DHS/USCIS/PIA-018(a)

Privacy Impact Assessment Update
for the

Alien Change of Address Card
(AR-11)
DHS/USCIS/PIA-018(a)
August 23, 2017
Contact Point
Donald K. Hawkins
Privacy Officer
U.S. Citizenship and Immigration Services
(202) 272-8000
Reviewing Official
Philip S. Kaplan
Chief Privacy Officer
Department of Homeland Security
(202) 343-1717

Privacy Impact Assessment Update
DHS/USCIS/PIA-018(a) AR-11
Page 1

Abstract
U.S. Citizenship and Immigration Services (USCIS) is updating this Privacy Impact
Assessment (PIA) for the Alien Change of Address Card (AR-11).1 USCIS is required to track
address changes submitted in paper and electronic form. The purpose of this update is to discuss
the additional USCIS Electronic Information System (USCIS ELIS) change of address method,
the new AR-11 Data Input System (AR-11/DIS), the new system interconnection with Enterprise
Citizenship and Immigrant Services Centralized Operational Repository (eCISCOR), and to
clarify existing external sharing practices.

Overview
As set forth in Section 256 of the Immigration and Nationality Act (INA),2 individuals who
have a pending or recently approved application, petition, or request form are required to keep
U.S. Citizenship and Immigration Services (USCIS) informed of their current mailing address.
Such change of address reporting is compulsory to allow USCIS to deliver notifications to
individuals who have filed an application, petition, or request under the INA. In addition, USCIS
may need to contact applicants, petitioners, and requestors to provide other documents or return
original copies of evidence submitted by the applicants, petitioners, and requestors. USCIS uses
the Alien Change of Address Card (AR-11) Mainframe, a computerized system, to support the
information management needs of USCIS in carrying out its mission.
USCIS offers three methods for applicants, petitioners, and requestors to report a change
of address, to include:
1.
Mail: Applicants, petitioners, and requestors complete Form AR-11, Alien’s
Change of Address Card, by paper and mail it to USCIS.3 Upon receipt, the information from the
change of address card is manually transcribed into the AR-11 Data Input System (AR-11/DIS),
which is a temporary data repository. The AR-11/DIS application consolidates the manuallyentered change of address information and securely transmits a daily file to AR-11 Mainframe.
2.
Online and Telephone: Applicants, petitioners, and requestors are able to
electronically complete and submit Form AR-11 through the online Customer Relationship
Interface System (CRIS) Change of Address (CoA) module.4 Applicants, petitioners, and
requestors who call into the National Customer Service Center may also report a change of
address.5 USCIS customer service representatives use the online CoA module to document the
1

See DHS/USCIS/PIA-018 Alien Change of Address Card (AR-11), available at www.dhs.gov/privacy.
8 U.S.C. § 1305.
3
https://www.uscis.gov/ar-11.
4
See DHS/USCIS/PIA-019 Customer Relationship Interface System (CRIS), available at www.dhs.gov/privacy.
5
See DHS/USCIS/PIA-054 National Customer Service Center, available at www.dhs.gov/privacy.
2

Privacy Impact Assessment Update
DHS/USCIS/PIA-018(a) AR-11
Page 2

telephonically-reported address change. CRIS CoA securely sends information directly to AR-11
Mainframe via Secure File Transfer Protocol (SFTP).6
USCIS Electronic Information System (USCIS ELIS): Applicants, petitioners, and
requestors who currently have a USCIS ELIS online account may submit their address changes in
USCIS ELIS.7 The change of address information is automatically updated in USCIS ELIS. This
process will not, however, automatically update AR-11 Mainframe and does not satisfy the legal
change of address requirements for a customer. Applicants, petitioners, and requestors are still
required to either submit a paper8 or electronic9 Form AR-11 to USCIS in order to legally update
their address.
Change of Address IT Systems
USCIS uses three independent systems to collect change of address information from
individuals, each of which corresponds to one of the three methods applicants, petitioners, and
requestors can utilize to report the change. These systems include: (1) AR-11/DIS, which is a
temporary repository for paper submissions; (2) CRIS CoA for telephone or electronic
submissions; and (3) USCIS ELIS for applicants, petitioners, and requestors with USCIS ELIS
online accounts.
The AR-11 Mainframe is primarily used to maintain and track address changes submitted
to USCIS, and contains the addresses of those non-U.S. citizens who are currently in the United
States and who have submitted an electronic or paper Form AR-11. The AR-11 Mainframe
maintains a two-way interface with AR-11/DIS and CRIS CoA. Address changes made in USCIS
ELIS only impact the filing submissions processed through USCIS ELIS, and so do not satisfy the
INA requirement to keep addresses up to date.
Through a system interconnection, change of address records are replicated from the AR11 Mainframe and stored in USCIS Enterprise Citizenship and Immigrant Services Centralized
Operational Repository (eCISCOR).10 eCISCOR replicates and stores data from several USCIS
systems. eCISCOR serves as an intermediary database for current read-only application systems
that require access to immigration and naturalization data. eCISCOR supports workflow
management, performance measurement, and information sharing requests from external users.
The AR-11 Mainframe has a one-way connection with eCISCOR, meaning change of address
information is only received and maintained by eCISCOR.

