34 U.S.C. § 40507 — Information sharing

(a) Access to NCIC: Within 1 year of December 27, 2022, the Attorney General must give the National Institute of Justice -- or whoever it designates as grantee or contractor to run NamUs -- access to the NCIC's Missing Person and Unidentified Person files. This is so NamUs can validate cases and reconcile its data with NCIC's. (b) Electronic data sharing: Within 6 months of December 27, 2022, the Attorney General must finish assessing the NCIC and NamUs computer systems, laws, policies, and procedures, and propose a plan for automatically and securely sending missing- and unidentified-person records from NCIC to NamUs, on this schedule: (1) Child Abduction or Amber Alert cases: within 72 hours of entering NCIC. (2) Endangered or Involuntary missing person cases: within 30 days of entering NCIC. (3) All other missing person cases: after they've been active (not cancelled) in NCIC for 180 days. (4) Unidentified person cases: after they've been active (not cancelled) in NCIC for 60 days. (5) Once a case transfers to NamUs, NCIC marks it as transferred, and any later updates must reach NamUs within 24 hours. (c) Rules on confidentiality (1) In general: Within 1 year of December 27, 2022, the Attorney General -- working with the FBI Director -- must write rules, through notice and public comment, spelling out what information NamUs may access from NCIC's Missing Person and Unidentified Person files, or what may be transmitted from NCIC to NamUs. These rules must: (A) protect confidential, private, and law-enforcement-sensitive information in the NCIC files; and (B) specify when parts of that information may be kept out of the NamUs databases.