DAF Form 4394, the Department of the Air Force User Agreement Statement — Notice and Consent Provision, is the one-page form you sign to consent to government monitoring before you are allowed to log on to any Department of the Air Force information system. Every active-duty and reserve member, DAF civilian employee, and contractor who touches a DAF computer, network, or connected device has to sign it before their account is created or reactivated.
Who Has to Sign It
The form covers three categories, and you check the one that applies on the form itself: Military, Civilian, or Contractor. Anyone using a desktop, laptop, mobile device, or other hardware attached to a DoD network needs a current signed copy on file. When you move to a new base or organization, the gaining unit’s Information System Security Officer verifies you have one before granting access.
Where to Get DAF Form 4394
The current fillable PDF is posted on the Department of the Air Force e-Publishing site at e-Publishing.af.mil.1Department of the Air Force. DAF Form 4394 – Department of the Air Force User Agreement Statement – Notice and Consent Provision In practice, you usually will not go looking for it. Your unit’s Communications Squadron, Client Systems section, or Information System Security Officer hands it to you as part of in-processing paperwork when you arrive at a new duty station or start a contract.
How to Fill Out the Form
The form collects very little personal information. Four items are on you:
- Name: your full legal name.
- Status: check Military, Civilian, or Contractor.
- Signature: your signature at the bottom confirms you have read the consent provision and agree to follow the monitoring standards as a condition of access.1Department of the Air Force. DAF Form 4394 – Department of the Air Force User Agreement Statement – Notice and Consent Provision
- Date: the date you sign.
Read the consent language before you sign. Most of the page is the legal text describing what you are agreeing to, and your signature confirms you have read and understood all of it. There are no obscure fields, but the implications are significant enough that treating the form as routine paperwork is a mistake.
What You Are Consenting To
The core function of the form is a privacy waiver for government systems. By signing, you agree that:
- The government routinely intercepts and monitors communications on its systems for network defense, communications security testing, personnel misconduct investigations, law enforcement, and counterintelligence purposes.1Department of the Air Force. DAF Form 4394 – Department of the Air Force User Agreement Statement – Notice and Consent Provision
- The government may inspect and seize data stored on any system you access, at any time.
- Communications sent through or data stored on a government system are not private and may be disclosed or used for any authorized government purpose.
- Authentication controls and other security measures on the system protect government interests, not your personal privacy.
You explicitly waive your expectation of privacy in your DAF electronic communications. The language tracks the standard DoD-wide notice and consent provision that every military department is required to include in its user agreements.2DoD CIO. Policy on Use of Department of Defense Information Systems – Standard Consent Banner and User Agreement The same condensed language appears on the DoD Notice and Consent Banner you click through every time you log on, which reaffirms the consent at each session.
What Stays Private: Privileged Communications
The consent is broad, but it has one boundary. Signing does not give investigators the right to use the content of privileged communications against you — specifically, communications with your attorney, a psychotherapist, or a member of the clergy, along with related work product from those professionals or their assistants.1Department of the Air Force. DAF Form 4394 – Department of the Air Force User Agreement Statement – Notice and Consent Provision Routine monitoring may still capture those communications, but they cannot be used in a personnel misconduct, law enforcement, or counterintelligence investigation against you.
Whether a particular message qualifies as privileged is determined by established legal standards and DoD policy. You are not required to label every privileged message for the privilege to hold, but taking reasonable steps to identify privileged material makes enforcement easier if a dispute comes up later.
What Else You Need Before You Get Network Access
A signed DAF Form 4394 by itself does not turn on your account. Air Force policy requires you to complete the DoD Cyber Awareness Challenge training before being granted access to any information system.3Department of the Air Force. DAFMAN 17-1304 – Department of the Air Force Information Technology Your unit will also process a DD Form 2875 (System Authorization Access Request) to formally authorize the account. For most people, all three items — the signed 4394, the completed training, and the DD 2875 — go through together during in-processing.
The training has to be renewed periodically. If you miss the renewal, your access to both unclassified and classified systems is immediately suspended and stays suspended until you finish the retraining. Your Information System Security Officer or Client Systems technician tracks compliance and flags overdue accounts.
Your Ongoing Responsibilities as a User
Signing the agreement also commits you to a set of behavioral rules spelled out in DoDI 8500.01. Violating them can cost you your access and, depending on severity, lead to administrative or criminal action.4Department of Defense. DoDI 8500.01 – Cybersecurity
- Use government information systems only for authorized purposes.
- Report data spills, suspicious activity, potential insider threats, and compromised passwords to your Information System Security Officer without delay.
- Protect your Common Access Card, passwords, and other authenticators, and report any suspected compromise.
- Do not install software, firmware, or hardware that has not been approved by the authorizing official.
- Do not bypass, strain, or test cybersecurity mechanisms on your own. If a bypass is legitimately necessary, coordinate with the security officer and get written approval first.
- Lock your screen when you step away, secure removable media, and control physical access to your work area.
Consequences of Misuse
Unauthorized access to a government computer system is a federal crime under 18 U.S.C. § 1030. For a first offense involving a government system used in national defense or the administration of justice, penalties can reach up to five years of imprisonment. Repeat offenses or offenses causing serious damage carry sentences of up to ten or twenty years.5Office of the Law Revision Counsel. 18 U.S. Code 1030 – Fraud and Related Activity in Connection With Computers
Military members also face action under the Uniform Code of Military Justice, ranging from a letter of reprimand or nonjudicial punishment up to court-martial depending on the conduct. Contractors risk termination and debarment from future government work in addition to any criminal exposure. Even smaller violations — installing an unauthorized app, plugging in a personal USB drive, sharing credentials — can trigger an investigation and immediate suspension of your access while the security team sorts out what happened. The monitoring you consented to on the form means whatever you did on the system is almost certainly already recorded.