Desktop Services Procedure - Malta Information Technology Agency

GMICT R 0084:2009Desktop ServicesProcedureversion 3.01. Request for a new PC• CIO (or his/her delegate) places a request to the Agent as an eRFS, for a new PC orupgrade, specifying any additional options required. The eRFS, in turn, raises a task inthe Agent’s Service Management System.• Agent orders PC from the Supplier allocated to the Site.• CIO (or his/her delegate), Supplier and Agent shall agree on the delivery and installation(data migration 1 ) date/s and required Image Profile. The agreed date/s shall not be laterthan that agreed with the Agent upon signing of the Desktop Services Agreement.• CIO (or his/her delegate):o informs the End User of the delivery date of the new PCo informs the End User of his/her responsibilitiesoforwards the Desktop Services Form (GMICT F 0084:2008) to the End User to becompleted in anticipation of the data migration 12. Pre-RequisitesA number of activities take place in preparation for the delivery of new PCs to End Users.These include the creation of the appropriate images and numerous logistical preparations.3. Data PreparationThe End User shall organise all data (excluding local databases) on the local hard disk into anappropriate folder structure in the My Documents folder.The End User fills the Desktop Services Form.The Desktop Services Form is forwarded to the Agent.4. Delivery and Installation of new PC• Supplier prepares the PC with the required Image Profile and Desktop Hardware optionsrequested. Image Profiles may be acquired by the Supplier in any one of the followingways:o via an SMS Distribution Point residing at MITAo via an SMS Distribution Point located at Supplier’s premises through a connection toMITAo via a mobile (laptop-based) Distribution Point connected to MITA through aDSL/Cable connection present on siteo installation of image provided by the manufacturer of the PC• Supplier delivers the new PC to the Site.• Supplier connects the PC to the MAGNET and configures the PC and any peripheralsaccording to the Desktop Software and Configuration Standard (GMICT S 0002:2008) andProcedure (GMICT R 0002:2008).• Supplier shall ensure that the SMS, EPO and WSUS agents are all installed andfunctioning correctly.• The End User and CIO (or his/her delegate) sign a delivery note containing the followingdetails:o Organisation (Ministry)1 Applicable only in cases where the procured PC replaces an existing one.UnclassifiedPage 3 of 16

GMICT R 0084:2009Desktop ServicesProcedureversion 3.0o Site (Department/Office)o Delivery Dateo Brand and Modelo Serial Numbero Image Profileo Wall Port Numbero Inventory Numbero End User Details− Name and Surname− Telephone Number• The Supplier forwards the signed delivery note to the Agent.• Supplier updates the Asset Management Database.5. Application Installation5.1 Transfer of Information System clientsMainstream Information System client software that is in widespread use within a Site shall beincluded in the hard disk image and will come pre-installed on the PC.One-off client software shall be installed by one of the following, depending on the particularcase:• PC Supplier• MITA contractor• Original supplier of the software• CIO / IMU5.2 Transfer of local databasesLocal databases (i.e databases that reside locally on the PC) for Information Systemsdeveloped by MITA shall be transferred either by the Supplier or MITA’s own contractor,depending on the nature of the database and the complexity of the configuration required.Local databases for client and third party Information Systems shall be transferred by thesupplier of those Information Systems.6. Data Migration 26.1 InitiationThe Desktop Services Project Manager will communicate dates and timeframes for rolloutwith the respective Ministry CIO, who will in turn ensure that the End User or his/herauthorised personnel are present on site.Data Migration shall take place on site. The CIO (or his/her delegate) and End User shallsupervise the data migration and the re-allocation of the old PC in a secure area.The CIO (or his/her delegate) shall oversee the migration of any classified data.2 Applicable only in cases where the procured PC replaces an existing one.UnclassifiedPage 4 of 16

