Policy for Establishment and Operation of a DNA Identification Index

Section 6192.1 Definitions.

(a) The term allele refers to one of the alternate forms of the DNA at a particular genetic locus.

(b) The phrase casework evidence DNA profile refers to a DNA profile that is derived from biological evidence originating from and associated with the commission of a crime.

(c) The term CODIS refers to the Federal Combined DNA Index System.

(d) The term commission refers to the Commission on Forensic Science established pursuant to Executive Law Section 995-a.

(e) The term commissioner refers to the Commissioner of the New York State Division of Criminal Justice Services, or his or her designee.

(f) The phrase convicted offender DNA profile refers to that DNA profile generated by testing of a biological sample collected from a designated offender as defined in Executive Law section 995(7).

(g) The phrase convicted offender index refers to the electronic database containing DNA profiles generated from designated offenders as defined in Executive Law section 995(7) and stored in CODIS.

(h) The term division refers to the NYS Division of Criminal Justice Services.

(i) The term DNA means deoxyribonucleic acid.

(j) The phrase DNA databank refers to the computerized State DNA Identification Index authorized pursuant to Executive Law Section 995-c, and known as the State DNA Index System (SDIS).

(k) The phrase DNA profile refers to a set of DNA identification characteristics which may permit the DNA of one person to be distinguished from that of another person. For STR DNA profiles it refers to the list of alleles carried by a particular individual at a specific set of genetic loci.

(l) The phrase DNA profile of a missing person refers to the results of a forensic analysis of the DNA of a person reported missing or whose whereabouts are unknown.

(m) The term DNA subcommittee refers to the subcommittee on forensic DNA laboratories and forensic DNA testing established pursuant to Executive Law, Section 995-b(13).

(n) The term FBI refers to the Federal Bureau of Investigation.

(o) The phrase forensic DNA laboratory shall have the same meaning as set forth in Executive Law Section 995(2).

(p) The term forensic DNA testing shall have the same meaning as set forth in Executive Law Section 995(2), shall mean any test that employs techniques to examine DNA derived from the human body for the purpose of providing information to resolve issues of identification.

(q) The phrase forensic DNA index refers to the electronic database in CODIS containing DNA profiles generated from casework evidence by forensic DNA laboratories.

(r) The phrase forensic DNA profile refers to a DNA profile that is derived from biological evidence originating from and associated with the commission of a crime.

(s) The phrase indirect association refers to the determination during the CODIS candidate match confirmation process that a forensic index DNA profile is similar to a DNA profile in the convicted offender index or subject index and a comparison reveals that the offender or subject may be a relative of the source of the forensic index profile.

(t) The term LDIS refers to that level of the CODIS program in which a public DNA laboratory maintains its DNA records for searching and uploading to higher level indices such as SDIS and NDIS.

(u) The term loci refers to specific chromosomal locations of genes or other DNA elements such as STRs.

(v) The term mitochondrial DNA testing or mtDNA testing refers to analysis of genetic polymorphisms that occur in the DNA of mitochondria.

(w) The term NDIS refers to the National DNA Index System.

(x) The phrase NDIS DNA Data Acceptance Standards refers to the document specifying the requirements for DNA data to be accepted for searching and storage in CODIS. It is authored by the FBI, Laboratory Division, 2501 Investigation Parkway, Quantico, Va. 22135, on January 11, 2000 and revised May 4, 2005. This document may be reviewed at the Division of Criminal Justice Services, Four Tower Place, Albany, NY 12203, and the Department of State, One Commerce Plaza, 99 Washington Avenue, Albany, NY 12231.

(y) The term STR refers to Short Tandem Repeat; STR analysis is a form of testing which provides DNA profiles for loci which contain simple DNA unit repeats. STR loci on the Y-chromosome are referred to as Y-STRs.

(z) The phrase subject DNA profile refers to that DNA profile generated by analysis of a biological sample collected from a subject convicted of a crime whose specimen was collected: pursuant to a plea agreement; as a condition for participation in a temporary release, Comprehensive Alcohol and Substance Abuse Treatment (CASAT) or shock incarceration program; as a condition of release on parole, post-release supervision, presumptive release, or conditional release on a definite or indeterminate sentence; or as a condition of probation or interim probation supervision.

(aa) The phrase subject index refers to the electronic database containing DNA profiles generated from subjects convicted of a crime whose DNA specimen was collected: pursuant to a plea agreement; as a condition for participation in a temporary release, CASAT, or shock incarceration program; as a condition of release on parole, post-release supervision, presumptive release, or conditional release on a definite or indeterminate sentence; or as a condition of probation or interim probation supervision.

(bb) The phrase unidentified human remains index refers to the electronic database in CODIS containing DNA profiles generated from human remains of unknown origin.

