- BACKGROUND AND AUTHORITIES
Presidential Policy Directive 28 (PPD-28), issued January 17, 2014, articulates principles for how the United States conducts signals intelligence activities for authorized foreign intelligence and counterintelligence purposes. Section 4 of PPD-28 requires each IC element to update or issue new policies and procedures that implement the principles for safeguarding personal information collected through signals intelligence. This document constitutes the Department of the Treasury ("Treasury Department"), Office of Intelligence and Analysis, PPD- 28 policies and procedures.
- GENERAL PROVISIONS
As a member of the Intelligence Community, the Office of Intelligence and Analysis (OIA) conducts its mission in conformance with the requirements of Executive Order 12333, as amended, its statutory authority, and other applicable laws. Pursuant to section 1.7(i) of Executive Order 12333, OIA is authorized to collect (overtly or through publicly available sources), analyze, produce, and disseminate information, intelligence, and counterintelligence to support national and departmental missions.
OIA is not authorized to conduct, and does not conduct, signals intelligence activities.
- SAFEGUARDING PERSONAL INFORMATION COLLECTED THROUGH
OIA will apply the following principles for safeguarding personal information of non- U.S. Persons collected from signals intelligence activities.1
- MINIMIZATION OIA does not conduct signals intelligence activities or bulk signals intelligence activities, but it receives, from other IC elements, signals intelligence information2 that has been evaluated, minimized, or otherwise included in finished intelligence products subject to - among other requirements - the provisions of PPD-283
- Dissemination. OIA will disseminate personal information of non-U.S.persons collected through signals intelligence activities only if dissemination of comparable information concerning U.S. persons would be permitted under section 2.3 of Executive Order 12333. OIA will disseminate personal information concerning a non-U.S. person that is foreign intelligence only if the information relates to an authorized intelligence requirement and not solely because of the person's foreign status. Unless it possesses specificinformation to the contrary, OIA will presume that any evaluated or minimized signals intelligence information it receives from other IC elements meets this standard. OIA will disseminate such information in accordance with applicable OIA and IC policies and procedures. For purposes of these policies and procedures, "dissemination" shall mean the transmission, communication, sharing, or passing of information outside of OIA by any means, including oral, electronic, or physical.
- Retention. OIA will retain personal information of non-U.S. persons collected through signals intelligence activities only if the retention of comparable information concerning U.S. persons would be permitted under section 2.3 of Executive Order 12333. OIA will retain personal information concerning a non-U.S. person that is foreign intelligence only if the information relates to an authorized intelligence requirement and not solely because of the person's foreign status. OIA will presume, unless it possesses specific information to the contrary, that any evaluated or minimized signals intelligence information it receives from other IC elements meets this standard. OIA will retain such information in accordance with its records retention policies, including records control schedule N 1-056-06-002 and any succeeding schedules.
- DATA SECURITY AND ACCESS
Access to all personal information collected through signals intelligence activities - irrespective of the nationality of the person whose information is collected - is restricted to those personnel who have a need to access that information in the performance of authorized duties in support of OIA or Departmental missions. Such information in either electronic or physical form will be maintained in secure facilities protected by appropriate physical and technological safeguards with access limited by appropriate security measures. Such information will be safeguarded in accordance with applicable laws, rules, and policies, including those of OIA, the Treasury Department, and the IC.
Classified information, including personal information collected through signals intelligence activities, will be stored appropriately in a secured, certified, and accredited facility, in secured databases and containers, and in accordance with other applicable requirements. OIA's electronic system in which such information may be stored will comply with applicable law, Executive Orders, and IC and Treasury Department policies, and procedures regarding information security, access controls, and monitoring, to include incorporating logging functions that facilitate the auditing of individual use and access.
