1 MEMORANDUM OF UNDERSTANDING
BETWEEN
THE FEDERAL BUREAU OF INVESTIGATION, LABORATORY DIVISION AND
________________________________________________________________ FOR
PARTICIPATION IN THE NATIONAL DNA INDEX SYSTEM (NDIS)
This Memorandum of Understanding (NDIS MOU) is made by and between the Federal Bureau of Investigation (hereinafter referred to as "FBI") and the ___________________________________________________ (hereinafter referred to as "NDIS Participating Laboratory").
WHEREAS, the FBI sponsors the Combined DNA Index System (CODIS)1 as part of a technical assistance program to State and Local forensic DNA laboratories which allow the forensic DNA laboratories to store and match DNA records from legally collected samples, offenders, crime scene evidence and missing persons.
WHEREAS, the FBI provides CODIS software, which includes database and networking capabilities, to any qualifying State and Local forensic DNA laboratory performing DNA analysis, as well as training, installation, user support and software upgrades at no cost to the forensic laboratory.
WHEREAS, the Federal DNA Identification Act of 1994 (codified at 34 U.S.C. §12592 amendments thereto, authorized
the Director of the FBI to establish a national index of DNA identification records of persons convicted of crimes, persons who have been charged in an indictment or information with a crime; other persons whose DNA samples are collected under applicable legal authorities, analyses of DNA samples recovered from crime scenes, analyses of DNA samples recovered from unidentified human remains and analyses of DNA samples voluntarily contributed from relatives of missing persons. NDIS also contains analyses of DNA samples collected from missing persons2, and individuals arrested, facing charges, or convicted, and from non-United States persons who are detained under the authority of the United States3 (hereinafter referred to The Federal DNA Act expressly excludes elimination samples
1 justice DNA databases as well as the software used to run these databases. The National DNA Index System or NDIS is considered the highest level of CODIS, e.g., the national level, containing the DNA profiles contributed by Federal, State, and Local participating forensic DNA laboratories. The State DNA Index System (SDIS) allows laboratories within a state to exchange DNA profiles. DNA profiles that originate at the Local DNA Index System (LDIS), are uploaded to SDIS and then to NDIS.
2 Enacted as part of the DNA Sexual Assault Justice Act of 2004 and as part of the Justice for All Act of 2004. 34 U.S.C. §40726(b).
3 See The DNA Fingerprint Act and its implementing regulation. 34 U.S.C. §40702(a)(1)(A) See also 28 C.F.R. §
28.12. The Oakland (CA) Police Department
The Oakland (CA) Police Department
2 from being uploaded into NDIS.
WHEREAS, the NDIS Participating Laboratory will comply with all applicable requirements and procedures for participation in the SDIS.
WHEREAS, the NDIS Participating Laboratory recognizes that the State DNA Index System (SDIS) is the gatekeeper and central point of contact between the NDIS Participating Laboratory and NDIS.
WHEREAS, the NDIS Participating Laboratory may have DNA records to contribute to NDIS through SDIS in order to permit other NDIS participating laboratories to search those records in the national index to generate investigative leads.
NOW, THEREFORE, in consideration of the mutual obligations contained herein, it is agreed by and between the FBI and the NDIS Participating Laboratory as follows:
GENERAL TERMS & CONDITIONS
The FBI and the NDIS Participating Laboratory agree to abide by the terms and conditions specified in the NDIS MOU Quality Assurance Standards for Forensic DNA Testing Laboratories and Quality Assurance Standards for DNA Databasing Laboratories (hereinafter refe Quality Assurance Standards) available at https://le.fbi.gov/science-and-lab-resources/biometrics-and-fingerprints/codis; and the NDIS Operational Procedures Manual available at https://le.fbi.gov/science-and-lab- resources/biometrics-and-fingerprints/codis, all of which are incorporated in and made a part of the NDIS MOU.
For the purposes of the NDIS MOU and operation of NDIS, the term NDIS Participating Laboratory shall be deemed to be a laboratory approved by the FBI for participation in NDIS that is responsible for complying with the Federal DNA Act, the NDIS Operational Procedures, and the terms of the NDIS MOU. The designated SDIS shall be the central point of
LICENSE TO USE CODIS SOFTWARE
Subject to the terms and conditions set forth below, the FBI hereby grants the NDIS Participating Laboratory a sublicense to use the CODIS software and software, for which the FBI has or will obtain an unrestricted license to use, shall remain the exclusive property of the FBI.
configurations for the CODIS application server and the minimum system requirements as documented in the CODIS On-Site Technical Support Reference Guide.
