Contractor Access to Information from Interstate Identification
                           Index

The Office o f Personnel Management and other agencies have authority to disclose criminal history
   records information to private contractors performing background investigations o f government em ­
   ployees or prospective employees.

OPM and other agencies also have authority to permit those contractors to have controlled on-line
  access to criminal history records o f individuals subject to background investigations through the
  Interstate Identification Index system.

                                                                                                A u g u st 15, 1996


               M e m o r a n d u m O p in io n f o r t h e D e p u t y A t t o r n e y G e n e r a l


   This responds to your request for our opinion concerning whether private con­
tractors retained by the Office of Personnel Management (“ OPM” ) to conduct
or assist in conducting background investigations of government employees (or
prospective employees) may be granted access to the criminal history records of
those employees that are maintained in the Interstate Identification Index system
(“ III” ). In particular, you have asked (1) whether OPM may provide designated
contractors with particular information gleaned by OPM from III system records
that OPM concludes will assist the contractor in performing background investiga­
tions; or, more expansively, (2) whether the contractors may themselves be granted
direct on-line access to all III records necessary to perform the required back­
ground investigations.
   Based upon the factual circumstances outlined below, we conclude that both
of the proposed arrangements would be lawful. Our conclusion with respect to
the second alternative is based on the understanding that direct contractor access
to the III system will be subject to effective mechanisms to guard against exceed­
ing authorized access, including contractual restrictions and systems for moni­
toring the identity of records accessed by contractor personnel through the III
system.

                                          I. BACKGROUND

                                                       A.

   OPM is one of several agencies responsible for conducting background inves­
tigations on federal employees and prospective federal employees for two general
purposes: (1) authorizing employee access to classified information and (2) deter­
mining a person’s suitability for federal employment or for particular categories
of federal employment. See 5 U.S.C. §3301; Exec. Order No. 10450, 3 C.F.R.
936 (1949-1953), Exec. Order No. 10577, 3 C.F.R. 218 (1954-1958), and Exec.

                                                      299
                           Opinions o f the Office o f Legal Counsel in Volume 20


Order No. 11222, 3 C.F.R. 306 (1964-1965). Under 5 C.F.R. pt. 731 (1996)
(“ Suitability” ), OPM is also authorized to deny federal appointments when nec­
essary to “ promote the efficiency of the [civil] service.” Id. §731.201. Among
the factors to be considered as grounds for disqualification under that regulation
are criminal or dishonest behavior and abuse of narcotics or alcohol. Id. §731.202.
  OPM’s background investigation workload has increased substantially over the
past ten years. The extent of that workload, the quality and cost of the background
investigations, and the measures OPM has taken to improve its performance have
been the subject of congressional attention and legislation. In 1985, for example,
Senate hearings explored federal government security clearance programs in gen­
eral, and OPM’s background investigation practices in particular, in considerable
depth. See F ederal Government Security Clearance Programs: Hearings Before
the Perm anent Subcomm. on Investigations o f the Senate Comm, on Governmental
Affairs, 99th Cong. (1985) (“ 1985 Hearings” ). In those hearings, OPM reported
that it had begun to use outside contractors to expand and enhance its background
investigation capabilities. Id. at 198, 256. Those hearings also showed that the
State Department, at that time, was already using retired federal investigators as
private contractors to perform background investigations previously performed for
the State Department by OPM. Id. at 287. The hearing record reveals that Con­
gress was not only aware that certain background investigations were being “ con­
tracted out,” but that Congress was actively exploring the benefits of expanded
contracting out for other civilian agencies. Id.

                                                      B.

