractors retained by the Office of Personnel Management ("OPM") to conduct or assist in conducting background investigations of government employees (or prospective employees) may be granted access to the criminal history records of those employees that are maintained in the Interstate Identification Index system ("III"). In particular, you have asked (1) whether OPM may provide designated contractors with particular information gleaned by OPM from III system records that OPM concludes will assist the contractor in performing background investigations; or, more expansively, (2) whether the contractors may themselves be granted direct on-line access to all III records necessary to perform the required background investigations.
Based upon the factual circumstances outlined below, we conclude that both of the proposed arrangements would be lawful. Our conclusion with respect to the second alternative is based on the understanding that direct contractor access to the III system will be subject to effective mechanisms to guard against exceeding authorized access, including contractual restrictions and systems for monitoring the identity of records accessed by contractor personnel through the III system.
OPM is one of several agencies responsible for conducting background investigations on federal employees and prospective federal employees for two general purposes: (1) authorizing employee access to classified information and (2) determining a person's suitability for federal employment or for particular categories of federal employment. See 5 U.S.C. § 3301; Exec. Order No. 10450, 3 C.F.R. 936 (1949-1953), Exec. Order No. 10577, 3 C.F.R. 218 (1954-1958), and Exec. Order No. 11222, 3 C.F.R. 306 (1964-1965). Under 5 C.F.R. pt. 731 (1996) ("Suitability"), OPM is also authorized to deny federal appointments when necessary to "promote the efficiency of the [civil] service." Id. § 731.201. Among the factors to be considered as grounds for disqualification under that regulation are criminal or dishonest behavior and abuse of narcotics or alcohol. Id. § 731.202.
OPM's background investigation workload has increased substantially over the past ten years. The extent of that workload, the quality and cost of the background investigations, and the measures OPM has taken to improve its performance have been the subject of congressional attention and legislation. In 1985, for example, Senate hearings explored federal government security clearance programs in general, and OPM's background investigation practices in particular, in considerable depth. See Federal Government Security Clearance Programs: Hearings Before the Permanent Subcomm. on Investigations of the Senate Comm. on Governmental Affairs, 99th Cong. (1985) ("1985 Hearings"). In those hearings, OPM reported that it had begun to use outside contractors to expand and enhance its background investigation capabilities. Id. at 198, 256. Those hearings also showed that the State Department, at that time, was already using retired federal investigators as private contractors to perform background investigations previously performed for the State Department by OPM. Id. at 287. The hearing record reveals that Congress was not only aware that certain background investigations were being "contracted out," but that Congress was actively exploring the benefits of expanded contracting out for other civilian agencies. Id.
As part of the background investigation process, it is necessary for an investigating agenc[y] to have access to the criminal history record ("CHR") of the subject. (1) For many years, CHRs have been collected, maintained, and exchanged on a nationwide basis under the auspices of the Federal Bureau of Investigation ("FBI") in cooperation with federal, state, and local law enforcement agencies. Statutory authority for the creation, maintenance, and use of that system is set forth in 28 U.S.C. § 534. That statute directs the Attorney General, inter alia, to "acquire, collect, classify, and preserve identification, criminal identification, crime, and other records" and to "exchange such records and information with, and for the official use of, authorized officials of the Federal Government, the States, cities, and penal and other institutions." Id. § 534(a)(1), (4).
The FBI has complied with this mandate by acquiring CHR information (as well as related identifying information, such as fingerprint cards) from the states. The states have provided this information to the FBI and derived reciprocal benefit by drawing upon the FBI's national repository of such record information for their own law enforcement purposes. In more recent years, the FBI has sought to improve and streamline this system by approving the development and implementation of the Interstate Identification Index, a computerized and more decentralized system of CHR exchange maintained in cooperation with the National Crime Information Center ("NCIC") and participating states.