3 The NDIS Participating Laboratory personnel shall not use the CODIS software in any manner until specifically authorized to do so by the FBI. The NDIS Participating Laboratory shall not use the CODIS software in any manner not authorized by the FBI.
Generally, participation in NDIS and maintenance of a local DNA database in accordance with applicable State law shall be considered an authorized use of the CODIS software. The generation of DNA data and/or a DNA database for dissemination beyond the purposes authorized by the Federal DNA Act [34 U.S.C. §12592(b)(3)] shall be considered an unauthorized use of the CODIS software. Similarly, the generation of DNA data and/or a DNA database consisting of such DNA data for dissemination to individuals, entities, agencies, or laboratories other than NDIS Participating Laboratories shall be considered an unauthorized use of the CODIS software.
The NDIS Participating Laboratory is not authorized to distribute or sublicense the CODIS software, and shall not copy the CODIS software for purposes of distribution or distribute the CODIS software to any person or agency outside the NDIS Participating Laboratory without the express written permission of the FBI. The NDIS Participating Laboratory shall not publish or publicly disclose information obtained from or included in the CODIS software and/or NDIS, including, but not limited to: CODIS Bulletins; screen shots of CODIS software; or CODIS meeting, instructional, and/or training materials without the prior written approval of the FBI.
The FBI may terminate the NDIS MOU immediately if the NDIS Participating Laboratory is found in violation of any of the provisions of the software sublicense. In the event the NDIS MOU is terminated, the NDIS Participating Laboratory shall remove the CODIS software from its system(s), including all on-line and backup storage media, within ten (10) business days of receipt of the termination notice, and shall immediately return the CODIS software and all accompanying materials provided to the FBI.
The NDIS Participating Laboratory will take reasonable precautions to prevent unauthorized persons from accessing the CODIS software. For purposes of the software sublicense, unauthorized persons shall mean persons who are not authorized CODIS users. In the event that the FBI determines that such reasonable precautions have not been taken, the sublicense to use the CODIS software will be canceled immediately and will not be restored unless and until the NDIS Participating Laboratory has established that sufficient security procedures have been implemented to protect the CODIS software from unauthorized access.
The determination whether sufficient security procedures to protect the CODIS software have been implemented by the NDIS Participating Laboratory shall be in the sole discretion of the FBI. Upon written cancellation notification by the FBI that sufficient security procedures have not been implemented to the satisfaction of the FBI, within thirty (30) business days of receipt of the cancellation notice, the FBI may terminate the NDIS MOU immediately, and the NDIS Participating Laboratory shall return the CODIS software to the FBI as provided above.
4 The FBI will provide the CODIS software free of charge to the NDIS participating laboratory. Unless otherwise agreed in writing, each party shall bear its own costs in relation to the NDIS MOU as further set forth in the Legal Obligations clause of the NDIS MOU.
DNA IDENTIFICATION ACT OF 1994, as amended
As required by the Federal DNA Identification Act of 1994 (codified at 34 U.S.C. §12592 et seq.) the NDIS Participating Laboratory shall only contribute DNA identification records and DNA analyses to NDIS which are:
(1) Based on analyses performed by or on behalf of a criminal justice agency (or the Secretary of Defense in accordance with section 1565 of title 10) in accordance with publicly available standards that satisfy or exceed the guidelines for a quality assurance program for DNA analysis issued by the Director of the FBI under section 12591 of this title;. (2) prepared by
(A) laboratories that
(i) have been accredited by a nonprofit professional association of persons actively involved in forensic science that is nationally recognized within the forensic science community; and
(ii) undergo external audits, not less than once every 2 years, that demonstrate compliance with standards established by the Director of the Federal Bureau of Investigation; or
(B) criminal justice agencies using Rapid DNA instruments approved by the Director of the Federal Bureau of Investigation in compliance with the standards and procedures issued by the Director under section 12591(a)(5) of this title; and (3) Maintained by Federal, State, and local criminal justice agencies (or the Secretary of Defense in accordance with section 1565 of title 10) pursuant to rules that allow disclosure of stored DNA samples and DNA analyses only--
A. to criminal justice agencies for law enforcement identification purposes; B. in judicial proceedings, if otherwise admissible pursuant to applicable statutes or rules; C. for criminal defense purposes, to a defendant, who shall have access to samples and analyses performed in connection with the case in which such defendant is charged; or D. if personally identifiable information is removed, for a population statistics database, for identification research and protocol development purposes, or for quality control purposes.