6192.2 Statement of purpose.

Executive Law, Section 995-b(9) states that "After reviewing recommendations from the Division of Criminal Justice Services, the commission, in consultation with the DNA subcommittee, shall promulgate a policy for the establishment and operation of a DNA identification index consistent with the operational requirements and capabilities of the Division of Criminal Justice Services." This policy ensures that procedures related to all legal and programmatic obligations of Executive Law, Section 995-b have been set forth in order to properly govern the establishment and operation of the DNA Databank. This policy was adopted by the Commission based on the recommendations of the Division and in consultation with the DNA Subcommittee.

6192.3 Forensic DNA methodology.

(a) The DNA databank shall be comprised of data generated from DNA testing methods approved in the NDIS DNA Data Acceptance Standards. Loci required for the upload of authorized DNA profiles to the national system shall be in accordance with the NDIS DNA Data Acceptance Standards.

(b) Casework evidence DNA profiles to be maintained in the DNA databank shall be comprised of information for at least six of the STR loci or other combinations of loci using alternative technologies approved for use in the NDIS DNA Data Acceptance Standards. This requirement for a minimum number of loci applies only to those casework evidence DNA profiles which an authorized laboratory desires to have maintained in the forensic index of the DNA databank.

(c) For purposes of searches of the DNA databank, a minimum of four loci shall be provided by a laboratory requesting a forensic DNA profile search against the DNA databank. Generally, all available loci associated with a forensic DNA profile shall be searched in the DNA databank. Notwithstanding this requirement, the laboratory may, at its discretion, request that a search be performed using fewer loci if there is an investigative need and sufficient scientific reasons which support using fewer than four loci in a particular case. The scientific reasons shall include, but not be limited to, the apparent presence of mixtures, sample degradation or limited sample availability. The basis of the scientific reason(s) must be summarized on the search request form whenever fewer than four loci are provided with a search request.

(d) DNA profiles that may be added to the DNA databank by forensic DNA laboratories include casework evidence DNA profiles, convicted offender DNA profiles, subject DNA profiles, DNA profiles of missing persons, relatives of individuals reported missing, unidentified humans or human remains.

(e) Upon notification by the NDIS Custodian that all applicable NDIS requirements have been satisfied, the division may release the name of an offender whose DNA profile has been indirectly associated through a national CODIS search with a DNA profile in another state's forensic index. Testing of additional loci of the offender sample may be required and may include Y-STR and/or mtDNA analysis.

(f) The division may release the name of an offender whose DNA profile has been indirectly associated through a State CODIS search with a forensic DNA profile when it has been determined that the information may lead to the identification of an individual related to the offender. For associations obtained from a State CODIS search, the following conditions must be met:

(1) The laboratory submitting the crime scene DNA profile to the CODIS program shall complete an application to the division requesting the name of the offender and, as part of the application, confirm that:

(i) an LDIS search has been performed using the profile in the Forensic Index;

(ii) the forensic DNA profile derives from a single source and contains at least ten of the CODIS core loci;

(iii) the submitting agency and the appropriate prosecutor have committed to pursue further investigation of the case if the name is released. Such entities also agree to provide follow-up information to the division regarding the outcome of the case, which the division will provide to the DNA Subcommittee at six month intervals; and

(iv) the submitting laboratory has confirmed that release of the name will be followed by a report to the investigating agency.

(2) The report from the submitting laboratory to the investigating agency shall indicate that:

(i) the match is indirect;

(ii) the information provided is an investigative lead;

(iii) the available data suggests that the source of the evidentiary DNA pattern is potentially a relative of the convicted offender but is not conclusive evidence of the same.

(3) The division will provide the match information to the State DNA databank which, in turn, will calculate and report whether the appropriate statistical threshold approved by the DNA Subcommittee has been met.

(4) Upon receiving a completed application from the local participating CODIS laboratory and confirmation from the databank that the appropriate statistical threshold has been met, the division will release the name of the offender to the submitting laboratory. If the appropriate statistical threshold value is not supported by the available data, then testing of additional loci of the offender sample may be required and may include Y-STR and/or mtDNA analysis. If the subsequent testing does not meet the appropriate threshold, the databank will notify the division and the offender's name will not be released.

6192.4 Accuracy and completeness of DNA records.

The accuracy and completeness of all DNA records maintained as part of the DNA databank will be assured through compliance with laboratory accreditation standards as promulgated by the commission in Part 6190 of this Title. In addition, accuracy and completeness of all DNA records maintained as part of the DNA databank will be assured through compliance by all forensic DNA laboratories with the requirements of the NDIS DNA Data Acceptance Standards. Each DNA profile (for either convicted offender or forensic samples) submitted must be certified by the submitting laboratory as being associated with the appropriate controls and blanks. Copies of all official correspondence between the DNA databank and participating laboratories will be maintained in the appropriate division file.