GMICT R 0084:2009Desktop ServicesProcedureversion 3.0To facilitate the eventual wiping of data from the old PC, the Supplier shall set the firstbootable device in the BIOS of the old PC to Floppy Disk or CDROM prior to carrying outData Migration, depending on the boot devices available on the old PC.In those cases where the BIOS is protected by a password, the Supplier shall open the oldPC and short-circuit the BIOS EEPROM to disable the password. If this step is not possible,the problem is to be escalated to CIO (or his/her delegate).6.2 Transfer of all filesThe Supplier shall log onto the old PC as Administrator.The Supplier shall transfer all files and folders from the old PC to the new PC and place it in ahidden folder called OLDHDD. These files shall not include system files. The OLDHDDfolder shall also only be accessible by the Administrator.The actual method of data transfer is being left to the Supplier’s discretion. This may include(in order of preference) the use of:• Cross-over cable (back to back PC connectivity)• Network connectivity (through the LAN)• Optical media: CD-R, CD-RW, DVD-R, DVD-RW• External hard disk• Flash driveFor PCs in use by VIPs and all other PCs that have been deemed by the CIO to containClassified Information, only the first two options are allowed and no external media maybe used.If the data is too large to fit on the new PC’s hard disk, files may be backed up onto opticalmedia and given to the End User.When the transfer has been completed, the Supplier shall verify that the number and size ofthe files transferred are the same both on the old and the new PCs. This will serve as a quick(albeit not comprehensive) data integrity check.6.3 Transfer of documentsThe Supplier shall then proceed to copy (not move) those files as identified by the End Userwithin the Desktop Services Form to the proper location. For example, if the My Documentshad been selected by the End User, the Supplier shall copy the files from the My Documentsin the OLDHDD folder to the actual My Documents folder on the End User’s new PC.After the files have been copied, the OLDHDD folder is left intact but in a hidden state. Thiswould not be normally accessible to the End User but can be accessed by the Supplier ifneeded.6.4 Transfer of digital certificatesThe Supplier shall transfer any digital certificates from the old PC to the new according to thefollowing export and import procedures. It is important that the End User is present duringthis procedure to enter any passwords needed.6.4.1 Export digital certificate with Internet Explorer• In Internet Explorer, select Internet Options.. under the Tools menu.• Select the Content tab and click the Certificates... button.• Select the certificate that you want to export.UnclassifiedPage 5 of 16

GMICT R 0084:2009Desktop ServicesProcedureversion 3.0• Click the Export... button.• Choose 'Yes, export the private key', Click 'Next'.• Tick 'Include all certificates in the certification path if possible', Click 'Next'.• Choose a password, key it in twice, Click 'Next'.• This password will be needed to re-import the certificate into another browser and/ormachine.• Click 'Browse...', 'Desktop', choose a File name, click 'Save'.• Click 'Finish'.• Enter password if prompted or choose 'Yes' to confirm.6.4.2 Import digital certificate with Internet Explorer• In Internet Explorer, select Internet Options.. under the Tools menu.• Select the Content tab and click the Certificates... button.• Click the Import... button.• Follow the Certificate Manager Import Wizard.o Click 'Browse...', 'Desktop', Choose 'Personal Information Exchange (*.pfx, *.p12)'o Highlight the file, Click 'Open', Click 'Next 'o You will be prompted for the password used to encrypt the private key when thecertificate was initially exported (see export digital certificate step 7 above)o Key in password, tick both boxes, Click 'Next'o Choose 'Automatically select the certificate store based on the type of certificate',Click 'Next'o Click 'Finish'• Upon completing the Import Wizard, you will be prompted for the Security level of thePrivate Key Container, it is highly recommended to Set Security Level to HIGH.o Choose Create a new password for this itemo Enter a new Password twiceo Click 'Finish'o Click ‘OK’6.5 VPN client configurationThe Supplier is to follow the instructions contained in MITA’s VPN User Guide v1.9. It isimportant that the End User is present during this procedure to enter any passwords needed.6.6 Data Erasure from other Electronic MediaElectronic media, such as floppy disks, rewritable CD-ROMS, zip disks, pen drives andmagnetic tapes, that may have been used as temporary storage to carry out Data Migrationshall be reformatted if the media type allows it, or erased if formatting is not possible. Otherelectronic media, such as DVDs and CDRs (write once), shall be rendered unusable throughphysical destruction before leaving the custodianship of the owner.6.7 Data Verification and Data Migration EndorsementThe old PC is to be kept on site, in a secure location, for a minimum of five (5) working daysand a maximum of ten (10) working days after the data has been migrated from the old PC toUnclassifiedPage 6 of 16