5 Access to NDIS shall be canceled immediately and the NDIS MOU terminated in the event the NDIS Participating Laboratory does not comply with any of the above-referenced requirements.
In addition, the Federal DNA Act provides for imposition of a fine of up to $250,000 or imprisonment for not more than one year or both such fine and imprisonment (34 U.S.C. §12593(c)), in the event that:
a. Any person who, by virtue of employment or official position, has possession of, or access to, individually identifiable DNA information indexed in a database created or maintained by any Federal law enforcement agency, and knowingly discloses such information in any manner to any person or agency not authorized to receive it [maximum fine of $100,000]; or
b. Any person, without authorization, knowingly obtains DNA samples or individually identifiable DNA information indexed in a database created or maintained by any Federal law enforcement agency [maximum fine of $250,000 or imprisoned for a period of not more than one year, or both].
ACCESS TO AND/OR DISCLOSURE OF CODIS AND/OR DNA RECORDS
The NDIS Participating Laboratory acknowledges that information and data derived from the use of the software described herein or stored therein may identify U.S. persons, whose information is protected by the Privacy Act of 1974 (Privacy Act) and/or Executive Order 12333 (or any successor Executive Order). All such information will be handled lawfully pursuant to the provisions of the Privacy Act and any other applicable Executive Orders.
The NDIS Participating Laboratory agrees to comply with the limited access and disclosure provisions of the Federal DNA Act. NDIS Participating Laboratories in states that may have more expansive provisions in their State laws relating to access and disclosure of DNA analysis and/or records agree to abide by the more restrictive provisions in Federal law in order to participate in NDIS. NDIS will not accept DNA analyses from any NDIS Participating Laboratories that fail to comply with these restrictions. Examples of unauthorized release/disclosure of DNA records at NDIS include: release to defendant of any or all of the DNA records contained in the State database or samples/analyses performed in relation to a case other than that of the requesting defendant beyond the scope of the Federal DNA Act; or the release of CODIS candidate match information that has not been confirmed (e.g. any data other than the confirmed match).
Agencies granted access to NDIS are required to establish and maintain a system of controls to ensure that continued use of their DNA records in NDIS is lawfully permitted. A DNA record entered into CODIS shall be considered the exclusive property and sole
6 responsibility of the NDIS participating laboratory that enters such record into CODIS. The NDIS Participating Laboratory shall not provide access to or disclosure of DNA records that have been uploaded to NDIS to an entity or agency that is not a criminal justice agency nor authorized to access such DNA records under the Federal DNA Act. If the NDIS Participating Laboratory disseminates, provides, or releases DNA records that have been uploaded to NDIS for purposes not authorized under the Federal DNA Act or to an entity or agency other than another NDIS Participating Laboratory or criminal justice agency, the NDIS Participating Laboratory shall notify the NDIS Custodian.
The NDIS Participating Laboratory shall immediately notify their SDIS of any instance in which data derived from the use of the CODIS software is used, disclosed, accessed or maintained in an unauthorized manner (including any data losses or breaches).
ACCREDITATION AND QUALITY ASSURANCE STANDARDS
Pursuant to the Federal DNA Act, NDIS Participating Laboratories shall only contribute DNA records to NDIS that have been generated by an accredited laboratory in Quality Assurance Standards in effect at the time the DNA analysis is performed available at https://le.fbi.gov/science-and-lab-resources/biometrics-and- fingerprints/codis.
NDIS OPERATIONAL PROCEDURES MANUAL
The procedures and processes governing participation in NDIS are contained in the NDIS Operational Procedures Manual available at https://le.fbi.gov/science-and-lab- resources/biometrics-and-fingerprints/codis and the NDIS Security Requirements Procedure available on the CODIS CJIS SEN. The FBI and the NDIS Participating Laboratory hereby agree to abide by the NDIS Operational Procedures Manual and the NDIS Security Requirements Procedure and any amendments thereto.