6192.5 Security features preventing unauthorized access.

The server on which the DNA databank resides shall be located in a secure area to prevent unauthorized physical access in accordance with CODIS requirements. All forensic DNA laboratories which use or contribute data to the DNA databank shall choose CODIS compatible software and hardware designs which prevent unauthorized access to DNA records. Each participating laboratory must have a written information systems plan which specifies the architecture of the laboratory's computer hardware and the structure of security features comprising the access control component of the computer software employed. The information systems plan must demonstrate that an electronic audit trail is maintained for activities related to the entering or editing of DNA records. In addition, the information systems plan shall conform with all applicable information security rules, regulations, and policies. The division, in consultation with forensic DNA laboratory directors, shall develop model documents to assist forensic DNA laboratories in complying with the requirements of this Part. A final information systems plan shall be submitted by the laboratory for review and approval by the division prior to the laboratory gaining access as a participant in the DNA databank. The division shall determine the acceptability of each laboratory information systems plan. The NYS standards must be designed and applied in such a way as to allow compliant participating forensic DNA laboratories to participate in the Federal CODIS program.

6192.6 Prevention of illegal disclosures.

At least once per year, audits will be conducted by the division of all forensic DNA laboratories to assure that no illegal disclosures of DNA records have taken place. This audit will verify that all necessary documents required for accessing and controlling DNA records and their associated information have been appropriately completed, and compliance with the laboratory's approved information systems plan. These documents include, but are not limited to, the use and dissemination agreements between the laboratory and user agencies or the division; search request forms and search result forms; and case disposition query forms. In addition, the audit will review the participant laboratory's standard operating procedure (SOP) related to these procedures to insure that the SOP is complete and up-to-date. The division may develop a standardized audit checklist to assist in completion of the required audits. The division may provide the audit report to the laboratory for remediation of any findings, if necessary. Within 90 days of the completion of the audit, the division shall submit a summary audit report to the chair of the DNA subcommittee, reporting the findings of the audit as well as any response from the laboratory and/or recommendations for changes. The DNA Subcommittee shall review the audit report, and forward binding recommendations to the commission for action. Once DNA subcommittee and commission action on the audits are completed, the audit report shall be maintained by the division for three years from the date of the commission's final action related to the audit report, after which the audit report may be disposed. A record of disposition shall be maintained in the permanent files of the division for each forensic DNA laboratory.

6192.7 Restriction of access to information systems.

Access to record information system facilities, systems operating environments and data file contents (whether while in use or when stored in a media library) shall be restricted to authorized personnel only. These restrictions shall be assured through compliance by the laboratory with the accreditation standards promulgated by the commission in Part 6190 of this Title.

6192.8 Inquiry, update or destruction of records.

Inquiries, updates, or destruction of DNA records in the DNA databank shall only be made by authorized sources of inquiry, update, or destruction. Inquiries related to DNA records in the DNA databank may be accepted only from a participating, accredited forensic DNA laboratory; a subject of the DNA databank (see Part 6193 of this Title); an agency authorized to make such inquiry pursuant to a properly executed use and dissemination agreement (see Part 6193 of this Title); other authorized CODIS laboratories outside of New York State; or the FBI (see section 6192.10 of this Part). Update or destruction of records shall only be made by an authorized agent of the division or its designee. Any update to, or destruction of, a DNA record in the DNA databank shall be recorded in a log following an electronic or hardcopy form prescribed by the division.

6192.9 Unauthorized attempts to penetrate the databank.

As noted in Executive Law § 995-b(9) (vi), "Operational programs shall be used to detect and store for the output of the Division or its designee all unauthorized attempts to penetrate the DNA Databank." The Division shall certify to the DNA Subcommittee and Commission that the DNA databank hardware and software architecture has been appropriately designed, implemented and safeguarded to eliminate the realistic chance that such unauthorized attempts to penetrate the DNA Databank could go undetected. This certification shall be made based on conformance of the DNA databank with all applicable information security rules, regulations, and policies. The Division shall maintain this certification in a file with the written Information System Plans from participant laboratories (see § 6192.5 of this Part). A current certification must be on file at the Division at all times.

6192.10 Mutual exchange, use and storage of DNA records.

Mutual exchange, use and storage of DNA records within the DNA Databank with the system of DNA identification by the FBI shall be allowed, provided that:

(a) the Commission determines that such exchange, use and storage are consistent with the provisions of Article 49-B of the Executive Law and applicable provisions of NYS law;

(b) applicable requirements enumerated within sections 6192.3 through 6192.9 of this Part have been met; and

(c) a memorandum of understanding has been executed between the appropriate New York State agencies and the FBI.