v. l SETTLEMENT AGREEMENT · The terms of this Settlement Agreement and any attachments thereto are the exclusive and full agreement of the Parties with respect to all claims for

UNITED STATES DISTRICT COURT WESTERN DISTRICT OF NEW YORK

VIETNAM VETERANS OF AMERICA, et al.,

Plaintiffs,

v.

DEPARTMENT OF DEFENSE, et al.,

Defendants.

Case No. l 7-cv-730-LJV

SETTLEMENT AGREEMENT

WHEREAS the parties desire to resolve amicably all claims raised in this suit without

admission of liability;

WHEREAS the Servicemembers Civil Relief Act ("SCRA") is a federal law designed to

ease financial burdens on servicemembers during periods of military service. See 50 U.S.C. §§

3901-4043;

WHEREAS the SCRA provides protections for military members as they enter active

duty. See id.;

WHEREAS the SCRA covers issues such as rental agreements, security deposits, prepaid

rent, evictions, installment contracts, credit card interest rates, mortgage interest rates, mortgage

foreclosures, civil judicial proceedings, automobile leases, life insurance, health insurance and

income tax payments. See id. ;

WHEREAS Defendants operate a website for the purpose of allowing persons or entities

engaged in financial and legal transactions with servicemembers to verify a servicemembers'

eligibility for the benefits provided by the SCRA;

Case 1:17-cv-00730-LJV-LGF Document 44-1 Filed 10/03/19 Page 1 of 11

WHEREAS Plaintiffs brought suit under the Privacy Act and related laws to ensure that

Defendants prevent disclosure of personal information through the website to individuals or

entities for purposes of marketing, datamining, commercial profit, frauds, scams or any other

purposes other than verifying servicemembers' eligibility for the benefits provided by the SCRA.

WHEREAS Defendants have agreed to make significant changes to the SCRA website to

enhance security of the site and better protect the personal information of servicemembers while

restricting access, pursuant to the website's Terms of Use, to those individuals and entities who

are using the website for its intended purpose, so as to ensure the website achieves its intended

purpose.

NOW THEREFORE, the Vietnam Veterans of America, Vietnam Veterans of America

New York State Council, Vietnam Veterans of America Chapter 77 and Thomas Barden

(collectively "Plaintiffs"} and the Department of Defense, Mark Esper, in his official capacity as

Secretary of Defense, Dana W. White, in her official capacity as the Assistant to the Secretary of

Defense for Public Affairs, James N. Stewart, in his official capacity as Assistant Secretary of

Defense for Manpower and Reserve Affairs Performing the Duties of Under Secretary of

Defense for Personnel and Readiness, William H. Booth, in his official capacity as Director of

the Defense Human Resources Activity, Michael V. Sorrento, in his official capacity as Director

of the Defense Manpower Data Center, and the United States (collectively "Defendants"), in

consideration of the mutual agreements set forth below, agree as follows:

A. DEFINITIONS

a. "Multiple record searches" or "batch searches" refers to searches conducted

using the "Multiple Record Request" capability of the SCRA website, in


which a user uploads a text file of records for the system to match against the

SCRA database.

b. "Servicemembers Civil Relief Act" ("SCRA") refers to the law designed to

ease financial burdens on servicemembers during periods of military service,

and is codified at 50 U.S.C. §§ 3901-4043.

c. "SCRA website" refers to the website, currently located at

https://scra.dmdc.osd.mi llscra/#/home, which allows users to determine Title

10 active duty status of an individual for provisions under the SCRA.

d. "Single record searches" refers to searches conducted using the "Single

Record Request" capability of the SCRA website, in which a user types in the

identifying information of a single individual for the system to match against

the SCRA database.

B. TERMS OF USE:

Defendants agree to implement a Terms of Use using language to which the parties have

agreed to (as reflected in Appendix A to this agreement). The Terms of Use will define the

authorized use of the SCRA website, will warn of potential account termination in the event of

misuse, mention potential criminal penalties that may be enforced by other en~ities, and be

featured on the search page itself. Users will have to affirmatively accept the Terms of Use in

order to submit searches to the SCRA website. The parties agree that all requirements in this

paragraph will be implemented within 3 months of settlement.