GMICT R 0084:2009Desktop ServicesProcedureversion 3.0the new PC. It might be necessary to refer back to the old PC if the End User discovers thatsome data has gone missing or has been corrupted during the transfer process.The End User shall verify completeness of the data transferred.If the End User is not satisfied with the data transfer:• Any discrepancies shall be brought to the attention of the Supplier.• The Supplier shall retrieve the missing data from the OLDHDD folder on the new PC.• If the data is not found in the OLDHDD folder on the new PC, the End User/Supplier shallretrieve the required data/files from the old PC.If the End user is satisfied that all data has been transferred correctly:• The End User shall sign the Desktop Services Form, thus signifying acceptance that thedata transfer was carried out to his/her satisfaction.• The data from the old PC shall be wiped in accordance with the Data Wiping procedurefound later on in this document.7. PC Sign-offThe Supplier confirms with the End User that all software, data, applications and drivers arepresent on the new PC. If all these have been done successfully, the PC is deemed to besuccessfully commissioned and the End User signs off on the Desktop Services Form.8. Site CommissioningA Site is deemed to be fully commissioned when all PCs at that Site are reported to the Agentthrough SMS, EPO and WSUS.8.1 Hidden Folder ErasedAfter the data has been migrated from all old PCs in a Site, the hidden OLDHDD folders onthe new PCs shall be erased centrally through the network by the Agent and shall betransparent to the End User.9. ReconciliationUpon commissioning all the PCs in a Site, the Supplier shall provide the Agent with an export(in a predetermined format) from the Asset Management Database of the relevant PCs for theAgent to verify against its own records gained through SMS.10. Data Wiping10.1 GeneralThree methods of data erasure are possible:1. As a general rule, PC hard disks shall be wiped (except those in school classrooms andlaboratories). The InfoSec Authority requires that, in accordance with ISO/IEC 27001,any sensitive information, i.e. any information that is not in the public domain, must besecurely erased. Therefore, the InfoSec Authority stipulates that a three-pass wipingmethod shall be used to wipe hard disks.2. PC hard disks in Schools (classrooms and laboratories, not Administration) shall not bewiped but formatted (not quick formatted).3. The End User may request the hard disk to be retained by the Ministry for reasons suchas the security classification of the data contained on the hard disk. In such a case, theEnd User shall follow the Exemptions and Waivers Procedure (GMICT R 0048:2006).UnclassifiedPage 7 of 16

GMICT R 0084:2009Desktop ServicesProcedureversion 3.0The hard disk shall be handed over to the CIO who shall provide appropriate storage ofand access to the hard disk and its content.If, during the five to ten working days following Data Migration, the End User is satisfied thatData Migration has been carried out satisfactorily, the Supplier shall perform the Data Wipingprocedure.10.2 Data Wiping of Hard DiskThe Data Wiping software shall be provided to Supplier by the InfoSec Authority on abootable floppy diskette and/or bootable CDROM.If the Supplier is unable to carry out the Data Wiping procedure due to some technical orprocedural problem, the issues encountered may be forwarded to the Service Centre.The Supplier shall carry out the following steps:1. Insert the bootable floppy diskette in the old PC’s floppy drive or insert the bootableCDROM in the old PC’s CDROM drive.2. Switch on the PC. The PC will boot either from the floppy diskette or CDROM.3. To load the Linux boot Operating System and Wipe program, in the boot: prompt:a. either press Enter for Floppy Disk boot mediumb. or type nofloppy and press Enter for CDROM boot medium4. Once the kernel is loaded, the available HDD(s) will be displayed. Select the HDD to bewiped by means of the arrow keys and pressing the Spacebar.5. Press F10 to start the wiping process with default wiping method of three passes.6. Wait until the wiping process finishes. This should take approximately 2 ½ hrs for an80Gb Hard disk.7. Repeat steps 1 through to 6 for any other HDDs present.8. When all HDDs have been wiped, remove floppy diskette or CDROM from old PC.9. Switch off the PC.10. Confirm that the data has been successfully wiped from the old PC by signing the relevantsection of the Desktop Services Form.10.3 Data Wiping AuditThe CIO (or his/her delegate) will randomly select 10% of the batch of wiped hard disks toensure that these have been properly wiped and will carry out the following steps:• The Supplier shall remove the hard disk from the PC.• The CIO (or his/her delegate) shall, through a USB IDE/SATA Adaptor, connect the harddisk externally to a laptop running software called XWays Forensics for which a licence isrequired.• Once the CIO (or his/her delegate) confirms that wiping has been carried outsuccessfully, the Supplier shall reconnect the hard disk inside the old PC.10.4 Software LicensesThe CIO must be informed whenever a software license is revoked or transferred. If a PC iseither donated, sold or decommissioned, the software license(s) should be revoked.10.5 PC and Information CustodianshipEnd Users, as data owners and PC custodians, shall ensure, before the PC leaves theircustodianship, that no unauthorised person can access this data by ordinary means.UnclassifiedPage 8 of 16