As explained to us by the FBI, the III system consists of three basic parts: (1) the National Identification Index; (2) the National Fingerprint File; and (3) the actual criminal record repositories of the participating federal, state, and local agencies. The National Identification Index is essentially an electronic locator system for the federal and state criminal history records of individuals. The system database is maintained by the FBI and accessed by participants through a web of computer linkups. The National Fingerprint File ("NFF") consists of a system of fingerprint records provided by participating governments and maintained by the FBI. The NFF serves to provide positive identification of the subjects of such records. Finally, the criminal record repositories maintain and make available the actual criminal history records of individuals.
The federal-state exchange of criminal history records pursuant to 28 U.S.C. § 534 was originally and primarily intended for criminal law enforcement purposes. See United States Dept. of Justice v. Reporters Comm. For Freedom of Press, 489 U.S. 749, 752 (1989). Although many states would also provide such records to federal agencies for background investigation purposes (i.e., non-criminal justice purposes) on a voluntary basis, the 1985 hearings showed that some states refused to do so, either as a matter of policy or due to state laws limiting access to such information. See H.R. Conf. Rep. No. 99-373, at 24-25 (1985), reprinted in 1985 U.S.C.C.A.N. 959, 967-68 ("Conf. Rep."). As a result, Congress enacted 5 U.S.C. § 9101, which now provides a mandatory mechanism for federal agencies performing background investigations to obtain CHR information from state and local (as well as federal) law enforcement agencies.
OPM has entered into a contract with a company called US Investigations Services, Inc. ("USIS") to obtain assistance in performing personnel background investigations. The contract provides that USIS "will conduct background investigations nationwide on Federal Government applicants, employees, and contract employees performing sensitive work." USIS Contract at 50. The contract also contains a variety of provisions restricting the use and disclosure of background information made available under the contract, including a clause prohibiting the contractor from disclosing such information for any purpose other than fulfilling its obligations under the contract. (2)
We have been asked to consider the legality of two possible arrangements that OPM might pursue with its contractor. Under one arrangement, OPM would provide contractor personnel with only particular items of information from a subject's CHR (including items obtained by OPM personnel from the III system) to enable the contractor to resolve particular questions raised by a subject's CHR. For example, the contractor might be provided information concerning a particular criminal charge against the subject and assigned the task of ascertaining its ultimate disposition.
Under the second alternative, OPM would provide its contractors with direct on-line access to the III records and would leave it to the contractors to perform all aspects of the background investigations, albeit under OPM's ultimate supervision. Under this arrangement, although contractor personnel would be authorized to access only the III records of designated investigation subjects and would be subject to a variety of sanctions for exceeding authorized access, their actual on-line access would extend to the system as a whole. (3) At the same time, we understand that any attempt by users to access unauthorized records on the III system would be recorded by the system's monitoring mechanisms and readily subject to detection.
1. Authorized Disclosure of CHR Information.
In 1985, Congress enacted what is now 5 U.S.C. § 9101 as part of the Intelligence Authorization Act for FY 1986, Pub. L. No. 99-169, tit. VIII, § 801(a), 99 Stat. 1002, 1008 (1985). That legislation provided the Department of Defense, OPM, and the Central Intelligence Agency (the FBI and State Department were included under subsequent amendments) with the right to obtain federal, state, and local criminal history record information for purposes of determining the eligibility of personnel for (1) access to classified information; and (2) assignment to or retention in sensitive national security duties. As relevant here, the operative portion of this statute now provides:
Upon request by the [OPM or the FBI], criminal justice agencies shall make available criminal history record information regarding individuals under investigation by [OPM or the FBI] for the purpose of determining eligibility for (A) access to classified information or (B) assignment to or retention in sensitive national security duties.
5 U.S.C. § 9101(b)(1). The "criminal justice agencies" required to provide the information include federal, state, and local agencies engaged in the administration of criminal justice. Id. § 9101(a)(1). The "criminal history record information" covered by the statute consists of
information collected by criminal justice agencies on individuals consisting of identifiable descriptions and notations of arrests, indictments, informations, or other formal criminal charges, and any disposition arising therefrom, sentencing, correction supervision, and release.