6

CRIS is a web based system accessible through the USCIS.gov website that provides customers with pending
immigration benefits application, case status information, and estimated processing times.
7
See DHS/USCIS/PIA-056 USCIS Electronic Immigration System (USCIS ELIS), available at
www.dhs.gov/privacy.
8
https://www.uscis.gov/ar-11
9
https://egov.uscis.gov/coa/displayCOAForm.do
10
See DHS/USCIS/PIA-023(a) eCISCOR, available at www.dhs.gov/privacy.

Privacy Impact Assessment Update
DHS/USCIS/PIA-018(a) AR-11
Page 3

Information Sharing
The AR-11 Mainframe is an online query system primarily used by DHS employees and
contractors. DHS offices in the United States and numerous foreign countries query the AR-11
Mainframe to obtain the most recent address information of an individual. USCIS grants queryonly access to users with an operational need for the information, and subsequently users may not
make changes to the information. U.S. Immigration and Customs Enforcement (ICE), U.S.
Customs and Border Protection (CBP), and other government agencies are given access to the AR11 Mainframe for investigations, enforcement, removal, and adjudicative functions. Additionally,
external partner agencies, such as local law enforcement offices, Department of Justice (DOJ), and
Department of Defense (DoD), may also receive change of address information through respective
data interfaces. External users, such as the Department of State (DOS), may access AR-11
Mainframe data through the Person Centric Query System (PCQS).11

Reason for the PIA Update
USCIS is updating the AR-11 PIA to include the following updates:
1. The new AR-11/DIS is used to electronically process alien change of address forms that
are sent to USCIS, and to transmit the results to USCIS Headquarters (HQ). The Forms
AR-11 that cannot be processed and returned to the applicant, petitioner, or requestor are
also tracked in AR-11/DIS. USCIS may additionally return AR-11 forms for illegible
handwriting, use of another language, not utilizing the proper Form AR‐11, an incomplete
name, date of birth, address, a missing signature or date, or listing multiple individuals on
a single form. Furthermore, AR-11/DIS supports the ability to record, measure, and report
on contractual performance requirements, reporting on data entry accuracy and document
processing timeframes through the audit functionality.
Information from the original paper Form AR-11 is entered into AR-11/DIS. If the
applicant submits a form that cannot be processed, USCIS will return the forms to the individual,
along with any materials submitted, but were not required, to report the change of address (e.g.,
funds, original birth certificates, pictures, or other attachments). The AR-11/DIS application
consolidates the manually-entered change of address information, which is securely transferred to
the AR-11 Mainframe.
2. New change of address method via USCIS ELIS. Applicants, petitioners, and requestors
who currently have a USCIS ELIS online account may submit their address changes in
USCIS ELIS. The change of address information is automatically updated in USCIS ELIS.
This process will not automatically update the AR-11 Mainframe (or any other system

11

See DHS/USCIS/PIA-010 Person Centric Query System (PCQS), available at www.dhs.gov/privacy.

