Form 10035 (12/07) 10035 (12/07) Memorandum of Agreement - PREDICT (PCC) Coordinating Cen

DHS PREDICT Memorandum of Agreement between PREDICT Coordinating

Center and Researcher/User Form

Cover Sheet

1. Department Name: Department of Homeland Security

2. Component/Agency Name: Science and Technology Directorate

3. OMB Control Number: 1640-0012

4. Expiration Date: 08/31/2010

5. Agency Form Number: DHS Form 10035 (12/07)

6. Name of Form: Memorandum of Agreement (MoA) between PREDICT

Coordinating Center (PCC) and Researcher/User

7. Purpose of Form: The MoA is required for all applications to be a data host.

The MoA defines the roles of the Researcher/User and the PCC

8. How to submit: Sign and fax to the PREDICT Coordinating Center, RTI

International, Attn: Renee Karlsen, 866.835.0255 (toll free).

Cover Letter

Memorandum of Agreement

Thank you for your interest in using PREDICT datasets. In order for your application for PREDICT datasets to be considered, you must complete and sign the attached Memorandum of Agreement (MOA) and submit it to the PREDICT Coordinating Center (PCC).

Instructions:

1. Print the MOA.

2. Fill in requested information and complete Attachment A, as noted.

3. Complete the Contact Information form below

4. Sign the MOA and fax it to 866.835.0255 (toll free). An executed copy will be returned to you for your files.
   
   

Questions regarding this MOA or your request for PREDICT datasets may be directed to the PCC via email: [email protected].

Contact Information For Person Signing Document

Name
Title
Organization
Address
City		State		Zip
Email
Phone
Fax

Memorandum of Agreement

PCC and Researcher/User

This Memorandum of Agreement (“MOA” or “Agreement”) is between _____________________, a _____________ corporation or entity having offices at __________________________________________________________________ or an individual, _____________________, with address of ___________________________________ (“Researcher/User” for either corporation/entity or individual) and Research Triangle Institute (“RTI”), a North Carolina corporation having offices at 3040 Cornwallis Road, Research Triangle Park, NC 27709, collectively referred to as “the Parties.”

RTI serves under contract to the United States Department of Homeland Security (“DHS”) as the operator of the PREDICT Coordinating Center (“PCC”). References throughout this document to “PCC” shall be deemed to refer to RTI. References to the MOA Identification number (“MOA ID”) assigned at the top left of each page of this document shall refer to this Agreement.

Recitals

The PCC supports the Protected Repository for the Defense of Infrastructure against Cyber Threats (PREDICT) project sponsored by the United States Department of Homeland Security (DHS).

The following eight types of organizations participate in PREDICT:

Department of Homeland Security (DHS)	Data Providers	Researchers/Users	Application Review Board (ARB)
PCC	Data Hosts	Sponsoring Institutions	Publication Review Board (PRB)

This Agreement consists of: the General Terms and Conditions and Attachment A and any subsequent Amendment(s) to Researcher/User Agreement, if executed.

The provisions of Attachment A shall be construed so as to be fully consistent with all of the provisions of the General Terms and Conditions of this Agreement and, in the case of any conflict, the General Terms and Conditions shall prevail unless an Attachment is separately executed by both Parties and expressly amends particular provisions of the General Terms and Conditions, in which case the amendments of such Attachment shall prevail over such particular provisions of the General Terms and Conditions.

General Terms and Conditions

Researcher/User and PCC agree to the following:

Data shall mean the datasets described in Attachment A that are owned or controlled by a Data Provider, which are being requested by the Researcher/User.

Metadata is descriptive information about the Data (but not the Data itself) that is inserted in the PREDICT data catalog and serves as a description of the Data.

DHS shall mean the U.S. Department of Homeland Security.

PCC shall mean the Predict Coordinating Center that manages the PREDICT data catalog and operations, processes applications for PREDICT data, and handles requests for approval of publication and other administrative matters. PCC does not store, maintain, or have access to any of the Data.

Data Provider shall mean an entity that provides Data to the PREDICT project that it owns or has a right to control and disclose to the PREDICT project, subject to the terms and conditions in an MOA between it and PCC.

Data Host shall mean an entity that provides computing infrastructure to store Data received from one or more Data Providers, and provides approved Researchers/Users access to Data.

Researcher/User shall mean an approved person or entity that is requesting Data from PREDICT for use in research and who is responsible for the receipt, security, oversight, use, and return of Data.