Id. § 9101(a)(2). This definition encompasses CHR information contained in the III system. (4)
Section 9101 provides separate authorization for the controlled use and disclosure of the subject CHR information by the recipient agency, as follows:
Criminal history record information received under this section shall be disclosed or used only for the purposes set forth in paragraph (b)(1) or for national security or criminal justice purposes authorized by law, and such information shall be made available to the individual who is the subject of such information upon request.
Id. § 9101(d) (emphasis added). The text of § 9101 thus indicates that some disclosure of CHR information to individuals outside the agency by the recipient agencies is contemplated and permitted. In particular, use of the term "disclosure" would amount to mere surplusage, and make little sense, if construed to refer only to disclosure to employees within the recipient agency. See Zeigler Coal Co. v. Kleppe, 536 F.2d 398, 406 (D.C. Cir. 1976) (statute should not be construed in a manner that renders some provisions superfluous). The recipient agency's "use" of the information necessarily encompasses its "disclosure" to the agency employees who handle and review it. Use of the broader phrase "disclosed or used" thus indicates that Congress contemplated and authorized disclosure of the CHR information in contexts apart from the internal use of it by agency employees. See also 5 U.S.C. § 9101(b)(3)(A) (providing for indemnification of state and local governments for damages resulting from "disclosure or use" by OPM or the FBI of CHR information initially received from the state or local government). The disclosures authorized by § 9101(d) are limited to those that serve certain national security or criminal justice purposes or "the purposes set forth in paragraph (b)(1)" -- that is, the performance of background investigations to determine eligibility for access to classified information or suitability for sensitive positions. Disclosure of CHR information to private contractors retained to perform background investigations constitutes such a disclosure.
The legislative history of § 9101, moreover, further supports the conclusion that Congress intended to authorize the disclosure of CHR information to private contractors. Congress conducted extensive hearings in 1985 on problems arising out of the federal government's background investigation and security clearance process. It was those hearings that revealed that state and local governments were frequently refusing to make CHR information available to federal background investigators, thereby leading to the enactment of 5 U.S.C. § 9101. See S. Rep. No. 99-136, at 2 (1985). The 1985 hearings also established that OPM and the State Department had already begun to utilize outside contractors to help reduce their growing backlogs of background investigation work. 1985 Hearings at 198, 256-57, 287-90. As then OPM Director Donald Devine testified in explaining one of the key measures taken by OPM to deal with its increased background investigation workload:
[M]ost importantly in a major change [of] policy, we have been moving to a concept of a corps of permanent investigators consisting of OPM employees supplemented by an expanding contractor relationship with outside investigators, many of them previous OPM investigations [sic]. This measure is the only way we can meet the recurring surges and declines in work load without significant disruptions.
Id. at 198 (emphasis added). Senators at the hearing revealed not only their awareness that agencies were "contracting out" background investigation work, but their considerable interest in the potential cost savings that might be achieved through that practice. Id. at 202 (remarks of Senator Nunn, who observed, "[W]e heard testimony yesterday that the State Department had contracted out their investigative services at a cost of approximately $900 per personnel case."); id. at 287-88 (additional written Committee questions and OPM responses submitted for the record, including the following question from the Committee: "Should other civilian agencies contract out [their background investigations] like the State Department to get the same quality [of] work cheaper and faster than with OPM?").
It is therefore evident that when Congress enacted § 9101, it fully understood and accepted the fact that personnel background investigations conducted by OPM and the State Department were sometimes "contracted out" to private firms or individuals. That understanding provides relevant perspective as to what Congress had in mind when it provided that recipient agencies could "disclose" criminal history record information for authorized background investigation purposes. (5) In this context, it would appear that Congress intended to authorize OPM and other agencies to continue their practice of, at least at times, using contractors to perform background investigations and, correspondingly, to permit those contractors to have access to the necessary CHR information. (6)
2. Controlled On-Line Access to III System.
We also conclude that OPM's proposal to provide certain contractor personnel with controlled on-line access to the III system in order to review the criminal history records of individuals subject to background investigations is consistent with the requirements and restrictions of § 9101. Such access, properly controlled to prevent unauthorized inquiries, simply constitutes another form of authorized disclosure under § 9101(d). It should be recognized, however, that allowing contractor personnel to have direct access to the III system could pose an increased risk of abuse and litigation.