   As part of the background investigation process, it is necessary for an inves­
tigating agenc[y] to have access to the criminal history record (“ CHR” ) of the
subject.1 For many years, CHRs have been collected, maintained, and exchanged
on a nationwide basis under the auspices of the Federal Bureau of Investigation
(“ FBI” ) in cooperation with federal, state, and local law enforcement agencies.
Statutory authority for the creation, maintenance, and use of that system is set
forth in 28 U.S.C. §534. That statute directs the Attorney General, inter alia,
to “ acquire, collect, classify, and preserve identification, criminal identification,
crime, and other records” and to “ exchange such records and information with,
and for the official use of, authorized officials of the Federal Government, the
States, cities, and penal and other institutions.” Id. § 534(a)(1), (4).
   The FBI has complied with this mandate by acquiring CHR information (as
well as related identifying information, such as fingerprint cards) from the states.
The states have provided this information to the FBI and derived reciprocal benefit
by drawing upon the FBI’s national repository of such record information for their
   1 As OPM stated in the 1985 Senate hearings, “ [i]t is obvious that State and local law enforcement checks are
an essential and irreplaceable component o f an y background investigation.” 1985 Hearings at 271.


                                                     300
              Contractor Access to Information from Interstate Identification Index


own law enforcement purposes. In more recent years, the FBI has sought to im­
prove and streamline this system by approving the development and implementa­
tion of the Interstate Identification Index, a computerized and more decentralized
system of CHR exchange maintained in cooperation with the National Crime In­
formation Center (“ NCIC” ) and participating states.
   As explained to us by the FBI, the III system consists of three basic parts:
(1) the National Identification Index; (2) the National Fingerprint File; and (3)
the actual criminal record repositories of the participating federal, state, and local
agencies. The National Identification Index is essentially an electronic locator sys­
tem for the federal and state criminal history records of individuals. The system
database is maintained by the FBI and accessed by participants through a web
of computer linkups. The National Fingerprint File (“ NFF” ) consists of a system
of fingerprint records provided by participating governments and maintained by
the FBI. The NFF serves to provide positive identification of the subjects of such
records. Finally, the criminal record repositories maintain and make available the
actual criminal history records of individuals.
   The federal-state exchange of criminal history records pursuant to 28 U.S.C.
§534 was originally and primarily intended for criminal law enforcement pur­
poses. See United States Dept, o f Justice v. Reporters Comm. For Freedom o f
Press, 489 U.S. 749, 752 (1989). Although many states would also provide such
records to federal agencies for background investigation purposes (i.e., non-crimi-
nal justice purposes) on a voluntary basis, the 1985 hearings showed that some
states refused to do so, either as a matter of policy or due to state laws limiting
access to such information. See H.R. Conf. Rep. No. 99-373, at 24-25 (1985),
reprinted in 1985 U.S.C.C.A.N. 959, 967-68 (“ Conf. Rep.” ). As a result, Con­
gress enacted 5 U.S.C. §9101, which now provides a m andatory mechanism for
federal agencies performing background investigations to obtain CHR information
from state and local (as well as federal) law enforcement agencies.

                                              C.

   OPM has entered into a contract with a company called US Investigations Serv­
ices, Inc. (“ USIS” ) to obtain assistance in performing personnel background in­
vestigations. The contract provides that USIS “ will conduct background investiga­
tions nationwide on Federal Government applicants, employees, and contract em­
ployees performing sensitive work.” USIS Contract at 50. The contract also con­
tains a variety of provisions restricting the use and disclosure of background infor­
mation made available under the contract, including a clause prohibiting the con-



                                              301
                             Opinions o f the Office o f Legal Counsel in Volume 20


tractor from disclosing such information for any purpose other than fulfilling its
obligations under the contract.2
   We have been asked to consider the legality of two possible arrangements that
OPM might pursue with its contractor. Under one arrangement, OPM would pro­
vide contractor personnel with only particular items of information from a sub­
ject’s CHR (including items obtained by OPM personnel from the III system)
to enable the contractor to resolve particular questions raised by a subject’s CHR.
For example, the contractor might be provided information concerning a particular
criminal charge against the subject and assigned the task of ascertaining its ulti­
mate disposition.
   Under the second alternative, OPM would provide its contractors with direct
on-line access to the III records and would leave it to the contractors to perform
all aspects of the background investigations, albeit under OPM’s ultimate super­
vision. Under this arrangement, although contractor personnel would be authorized
to access only the III records o f designated investigation subjects and would be
subject to a variety of sanctions for exceeding authorized access, their actual on­
line access would extend to the system as a whole.3 At the same time, we under­
stand that any attempt by users to access unauthorized records on the III system
would be recorded by the system’s monitoring mechanisms and readily subject
to detection.

