Pia

PRIVACY IMPACT ASSESSMENT (PIA)
For the
Defense Sexual Assault Incident Database (DSAID)
Office of the Under Secretary of Defense (OUSD)
for Personnel and Readiness (P&R),

SECTION 1: IS A PIA REQUIRED?
a. Will this Department of Defense (DoD) information system or electronic collection of
information (referred to as an "electronic collection" for the purpose of this form) collect,
maintain, use, and/or disseminate PII about members of the public, Federal personnel,
contractors or foreign nationals employed at U.S. military facilities internationally? Choose
one option from the choices below. (Choose (3) for foreign nationals).
(1) Yes, from members of the general public.
(2) Yes, from Federal personnel* and/or Federal contractors.
(3) Yes, from both members of the general public and Federal personnel and/or Federal contractors.
(4) No
* "Federal personnel" are referred to in the DoD IT Portfolio Repository (DITPR) as "Federal employees."

b. If "No," ensure that DITPR or the authoritative database that updates DITPR is annotated
for the reason(s) why a PIA is not required. If the DoD information system or electronic
collection is not in DITPR, ensure that the reason(s) are recorded in appropriate
documentation.
c. If "Yes," then a PIA is required. Proceed to Section 2.

DD FORM 2930 NOV 2008

Page 1 of 15

SECTION 2: PIA SUMMARY INFORMATION
a. Why is this PIA being created or updated? Choose one:
New DoD Information System

New Electronic Collection

Existing DoD Information System

Existing Electronic Collection

Significantly Modified DoD Information
System

b. Is this DoD information system registered in the DITPR or the DoD Secret Internet Protocol
Router Network (SIPRNET) IT Registry?
Yes, DITPR

Enter DITPR System Identification Number

Yes, SIPRNET

Enter SIPRNET Identification Number

11499

No

c. Does this DoD information system have an IT investment Unique Project Identifier (UPI), required
by section 53 of Office of Management and Budget (OMB) Circular A-11?
No

Yes
If "Yes," enter UPI

007-97-01-20-02-3659-00

If unsure, consult the Component IT Budget Point of Contact to obtain the UPI.

d. Does this DoD information system or electronic collection require a Privacy Act System of
Records Notice (SORN)?
A Privacy Act SORN is required if the information system or electronic collection contains information about U.S. citizens
or lawful permanent U.S. residents that is retrieved by name or other unique identifier. PIA and Privacy Act SORN
information should be consistent.

No

Yes
If "Yes," enter Privacy Act SORN Identifier

DHRA 06

DoD Component-assigned designator, not the Federal Register number.
Consult the Component Privacy Office for additional information or
access DoD Privacy Act SORNs at: http://www.defenselink.mil/privacy/notices/

or
Date of submission for approval to Defense Privacy Office
Consult the Component Privacy Office for this date.

DD FORM 2930 NOV 2008

Pending submission

Page 2 of 15

e. Does this DoD information system or electronic collection have an OMB Control Number?
Contact the Component Information Management Control Officer or DoD Clearance Officer for this information.
This number indicates OMB approval to collect data from 10 or more members of the public in a 12-month period
regardless of form or format.