Privacy Impact Assessment Update
DHS/USCIS/PIA-018(a) AR-11
Page 4

outside of ELIS) and does not satisfy the change of address legal requirements for an
applicant, petitioner, and requestor.
3.
New system interconnection with eCISCOR. AR-11 Mainframe sends eCISCOR
change of address information on a nightly basis.
4.
Clarifying external sharing partners. Change of address information is shared with
external sharing partners such as DOJ, DOS, and DoD.
USCIS will be revamping the change of address program and support information
technology (IT) systems. As future change of address enhancements and components are
developed, USCIS will consolidate the Change of Address PIA and updates to provide a holistic
view on the collection, use, maintenance, and dissemination of information.

Privacy Impact Analysis
Authorities and Other Requirements
All non-U.S. citizens who are required to be registered are also required to keep the
USCIS informed of their current address. Pursuant to Section 265 of the INA, USCIS applicants,
petitioners, and requestors are required to report a change of address within 10 days of moving
by submitting an electronic or paper Form AR-11 to USCIS.12
The change of address process receives System of Records Notice (SORN) coverage by
the DHS/USCIS-007 Benefits Information System (BIS).13
AR-11 Mainframe was authorized to operate under the USCIS Mainframe Applications
(USCIS Mainframe) Authority to Operate (ATO), on September 2, 2014. AR-11 Mainframe will
enter into the Ongoing Authorization program upon completion of this PIA. Ongoing
Authorization requires AR-11 Mainframe to be reviewed on a monthly basis and to maintain its
security posture in order to retain its ATO.
The AR-11/DIS is covered as a minor system under the Digital Innovation and
Development (DID-IT) accreditation boundary. DID-IT completed the security assessment and
authorization documentation in August 2013 and accepted AR-11/DIS into the Ongoing
Authorization program by September 2013.
NARA approved the retention schedule, N1-566-10-3 and NM-162-71, for the Form AR11, AR-11 Mainframe, and AR-11/DIS.

12
13

8 U.S.C. 1305
DHS/USCIS-007 Benefits Information System, 81 FR 72069 (Oct. 19, 2016).

Privacy Impact Assessment Update
DHS/USCIS/PIA-018(a) AR-11
Page 5

USCIS collects the change of address information directly from the applicant through a
completed Form AR-11, which is subject to the requirements of the Paperwork Reduction Act
(PRA). DHS obtained OMB approval and the Form AR-11 OMB Control Number is 1615-0007.
Characterization of the Information
There are no changes to the characterization of information outlined in DHS/USCIS/PIA018 AR-11.
Uses of the Information
As required by Section 265 of the INA, 8 U.S.C. 1305, applicants, petitioners, and
requestors are required to report a change of address so USCIS may maintain accurate contact
information. USCIS uses the updated address to issue notification of a decision on that application,
petition, or request. In addition, USCIS may need to contact applicants, petitioners, and requestors
to provide other issued documents or return original copies of evidence.
USCIS provides read-only access to information contained in the AR-11 Mainframe to ICE
and CBP for mission essential purposes. Such purposes include investigatory, deportation, and
immigration court functions. Additionally, DOJ and DoD also have read-only accounts to AR-11
for verification, identification, and investigation of individuals. AR-11 Mainframe data is also used
for statistical and recordkeeping purposes, and data may also be furnished to external federal, state,
local, and foreign law enforcement officials for law enforcement purposes on an ad hoc basis.
Notice
USCIS is providing notice about these changes through this PIA update. The Benefits
Information System SORN covers the collection, use, and maintenance of data with this update.14
Additionally, USCIS provides Privacy Notice on the Form AR-11 instructions that explains (1)
the authority to collect the information; (2) the purpose for which the information is used; (3) how
the information is going to be used outside of the agency; and (4) whether providing the
information is mandatory.
Privacy Risk: There is a privacy risk that USCIS ELIS users are unaware that the change
of address functionality does not satisfy the legal requirement for the applicant, petitioner, or
requestor set forth in section 254 of the INA.
Mitigation: This risk is partially mitigated. Individuals who currently have a USCIS ELIS
online account may submit their address changes in USCIS ELIS for correspondence purposes
only.15 USCIS ELIS notifies individuals that they are also required to file a paper or electronic
14
15

DHS/USCIS-007 Benefits Information System, 81 FR 72069 (Oct. 19, 2016).
See DHS/USCIS/PIA-056 USCIS Electronic Immigration System (USCIS ELIS), available at