GMICT R 0084:2009Desktop ServicesProcedureversion 3.011. Collection of old PCThe Supplier collects the old PC.Details of the old PC and its location are to be included in the Desktop Services Form.The CIO (or his/her delegate) updates the relevant inventory to record the removal of the oldPC.The Supplier shall determine which old PCs are to be refurbished or disposed of by referringto the categorisation provided by MITA.The Supplier shall inform the Agent of the number of PCs collected from the Site, indicatingwhich quantity is fit for redeployment. The Agent shall, in turn, inform MITA.12. Refurbishment and DeliveryIf the PC is to be redeployed:• Supplier installs the operating system on the old PC. Agent may, at its discretion, test asample of the refurbished PCs.• The ISS shall provide the Supplier with a list of individuals or organisations eligible for arefurbished PC.• The Agent shall provide the Supplier with an additional software package for delivery withthe old PC. The Supplier shall not install the software package.• The Supplier shall deliver the old PC, together with an additional software package, to thenew destinations accordingly.• Supplier returns the Desktop Services Form to the Agent.12.1 Minimum Requirements From PC Refurbisher/sThe minimum requirements the PC refurbisher/s need to abide by are the following:12.1.1 Refurbishment of PCs• Provide adequate and secure storage for PCs that will be refurbished and store PCs thatfall under different categories separately.• Provide adequate and secure storage for the Microsoft SI 2 packages.• If the balance of PCs and Microsoft SI 2 packages does not tally (i.e. in the case of PCsor Microsoft SI 2 packages going missing) the PC refurbisher will have to replaceaccordingly at his own expense.• Ensure that the PCs are clean from any Government data and installed with theappropriate operating system.• Refurbish PCs that fall under categories 3 and 4 ensuring that the PCs are capable to runXP home prior to refurbishment according to the technical requirements provided byMITA.• Complete the refurbishment of a PC within 15 working days from its collection from aMinistry or Department.12.1.2 Distribution of PCs• Abide by a plan, developed by MITC in liaison with MITA, outlining the type and numberof PCs that will be refurbished, when and where the PCs will be available for collection.Plan will need to be discussed and agreed with MIIIT.• Provide adequate administrative human resources to inform eligible applicants on thevenue and dates of collection of refurbished PCs, verify the applicants’ eligibility beforeUnclassifiedPage 9 of 16

GMICT R 0084:2009Desktop ServicesProcedureversion 3.0collection of refurbished PC, as well as keep records of who collected and paid for thePCs and who did not.• Use adequate premises to act as a central point for collection for refurbished PCs andMicrosoft software.• Ensure that a Microsoft SI 2 package is distributed with every refurbished PC.12.1.3 Sale of refurbished PCs and MS packages and transfer of funds• Collect payment of refurbished PCs and Microsoft software package upon distribution.• Must transfer the funds related to the value of the PCs and software packagesrespectively to MITA on a quarterly basis.• Must effectively record the movement of all PCs from the collection of the PCs from theMinistries/Departments to the disposal or distribution of refurbished PCs.• Must provide a report on a monthly basis to Government accompanying the transfer offunds, detailing up to the date of the report:o the number of PCs disposed ofo the number of PCs refurbishedo the number of refurbished PCs in stocko the number of refurbished PCs sold and distributed indicating clearly to whom PCswhere sold; as well as indicating the persons who resulted as eligible but declined tomake the purchaseo the amount of funds owed to Governmento the amount of funds owed to MITA• The buyer will agree to accept any cosmetic marks, cracks or other material defects thatmay reasonably appear on the refurbished PC and will not make any claim or otherwisereturn the refurbished PC or any refurbished PC on the basis of any such cosmetic mark,crack, or material defect. The refurbished PC is being sold tale quale and carries nowarranty of any kind (express or implied) on its condition and suitability for purpose.12.1.4 Auditing• Accept to be audited with regards to the PC refurbishment project by a competent auditfirm appointed by Government as and when necessary.13. PC DisposalIf the PC is to be disposed of:• Supplier follows the Waste Consignment Notes found on the Web site of the MaltaEnvironment & Planning Authority (MEPA):(http://www.mepa.org.mt/Environment/waste/national_waste_register/waste_consignment_notes.htm)• In case of difficulty, Supplier may contact Wasteserv Malta Limited call centre on 2385 8000.• Supplier disposes of the PCs. This shall be done at the Supplier’s expense.• Supplier returns all related documents, including the Desktop Services Form, to theAgent.14. PC Damage or LossIn the event that a PC is required to be repaired or replaced due to damage and/or loss incases such as accident, fire, theft, etc, the following procedure is to be followed:UnclassifiedPage 10 of 16