Yes
Enter OMB Control Number
Enter Expiration Date
No
f. Authority to collect information. A Federal law, Executive Order of the President (EO), or DoD
requirement must authorize the collection and maintenance of a system of records.
(1) If this system has a Privacy Act SORN, the authorities in this PIA and the existing Privacy Act
SORN should be the same.
(2) Cite the authority for this DoD information system or electronic collection to collect, use, maintain
and/or disseminate PII. (If multiple authorities are cited, provide all that apply.)
(a) Whenever possible, cite the specific provisions of the statute and/or EO that authorizes
the operation of the system and the collection of PII.
(b) If a specific statute or EO does not exist, determine if an indirect statutory authority can
be cited. An indirect authority may be cited if the authority requires the operation or administration of
a program, the execution of which will require the collection and maintenance of a system of records.
(c) DoD Components can use their general statutory grants of authority (“internal
housekeeping”) as the primary authority. The requirement, directive, or instruction implementing the
statute within the DoD Component should be identified.
10 U.S.C. 113 note; 10 U.S.C. 136, Under Secretary of Defense for Personnel and Readiness; DoD
Directive 6495.01, Sexual Assault Prevention and Response (SAPR) Program; DoD Instruction 6495.02,
Sexual Assault Prevention and Response (SAPR) Program Procedures; 10 U.S.C. 3013, Secretary of
the Army; Army Regulation 600-20, Sexual Assault Prevention and Response (SAPR) Program; 10 U.S.
C. 5013, Secretary of the Navy; Secretary of the Navy Instruction 1752.4A, Sexual Assault Prevention
and Response; Marine Corps Order 1752.5A, Sexual Assault Prevention and Response (SAPR)
Program; 10 U.S.C. 8013, Secretary of the Air Force; Air Force Instruction 36-6001, Sexual Assault
Prevention and Response (SAPR) Program; and E.O. 9397, as amended (SSN).

DD FORM 2930 NOV 2008

Page 3 of 15

g. Summary of DoD information system or electronic collection. Answers to these questions
should be consistent with security guidelines for release of information to the public.
(1) Describe the purpose of this DoD information system or electronic collection and briefly
describe the types of personal information about individuals collected in the system.
To centralize case-level sexual assault data involving a member of the Armed Forces, including information,
if available, about the nature of the assault, the victim, the alleged perpetrator, and case outcomes in
connection with the assault. At the local level, Sexual Assault Response Coordinators and Victim Advocates
work with victims to ensure that they are aware of services available, and that they have contact with medical
treatment personnel and DoD law enforcement entities. At the DoD level, only de-identified data is used to
respond to mandated reporting requirements. The DoD Sexual Assault Prevention and Response Office has
access to identified closed case information and de-identified, aggregate open case information for study,
research, and analysis purposes.

(2) Briefly describe the privacy risks associated with the PII collected and how these risks are
addressed to safeguard privacy.
The Defense Sexual Assault Incident Database (DSAID) collects victim and alleged perpetrator personal identifiers,
incident information, and case outcomes in connection with the assault. In order to safeguard individual privacy,
records are maintained in a controlled facility. Physical entry is restricted by the use of alarms, cipher and 509 locks,
armed guards, and slow access. Access to case files in the system is role-based and requires the use of a Common
Access Card and password. Further, at the DoD-level, only de-identified data can be accessed.
DSAID will reside on the Washington Headquarters Services network. The protections on the network will include
firewalls, passwords, and web-common security architecture. In addition, the local drive will reside behind the
firewall on the safe side; the direct database cannot be accessed from the outside; and the system rests on the
Nonsecure Internet Protocol Router Network.

h. With whom will the PII be shared through data exchange, both within your DoD Component and
outside your Component (e.g., other DoD Components, Federal Agencies)? Indicate all that apply.
Within the DoD Component.
Specify.

Office of the Secretary of Defense

Other DoD Components.

Specify.

Army, Marine Corps, Navy, Air Force and the National Guard Bureau

Other Federal Agencies.

Specify.
State and Local Agencies.

Specify.
Contractor (Enter name and describe the language in the contract that safeguards PII.)

Specify.
Other (e.g., commercial providers, colleges).

DD FORM 2930 NOV 2008

Page 4 of 15

Specify.
i. Do individuals have the opportunity to object to the collection of their PII?
Yes

No

(1) If "Yes," describe method by which individuals can object to the collection of PII.
DSAID will collect information regarding Military personnel, DoD civilians, or contractors who may be victims
and/or alleged perpetrators in a sexual assault involving a member of the Armed Forces.
Sexual Assault Response Coordinators will read victims the Privacy Act Statement. Alleged perpetrator PII
data are collected by Service Military Criminal Investigative Organizations and Offices of the Judge Advocate
General systems and are loaded into DSAID after reasonable suspicion has been found that the alleged
perpetrator may have committed the crime.