C. ACCOUNT CREATION PROCESS:

Defendants agree that all users will be required to register for an account on the SCRA

website in order to run searches on the SCRA website. This will include both single-record


searches and multiple-record, or ''batch'' searches. Defendants agree that they will collect the

name, mailing address, and company name (if applicable) of every user as part of the account

creation process. The parties agree that all requirements in this paragraph will be implemented

on or before October 31, 2019.

D. LANGUAGE ABOUT SOCIAL SECURITY NUMBER:

Defendants agree to make changes to the SCRA Website interface to make clear that a

social security number is not required in order to access SCRA information. The intent of this

change is to discourage collection of social security numbers from third party users of the SCRA

website for the sole purpose of SCRA verification. The agreed-upon changes to the website are

reflected in Appendix B to this agreement. The parties agree that Defendants will make these

changes within 3 months of settlement.

E. PUBLIC NOTIFICATION OF CHANGES:

Defendants agree to post a reasonable notification on the SCRA website highlighting why

changes are being made to the SCRA website. This notification will state that the changes are

intended to prohibit misuse, including for non-SCRA commercial purposes. The agreed-upon

language is reflected in Appendix C to this agreement. The parties agree that Defendants will

post this notification within 3 months of settlement.

F. BACK-END ANALYTICS:

Defendants agree to implement analytics to monitor the use of the SCRA website in order

to identify, among other things, patterns of misuse that would indicate a user is attempting to

misuse the database. These analytics will include automatically flagging accounts that are

searching for name/social security matches by running the same name against multiple social

security numbers (or vice versa). The parties agree that the procedure described in in this


paragraph will be implemented on or before October 31, 2019, although, due to technical

limitations, the analytics will not report results until December 31, 2019.

G. ACCOUNT DEACTIVATION PROCEDURE:

Defendants agree to adopt a procedure that may be utilized when Defendants suspect

misuse of the SCRA website by a third party. The procedure will include procedures for

investigating potential misuse and for deactivation of accounts. Defendants will allow Plaintiffs

to comment on the draft procedure before it is finalized. When the procedure is finalized,

Defendants agree to provide a copy of the written procedure and information on the internal

protocol that is used for enforcement. The parties agree that Defendants will provide Plaintiffs a

copy of the draft procedure on or before September 1, 2019. Plaintiffs will provide comments, if

any, on or before September 21, 2019. The parties agree that all other requirements in this

paragraph will be implemented on or before October 31, 2019.

H. SYSTEM OF RECORDS NOTICE:

Defendants will publish a new System of Records Notice ("SORN") in the Federal

Register that specifies the circumstances in which information may be disclosed through the

SCRA Website. Defendants agree to provide Plaintiffs updates on the progress of publishing the

SORN through the Federal Register every sixty days until the publication of the new SORN,

with the first update being on the date the settlement becomes effective.

I. REPORTING

Subject to applicable laws and regulations, including the Privacy Act, Defendants will

provide quarterly reports to the Plaintiffs that will provide the following: ( 1) list of the company

names of active users; (2) information on volume of searches per active user; (3) the number of

suspected and terminated accounts; ( 4) the company names of suspended and terminated


accounts, so long as those company names would not identify individuals; and (5) description of

the "back-end analytics" that have been implemented and the results thereof. The first report

will be provided within 3 months of the date that the settlement is executed, and the final report

will be provided two years after Defendants notify Plaintiffs that the final element of the

settlement agreement has been implemented.

J. ATTORNEY FEES

Defendants will pay Plaintiffs the amount of seven thousand seven hundred and fifty

three dollars ($7, 753) via electronic funds transfer. This payment shall constitute full and final

satisfaction of any and all of Plaintiffs claims in the above-captioned action, including for

attorney's fees, costs, and litigation expenses, and is inclusive of any interest. Plaintiffs will

provide Defendants, no later than the execution of this Settlement Agreement, with all necessary

information required to make the electronic funds transfer.

