Privacy Compliance Review for the Analytical Framework for Intelligence

The U.S. Customs and Border Protection’s (CBP) Analytical Framework for Intelligence (AFI) system provides enhanced search and analytical capabilities to identify, apprehend, and prosecute individuals who pose a potential law enforcement or security risk, and aids in the enforcement of customs, immigration, and other laws enforced by DHS at the border. AFI augments DHS’s ability to gather and develop information about persons, events, and cargo of interest by creating an index of the relevant data in existing operational systems and providing DHS AFI analysts with tools that assist in identifying non-obvious relationships.

The objective of the Privacy Compliance Review (PCR) is to assess AFI’s compliance with existing privacy compliance documentation and to make sure the privacy protections in the Privacy Impact Assessment (PIA) are followed. The DHS Privacy Office Oversight Team assessed these privacy protections and issued its first PCR on the AFI system in 2014, resulting in 16 recommendations including a note that another PCR would be conducted. CBP updated its PIA for AFI in 2016 while the second PCR was underway. 

The DHS Privacy Office finds that CBP continues to operate and manage AFI with privacy-protective objectives, and with sensitivity to privacy and data aggregation risks. Of the 16 recommendations made in the 2014 PCR, the DHS Privacy Office notes that CBP fully implemented ten and is in the process of implementing the remaining six. The DHS Privacy Office strongly encourages full implementation of the 2014 recommendations and additionally recommends that CBP implement an additional eight recommendations to continue to improve its ability to demonstrate compliance with privacy requirements.

December 2016