Overview
The Criminal History Systems Board was created in 1972 by Sections 167 through 178 of Chapter 6 of the Massachusetts General Laws. Chapter 256 of the Acts of 2010 (referred to as the Criminal Offender Record Information [CORI] Reform) renamed it as the Department of Criminal Justice Information Services (DCJIS). DCJIS was established within the state’s Executive Office of Public Safety and Security, pursuant to Section 167A of Chapter 6 of the General Laws, on November 4, 2010. This new legislation also allowed the general public to gain access, through the internet, to CORI. Since 2012, the public has been able to request CORI on DCJIS’s website through the iCORI database.
According to the Commonwealth Budget’s website,
The mission of the Department of Criminal Justice Information Services (DCJIS) is to . . . [provide] timely and accurate criminal justice information and services to authorized law enforcement and non-criminal justice agencies and individuals in support of promoting the public safety and security of the Commonwealth of Massachusetts.
DCJIS is overseen by a commissioner, who is appointed by the Secretary of the Executive Office of Public Safety and Security. DCJIS manages and administers the Commonwealth’s iCORI database, Firearms Records Bureau database, Statewide Applicant Fingerprint Identification Services, and Post-conviction Victim Notification Program. According to its website, DCJIS serves the following groups:
- Law enforcement personnel
- Victims of crimes
- Governmental entities
- Private organizations
- Employers
- Firearms dealers
- Firearms license holders
- The general public
Additionally, there is a criminal record review board within DCJIS. Section 168 of Chapter 6 of the General Laws states,
[This criminal review board consists] of the following persons: the secretary of public safety and security, who shall serve as chair, the attorney general, the secretary of labor and workforce development, the chair of the Massachusetts sentencing commission, the chief counsel for the committee for public counsel services, the chair of the parole board, the commissioner of correction, the commissioner of probation, the commissioner of youth services, the colonel of state police and the presidents of the Massachusetts District Attorneys Association, the Massachusetts Sheriffs’ Association and the Massachusetts Chiefs of Police Association, or their designees, all of whom shall serve ex officio, and 5 persons to be appointed by the governor, 1 of whom shall represent private users of criminal offender record information, 1 of whom shall be a victim of crime, 1 of whom shall have experience in the areas of workforce development or ex-offender rehabilitation or economic development and 2 of whom shall be persons who have experience in issues relating to personal privacy. Upon the expiration of the term of any appointive member, [the member’s] successor shall be appointed in a like manner for a term of 3 years.
This board reviews and investigates complaints alleging violations of CORI laws or regulations.
The DCJIS commissioner directs strategic planning for DCJIS and sets operational priorities for the 40 employees in its office at 200 Arlington Street in Chelsea. DCJIS had a budget of $6,824,479 for fiscal year 2021, and it collected $10,173,495 from CORI requests during the same period.
DCJIS is organized into the following units: Legal Services, Law Enforcement and Civil Information Services, Fiscal Services, and Human Resources. Within the Law Enforcement and Civil Information Services Unit, there are the following groups with varying responsibilities:
- The Firearms Records Bureau maintains a database of registered firearms, gun dealers, machine gun licenses, and issued firearm identification cards in Massachusetts.
- The Victim Services Unit provides assistance to victims of crimes through resources, referrals, crisis intervention, and safety planning and notifies victims in advance when the offenders who committed the crimes are going to be released from prison.
- The Statewide Applicant Fingerprint Identification Services Unit processes fingerprint-based criminal record checks for non–criminal justice agencies.
- The Project and Constituent Services (PCS) Unit provides CORI to DCJIS-approved, non–criminal justice agencies, such as schools, daycare centers, home healthcare organizations, youth athletic organizations, and municipal government agencies. Individuals can also obtain copies of their own criminal records from the PCS Unit. The PCS Unit processes an average of 85,000 requests per month. The PCS Unit does the following:
- assists with correcting inaccurate criminal records; investigates complaints of improper access to or dissemination of CORI; and provides legal assistance on matters regarding CORI law to police, prosecutors, judges, and the public
- helps ensure that DCJIS-approved, non–criminal justice agencies with access to the iCORI database understand the purposes for which they are authorized to access CORI
- assists individuals and agencies with the reading and interpretation of CORI reports; how CORI affects potential employment; the responsibilities of employers regarding access, review, storage, and dissemination of CORI; the relevance of a criminal record to the duties and qualifications of job positions; and how to interpret and use the CORI they receive in a fair and objective manner.
- The Criminal Justice Information System (CJIS) Support Services Unit offers—to law enforcement and criminal justice agencies in the state—access 24-hours a day, seven days a week to the National Crime Information Center and the International Public Safety and Justice Network, which store state and interstate criminal history record information, missing and wanted person files, driver’s license and motor vehicle information, and other critical criminal justice information.
CORI Request Process
DCJIS provides and maintains an electronic application on its website that members of the public and organizations can use to request criminal background checks on individuals. Individuals or organizations that do not have online access may request CORI through the mail. DCJIS employees enter any mailed requests into the iCORI database.
An organization needs to first submit an application, and if approved by DCJIS, they can request CORI based on the specific requestor type. An individual can submit a request for their own information, or an organization can submit a request about an individual for various reasons such as employment, volunteering, or housing. There is a $25 fee to process a request.
