Virginia Law

Direct or remote access to computer systems for the purpose of accessing criminal history record information shall require that the direct or remote access device use dedicated telecommunication lines. The use of any nondedicated means of data transmission to access criminal history record information shall generally be prohibited. Exceptions may be granted for systems which obtain expressed approval of the department based on a determination that the system has adequate and verifiable policies and procedures in place to ensure that access to criminal history record information is limited to authorized system users. The Department of State Police shall further approve of any access to the Virginia Criminal Information Network (VCIN), in accordance with State Police regulations governing the network. Nothing in this regulation shall be construed to affect the authority of the Department of State Police to regulate access to VCIN.

In those systems where remote access of criminal history record information is permitted, remote access devices must be secure. Remote access devices capable of receiving or transmitting criminal history record information shall be attended during periods of operation. In cases in which the remote access device is unattended, the device shall, through security means, be made inoperable, for purposes of accessing criminal history record information.

Telecommunications facilities used in connection with the remote access device shall also be secured. The remote access device shall be identified on a hardware basis to the host computer. In addition, appropriate identification of the remote access device operator shall be required. Equipment associated with the remote access device shall be reasonably protected from possible tampering or tapping.