                                                  U. ANALYSIS

                                                           A.

   1. A uthorized D isclosure of CH R Information.

   In 1985, Congress enacted what is now 5 U.S.C. §9101 as part of the Intel­
ligence Authorization Act for FY 1986, Pub. L. No. 99-169, tit. VIII, §801 (a),
99 Stat. 1002, 1008 (1985). That legislation provided the Department of Defense,
OPM, and the Central Intelligence Agency (the FBI and State Department were
included under subsequent amendments) with the right to obtain federal, state,
and local criminal history record information for purposes of determining the eligi­
bility of personnel for (1) access to classified information; and (2) assignment
to or retention in sensitive national security duties. As relevant here, the operative
portion of this statute now provides:
    2 Paragraph H .18 o f the contract, for exam ple, provides: “ Except as otherwise provided herein, any information
m ade available to the Contractor by the G overnm ent shall be used only for the purpose o f carrying out the provisions
o f this contract and shall not be divulged o r m ade known in any manner to any persons except as may be necessary
in the perform ance o f the contract.” Id. at 83.
    3 W e have been advised by O PM that it is not technically feasible to arrange for contractor personnel to be granted
com puter access only to the full III criminal history records o f designated investigation subjects without being granted
access to the III system as a whole. That is, the system apparently does not permit retrieval of the complete CHR
on a subject by means o f a limited access password that w ould confine the user's HI access solely to the records
o f that individual subject.


                                                          302
                   Contractor Access to Information from Interstate Identification Index


             Upon request by the [OPM or the FBI], criminal justice agencies
          shall make available criminal history record information regarding
          individuals under investigation by [OPM or the FBI] for the pur­
          pose of determining eligibility for (A) access to classified informa­
          tion or (B) assignment to or retention in sensitive national security
          duties.

5 U.S.C. § 9101(b)(1). The “ criminal justice agencies” required to provide the
information include federal, state, and local agencies engaged in the administration
of criminal justice. Id. §9101(a)(l). The “ criminal history record information”
covered by the statute consists of

          information collected by criminal justice agencies on individuals
          consisting of identifiable descriptions and notations of arrests, in­
          dictments, informations, or other formal criminal charges, and any
          disposition arising therefrom, sentencing, correction supervision,
          and release.

Id. § 9101(a)(2). This defmition encompasses CHR information contained in the
III system.4

  Section 9101 provides separate authorization for the controlled use and disclo­
sure of the subject CHR information by the recipient agency, as follows:

             Criminal history record information received under this section
          shall be disclosed o r used only for the purposes set forth in para­
          graph (b)(1) or for national security or criminal justice purposes
          authorized by law, and such information shall be made available
          to the individual who is the subject of such information upon re­
          quest.

Id. § 9101(d) (emphasis added). The text of §9101 thus indicates that some disclo­
sure of CHR information to individuals outside the agency by the recipient agen­
cies is contemplated and permitted. In particular, use of the term “ disclosure”
would amount to mere surplusage, and make little sense, if construed to refer
only to disclosure to employees within the recipient agency. See Zeigler Coal
Co. v. Kleppe, 536 F.2d 398, 406 (D.C. Cir. 1976) (statute should not be construed
in a manner that renders some provisions superfluous). The recipient agency’s
“ use” of the information necessarily encompasses its “ disclosure” to the agency
employees who handle and review it. Use of the broader phrase “ disclosed or
   4 It is also o u r understanding, based on descriptions o f the III system provided to us by the FBI, that information
made available through the in system is limited to the categories o f information covered by §9101(a)(2)’s definition
o f "crim inal history record information.”