- DATA QUALITY
Personal information of both U.S. and non-U.S. persons collected through signals Intelligence activities - when identifiable - shall be included in OIA intelligence products only as consistent with applicable IC analytic standards, including ICD 203, Analytic Standards. With respect to personal information collected through signals intelligence, OIA will take particular care to apply standards relating to the quality and reliability of the information, consider alternative sources of information and interpretations of data, and ensure objectivity in performing analysis.
In conjunction with quarterly reviews of OIA products for conformity with the IC's Analytic Integrity Standards, OIA will review randomly selected products for conformity with guidelines established within this document.
Instances of non-compliance with these policies and procedures shall be reported to the Deputy Assistant Secretary, Intelligence Community Integration, who shall ensure they are reported to the Assistant Secretary. The Assistant Secretary, in consultation with the Office of General Counsel and the Treasury Inspector General as appropriate, shall determine what further reporting or corrective actions are necessary. Significant instances of non-compliance with these policies and procedures involving personal information collected through signals intelligence activities shall be reported promptly to the DNI in accordance with section 4 of PPD-28. Such instances may also be reportable to the Intelligence Oversight Board in accordance with the "Criteria on Thresholds for Reporting Intelligence Oversight Matters and Instructions Relating to Formatting and Scheduling" issued under the authority of E.O. 13462.
This reporting procedure does not supersede the obligations imposed by Treasury Order 114-01 and its implementing directives on all Treasury personnel to report to the Inspector General any complaints or information concerning the possible existence of any activity constituting a violation of law, rules, or regulations, mismanagement, gross waste of funds, abuse of authority, a substantial and specific danger to the public health and safety, or a threat to the integrity of programs and operations relating to the Treasury Department.
All OIA personnel whose duties require access to personal information collected through signals intelligence activities will receive annual training on the requirements ofPPD-28 and these policies and procedures.
- DEVIATIONS FROM THESE PROCEDURES
The Assistant Secretary for Intelligence and Analysis must approve in advance any departures from these procedures, after consultation with the Office of the Director of National Intelligence and the National Security Division of the Department of Justice. If there is not time for such approval and a departure from these procedures is necessary because of the immediacy or gravity of a threat to the safety of persons or property or to the national security, the Assistant Secretary, or designee, may approve a departure from these procedures. The Assistant Secretary and the Office of General Counsel will be notified as soon thereafter as possible. OIA will provide prompt written notice of any such departures to the Office of the Director of National Intelligence and the National Security Division of the Department of Justice. Notwithstanding this paragraph, all activities in all circumstances must be carried out in a manner consistent with the Constitution and laws of the United States.
These procedures are set forth solely for internal guidance within OIA. Questions on the applicability or interpretation of these procedures should be directed to the Office of General Counsel.
S. Leslie Ireland Assistant Secretary Office of Intelligence and Analysis Department of the Treasury
1 These procedures do not alter the rules applicable to U.S. persons found in the Foreign Intelligence Surveillance Act, Executive Order 12333, guidelines approved by the Attorney General pursuant to Section 2.3 of Executive Order 12333, or other applicable law.
2 The sources of, or methods of, obtaining specific information contained in evaluated or finished intelligence products may not in all cases be evident to OIA or to the Treasury Department as a recipient of such intelligence products.
3 Such PPD-28 provisions include those in Section 1, such as (i) the United States shall not collect signals intelligence for the purpose of suppressing or burdening criticism or dissent, or for disadvantaging persons based on their ethnicity, race, gender, sexual orientation, or religion; (ii) signals intelligence shall be collected exclusively where there is a foreign intelligence or counterintelligence purpose to support national or departmental missions and not for any other purposes; (iii) it is not an authorized foreign intelligence or counterintelligence purpose to collect foreign private commercial information or trade secrets to afford a competitive advantage to U.S. companies and U.S. business sectors commercially; and (iv) signals intelligence activities shall be as tailored as feasible. If OIA suspects that signals intelligence disseminated to it may have been collected or disseminated in a manner inconsistent with PPD-28, it shall so notify appropriate officials at the IC element that disseminated the signals intelligence.