Confidentiality Pledge Revision Notice

AGENCY:

U.S. Census Bureau, Department of Commerce.

ACTION:

Notice of revision of the confidentiality pledge under Title 13 United States Code, Section 9.

SUMMARY:

Under 44 U.S.C. 3506(e) and 13 U.S.C. Section 9, the U.S. Census Bureau is announcing revisions to the confidentiality pledge it provides to its respondents under Title 13, United States Code, Section 9. These revisions are required by the passage and implementation of provisions of the Federal Cybersecurity Enhancement Act of 2015 (H.R. 2029, Division N, Title II, Subtitle B, Sec. 223), which permit and require the Secretary of Homeland Security to provide Federal civilian agencies' information technology systems with cybersecurity protection for their Internet traffic. More details on this announcement are presented in the SUPPLEMENTARY INFORMATION section below.

DATES:

These revisions become effective upon publication of this notice in the Federal Register. In a separate companion Federal Register notice, the U.S. Census Bureau is seeking public comment on these confidentiality pledge revisions.

ADDRESSES:

Questions about this notice should be addressed to Jennifer Jessup, Departmental Paperwork Clearance Officer, Department of Commerce, Room 6616, 14th and Constitution Avenue NW., Washington, DC 20230 (or via the Internet at jjessup@doc.gov).

FOR FURTHER INFORMATION CONTACT:

Requests for additional information should be directed to Robin J. Bachman, Policy Coordination Office, Census Bureau, HQ-8H028, Washington, DC 20233; 301-763-6440 (or via email at pco.policy.office@census.gov). Due to delays in the receipt of regular mail related to security screening, respondents are encouraged to use electronic communications.

SUPPLEMENTARY INFORMATION:

Federal statistics provide key information that the Nation uses to measure its performance and make informed choices about budgets, employment, health, investments, taxes, and a host of other significant topics. The overwhelming majority of Federal surveys are conducted on a voluntary basis. Respondents, ranging from businesses to households to institutions, may choose whether or not to provide the requested information. Many of the most valuable Federal statistics come from surveys that ask for highly sensitive information such as proprietary business data from companies or particularly personal information or practices from individuals. Strong and trusted confidentiality and exclusively statistical use pledges under Title 13, U.S.C. and similar statistical confidentiality pledges are effective and necessary in honoring the trust that businesses, individuals, and institutions, by their responses, place in statistical agencies.

Under the authority of Title 13, U.S.C. and similar statistical confidentiality protection statutes, many Federal statistical agencies make statutory pledges that the information respondents provide will be seen only by statistical agency personnel or their sworn agents, and will be used only for statistical purposes. Title 13, U.S.C. and similar statutes protect the confidentiality of information that agencies collect solely for statistical purposes and under a pledge of confidentiality. These acts protect such statistical information from administrative, law enforcement, taxation, regulatory, or any other non-statistical use and immunize the information submitted to statistical agencies from legal process. Moreover, many of these statutes carry criminal penalties of a Class E felony (fines up to $250,000, or up to five years in prison, or both) for conviction of a knowing and willful unauthorized disclosure of covered information.

As part of the Consolidated Appropriations Act for Fiscal Year 2016 signed on December 17, 2015, the Congress included the Federal Cybersecurity Enhancement Act of 2015 (H.R. 2029, Division N, Title II, Subtitle B, Sec. 223). This Act, among other provisions, permits and requires the Secretary of Homeland Security to provide Federal civilian agencies' information technology systems with cybersecurity protection for their Internet traffic. The technology currently used to provide this protection against cyber malware is known as Einstein 3A; it electronically searches Internet traffic in and out of Federal civilian agencies in real time for malware signatures.

When such a signature is found, the Internet packets that contain the malware signature are shunted aside for further inspection by Department of Homeland Security (DHS) personnel. Since it is possible that such packets entering or leaving a statistical agency's information technology system may contain a small portion of confidential statistical data, statistical agencies can no longer promise their respondents that their responses will be seen only by statistical agency personnel or their sworn agents. However, they can promise, in accordance with provisions of the Federal Cybersecurity Enhancement Act of 2015, that such monitoring can be used only to protect information and information systems from cybersecurity risks, thereby, in effect, providing stronger protection to the integrity of the respondents' submissions.

Consequently, with the passage of the Federal Cybersecurity Enhancement Act of 2015, the Federal statistical community has an opportunity to welcome the further protection of its confidential data offered by DHS' Einstein 3A cybersecurity protection program. The DHS cybersecurity program's objective is to protect Federal civilian information systems from malicious malware attacks. The Federal statistical system's objective is to ensure that the DHS Secretary performs those essential duties in a manner that honors the Government's statutory promises to the public to protect their confidential data. Given that the Department of Homeland Security is not a Federal statistical agency, both DHS and the Federal statistical system have been successfully engaged in finding a way to balance both objectives and achieve these mutually reinforcing objectives.

Accordingly, DHS and Federal statistical agencies, in cooperation with their parent departments, have developed a Memorandum of Agreement for the installation of Einstein 3A cybersecurity protection technology to monitor their Internet traffic and have incorporated an associated Addendum on Highly Sensitive Agency Information that provides additional protection and enhanced security handling of confidential statistical data.

However, many current Title 13, U.S.C. and similar statistical confidentiality pledges promise that respondents' data will be seen only by statistical agency personnel or their sworn agents. Since it is possible that DHS personnel could see some portion of those confidential data in the course of examining the suspicious Internet packets identified by Einstein 3A sensors, statistical agencies need to revise their confidentiality pledges to reflect this process change. Therefore, the U.S. Census Bureau is providing this notice to alert the public to the confidentiality pledge revisions in an efficient and coordinated fashion.

The following is the revised statistical confidentiality pledge for the Census Bureau's data collections:

The U.S. Census Bureau is required by law to protect your information. The Census Bureau is not permitted to publicly release your responses in a way that could identify you. Per the Federal Cybersecurity Enhancement Act of 2015, your data are protected from cybersecurity risks through screening of the systems that transmit your data.

The following listing includes Census Bureau information collections which are confidential under 13 U.S.C. Section 9, as well as information collections that the Census Bureau conducts on behalf of other agencies which are confidential under 13 U.S.C. Section 9 and for which the confidentiality pledges will also be revised.