Policy Text
University of California, San Francisco
Police Department General Orders
1 8.2 Communications: Operations
8.2.21 Criminal Justice Infor mation Media Protection (Issued : 12/14/17 )
A. Purpose
The purpose of this policy is to provide guidelines for the h andling , transmission, storage and
disposal of media related to confidential and sensitive Criminal Justice Information (CJI) and
Personal Identifiable Information (PII).
All information classified as confidential, personal and/or protected information must be
properly stored, transmitted, transported and disposed of in a timely manner to protect it
from unauthorized access or disclosure, alteration or misuse. Regardless of it s form or
method of dissemination (i.e., hard copy, fax, etc.), CJI requires protecti on throughout its
life.
B. Policy
1. Media Storage and Access
a. Printed material, electronic media or containers with CJI and/or PII may only
be stored at approved locations , with a locking mechanism in place, staffed
by persons who have been fingerprinted and background checked.
b. All operators having direct access to CLETS system CJI must log off and
lock CLETS terminals when they are away from the area.
c. Storage of CJI and/or PII on desktop computers, portable computing devices
or personal telecommunication devices and hard disks is prohibited.
2. Transportation
a. Printed material, electronic media or containers with CJI may only be
handled or transported by approved persons who have been fingerprinted and
background checked.
b. Office Move/Media Transport
When it is necessary for an office to move to another loc ation, protection of
CJI and/or PII information shall be ensured . All CJI and/or PII must be
securely moved. The media must be handled in such a manner that it does
not become misplaced or available to unauthorized personnel.
The term m edia, as used here, is inclusive of paper documents and electronic
formats, such as removable tapes, disk drives, flash drives and entire
computers if hard drives are not removed.
While in relocation status, the following procedures apply:
(1) The media must remain in the custody of authorized personnel to
ensure media does not become misplaced or lost during the move.
(2) The media must be in locked cabinets or sealed packaging cartons
while in transition.
University of California, San Francisco
Police Department General Orders
2 (3) In the event the media must be hand -carried by an authorized
employee in connection with a trip or in the course of daily activities,
it must be kept with that employee and protected from unauthorized
disclosures.
(4) Backup media, such as removable tapes and optical discs, and
portable electronic devices must be encrypted prior to movement.
c. Email Transport
(1) CJI and/or PII information should not be transmitted by email . If,
however, CJI and/or PII must be transmitted by email , the email shall
be encrypted.
(2) If an email that is not encrypted and contains CJI and/or PII is
received or sent by any authorized personnel , they must report it to
the ECC Manager .
d. CLETS Equipment
Multi -function printers must be securely configured , and anti -virus software
must be installed on CLETS e quipment (transport precaution).
C. Digital Media Sanitization and Disposal – Electronic Media
Electronic media records on decommissioned servers or other storage devices are to be
securely erased using Department of Defense (DOD) -approved methods or the physical
media destroyed. Electronic media may be re -used; however, the media should be securely
erased and sanitized first where practical.
Media Disposal Methods
1. CD/DVD Media
a. Break/destroy media prior to disposal .
2. Hard Drives
a. Erase the drive using DOD approved methods.
b. Use vendor provided utility for built -in “secure erase” function .
c. Break/destroy the drive.
3. Flash Drives
a. Break/destroy the device .
D. Disposal of Physical Media – Printed Material
Printed material may be placed in locked confidential shredder bins and subsequently
destroyed by a contracted vendor. Cross -cut or confetti shredders may be used. “Strip cut”
shred ders are not to be used for CJI and/or PII confidential data.
E. Notification – Mishandling of Confidential CJI and/or PII
Any mishandling of confidential CJI and/or PII while stored, transmitted or disposed of that
results in suspected or actual unauthorized access, disclosure and/or modification must be
reported to the ECC Manager.
University of California, San Francisco
Police Department General Orders
3 F. Definitions
1. Crimi nal Justice Information (CJI) : CJI is the term used to describe all the FBI CJIS -
provided data necessary for law enforcement and civil agencies to perform their
missions , including, but not limited to, biometric, identity history, biographic,
property and incident history data.
2. Criminal History Record Information (CHRI) : CHRI, sometimes informally referred
to as “restricted data,” is a subset of CJI. Due to its comparatively sensitive nature,
additional controls are required for the access, use and dissemination of CHRI.
3. Personal Identifiable Information (PII ): PII is information that can used to distinguish
or trace an individual’s identity, such as a name, social security number or biometric
records, alone or when combined with other personal or identifying information that