(2) If "No," state the reason why individuals cannot object.

j. Do individuals have the opportunity to consent to the specific uses of their PII?
Yes

No

(1) If "Yes," describe the method by which individuals can give or withhold their consent.
Victims of sexual assault have two options when reporting information regarding an incident. Individuals may
consent to a full collection of information, which will initiate legal proceedings, or they may report in a way
that enables them to receive assistance without legal obligation. If necessary information is withheld at the
time the incident is reported, the case may not be able to proceed or be closed.
Alleged perpetrator PII data are collected by Service Military Criminal Investigative Organizations and Office
of the Judge Advocate Generals systems and are loaded into DSAID after reasonable suspicion has been
found that the alleged perpetrator may have committed the crime.

(2) If "No," state the reason why individuals cannot give or withhold their consent.

DD FORM 2930 NOV 2008

Page 5 of 15

k. What information is provided to an individual when asked to provide PII data? Indicate all that
apply.
Privacy Act Statement

Privacy Advisory

Other

None

Describe Sexual Assault Response Coordinators will read victims the Privacy Act Statement.
each
applicable
format.

NOTE:
Sections 1 and 2 above are to be posted to the Component's Web site. Posting of these
Sections indicates that the PIA has been reviewed to ensure that appropriate safeguards are in
place to protect privacy.
A Component may restrict the publication of Sections 1 and/or 2 if they contain information that
would reveal sensitive information or raise security concerns.

DD FORM 2930 NOV 2008

Page 6 of 15

SECTION 3: PIA QUESTIONNAIRE and RISK REVIEW
a. For the questions in subparagraphs 3.a.(1) through 3.a.(5), indicate what PII (a data element
alone or in combination that can uniquely identify an individual) will be collected and describe
the source, collection method, purpose, and intended use of the PII.
(1) What PII will be collected?

Indicate all individual PII or PII groupings that apply below.

Name

Other Names Used

Social Security Number (SSN)

Truncated SSN

Driver's License

Other ID Number

Citizenship

Legal Status

Gender

Race/Ethnicity

Birth Date

Place of Birth

Personal Cell Telephone
Number

Home Telephone
Number

Personal Email Address

Mailing/Home Address

Religious Preference

Security Clearance

Mother's Maiden Name

Mother's Middle Name

Spouse Information

Marital Status

Biometrics

Child Information

Financial Information

Medical Information

Disability Information

Law Enforcement
Information

Employment Information

Military Records

Emergency Contact

Education Information

Other

If "Other," specify or PII: last name, first name, middle name, case number (i.e. system generated unique
explain any PII
control number), identification type (i.e. social security number, passport, U.S.
grouping selected. Permanent Residence Card, foreign identification), identification number for type of
identification type referenced, birth date, age at the time of incident, gender, race,
ethnicity, and victim/alleged perpetrator type (i.e. military, civilian)
However, if a victim makes a restricted report of sexual assault, no personal identifying
information will be included in victim or alleged perpetrator information.

(2) What is the source for the PII collected (e.g., individual, existing DoD information
systems, other Federal information systems or databases, commercial systems)?
Victims will be asked for their information by the Sexual Assault Response Coordinators.
DSAID will receive alleged perpetrator PII information from Military Criminal Investigative Organizations and Office
of the Judge Advocate Generals systems to include the following:
The Department of the Army. Sexual Assault Data Management System.
The Department of the Navy. Consolidated Law Enforcement Operations Center.
The Department of the Navy. Department of the Navy Criminal Justice Information System.
DD FORM 2930 NOV 2008

Page 7 of 15

The Department of the Navy. Sexual Assault Victim Intervention.
The Marine Corps. Sexual Assault Information Reporting Database.
The Department of the Air Force. Investigative Information Management System.
The Department of the Air Force. Automated Military Justice Analysis and Management System.

(3) How will the information be collected? Indicate all that apply.

Paper Form

Face-to-Face Contact

Telephone Interview

Fax

Email

Web Site

Information Sharing - System to System
Other

(4) Why are you collecting the PII selected (e.g., verification, identification, authentication,
data matching)?
Identification.