Privacy Impact Assessment Update
DHS/USCIS/PIA-018(a) AR-11
Page 6

Form AR-11 to USCIS in order to legally update their address in the ELIS Frequently Asked
Questions.16 USCIS found the clearance process to update the language directly on the USCIS
ELIS customer interface to be costly and time-consuming. USCIS is currently focusing its
resources to replace the customer interface for many e-filing methods, including change of address,
with MyUSCIS.17 MyUSCIS is a separate online system that USCIS plans to deploy near the same
date as notice would have been posted to the USCIS ELIS customer interface. In the interim, this
PIA provides notice to file a separate Form AR-11 to satisfy section 254 of the INA.
Data Retention by the Project
NARA approved the retention schedule N1-566-10-3 for the electronic and paper-based
Form AR-11 and respective AR-11 systems on December 14, 2010. This retention schedule states
that paper forms should be destroyed within 180 days of the information being manually entered
into AR-11/DIS, which is a temporary repository. Change of address information is maintained
and disposed of in accordance with the approved NARA Retention Schedule. The schedule further
states that the records retained in AR-11 Mainframe are destroyed five years after the date of
receipt unless destroyed upon naturalization, departure, or the registrant’s death. Records retained
in AR-11/DIS are deleted after two years from the date of receipt.
Information Sharing
External access to the AR-11 Mainframe is governed by the Password Issuance and Control
System (PICS), which is owned by U.S. Immigration and Customs Enforcement (ICE). PICS is a
legacy mainframe system that provides a centralized system for issuing and authenticating user
names and passwords. This centralizes the burden of account administration through a single
system. PICS user accounts are used for user authentication across multiple systems throughout
DHS. ICE manages access to AR-11 and provides access to non-ICE agencies, such as local law
enforcement agencies, DOJ, and DoD. ICE plans to decommission PICS by the end of Fiscal Year
2017 and require DHS components to develop their own replacement solution. USCIS plans to use
myAccess to control and monitor system access in order to limit external access to those with a
need-to-know and as permitted by associated SORNs.
Additionally, external agencies (i.e., DOS) may access change of address information
through PCQS. PCQS does not store data. PCQS retrieves and temporarily displays information
from connected systems in a consolidated read-only format for the user. PCQS is only available to
authorized users who have been granted appropriate access privileges from connected systems.

www.dhs.gov/privacy.
16 https://my.uscis.gov/helpcenter/article/how-do-i-update-my-mailing-address
17 See DHS/USCIS/PIA-064 MyUSCIS, available at www.dhs.gov/privacy.

Privacy Impact Assessment Update
DHS/USCIS/PIA-018(a) AR-11
Page 7

Redress
Individuals may file a Freedom of Information Act (FOIA) or Privacy Act (PA) request to
gain access to their USCIS records. Only U.S. citizens or Lawful Permanent Residents may file a
Privacy Act request to amend their USCIS records. Individuals may send Privacy Act or FOIA
requests to USCIS National Records Center (NRC), P.O. Box 648010, Lee’s Summit, MO 640648010. Persons not covered by the Privacy Act are also able to amend their records. If a person finds
inaccurate information in his or her record received through FOIA, he or she may visit a local
USCIS Field Office to identify and amend inaccurate records with evidence.
Individuals may also file a new Form AR-11 to report a change of address. Incorrect
address information associated with other systems or specific applications, petitions, or benefits
must be explicitly identified by the individual with requests that those other locations of incorrect
data be corrected.
Auditing and Accountability
There is no change in the auditing and accountability as described in the DHS/USCIS/PIA019 AR-11 PIA. USCIS continues to employ technical and security controls to preserve the
confidentiality, integrity, and availability of the systems used to process change of address
requests, which are validated during the security authorization process. 18 These technical and
security controls mitigate privacy risks associated with unauthorized access and disclosure.

Responsible Official
Donald K. Hawkins
Privacy Officer
U.S. Citizenship and Immigration Services
Department of Homeland Security

Approval Signature
Original signed and on file with the DHS Privacy Office.
Philip S. Kaplan
Chief Privacy Officer
Department of Homeland Security
18

The security authorization process substantiates the implementation of security standards and guidelines for
information systems.