Data Custodian shall mean the person designated by an entity Researcher/User who has primary responsibility for the receipt, security, oversight, use, and return of Data on behalf of a Researcher/User that is an entity, not an individual.

Sponsoring Institution is an organization that is affiliated with or otherwise sponsors Researchers/Users and validates their research and need for PREDICT data.

Application Review Board (“ARB”) shall mean an entity that reviews and approves or rejects applications for (a) accounts to access the catalog of Metadata and (b) MOAs serving as applications for requested Data.

Publication Review Board (“PRB”) shall mean an entity that reviews and comments upon applications from Researchers/Users to publish or otherwise release any study results or other information relating to research using Data received through PREDICT.

Researcher/User must sign Attachment A as a condition precedent to obtaining any Data under PREDICT.

Researcher/User Agreements, Rights, and Obligations

In consideration of the release to Researcher/User of the Data described in Attachment A, the Researcher/User agrees to the following terms and conditions:

1. Researcher/User certifies that all information provided by Researcher/User in this Agreement is accurate and complete.

2. Researcher/User agrees that all information contained in this Agreement may be shared as necessary to facilitate PCC operations and comply with PCC operational policies and procedures, including the sharing of information in this Agreement with the ARB, PRB, Data Hosts, Data Providers, and, if necessary, DHS.

3. Researcher/User agrees to use the Data solely for the research purpose described in Attachment A and in all respects in accordance with this Agreement (including the terms and terms and conditions specified in Attachment A).

4. Upon receipt of the Data, Data Provider hereby grants to Researcher/User, a license to Researcher/User to use the Data solely for the research purpose described in the Researcher/User’s application.

5. Researcher/User agrees that he/she shall not transmit, send, export, or use the Data outside of the United States, and Researcher/User shall take steps to ensure that all persons named on Researcher/User’s application are aware of this restriction and do not transmit, send, export, or use the Data outside the United States.

6. The Researcher/User shall not allow access to or use of Data to any persons other than those identified in Attachment A of this Agreement. Researcher/User shall initiate an Amendment to this Agreement if individuals other than those identified in Attachment A are to be given access to the Data. Such Amendment must be approved and signed by both the Researcher/User and the PCC prior to any new individuals being given access to any Data.

7. Researcher/User shall establish and maintain the appropriate administrative, technical, and physical safeguards to protect the confidentiality of the Data and to prevent unauthorized use or access to the Data. At a minimum, Researcher/User shall use at least the same degree of care in safeguarding Data he/she uses for his/her own proprietary information, provided such degree of care is reasonably calculated to prevent inadvertent disclosure or unauthorized use.

8. Researcher/User, if an individual, shall notify the PCC in writing within thirty (30) days if he/she leaves the Sponsoring Institution or the research project or, in the case of a Researcher/User that is an entity, if the Data Custodian is no longer serving in this capacity.

9. (a) Researcher/User as an Individual

If Researcher/User is an individual and (i) moves to a different institution after access to Data is granted, (ii) moves to another area of the Sponsoring Institution or for any other reason is no longer affiliated with the research associated with the Data, or (iii) dies, Researcher/User’s approval to use or disclose the Data shall immediately be suspended, as shall use of Data by any other individual whether or not named in Researcher/User’s application or located at Researcher/User’s Sponsoring Institution. Researcher/User, or designate in the event of death, shall notify the PCC in writing within thirty (30) days of such event regarding the proposed disposition of all copies of the Data and follow PCC’s directions as provided. Continued use of the Data to which Researcher/User had approved access shall be contingent upon the submission and approval of a new application for use of the datasets

(b) Researcher/User as an Entity

If Researcher/User is an entity and the individual identified as the Data Custodian (i) leaves employment with Researcher/User, (ii) moves to another area of the Sponsoring Institution or for any other reason is no longer affiliated with the research associated with the Data, or (iii) dies, Researcher/User (the entity) shall provide the PCC with an interim point of contact and propose a substitute Data Custodian to the PCC within thirty (30) days of such event via an Amendment to Researcher/User Agreement. PCC shall approve or deny the proposed substitution within five business days, or such longer period as may be required to obtain adequate information and/or approvals from Researcher/User or third parties as is necessary to fully evaluate the proposed Data Custodian’s fitness for the position. During the period of review, no individuals other than those previously approved shall have access to the Data pending the PCC’s decision.

