May 2004
Office of the Inspector General
Appendix IV
NDIS Requirements
The NDIS Requirements are found in the Memorandum of Understanding (MOU) signed by the FBI and each NDIS participant. The MOU requires that signatories comply with general requirements already established (i.e., federal legislation, the Forensic and Offender Standards), as well as requirements specific to the national index that accompany the MOU in three appendices: NDIS Responsibilities (Appendix A); NDIS Data Acceptance Standards (Appendix B); and the NDIS Procedures Manual (Appendix C). While the Appendices include a multitude of individual requirements, we include in the following examples from among the more significant of those requirements.
Appendix A, NDIS Responsibilities, mandates that laboratories:
- Comply with FBI requirements for physically and electronically safeguarding CODIS against unauthorized use, including providing an appropriate and secure site for the NDIS system.
- Designate one agency within each state to be responsible for ensuring that conditions and standards for participation in the national index are met.
- Designate one CODIS liaison within the state agency to handle communications with the FBI.
- Ensure that appropriate personnel are provided copies of, understand, and abide by the NDIS Procedures Manual.
- Identify in writing, in prescribed form, personnel approved to access CODIS and ensure that access to CODIS is limited to approved personnel.
- Maintain records on personnel approved to access CODIS, including proficiency testing records and any other report required by the FBI, for a period of 10 years.
- Conduct background investigations of personnel designated to input data to or access the national index.
- Maintain a system of controls to ensure that DNA records are kept as long as they are substantiated by the laboratory's internal records and are allowed to be retained by federal or state law, by judicial decree or by consent, and used in local, state, and national indexes in accordance with the Act, applicable state law, and for the national index, in accordance with the Privacy Act of 1974. This is the only NDIS requirement that pertains to the convicted offender profile sample as well as the forensic profile sample.
- Report on a monthly basis confirmed national index matches to the FBI in a form prescribed by the FBI.
- Provide to the FBI a written report of deletions/modifications within 10 business days of discovering a DNA record requires deletion/modification.
Appendix B, NDIS Data Acceptance Standards, requires that:
- Laboratories using STR technology must use an FBI-approved STR kits.
- Laboratories must attempt analysis of all 13 STR chromosomal locations that constitute a complete DNA profile (see Appendix 3 for an example of a complete DNA profile that includes each of these 13 chromosomal locations) and must obtain results for a minimum of 10 of those locations for a forensic profile to be considered "complete" and be included in the national index. An STR convicted offender profile will not be included in the national index unless the laboratory tests and obtains results for all 13 chromosomal locations.
- Only forensic profiles derived from crime scene evidence matching the suspected perpetrator(s) or an unknown individual can be uploaded to the national index. Profiles clearly matching the victim or any known person other than the suspected perpetrator(s) cannot be uploaded to the national index. However, if the forensic profile is a mixture that cannot be clearly separated into a portion matching the victim or other known person and the portion matching the suspected perpetrator, such a profile would be accepted.
Appendix C, NDIS Procedures Manual, provides (among other information) procedures for confirming and documenting potential matches found in the CODIS databases, both for case-to-case matches as well as case-to-offender matches. These procedures require that:
- Potential or "candidate" matches be refuted or confirmed within 30 business days.
- In circumstances where a match is confirmed between two cases, the laboratory must notify, at a minimum, the law enforcement agencies investigating the cases.
- A report must be generated and filed for each confirmed candidate match, including, at a minimum, the prescribed forms and information delineated in the procedures.