                                                        303
                     Opinions o f the Office o f Legal Counsel in Volume 20


used” thus indicates that Congress contemplated and authorized disclosure of the
CHR information in contexts apart from the internal use of it by agency employ­
ees. See also 5 U.S.C. § 9101(b)(3)(A) (providing for indemnification of state and
local governments for damages resulting from “ disclosure or use” by OPM or
the FBI of CHR information initially received from the state or local government).
The disclosures authorized by § 9101(d) are limited to those that serve certain
national security or criminal justice purposes or “ the purposes set forth in para­
graph (b)(1)” — that is, the performance of background investigations to deter­
mine eligibility for access to classified information or suitability for sensitive posi­
tions. Disclosure of CHR information to private contractors retained to perform
background investigations constitutes such a disclosure.
   The legislative history of §9101, moreover, further supports the conclusion that
Congress intended to authorize the disclosure of CHR information to private con­
tractors. Congress conducted extensive hearings in 1985 on problems arising out
of the federal government’s background investigation and security clearance proc­
ess. It was those hearings that revealed that state and local governments were
frequently refusing to make CHR information available to federal background in­
vestigators, thereby leading to the enactment of 5 U.S.C. §9101. See S. Rep. No.
99-136, at 2 (1985). The 1985 hearings also established that OPM and the State
Department had already begun to utilize outside contractors to help reduce their
growing backlogs of background investigation work. 1985 Hearings at 198, 256-
57, 287-90. As then OPM Director Donald Devine testified in explaining one
of the key measures taken by OPM to deal with its increased background inves­
tigation workload:

        [M]ost importantly in a major change [of] policy, we have been
        moving to a concept of a corps of permanent investigators con­
        sisting of OPM employees supplem ented by an expanding con­
        tractor relationship with outside investigators, many of them pre­
        vious OPM investigations [sic]. This measure is the only way we
        can meet the recurring surges and declines in work load without
        significant disruptions.

Id. at 198 (emphasis added). Senators at the hearing revealed not only their aware­
ness that agencies were “ contracting out” background investigation work, but
their considerable interest in the potential cost savings that might be achieved
through that practice. Id. at 202 (remarks of Senator Nunn, who observed, “ [W]e
heard testimony yesterday that the State Department had contracted out their in­
vestigative services at a cost of approximately $900 per personnel case.” ); id.
at 287-88 (additional written Committee questions and OPM responses submitted
for the record, including the following question from the Committee: “ Should
other civilian agencies contract out [their background investigations] like the State

                                             304
                    Contractor Access to Information from Interstate Identification Index


Department to get the same quality [of] work cheaper and faster than with
OPM?” ).
  It is therefore evident that when Congress enacted §9101, it fully understood
and accepted the fact that personnel background investigations conducted by OPM
and the State Department were sometimes “ contracted out” to private firms or
individuals. That understanding provides relevant perspective as to what Congress
had in mind when it provided that recipient agencies could “ disclose” criminal
history record information for authorized background investigation purposes.5 In
this context, it would appear that Congress intended to authorize OPM and other
agencies to continue their practice of, at least at times, using contractors to per­
form background investigations and, correspondingly, to permit those contractors
to have access to the necessary CHR information.6