10. No findings, analysis, or information derived from the Data may be released if such findings contain any combination of data elements that might allow for identification or the deduction of a person’s or institution’s identity, unless such identification is both (a) explicitly permitted under the terms governing handling and release of Data incorporated herein and (b) not in violation of applicable U.S. or state law.

11. Researcher/User shall submit any findings, results of analysis, or manuscripts proposed for public release, publication, or any other type of disclosure (“Writings”) to persons not listed in Attachment A to the PCC for review and approval by a Publications Review Board (PRB). Researcher/User shall submit such Writings to the PCC at the same time that Researcher/User submits the Writings for conference or journal acceptance or for any other purpose. PRB review is limited to ensuring that data confidentiality is maintained, entities or individuals cannot be identified (except as permitted under Article 11 above), and the terms and conditions attached to the use of the Data have been followed. Doug—OK?

12. Researcher/User shall identify the PREDICT program as the source of Data in all Writings and DHS as the sponsor of PREDICT. Researcher/User shall abide by any decisions made by the PCC and PRB with respect to non-publication or changes necessary to ensure the conditions associated with the Data are met. Researcher/User shall not permit publication or otherwise publicly release such Writings until PRB approval has been received from the PCC. PCC may withhold approval to publish on the results of research only if it reasonably determines that the format of Data presentation is such that it does not meet the terms and conditions for the use of the Data as reflected in this MOA and Attachments or if publication of the Writings may result in identification of the Data Provider or another institution, organization, or individual or otherwise breach a duty of confidence owed to Data Provider or the subject from whom the Data was collected. Researcher/User shall provide to the PCC a link to or copy of all published Writings.

13. Researcher/User shall report immediately to PCC any use or disclosure of the Data other than as permitted by this Agreement. Researcher/User shall take all commercially reasonable steps to mitigate the effects of such improper use or disclosure, including cooperating with all reasonable requests of PCC.

14. Unless re-identification of Data is required and was disclosed and approved in the application by Researcher/User to the ARB, Researcher/User shall not attempt to or actually unlock, override, reverse engineer, or otherwise take any steps to defeat any anonymization or obfuscation methods or tools that have been applied to any Data by the Data Provider or Data Host, or otherwise to violate any of the terms of use associated with the Data.

15. Researcher/User agrees that in the event PCC determines or has a reasonable belief that Researcher/User has violated any terms of this Agreement, PCC may terminate this Agreement and require that Researcher/User destroy the Data and all derivative files pursuant to PCC instructions. PCC may also seek injunctive relief against Researcher/User to prevent any unauthorized disclosure of Data by Researcher/User. Researcher/User understands that as a result of this determination or reasonable belief that a violation of this Agreement has occurred, PCC may also refuse to release further Data to Researcher/User. In addition, PCC may report any misuse or improper disclosure of Data to Data Provider and Data Host and to appropriate authorities as permitted or required by applicable Federal or state law.

16. Access to Data ends upon expiration or termination of this Agreement and Researcher/User shall, as directed by PCC, destroy all copies of the Data per PCC’s instructions. Researcher/User or the Data Custodian shall certify such destruction or return by signing and providing to PCC a Certification of Data Destruction.

17. Researcher/User shall be responsible for harm directly caused by the gross negligence or willful misconduct of Researcher/User or its agents, arising out of or connected to the use of any of the Data or research related to this Agreement.

18. Researcher/User shall promptly notify PCC of any claim against it or a third party of which it becomes aware pertaining to Data or research related to this Agreement.

PREDICT Coordinating Center (PCC) Rights and Obligations

1. PCC shall notify Researcher/User of

1. Freedom of Information Act (“FOIA”) or other legal requests for access to data regarding this Agreement; and

2. Data destruction requirements at expiration of this Agreement.

2. PCC shall obtain from all Data Providers written agreement that (i) its Data complies with all restrictions specified by the PCC and all requirements of applicable governing or regulating bodies and/or contractual agreements, and (ii) that all Data is consistent with Data Provider’s privacy, security, or other policies and procedures applicable to the Data.

3. PCC may terminate this Agreement upon determination that information provided in this Agreement was false, inaccurate, incomplete, or otherwise designed to conceal material information and require destruction of all Data (and copies thereof) that was provided to Researcher/User.