If contractors were permitted unrestricted access to the III system as a whole, it might reasonably be argued that such access is functionally equivalent to the disclosure to the contractors of all records accessible on the system. Such wholesale disclosure would plainly exceed the sort permitted under § 9101, which is (for present purposes) limited to disclosure for the purpose of conducting required background investigations of government employees or prospective employees. As we understand it, however, the arrangement that OPM has negotiated with USIS does not go this far. On the contrary, there are numerous contractual, legal, and practical mechanisms to deter and sanction unauthorized exploitation of III access in these circumstances. The USIS contract includes at least four clauses (paragraphs H.14, H.18, and H.20-21) prohibiting or sanctioning unauthorized use of confidential information accessed under the contract by the contractor or its employees. OPM is also authorized to revoke a contract employee's access authorization and to bar him from work on the contract in the event of "misconduct . . . affecting the integrity of an investigative product under the contract" (para. H.24) -- which would likely include unauthorized examination of non-subject CHR's on the III system. USIS Contract at 85. Moreover, continuous system monitoring and recording of the particular records accessed on the III system provides an added deterrent against such abuse. By comparing the record subjects that contract personnel are authorized to examine by OPM against those that they actually examine (as recorded by the monitoring system), unauthorized examinations would be readily detectable. Finally, abuse of access to III records could also subject the perpetrator to criminal prosecution under some circumstances. (7)
Such restrictions provide the kind of limitations on access to sensitive records that have been upheld as adequate in comparable contexts. See, e.g., Whalen v. Roe, 429 U.S. 589, 598-602 (1977) (measures to preserve confidence of state drug prescription registry held sufficient to negate claims that potential for public disclosure would violate privacy rights); Hodge v. Jones, 31 F.3d 157, 165-66 (4th Cir.), cert. denied, 513 U.S. 1018 (1994) (Maryland statutory procedures held adequately to limit access to child abuse information records, and thus "tangential possibility" of public disclosure through such theoretical means as improperly motivated state employees or fortuitous computer hackers did not implicate a constitutional privacy right). Here, we believe the above-described restrictions provide adequate assurance that the contractor's access to III records will be limited to the background investigation purposes authorized by 5 U.S.C. § 9101(b)(1).
Finally, our conclusion that § 9101 authorizes the sort of disclosures contemplated by the OPM/USIS contract is not inconsistent with prior opinions of this office that have concluded that certain disclosures of CHR information to private entities were not authorized by the governing law. See Memorandum for William Webster, Director, Federal Bureau of Investigation, from Robert B. Shanks, Deputy Assistant Attorney General, Office of Legal Counsel, Re: Missing Children Act (April 24, 1984) (concluding that certain CHR information on missing persons could not be provided to private organizations); Memorandum for Joseph H. Davis, Assistant Director, Legal Counsel Division, Federal Bureau of Investigation, from William P. Barr, Assistant Attorney General, Office of Legal Counsel, Re: Proposal by Federally Chartered or Insured Financial Institutions to Disseminate FBI Criminal History Record Information to CARCO Group, Inc. (Sept. 1, 1989) (concluding that secondary dissemination of CHR information by authorized private users -- banks and securities firms -- to other private entities who were in a contractual relationship with the authorized private user was not permitted); Memorandum to Files, from Mary C. Lawton, Deputy Assistant Attorney General, Office of Legal Counsel, Re: Railroad Police Access to FBI Criminal Identification Records (June 22, 1978) (concluding that a local criminal justice agency may not provide private railroad police with criminal history information obtained from the FBI).
None of these prior opinions involved the question whether disclosure was authorized under § 9101, but rather each turned on the distinct question whether disclosure was permitted under 28 U.S.C. § 534. In short, each of these prior opinions rests on the premise that § 534 only authorizes the "exchange" of information between governmental officials, and that governmental officials who receive information pursuant to § 534 may not disseminate the information to private entities. (8) Here, in contrast, we conclude that the disclosures at issue are authorized under § 9101, and § 534 does not purport to limit the dissemination of information authorized under a separate statute.