   2. Controlled On-Line Access to III System.

   We also conclude that OPM’s proposal to provide certain contractor personnel
with controlled on-line access to the III system in order to review the criminal
history records of individuals subject to background investigations is consistent
with the requirements and restrictions of §9101. Such access, properly controlled
to prevent unauthorized inquiries, simply constitutes another form of authorized
disclosure under § 9101(d). It should be recognized, however, that allowing con­
tractor personnel to have direct access to the HI system could pose an increased
risk of abuse and litigation.
   If contractors were permitted unrestricted access to the III system as a whole,
it might reasonably be argued that such access is functionally equivalent to the
disclosure to the contractors of all records accessible on the system. Such whole­
sale disclosure would plainly exceed the sort permitted under §9101, which is
(for present purposes) limited to disclosure for the purpose of conducting required
background investigations of government employees or prospective employees. As
we understand it, however, the arrangement that OPM has negotiated with USIS
   5 The Conference Report on the legislation provides little additional insight on the meaning o f the authorized
disclosure provision o f 5 U.S.C. §9101(d). Conf. Rep. at 29, reprinted in 1985 U.S.C.C.A.N. at 972-73. Insofar
as pertinent here, it merely reiterates the point that disclosures o f CHR information permitted under the statute
must be limited to those furthering the statutory purposes. We should note, however, that a reference in the C on­
ference Report to a “ specific need" as a predicate for disclosure o f CHR information refers only to certain special
disclosures “ for national security o r criminal justice purposes,” as specified in § 9101(d). Id. T hat "specific need”
qualification does not relate or apply to disclosures made for the basic purpose o f conducting background investiga­
tions pursuant to § 9 1 0 1(b)(1).
   6 The Privacy Act, o f course, precludes an agency from disclosing "a n y record which is contained in a system
o f records . . . to any person . . . except . . . w ith the prior written consent o f t ) the individual to whom the
record pertains, unless” a particular exemption applies. 5 U.S.C. §552a(b). Here, we understand that all those who
will be subject to background checks conducted by USIS employees will first sign releases, authorizing the disclosure
o f CHR information to a "representative” o f OPM . To avoid any confusion regarding the scope of the release,
and to minimize the risk o f litigation, we strongly recommend that OPM modify the release to clarify that the
CHR information will be disclosed to an independent contractor retained to assist in performing background investiga­
tions. In addition, the risk o f litigation would also be reduced by the issuance o f a relevant routine use notification.
See id. at §552a(b)(3).

                                                          305
                           Opinions o f the Office o f Legal Counsel in Volume 20


does not go this far. On the contrary, there are numerous contractual, legal, and
practical mechanisms to deter and sanction unauthorized exploitation of III access
in these circumstances. The USIS contract includes at least four clauses (para­
graphs H.14, H.18, and H.20-21) prohibiting or sanctioning unauthorized use of
confidential information accessed under the contract by the contractor or its em­
ployees. OPM is also authorized to revoke a contract employee’s access authoriza­
tion and to bar him from work on the contract in the event of “ misconduct . . .
affecting the integrity of an investigative product under the contract” (paragraph
H.24)— which would likely include unauthorized examination of non-subject
CHR’s on the III system. USIS Contract at 85. Moreover, continuous system mon­
itoring and recording of the particular records accessed on the III system provides
an added deterrent against such abuse. By comparing the record subjects that con­
tract personnel are authorized to examine by OPM against those that they actually
examine (as recorded by the monitoring system), unauthorized examinations would
be readily detectable. Finally, abuse of access to III records could also subject
the perpetrator to criminal prosecution under some circumstances.7
   Such restrictions provide the kind of limitations on access to sensitive records
that have been upheld as adequate in comparable contexts. See, e.g., Whalen v.
Roe, 429 U.S. 589, 598-602 (1977) (measures to preserve confidence of state
drug prescription registry held sufficient to negate claims that potential for public
disclosure would violate privacy rights); H odge v. Jones, 31 F.3d 157, 165-66
(4th Cir.), cert, denied, 513 U.S. 1018 (1994) (Maryland statutory procedures held
adequately to limit access to child abuse information records, and thus ‘‘tangential
possibility” of public disclosure through such theoretical means as improperly
motivated state employees or fortuitous computer hackers did not implicate a con­
stitutional privacy right). Here, we believe the above-described restrictions provide
adequate assurance that the contractor’s access to III records will be limited to
the background investigation purposes authorized by 5 U.S.C. § 9101(b)(1).