(5) What is the intended use of the PII collected (e.g., mission-related use,
administrative use)?
Mission-related use.
Collected PII is used in DSAID to execute the mandated system through reporting, data entry/case
management, interfacing, and business management. When implemented, DSAID will enhance the
transparency of sexual assault-related data, while adhering to the privacy and restricted reporting options for
sexual assault victims; provide accurate and timely reporting of sexual assault incidents; use data as an
enabler to enhance analysis and trend identification capabilities; and allow for evaluation of Sexual Assault
Prevention and Response Office and Service Sexual Assault Prevention and Response program
effectiveness.
b. Does this DoD information system or electronic collection create or derive new PII about
individuals through data aggregation? (See Appendix for data aggregation definition.)
Yes

No

If "Yes," explain what risks are introduced by this data aggregation and how this risk is mitigated.
Data will not be broken out into personal descriptors. It remains in numerical form.
DD FORM 2930 NOV 2008

Page 8 of 15

c. Who has or will have access to PII in this DoD information system or electronic
collection? Indicate all that apply.
Users

Developers

System Administrators

Contractors

Other

During the testing phase, developers will utilize information to ensure that the system performs the
appropriate functionalities.

d. How will the PII be secured?
(1) Physical controls. Indicate all that apply.
Security Guards

Cipher Locks

Identification Badges

Combination Locks

Key Cards

Closed Circuit TV (CCTV)

Safes

Other

Records are maintained in a controlled facility. Physical entry is restricted by the use of alarms, cipher
and 509 locks, armed guards, and slow access. Access to case files in the system is role-based and
requires the use of a Common Access Card and password. Further, at the DoD-level, only deidentified data can be accessed.

(2) Technical Controls. Indicate all that apply.
User Identification

Biometrics

Password

Firewall

Intrusion Detection System
(IDS)

Virtual Private Network (VPN)

Encryption

DoD Public Key Infrastructure
Certificates

External Certificate Authority
(CA) Certificate

Common Access Card (CAC)

Other

System access to case files is limited to the victim’s Sexual Assault Response Coordinator and Sexual
Assault Prevention and Response program mangers. DSAID will sit on the Washington Headquarters
DD FORM 2930 NOV 2008

Page 9 of 15

Service's network. The protections on the network will include firewalls, passwords, and web-common
security architecture. In addition, the local drive will reside behind the firewall on the safe side, the
direct database cannot be accessed from the outside, and the system rests on the Nonsecure Internet
Protocol Router Network.
(3) Administrative Controls. Indicate all that apply.
Periodic Security Audits
Regular Monitoring of Users' Security Practices
Methods to Ensure Only Authorized Personnel Access to PII
Encryption of Backups Containing Sensitive Data
Backups Secured Off-site
Other

Access roles and permission lists for the Sexual Assault Prevention and Response Office and
Sexual Assault Response Coordinators are granted by Service Sexual Assault Prevention and
Response program mangers through the assignment of appropriate user roles. During the
testing phase, developers will utilize information to ensure that the system performs the
appropriate functionalities.
e. Does this DoD information system require certification and accreditation under the DoD
Information Assurance Certification and Accreditation Process (DIACAP)?
Yes. Indicate the certification and accreditation status:
Authorization to Operate (ATO)

Date Granted:

Interim Authorization to Operate (IATO)

Date Granted:

Denial of Authorization to Operate
(DATO)

Date Granted:

Interim Authorization to Test (IATT)

Date Granted:

Pending Accreditation

No, this DoD information system does not require certification and accreditation.

f. How do information handling practices at each stage of the "information life cycle" (i.e.,
collection, use, retention, processing, disclosure and destruction) affect individuals' privacy?

