Mandatory Fingerprinting for Criminal Record Checks – FAQs

Name based checks have inherent weaknesses due to variances in spelling, common surnames, use of nicknames, name changes, both legal and those where an individual takes on a name for deceptive purposes. Fingerprint verification is the only means to effectively and accurately confirm the identity of individuals, ensuring that individuals cannot evade their criminal past, and prevent individuals from being falsely associated with a criminal record that is not theirs. To date, the RCMP has used name-based checks for criminal record verifications because the technology did not previously exist to support fingerprint checks to meet the demand. If a name-based check indicated the possibility of an existing criminal record, fingerprints were required to confirm the identity prior to the release of any information. The RCMP now has a biometric (fingerprint) system capable of supporting the demand for all criminal record checks.

This is not a higher level of screening but an improvement over the existing process. The data being checked and the information released by the CCRTIS remain unchanged. The mandatory use of fingerprints provides a higher level of surety.

Fingerprints have been used for many years to confirm identity and is an internationally accepted ‘best practice’. Fingerprints are used increasingly to confirm identity for purposes unrelated to criminality, including immigration and visas, unlocking digital devices or paying for goods at major attractions. In the case of criminal records checks, fingerprinting is the only definite way to determine whether an individual has a criminal record, thereby eliminating false associations with criminality.

Submitting fingerprints electronically is easy and convenient. Members of the public submitting a fingerprint for civil purposes would simply visit an accredited company or a police service with an electronic submission device to have their fingerprints taken. Moreover, the immediacy of electronic results will be a direct benefit to employers and applicants, especially those individuals whose application would have otherwise been unnecessarily delayed due to their names being incorrectly associated with those of convicted offenders. The results of name based searches are not as accurate as a fingerprint based searches.

The CCRTIS will implement new internal workflow processes including electronic responses and automation of internal processes, which will allow for quicker turnaround times. In other words, an individual seeking a criminal record check will provide their fingerprints electronically and in most cases, will receive an electronic record of the results shortly after submitting their request.

The full functionality of CSM will be phased in to take advantage of technology changes within the CCRTIS. Parallel initiatives being implemented by the RCMP to automate the updating of dispositions and reduce its backlog of existing records through a risk-based approach will ensure that delays are reduced significantly.

The automation of internal processes coupled with electronic responses will serve to reduce response times.

The RCMP has invested significantly in creating a modern scalable technical solution, which will meet future requirements.

With the conclusion of the Real Time Identification (RTID) Project, the RCMP now has a robust infrastructure that enables law enforcement, government and the private industry to submit biometric-based (fingerprint) transactions to CCRTIS for both civil and criminal processes.

Since 2013, most police services have made arrangements to either buy the equipment or associate themselves with other police services that have the required capability or equipment. Many private companies have followed the trend, thereby ensuring that most locations are adequately served.

Technical solutions exist which can meet the needs of remote locations within Canada, including the use of scanning technology (CardScan) which allows for fingerprints to be taken on paper in remote locations and sent to central sites to be scanned and submitted to the RCMP. This model is already in place for some agencies.

The RCMP is not able to accept electronic civil submissions from outside of Canada. Individuals outside of Canada can continue to have their fingerprints taken on paper. The paper-based fingerprints can then be submitted to an accredited private company within Canada that provides scanning capabilities and can submit fingerprints electronically to the RCMP on behalf of the international client.

The RCMP does not retain civil fingerprint submissions. Once the work in progress is completed, the submission is deleted from the RCMP system. At no time are civil fingerprints populated on a database where they could be subject to further search.

The CCRTIS will not search the criminal record database by any means other than fingerprints. The agency requesting the search is responsible for any decision related to the purpose for which the criminal record check is completed. If an agency wishes to allow an individual to partake of employment or other activity without completing a criminal record check, any consequence of this decision is at the agency’s risk.

The RCMP classifies criminal record information as Protected "A".

The Treasury Board Standard on Security Screening determines the requirement for criminal record checks for federal government employment purposes. The requirement for fingerprints will apply to any request to the RCMP for a criminal record check for federal government employment security screening purposes. The responsibility for determining whether or not an existing employee or contractor requires a criminal record check falls to the appropriate Departmental Security Officer.

There are no fees for criminal record checks for federal employment purposes. However, local service fees may be required for fingerprinting by a police service and/or an accredited fingerprinting company.

Federal government departments and agencies will be required to submit or have an implementation plan to submit fingerprints for all criminal record checks for security screening purposes as of July 1^st, 2015. The RCMP recognizes that not all departments and agencies will be in a position to submit fingerprints for all of their criminal record checks for employment purposes by July 2015; therefore, the RCMP will continue to support those agencies by providing name-based checks during the transition. Federal Agencies will be required to communicate and put in implementation plans to ensure an effective migration to meet the new requirements.