Moreover, to the extent any inconsistency might arguably exist between the two statutes, § 534 must yield to § 9101. Insofar as conflicts between two statutes cannot be reconciled by construction, "the most recent and more specific congressional pronouncement will prevail over a prior, more generalized statute." Natural Resources Defense Council, Inc. v. EPA, 824 F.2d 1258, 1278 (1st Cir. 1987), citing 2A C. Sands, Sutherland on Statutes and Statutory Construction § 51.02 (4th ed. 1984). Section 9101 was enacted in 1985 to establish specific provisions for designated federal agencies to obtain CHR information from the states on a mandatory basis for purposes of conducting background investigations. Its enactment was necessitated in part by the fact that the more general provisions for exchange of CHR information previously provided by § 534 (enacted in 1966, Pub. L. No. 89-554, §4(c), 80 Stat. 616) did not require the states to provide such information for background investigation purposes. As the more recently enacted and more specific provision, therefore, the disclosure provision of § 9101 would prevail over § 534 insofar as a conflict exists.
CHRISTOPHER H. SCHROEDER
Acting Assistant Attorney
General
Office of Legal Counsel
1 As OPM stated in the 1985 Senate hearings, "[i]t is obvious that State and local law enforcement checks are an essential and irreplaceable component of any background investigation." 1985 Hearings at 271.
2 Paragraph H.18 of the contract, for example, provides: "Except as otherwise provided herein, any information made available to the Contractor by the Government shall be used only for the purpose of carrying out the provisions of this contract and shall not be divulged or made known in any manner to any persons except as may be necessary in the performance of the contract." Id. at 83.
3 We have been advised by OPM that it is not technically feasible to arrange for contractor personnel to be granted computer access only to the full III criminal history records of designated investigation subjects without being granted access to the III system as a whole. That is, the system apparently does not permit retrieval of the complete CHR on a subject by means of a limited access password that would confine the user's III access solely to the records of that individual subject.
4 It is also our understanding, based on descriptions of the III system provided to us by the FBI, that information made available through the III system is limited to the categories of information covered by § 9101(a)(2)'s definition of "criminal history record information."
5 The Conference Report on the legislation provides little additional insight on the meaning of the authorized disclosure provision of 5 U.S.C. § 9101(d). Conf. Rep. at 29, reprinted in 1985 U.S.C.C.A.N. at 972-73. Insofar as pertinent here, it merely reiterates the point that disclosures of CHR information permitted under the statute must be limited to those furthering the statutory purposes. We should note, however, that a reference in the Conference Report to a "specific need" as a predicate for disclosure of CHR information refers only to certain special disclosures "for national security or criminal justice purposes," as specified in § 9101(d). Id. That "specific need" qualification does not relate or apply to disclosures made for the basic purpose of conducting background investigations pursuant to § 9101(b)(1).
6 The Privacy Act, of course, precludes an agency from disclosing "any record which is contained in a system of records . . . to any person . . . except . . . with the prior written consent of[ ] the individual to whom the record pertains, unless" a particular exemption applies. 5 U.S.C. § 552a(b). Here, we understand that all those who will be subject to background checks conducted by USIS employees will first sign releases, authorizing the disclosure of CHR information to a "representative" of OPM. To avoid any confusion regarding the scope of the release, and to minimize the risk of litigation, we strongly recommend that OPM modify the release to clarify that the CHR information will be disclosed to an independent contractor retained to assist in performing background investigations. In addition, the risk of litigation would also be reduced by the issuance of a relevant routine use notification. See id. at § 552a(b)(3).
7 For example, the Privacy Act provides misdemeanor sanctions for "[a]ny person who knowingly and willfully requests or obtains any record concerning an individual from an agency under false pretenses." 5 U.S.C. § 552a(i)(3).
8 Because we conclude that § 9101 authorizes the disclosures at issue here, we need not (and do not) consider whether § 534 might also authorize these disclosures.