The NDIS Participating Laboratory further agrees to participate in NDIS assessment reviews as requested and conducted by the FBI to verify compliance with Federal statutory requirements and the NDIS Operational Procedures Manual for participation in NDIS.
COMMUNICATIONS ACCESS
To participate in and access NDIS, the NDIS Participating Laboratory shall ensure secure transmission of NDIS data from Local to State indexes. The FBI reserves the exclusive right to determine the most appropriate method to ensure secure communications to access NDIS and to alter that method if necessary.
LEGAL OBLIGATIONS
7 The NDIS MOU is not intended, and should not be construed, to create any right or benefit, substantive or procedural, enforceable at law or otherwise by any third party against the parties, their parent agencies, the U.S., or the officers, employees, agents or other associated personnel thereof.
The NDIS MOU is not an obligation or commitment of funds, nor a basis for transfer of funds, but rather is a basic statement of the understanding between the parties hereto of the tasks and methods for performing the tasks described herein. Unless otherwise agreed in writing, each party shall bear its own costs in relation to the NDIS MOU. Expenditures by each party will be subject to its budgetary processes and to the availability of funds and resources pursuant to applicable laws, regulations, and policies. The parties expressly acknowledge that the above language in no way implies that Congress will appropriate funds for such expenditures.
NDIS LIABILITY
The NDIS Participating Laboratory shall be legally responsible for any demands, claims, actions, suits or proceedings brought by any third party against it that is a consequence of the conduct of the NDIS Participating Laboratory, including, but not limited to, any damages for false imprisonment or arrest.
NOTIFICATION OF LEGAL ACTIONS
The NDIS Participating Laboratory shall notify the FBI in writing within ten (10) business days after initial notification to the NDIS Participating Laboratory of any legal actions brought by a third party against the FBI or the NDIS Participating Laboratory involving CODIS or NDIS. Examples of such legal actions include, but are not limited to, court orders and/or discovery requests for CODIS source code or database design and court orders and/or discovery requests for any DNA records maintained in NDIS.
It shall be the responsibility of the Laboratory Director to notify the NDIS Custodian within five (5) business days in the event its CODIS Administrator is arrested in any state and/or charged with a criminal offense.
Notwithstanding any other provision in the NDIS MOU, in the event that the NDIS Participating Laboratory receives a request pursuant to its public access laws (state/local FOIA law) or any other similar judicial, legislative, or administrative process, to disclose information concerning the subject of the NDIS MOU, the NDIS Participating Laboratory will immediately notify the FBI of any such request in order to allow the FBI sufficient time to seek to protect its equities through appropriate channels, if necessary. This provision survives the termination of this agreement.
8 TERMINATION
In addition to the termination provisions set forth above, upon thirty (30) business days written notice, the FBI may terminate the NDIS MOU and require removal of the CODIS software from the computer equipment of an NDIS Participating Laboratory and/or return of that software and any accompanying materials if funds for the continued support of CODIS and/or NDIS are not appropriated by the United States Congress.
MODIFICATIONS TO MEMORANDUM
Modifications to the NDIS MOU shall only be effective if in writing and signed by both Quality Assurance
Standards and the NDIS Operational Procedures Manual to reflect changes in law, processes and/or technology with respect to CODIS or NDIS. In the event that a revision to any or all of the FBI Quality Assurance Standards, and the NDIS Operational Procedures Manual are made, the Parties agree that the FBI shall provide notice of such revisions and that thereafter such revision shall be incorporated in and made a part of the NDIS MOU without the need for both parties to re-execute the NDIS MOU.
EFFECTIVE DATE
The NDIS MOU shall become effective when signed by the Director of the Laboratory Division, FBI or designee, and the Laboratory Director of the NDIS Participating Laboratory having the authority to contract on behalf of the Laboratory.
FEDERAL BUREAU OF INVESTIGATION NDIS PARTICIPATING LABORATORY
LABORATORY DIVISION
By: Eric G. Pokorak By: _____________________________
Title: Director, FBI Laboratory Title: _____________________________
Signature: __________________________ Signature: _____________________________
Date: __________________________ Date: _____________________________