GMICT R 0084:2009Desktop ServicesProcedureversion 3.0• Where a claim may give rise to a criminal offence, a representative from theDepartment/Entity is to file an official Police report.• The Department/Entity is to report such occurrence to the Agent through a formal letterwithin three (3) working days.• The Agent shall acknowledge this report and inform the Supplier formally in writing,annexing the original Department/Entity’s letter, within two (2) working days.• The Department/Entity shall be subject to the payment of a charge as a result of therepair or replacement of the PC.15. PC MovementMovement of PCs across Sites is only possible in the cases outlined in the Desktop HardwarePolicy and Directive (GMICT P 0001:2009).15.1 Approval Process• Employee raises the request for movement of PC to CIO.• CIO forwards the request to the Agent as an eRFS, which raises an incident in theAgent’s Service Management System.• Agent shall assess the request against Directives regarding Movement of PCs in theDesktop Hardware Policy and Directive (GMICT P 0001:2009).• If the Agent approves request, the Agent initiates the movement process with theSupplier.15.2 Movement Process• Agent raises an incident in the Service Management System for the Supplier to initiatemovement of PC.• Supplier carries out requested movement of PC, in co-ordination with CIO.• Supplier updates inventory details.• Agent updates inventory details and appropriate supporting systems as necessary.UnclassifiedPage 11 of 16

GMICT R 0084:2009Desktop ServicesProcedureversion 3.016. Roles and ResponsibilitiesAgent CIO (or his/her delegate) End User SupplierDelivery andInstallation ofnew PC• Prepares the PC with therequired Image Profile andDesktop Hardware optionsrequested.• Delivers the new PC to theSite.• Connects and configuresPC.• Updates the AssetManagement Database.Data Migration • Co-ordinates datamigration activities.• Manages Suppliers toprovide a good and costeffective service.• Prepares technicaldocuments to bedistributed to End Users.• Keeps End Users informedabout the whole process,including migration dates.• Provides requiredinformation to the Agent.• Highlights known possibleissues prior to datamigration exercise.• Identifies what data is to betransferred and copies it toa predefined location.• Abides to the relatedcommunications andprocesses.• Asks for assistance (viaCIO) only when required.• Transfers all files andfolders from the old PC tothe new PC.• Copies files from the MyDocuments folder on theold PC to the appropriatelocations on the new PC.• Transfer digital certificates.• Provides technicalassistance to CIOs on EndUser related issues.• Supervises Data Migration.• Solves End User relatedissues with assistance fromthe Agent or its Suppliers.• Raises request to theAgent for Supplierinvolvement when required.• Fills in the requiredinformation within theDesktop Services Form.• Configure VPN clientsoftware.• Fills in the requiredinformation within theDesktop Services Formsand submits them to theAgent after completion.UnclassifiedPage 12 of 16