DD FORM 2930 NOV 2008

Page 10 of 15

Collection: PII information is collected by Sexual Assault Response Coordinators and Victim Advocates. The
collection of records will be used to document elements of the sexual assault response and reporting process
and comply with the procedures in place to effectively manage the sexual assault prevention and response
program.
Use, Retention, and Processing: These are For Official Use Only records and are maintained in controlled
facilities that employ physical restrictions and safeguards such as security guards, identification badges, key
cards, and locks. Records are cut off two years after inactivity and destroyed sixty years after cut off.
Disclosure: No other personnel other than those with role-based access can have access to member’s PII
information unless permission is granted from the individual in writing to release the information.

g. For existing DoD information systems or electronic collections, what measures have been put in
place to address identified privacy risks?
.

h. For new DoD information systems or electronic collections, what measures are planned for
implementation to address identified privacy risks?
.Access Controls: Role-based access and Common Access Card enabled functionality limit access to the
application and/or specific functional areas of the application.
Confidentiality: PII data in transit to or held in DSAID is not made available or disclosed to unauthorized
individuals, entities, or processes through encryption and firewall protection. Data cannot be stored on local
hard drives or thumbs drives and will be immobile.
Integrity: Data in DSAID is protected through the above access controls to ensure that it has not been altered or
destroyed in an unauthorized manner.
Audits: Audits will review and examine records, activities, and system parameters to assess the adequacy of
maintaining, managing, and controlling events that may degrade the security posture of DSAID's following
capabilities: reporting, data entry/case management, interfacing, and business management.
Training: Security training is provided to educate users to DSAID's security requirements. The system will
display reminders to ensure users remain aware of their responsibilities to protect PII.
Physical Security: In order to safeguard individual privacy, records are maintained in a controlled facility.
Physical entry is restricted by the use of alarms, cipher and 509 locks, armed guards, and slow access. Access
to case files in the system is role-based and requires the use of a Common Access Card and password.
Further, at the DoD-level, only de-identified data can be accessed.

DD FORM 2930 NOV 2008

Page 11 of 15

SECTION 4: REVIEW AND APPROVAL SIGNATURES
Prior to the submission of the PIA for review and approval, the PIA must be coordinated by
the Program Manager or designee through the Information Assurance Manager and Privacy
Representative at the local level.

Program Manager or
Designee Signature

GALBREATH.NATHAN.
W.1160550127

Digitally signed by GALBREATH.NATHAN.W.1160550127
DN: c=US, o=U.S. Government, ou=DoD, ou=PKI, ou=USAF,
cn=GALBREATH.NATHAN.W.1160550127
Date: 2009.08.04 14:54:51 -04'00'

Name:

LtCol Nate Galbreath

Title:

Deputy Director of Program Policy

Organization:

Sexual Assault Prevention and Response Office

Work Telephone Number: (703) 696-7168
DSN:
Email Address:

nate.galbreath@wso.whs.mil

Date of Review:
Other Official Signature
(to be used at Component
discretion)

WHITLEY.KAYE.
H.1062168770

Digitally signed by WHITLEY.KAYE.H.1062168770
DN: cn=WHITLEY.KAYE.H.1062168770, c=US, o=U.S.
Government, ou=DoD, PKI, DODHRA
Reason: I have reviewed this document
Date: 2009.08.04 14:57:34 -04'00'

Name:

Dr. Kaye Whitley

Title:

Director

Organization:

Sexual Assault Prevention and Response Office

Work Telephone Number: (703) 696-9423
DSN:
Email Address:

kaye.whitley@wso.whs.mil

Date of Review:

DD FORM 2930 NOV 2008

Page 12 of 15

Other Official Signature
(to be used at Component
discretion)

MCNAMEE.CATHERINE.
COAKLEY.1382763625

Digitally signed by MCNAMEE.CATHERINE.COAKLEY.1382763625
DN: cn=MCNAMEE.CATHERINE.COAKLEY.1382763625, c=US, o=U.S.
Government, ou=DoD, PKI, DODHRA
Reason: I have reviewed this document
Date: 2009.09.03 12:52:30 -04'00'

Name:

Catherine McNamee

Title:

Senior Research and Data Analyst

Organization:

Sexual Assault Prevention and Response Office

Work Telephone Number: (703) 696-8977
DSN:
Email Address:

catherine.mcnamee@wso.whs.mil

Date of Review:

3 September 2009

Component Senior
Information Assurance
Officer Signature or
Designee
Name:

Sally DeSanto

Title:

Deputy CIO

Organization:

P&R IM

Work Telephone Number: (703) 696-8186
DSN:
Email Address:

sally.desanto@osd.pentagon.mil

Date of Review:
Component Privacy Officer ALLARD.CINDY.
Signature
L.1231656614
Name:

Cindy Allard

Title:

Chief

Organization:

OSD/JS Privacy Office

Digitally signed by ALLARD.CINDY.L.1231656614
DN: c=US, o=U.S. Government, ou=DoD, ou=PKI,
ou=WHS, cn=ALLARD.CINDY.L.1231656614
Date: 2009.09.11 10:57:54 -04'00'

Work Telephone Number: (703) 588-6830
DSN:

425-6830

Email Address:

cindy.allard@whs.mil

Date of Review:

9/11/2009

DD FORM 2930 NOV 2008

Page 13 of 15

Component CIO Signature
(Reviewing Official)
Name:

Ms. Norma St. Claire

Title:

CIO

Organization:

P&R IM

Work Telephone Number: (703) 696-8710
DSN:
Email Address:

Norma.StClaire@osd.pentagon.mil

Date of Review:

Publishing:
Only Sections 1 and 2 of this PIA will be published. Each DoD Component will maintain a central
repository of PIAs on the Component's public Web site. DoD Components will submit an electronic
copy of each approved PIA to the DoD CIO at: pia@osd.mil.
If the PIA document contains information that would reveal sensitive information or raise security
concerns, the DoD Component may restrict the publication of the assessment to include Sections 1
and 2.

DD FORM 2930 NOV 2008

Page 14 of 15

APPENDIX
Data Aggregation. Any process in which information is gathered and expressed in a summary form for
purposes such as statistical analysis. A common aggregation purpose is to compile information about
particular groups based on specific variables such as age, profession, or income.
DoD Information System. A set of information resources organized for the collection, storage, processing,
maintenance, use, sharing, dissemination, disposition, display, or transmission of information. Includes
automated information system (AIS) applications, enclaves, outsourced information technology (IT)-based
processes and platform IT interconnections.
Electronic Collection. Any collection of information enabled by IT.
Federal Personnel. Officers and employees of the Government of the United States, members of the
uniformed services (including members of the Reserve Components), and individuals entitled to receive
immediate or deferred retirement benefits under any retirement program of the United States (including
survivor benefits). For the purposes of PIAs, DoD dependents are considered members of the general public.

Personally Identifiable Information (PII). Information about an individual that identifies, links, relates or is
unique to, or describes him or her (e.g., a social security number; age; marital status; race; salary; home
telephone number; other demographic, biometric, personnel, medical, and financial information). Also,
information that can be used to distinguish or trace an individual's identity, such as his or her name; social
security number; date and place of birth; mother's maiden name; and biometric records, including any other
personal information that is linked or linkable to a specified individual.

Privacy Act Statements. When an individual is requested to furnish personal information about himself or
herself for inclusion in a system of records, providing a Privacy Act statement is required to enable the
individual to make an informed decision whether to provide the information requested.

Privacy Advisory. A notification informing an individual as to why information is being solicited and how such
information will be used. If PII is solicited by a DoD Web site (e.g., collected as part of an email feedback/
comments feature on a Web site) and the information is not maintained in a Privacy Act system of records, the
solicitation of such information triggers the requirement for a privacy advisory (PA).

System of Records Notice (SORN). Public notice of the existence and character of a group of records under
the control of any agency from which information is retrieved by the name of the individual or by some
identifying number, symbol, or other identifying particular assigned to the individual. The Privacy Act of 1974
requires this notice to be published in the Federal Register upon establishment or substantive revision of the
system, and establishes what information about the system must be included.

DD FORM 2930 NOV 2008

Page 15 of 15