                                                        B.

  Finally, our conclusion that §9101 authorizes the sort of disclosures con­
templated by the OPM/USIS contract is not inconsistent with prior opinions of
this office that have concluded that certain disclosures of CHR information to
private entities were not authorized by the governing law. See Memorandum for
William Webster, Director, Federal Bureau of Investigation, from Robert B.
Shanks, Deputy Assistant Attorney General, Office of Legal Counsel, Re: Missing
Children A ct (Apr. 24, 1984) (concluding that certain CHR information on missing
persons could not be provided to private organizations); Memorandum for Joseph
H. Davis, Assistant Director, Legal Counsel Division, Federal Bureau of Investiga­

  7 For exam ple, the Privacy Act provides misdemeanor sanctions for “ [a]ny person w ho knowingly and willfully
requests o r obtains any record concerning an individual from an agency under false pretenses.” 5 U.S.C. §552a(i)(3).


                                                       306
                 Contractor Access to Information from Interstate Identification Index


tion, from William P. Barr, Assistant Attorney General, Office of Legal Counsel,
Re: Proposal by F ederally Chartered or Insured Financial Institutions to D issem i­
nate FBI Criminal H istory Record Information to CARCO Group, Inc. (Sept. 1,
1989) (concluding that secondary dissemination of CHR information by authorized
private users— banks and securities firms— to other private entities who were
in a contractual relationship with the authorized private user was not permitted);
Memorandum to Files, from Mary C. Lawton, Deputy Assistant Attorney General,
Office of Legal Counsel, Re: Railroad Police Access to FBI Criminal Identifica­
tion Records (June 22, 1978) (concluding that a local criminal justice agency may
not provide private railroad police with criminal history information obtained from
the FBI).
   None of these prior opinions involved the question whether disclosure was au­
thorized under §9101, but rather each turned on the distinct question whether
disclosure was permitted under 28 U.S.C. §534. In short, each of these prior opin­
ions rests on the premise that §534 only authorizes the “ exchange” of informa­
tion between governmental officials, and that governmental officials who receive
information pursuant to § 534 may not disseminate the information to private enti­
ties.8 Here, in contrast, we conclude that the disclosures at issue are authorized
under §9101, and §534 does not purport to limit the dissemination of information
authorized under a separate statute.
   Moreover, to the extent any inconsistency might arguably exist between the
two statutes, §534 must yield to §9101. Insofar as conflicts between two statutes
cannot be reconciled by construction, “ the most recent and more specific congres­
sional pronouncement will prevail over a prior, more generalized statute.” Natural
Resources Defense Council, Inc. v. EPA, 824 F.2d 1258, 1278 (1st Cir. 1987),
citing 2A C. Sands, Sutherland on Statutes and Statutory Construction §51.02
(4th ed. 1984). Section 9101 was enacted in 1985 to establish specific provisions
for designated federal agencies to obtain CHR information from the states on a
mandatory basis for purposes of conducting background investigations. Its enact­
ment was necessitated in part by the fact that the more general provisions for
exchange of CHR information previously provided by §534 (enacted in 1966,
Pub. L. No. 89-554, §4(c), 80 Stat. 616) did not require the states to provide
such information for background investigation purposes. As the more recently en­
acted and more specific provision, therefore, the disclosure provision of §9101
would prevail over § 534 insofar as a conflict exists.

                                                           CHRISTOPHER H. SCHROEDER
                                                            Acting A ssistant A ttorney General
                                                                 Office o f Legal Counsel

  8 Because we conclude that §9101 authorizes the disclosures at issue here, we need not (and do not) consider
whether §534 might also authorize these disclosures.

                                                   307