GMICT R 0084:2009Desktop ServicesProcedureversion 3.0Agent CIO (or his/her delegate) End User SupplierCommissioning • Installs any requiredsoftware applications (thatwere not in the hard diskimage) on specific PCs.• May be required to installInformation System clientsand/or transfer localdatabases.Reconciliation • Verifies informationobtained from Supplieragainst its own records.• Provides Agent with anexport of the relevant PCsfrom the AssetManagement Database.Data Wiping • Provides the Data WipingSoftware• Supervises the securestorage and movement ofthe old PC if this is to beredeployed or disposed of.• Ensures that no PCcontaining data is left in aninsecure place (e.g.corridors, open rooms).• Performs audit of 10% ofall wiped PCs.• Ensures, during the 5 daytime window following datamigration, that all data hasbeen transferred to the newPC without any problems.• Raises request forExemption from the DataWiping procedure in thosecases where the hard diskneeds to be retained.• Performs a 3-pass DataWiping procedure on theold PC.• Permanently erases datafrom any media used astemporary storage.• Assists CIO (or his/herdelegate) during audit ofwiped PCs.Collection ofold PC• Signs for the Supplier’scollection of the old PC.• Updates theMinistry/Department’s PCinventory.• Collects old PC.• Determines PCs to berefurbished or disposed of.UnclassifiedPage 13 of 16

GMICT R 0084:2009Desktop ServicesProcedureversion 3.0Agent CIO (or his/her delegate) End User SupplierPCRefurbishment• Supplies the additionalsoftware package to theSupplier.• May, at its own discretion,test refurbished PCs.• Reinstalls OperatingSystem.• Collects additional softwarepackage from the Agent.• Delivers PC and softwarepackage to new owner.• Collects payment andforwards to MITA and/orGovernment.PC Disposal • Receives Collection Notesfrom Supplier.• Manages the disposal ofPCs according to theSupplier’s contractual andlegal obligations, followingthe procedures for thedisposal of electronic wasteas prescribed by MEPAand operated by WasteservMalta Limited.• Returns Collection Notes tothe Agent.PC Movement • Asses request formovement.• Updates inventory detailsand appropriate supportingsystems as necessary.• Raises eRFS with EndUser’s request formovement of PC.• Raises request with CIO formovement of PC.• Carries out any movementof PCs as approved andinstructed by the Agent.• Updates AssetManagement Database.UnclassifiedPage 14 of 16

GMICT R 0084:2009Desktop ServicesProcedureversion 3.0Exemptions and WaiversIn instances where it may not be possible or cost-effective to comply with a particular GMICTPolicy requirement, a request for a deviation or exemption from the said requirement shall beraised and forwarded to the Assessor for consideration and assessment according to theprovisions of the Exemptions and Waivers Policy and Directive (GMICT P 0048:2006).Related DocumentsName Reference LocationDesktop Hardware Policy andDirectiveGMICT P 0001:2009http://ictpolicies.gov.mtDesktop Hardware Standard GMICT S 0001:2009 http://ictpolicies.gov.mtDesktop Software andConfiguration Policy and DirectiveDesktop Software andConfiguration ProcedureDesktop Software andConfiguration StandardGMICT P 0002:2009GMICT R 0002:2009GMICT S 0002:2009http://ictpolicies.gov.mthttp://ictpolicies.gov.mthttp://ictpolicies.gov.mtDesktop Services Form GMICT F 0084:2009 http://ictpolicies.gov.mtMEPA Waste Consignment Noteshttp://www.mepa.org.mt/Environment/waste/national_waste_register/waste_consignment_notes.htmCompliance Policy and Directive GMICT P 0018:2006 http://ictpolicies.gov.mtExemptions and Waivers Policy andDirectiveGMICT P 0048:2006http://ictpolicies.gov.mtExemptions and Waivers Procedure GMICT R 0048:2006 http://ictpolicies.gov.mtExemptions and Waivers Form GMICT F 0048:2006 http://ictpolicies.gov.mtReferencesReferenceProfessional Secrecy ActOfficial Secrets ActData Protection ActLocationhttp://docs.justice.gov.mt/lom/legislation/english/leg/vol_10/chapt377.pdfhttp://docs.justice.gov.mt/lom/legislation/english/leg/vol_3/chapt50.pdfhttp://docs.justice.gov.mt/lom/legislation/english/leg/vol_13/chapt440.pdfPublic Service Management Codehttp://www.mpo.gov.mt/downloads/psmcrevised.pdfUnclassifiedPage 15 of 16

GMICT R 0084:2009Desktop ServicesProcedureversion 3.0ReferenceManual of Procedures for theHandling of Classified Information inthe Malta Public ServiceLocationAvailable from the Director Cabinet Office orNational Security Accreditation AuthorityModification HistoryVersion Effective Date Changes1.0 Initial Release.2.0 6 February 2009 Updated version.3.0 12 March 2009 Amended version.UnclassifiedPage 16 of 16