The RCMP will only accept the electronic fingerprints. Electronic submissions must meet the RCMP standards and must be created by using either an Electronic Fingerprint Capture Device (Livescan), or by Cardscan where paper-based fingerprints are scanned and converted into an electronic submission.

The following options are available to federal government departments and agencies:

• Use of existing Livescan/Cardscan device – an upgrade of the device will be required;
• Acquire Livescan/Cardscan device;
• Enter into an agreement with another federal government department or agency that owns a Livescan/Cardscan device; and,
• Contract with or refer individuals to an accredited fingerprint company.

The decision as to whether or not to keep employee fingerprints on file falls under the responsibility of each organization, keeping in mind privacy and information management policies, practices and legislation. Fingerprint retention should be addressed in consultation with the Departmental Security Officer responsible for the department or agency.

All external networks must be connected to the NPSNet through a firewall or other Security Policy Enforcement Device (SPED). Following a request for agency certification, an assessment will be required to determine the best connectivity model. The costs for connectivity would depend on the model, resources and equipment required.

Any server or device that connects to the RCMP should be located in a Security Zone, where access is controlled and continuously monitored.

Two Factor Authentication is required for any device connecting to the RCMP Network. This consists of at least two of the following three criteria:

• Something you know: e.g. User ID & Password;
• Something you have: e.g. Token (PKI)/Smartcard (CISCO AnyConnect); and,
• Something you are: e.g. Finger/palm print.

Options are available for organizations that are not on the government of Canada’s server. As part of the agency certification process, an assessment of the network architecture would determine the most viable option for connectivity.

Outages of the system form part of regular maintenance and usually occur over a short period of time. They are normally scheduled to take place on the weekend to minimize the business disruption. Contributing departments and agencies are informed ahead of time of scheduled maintenances.

The number of transactions that organizations can send is unlimited.

Bulk submissions are not possible as each submission is one individual transaction and is tracked as such throughout the process.

The cost of electronic fingerprint capture devices vary greatly between vendors and configurations, and agencies interested in acquiring a device should contact the vendors directly for quotes. A National Master Standing Offer is also available and can be accessed via the Public Works and Government Services website.

It is recommended that agencies requesting certification include approximately 4 months to their schedules once a vendor has been selected as network changes and vendor availability timeframes may vary. The following outlines the step-by-step process for certification:

1. An agency must complete a Certification Application Form that details the devices to be purchased. The RCMP reviews the application to ensure that the device specifications meet the RCMP and FBI certified vendor guidelines.
2. A network infrastructure form must also be completed and submitted to the RCMP, detailing the agency network environment (VPNs, IP address, Routers, etc.). Once received, the RCMP opens a Change Order (CO) with network services, who review and assess the details of the network environment and recommend any changes if required. Following a satisfactory review, network services make the necessary configuration changes to allow the agency to connect to the RCMP through a secure VPN tunnel and submit electronic fingerprint applications and receive responses. This process can take 4 to 6 weeks to complete once the Change Order has been submitted to network services.
3. Once the configuration changes are completed, the RCMP informs the requesting agency to contact their vendor to schedule an installation and training date. If convenient for the agency, the vendor and the RCMP, a certification landing test may also be scheduled on this date, which will ensure that fingerprints can be submitted and responses received. The fingerprints submitted during the landing test are subjected to a quality control review (approximately 2 days) and if successful, the agency is certified to use their device.

Note that depending on the agency`s configuration of devices, special authentication (CISCO AnyConnect) may be required. This is determined following evaluation of the application and network infrastructure forms.

The status quo will continue until at least early 2016. Agencies will receive an error message and be requested to submit a hard copy of the fingerprints which will be processed manually and may result in a response containing the results of a name based criminal record check. Any time the override functionality of an electronic fingerprint capture device is used, it is recommended that a contributor print a hard copy of the fingerprint submission for possible re-use in the event that a submission is rejected. This will avoid a client having to return to the contributor in order to have a second set of fingerprints taken.

Once CSM is fully implemented, should a submission contain images that are not suitable for search, an error message will be sent to the contributor, and a name-based search will automatically be conducted. This will ensure that an agency has the information that is available, however, the fact that these results are based on name and date of birth and not fingerprints should be taken into consideration when undertaking other aspects of the background check.

Some training material is currently available on the Internet, and the RCMP is gathering additional training information internally and from partner agencies. This information will be shared as it comes available.

Shared Services Canada has advised that generic email boxes will remain available after the transition to the government of Canada’s single email platform.