K. MODIFICATION

The parties recognize that Defendants are required to comply with applicable statutes and

regulations. The parties recognize that nothing in this Settlement Agreement shall prohibit

Defendants from making changes to the SCRA Website or policies regarding the Website

consistent with this agreement, including technical fixes, security updates, etc.

L. DISCHARGE OF CLAIMS AND DISMISSAL WITH PREJUDICE

i. Upon execution of this Settlement Agreement, Plaintiffs hereby release and

forever discharge Defendants and their successors, the United States of America,

and any department, agency, or establishment of the United States, and any

officers, employees, agents, successors, or assigns of such department, agency, or


establishment, from any and all past, present, or future claims for attorney's fees,

costs, or litigation expenses in connection with the above-captioned litigation.

11. Upon the execution of this Settlement Agreement, Plaintiffs hereby release and

forever discharge Defendants, and their successors, the United States of America,

and any department, agency, or establishment of the United States, and any

officers, employees, agents, successors, or assigns of such department, agency, or

establishment, from any and all claims and causes of action that Plaintiffs assert

or could have asserted in this litigation, or which hereinafter could be asserted by

reason of, or with respect to, or in connection with, or which arise out of, the

FOIA l 7-F-1139 request on which this action is partially based or the causes of

action alleged in the Complaint. Nothing in this settlement limits Plaintiffs'

ability to bring suit against Defendants and their successors for future violations

of the Privacy Act or other laws on the basis of facts unrelated to the SCRA

Website or on the basis of facts that arise after the date on which the final element

of the settlement agreement is implemented.

111. Concurrent with the execution of this Settlement Agreement, Plaintiffs' counsel

shall seek the dismissal of this case with prejudice pursuant to Fed. R. Civ. P.

41 (a) by filing the Stipulation of Dismissal with Prejudice attached hereto.

M. COUNTERPARTS AND EFFECTIVE DATE

The terms of this Settlement Agreement and any attachments thereto are the exclusive

and full agreement of the Parties with respect to all claims for declaratory and injunctive relief

and attorney's fees and costs as set forth in this Settlement Agreement and in the Complaint. No

representations or inducements or promises to compromise in this action or enter into this


Settlement Agreement have been made, other than those recited or referenced in this Settlement

Agreement.

This Settlement Agreement may be executed in counterparts, and is effective on the date

by which both parties have executed this Agreement. Facsimiles and pdf versions of signatures

will constitute acceptable, binding signatures for purposes of this Agreement.

N. FULL AUTHORITY TO SIGN AND CONSULT A TI ON WITH COUNSEL

Each person signing this Settlement Agreement represents and warrants that he or she has

full authority to execute the Settlement Agreement on behalf of himself or herself, or on behalf

of the party or entity on whose behalf he or she signs this Settlement Agreement. Plaintiffs

acknowledge that they have discussed this Settlement Agreement with their counsel, who has

explained these documents to them, and that they understand all of the terms and conditions of

this Settlement Agreement. Plaintiffs further acknowledge that they have read this Settlement

Agreement, understand the contents thereof, and execute this Settlement Agreement of their own

free act and deed. The undersigned represent that they are fully authorized to enter into this

agreement.

0. RULES OF CONSTRUCTION

This Settlement Agreement shall be considered a jointly drafted agreement and shall not

be construed against any party as the drafter.

This Settlement Agreement shall be construed in a manner to ensure its consistency with

federal law. Nothing contained in this Settlement Agreement shall impose upon Defendants any

duty, obligation, or requirement, the performance of which would be inconsistent with federal

statutes, rules, or regulations in effect at the time of such performance.


The headings in this Settlement Agreement are for the convenience of the Parties only

and shall not limit, expand, modify, or aid in the interpretation or construction of this Settlement

Agreement.