If a request yields results, the requestor receives details of the requested individual’s Massachusetts criminal history. If a request does not yield results, the requestor receives a notification that no criminal history was found. In requests where there are results for the same or similar names (e.g., multiple John Does and Jon Doe), the system adds the request into a candidate screener queue for a DCJIS employee to review manually to ensure that the CORI report contains information on the correct individual.
DCJIS has two full-time employees dedicated to processing mailed requests. Additionally, DCJIS has other employees in call centers who are trained to handle mailed requests during busy periods. On average, there are approximately 70 mailed requests a day. All requests for CORI, submitted by mail or electronically, must be processed and returned to the requestor within 10 days.
During the audit period, there were 1,019,597 CORI requests from 9,814 organizations and 36,481 individuals. These 9,814 organizations comprise 62 requestor categories. Some of these categories were public and private schools, businesses, Massachusetts state agencies, hospitals, children’s programs and volunteer organizations, religious organizations, Massachusetts housing authorities, and Massachusetts municipal governments.
In cases where an employee of a media organization makes a CORI request about an individual, the organization requesting the information must pay a $50 fee. The CORI contains convictions that fall within the below offense types and timeframes as listed in DCJIS’s “What You Need to Know about Massachusetts Criminal Records” document:
- misdemeanor convictions for one year following the date of disposition or date of release from incarceration or custody, whichever is later;
- felony convictions . . . for two years following the date of disposition or date of release from incarceration or custody, whichever is later;
- felony convictions . . . punishable by five or more years in state prison provided, however, that such offense shall only be available for ten years following the date of disposition or date of release from incarceration or custody, whichever is later;
- and all convictions for murder, voluntary manslaughter, involuntary manslaughter, and sex offenses (as defined in M.G.L. c. 6, § 178C) punishable by a term of incarceration in state prison, unless sealed, including information relating to those offenses for which the subject was adjudicated as an adult while younger than 18 years old; and
- any cases where the individual has been found not guilty by reason of insanity
DCJIS employees review the CORI request and perform an additional review to ensure the accuracy of the CORI before releasing the information to the requestor. During the review, these employees perform an internet search about the subject of the CORI. If this search reveals recent media coverage regarding the individual, the request is forwarded to DCJIS’s general counsel for further review before the CORI report is released to the requesting individual or organization.
iCORI Revenue Reconciliation Process
If a request is submitted by mail, a DCJIS employee separates the payment from the request. This employee records the payment information (date, money order number, amount, and type of CORI requestor) in a Microsoft Excel spreadsheet. A different DCJIS employee reviews the payment information to ensure accuracy and adds their initials to the spreadsheet. At the end of each day that mailed requests are received, DCJIS’s budget director deposits all payments into the bank. The requests are also entered into the iCORI database to capture each requestor’s personal information, the date the request was received, and the payment amount.
CORI requests submitted online start in the iCORI database. Payments are processed using a third‑party payment system, nCourt, which processes the payment and deposits the funds into DCJIS’s bank. At the end of each month, DCJIS employees transfer the payment information to the Massachusetts Management Accounting and Reporting System (MMARS). Each day, nCourt sends a reconciliation report that includes daily funds collected and the requestors’ names to DCJIS. DCJIS records the daily nCourt totals and request dates into the same Microsoft Excel spreadsheet used for CORI requests received by mail.
At the end of each month, DCJIS reconciles the nCourt reconciliation reports and the Micrsoft Excel spreadsheet to its bank statement and MMARS.
Security Protection over CORI
Any person or organization that requests CORI from DCJIS is subject to audit by DCJIS to ensure, in part, that the requestor properly stores and safeguards CORI in accordance with Section 2.21(4)(d) of Title 803 of the Code of Massachusetts Regulations, which was effective during the audit period.
DCJIS has established an audit team within the CJIS Support Services Unit that performs audits on approximately 650 agencies—including federal agencies, Massachusetts law enforcement government agencies (e.g., state police, correctional institutions, and the Department of Children and Families), and local police departments across the Commonwealth—that have access to the CJIS Single Sign on Application (CSSOA) criminal record history database. These audits include a review of data quality information, cybersecurity awareness training completion records, and access to areas where CORI and the United States Department of Justice Federal Bureau of Investigation (FBI) data are located and a determination about whether criminal information is stored properly.
DCJIS has developed a policy on physical security that each individual or organization that has received CORI from DCJIS must follow, which includes securing applications and CORI reports in locked filing cabinets or in encrypted computer files and only allowing access to authorized users.
Cybersecurity Awareness Training
DCJIS developed, and maintains and monitors, CSSOA. The database contains Massachusetts criminal and motor vehicle history and national criminal and motor vehicle history from the FBI. DCJIS has made this application and data available to approximately 650 federal and state agencies and police departments, including municipal, state, and university police departments.
The FBI has established that all CSSOA users with access to federal criminal justice information must complete cybersecurity awareness training within six months of initial access and biennially thereafter. DCJIS audits all agencies that have access to CSSOA at least once every three years. DCJIS stated in a meeting to us that part of the audit includes a review of law enforcement agencies’ cybersecurity awareness training completion certificates to ensure that all users have completed the mandatory awareness training (see Finding 2).
| Date published: | April 13, 2023 |
|---|