Joint Rights and Obligations – Researcher/User and PCC, and Other Provisions

1. Either party may terminate this Agreement by providing thirty (30) days written notice. Upon any termination or the expiration of this Agreement, Researcher/User shall, upon direction from PCC, destroy all copies of Data, or portions thereof, in its possession that it has received from Data Host or created (or had others create). Researcher/User shall certify (or in the case of an entity that is a Researcher/User, the Data Custodian shall certify) to PCC such destruction or return by signing and providing a Certification of Data Destruction.

2. This Agreement shall remain in force for a period of one year commencing with the date of latest signature below, or as amended. All obligations or rights, which by their nature survive and continue after the end date of this Agreement, shall survive and continue, and this shall specifically include the obligation of Researcher/User to seek review by the PCC and PRB prior to publication as noted above. Any Amendments to this Agreement, to be effective, shall be in writing and signed by an authorized Representative of each Party.

3. This Agreement shall be construed and interpreted in accordance with the laws of the state of North Carolina.

4. Nothing contained herein shall be construed as conferring by implication, estoppel or otherwise any license or right in favor of either party or any third party in any patents or other intellectual property rights of the other.

5. Neither Party shall in any manner reference or cause to be referenced the trade names, trademarks, service marks or any other indicia of origin owned by the other Party, or indicate that its operations are any way sponsored, approved or endorsed by the other.

6. Except with the written consent of Researcher/User, PCC shall not cause to be issued or released for publication, or participate in the publication of, any articles or publicity relating to Researcher/User and the subject matter of this Agreement; provided, however, that PCC may reveal all information supplied by Researcher/User in this MOA and its applications to the ARB or PRB, so long as that information is used only for purposes of evaluating those applications.

7. Neither this Agreement nor the receipt of Data by Researcher/User shall constitute or imply any promise or intention by Researcher/User to evaluate, process or make use of the Data either now or in the future.

8. NEITHER PARTY SHALL BE LIABLE TO THE OTHER FOR INCIDENTAL, INDIRECT, CONSEQUENTIAL, SPECIAL, PUNITIVE, OR EXEMPLARY DAMAGES OF ANY KIND (INCLUDING LOST REVENUES OR PROFITS, OR LOSS OF BUSINESS) IN ANY WAY RELATED TO THIS AGREEMENT, REGARDLESS OF WHETHER IT WAS ADVISED, HAD OTHER REASON TO KNOW, OR IN FACT KNEW OF THE POSSIBILITY THEREOF.

9. Any legal action arising in connection with this Agreement must begin within two (2) years after the cause of action arises.

10. The Parties may execute two or more copies of this Agreement, each of which shall constitute an original copy of this Agreement. A scanned, imaged, facsimile or photocopy of this Agreement or amendment to this Agreement as executed by the Parties shall be deemed to be an original executed copy for all purposes.

11. If Researcher/User is an individual, this Agreement shall not be considered accepted or effective until signed below by Researcher/User and the authorized representative of PCC. If Researcher/User is an entity, this Agreement shall not be considered accepted or effective until signed below by authorized representatives of both Parties, and each Party represents and warrants that the person signing this Agreement on its behalf has full authority to bind his or her organization to this Agreement. By signing below, neither Party may assign all or a portion of its rights and obligations hereunder without the prior written approval of the other Party.

RESEARCH TRIANGLE INSTITUTE PREDICT Coordinating Center		RESEARCHER/USER
Signature		Signature
Name		Name
Title		Title
Date		Date

Attachment A

Primary Researcher or Data Custodian if entity (Name, Organization, Address, Telephone, Email):

All Other Persons With Access to Datasets (Name, Organization, Address, Telephone, Email):

Proposed Use of Data:

Dataset(s) Requested:

[One row must be completed for each data set being requested in Researcher/User’s Application]

Data Category	Dataset Name	IRB Approval Date (If Applicable)

Memorandum of Agreement

Attachment A - continued

Subject to the Following Additional Terms and Conditions for Access to and Use of Data as set by Data Provider

Subject to the Following Additional Terms and Conditions for Access to and Use of Data as set by Data Host (if any)

This Attachment A and its terms and conditions shall be a part of the Memorandum of Agreement between the PCC and Researcher/User upon both approval of Researcher/User’s application for access to the requested datasets by the Application Review Board and signature below by Researcher/User. Such Agreement and signature shall be a condition precedent to Researcher/User’s access to any Data requested in Attachment A.

RESEARCHER/USER

Signature

Name

Title

Date