SOSTIPULATEDANDAGREEDTHIS I"' dayof oc;o.~c(. 2019

Jonathan Manes, Supervising Attorney Civil Liberties and Transparency Clinic University at Buffalo School of Law 507 O'Brian Hall, North Campus Buffalo, NY 14260-1100 (716) 645-2167 (716) 645-6199 (Fax) [email protected]

Counsel for Plaint(ffs

JOSEPH H. HUNT Assistant Attorney General

ELIZABETH J. SHAPIRO

JOSEPH E. BORSON ANDREW E. CARMICHAEL Trial Attorneys United States Department of Justice Civil Division, Federal Programs Branch 1100 L Street, NW Washington, D.C. 20005 (202) 514-1944 (202) 616-8470 (Fax) [email protected]

Counselfor Defendants


APPENDIX A

Terms of Use Agreement:

Permissible Uses: Access to this website is restricted to financial institutions, collection agencies, and others with financial and legal transactions with eligible service members for the sole purpose of ensuring that those service members receive Servicemembers Civil Relief Act (SCRA) protections in accordance with 50 U .S.C. Chapter 50. All other use is strictly prohibited.

VIOLATIONS OF THESE TERMS OF USE MAY RESULT IN IMMEDIATE TERMINATION OF ACCESS TO THE SERVICES OF THIS WEBSITE WITHOUT PRIOR NOTICE.

UNAUTHORIZED ACCESS MAY SUBJECT YOU TO CRIMINAL PENALTIES INCLUDING POTENTIAL FINES AND IMPRISONMENT IF YOU MAKE A FALSE REPRESENTATION TO GAIN ACCESS TO THE SERVICES OFFERED ON THIS WEBSITE OR OBTAIN INFORMATION UNDER FALSE PRETENSES. 18 U.S.C. § 1001

By clicking the box marked "I accept," you indicate that you have read and agree to the Terms of Use and that you certify, under penalty of perjury, that you are only using this website for the permissible uses identified in this Agreement.

o I Accept.

APPENDIX B

Social Security Number Disclaimer

*SSN is NOT required. Unless you are a financial institution or otherwise required to collect SSNs, you should not require individuals to provide you with their SSN for the sole purpose of conducting a query on this website. Searches can be conducted using Name and Date of Birth alone. Providing additional details such as First Name, Middle Name, or SSN, if already known, will increase the accuracy of the match.

APPENDIXC

Website:

"[On DATE], OMDC made significant changes to the SCRA website to enhance security of the site and better protect the personal information of servicemembers.

Pursuant to the Terms of Use for the SCRA website, access to this website and to the personal information accessible through the website, is restricted only to those with financial and legal transactions with servicemembers detailed in the Servicemembers Civil Relief Act (SCRA) and


only for the purpose of verifying eligibility for SCRA benefits. All other uses, including datamining, marketing or other non-SCRA commercial uses are strictly prohibited.

In order to effectuate these rules, users of the site will not be permitted to access personal information unless they certify, under penalty of perjury, that they are seeking access to information for a permitted reason, as provided in the Terms of Use.

In addition, beginning in June 2019, all users of the site will be required to create user accounts. A user account will be required to access both the Single Record Request and the Multiple Record Request capabilities of the SCRA website. No search for active service on the SCRA website will be possible without a user account.

In addition to the username, password, company name, and challenge questions currently required to create a user account, beginning in June 2019, new SCRA website users will be required to supply the user's first name, last name, address, and e-mail address in order to create their user account.

Starting in early August 2019 existing SCRA website users will be required to update their accounts with the additional fields (user's first name, last name, address, and e-mail address).

DMDC appreciates the cooperation of SCRA website users as we implement improved security of the information of servicemembers."


Documents

v. l SETTLEMENT AGREEMENT · The terms of this Settlement Agreement and any attachments thereto are the exclusive and full agreement of the Parties with respect to all claims for