An EQUSA official provided the following explanation for the statistic
being under-reported for FY 2002. In August 2002, EOUSA provided the
USAOs new anti-terrorism category codes for categorizing cases entered into
LIONS. At that time, EOUSA asked all 94 USAOs to review all FY 2002 cases
entered into LIONS and to recode the cases before the close of the fiscal
year using the new anti-terrorism category codes, if appropriate. According
to the EOUSA official, not all USAOs had finished recoding their cases prior
to the close of FY 2002. Therefore, the statistic was understated. This
situation also applies to the discussions of inaccurately reported statistics on
defendants prosecuted (EOUSA Statistic 5 on page 57), and defendants
found guilty (EOUSA Statistic 6 on page 57).

For FY 2003 and FY 2004, the LIONS data agreed with the numbers
reported by EOUSA in the budget requests for those years. We selected a
judgmental sample of the defendants reported and performed additional
testing to determine the accuracy of the reported numbers. We selected
268 of the 786 defendants in cases reported as filed during FY 2003, and
338 of the 725 defendants in cases reported as filed during FY 2004. We
reviewed case file documentation and interviewed USAO officials to
determine if the cases were properly reported as anti-terrorism cases based
on EQUSA’s definition for this program activity. We found that, in the cases
we tested, the USAOs generally reported cases as anti-terrorism cases when
the underlying purpose or object of the investigation was intended to
prevent terrorism, regardless of whether the subject, target, or defendant
was reasonably linked to terrorist activity based upon the results of the
investigation. The overstatements in the following charts reflect defendants
charged with an offense not readily identifiable as terrorism-related, and for
which the USAQOs did not provide information of a terrorism link.*?

41 The number supported for these statistics are based on a sample of transactions
reported. Therefore, the number supported could be fess than shown in the table and the
difference could be more based on a 100-percent review of transactions reported. This
situation is also applicable to our testing of EQUSA statistics on terrorism convictions,
terrorism-related convictions, defendants sentenced to prison, terrorism and anti-terrorism
cases pending, and defendants for terminated terrorism and anti-terrorism cases.

43


APPENDIX III

EOUSA RESPONSE
U.S. Department of Justice

Executive Office for United States Attorneys
Office of the Director

Main dustice Building. Room 2261 (208) 584-2124
950 Pennsylvania Avenue, NW
Washington, DC 20530

MEMORANDUM
DATE: January 17, 2007

TO: Guy K. Zimmerman
Assistant Inspector General for Audit

a fe
FROM: lichael A. Battle

Director
Executive Office for United States Attorneys

SUBJECT: — Response to OIG Report on Terrorism Statisti

This memorandum is submitted by the Executive Office for United States Attomeys
(EOUSA) in response to the audit report by the Office of Inspector General (OIG) entitled, “The
Department of Justice’s Intemal Controls over Terrorism Reporting.”

EOUSA appreciates the effort that the OIG put into this review and the courtesies
extended by the OIG staff during the course of the review. We acknowledge that the report has
raised important issues regarding what constitutes an “anti-terrorism case." EOUSA respectfully
objects, however, to the teport’s general depiction of EOUSA’s terrorism statistics as
“inaccurate” or “unsupported.” OIG’s findings rest largely on its new interpretation of
EOUSA’s anti-terrorism coding definition, not on a finding that data were carelessly or
perfunctorily recorded. Apart from the definitional issue, EOUSA also has concems about the
methodology of the report and some of the factual assertions arising therefrom.

EOUSA fully agrees with OIG that EOUSA must provide the clearest possible statistical
picture of the important terrorism and anti-terrorism work being done by the United States
Atlomeys’ Offices around the country. Toward that end, EOUSA wiil rename its anti-terrorism
Program category code, and will modify and clarify its definition, in order to eliminate any
misunderstanding regarding its meaning.’ In addition, EOUSA will review its internal controls
in order to determine what improvements can be made.

‘In renaming and modifying its anti-terrorism code, EOUSA does not plan to create a program
code solely for those defendants who have links to terrorist activity, but who are investigated
and/or charged with non-terrorism charges. EOUSA sees significant problems with a program
code devoted solely to such cases and defendants.

i

107


the terrorism link. The initial allegation alone does not necessarily provide
such a link.


Criminal Division: Resolved. The Criminal Division concurred with
the recommendation and said it intends to maintain documentation of
the procedures and systems used to gather or track the statistics it
reports. This recommendation can be closed when we receive
documentation showing how the Criminal Division plans to maintain
documentation of the procedures and systems used to gather or track
the statistics it reports.

This recommendation was directed to the FBI, EQUSA, and Criminal
Division to maintain documentation of the methodologies and
procedures used to verify the accuracy of the statistics reported.

FBI: Resolved. The FBI stated that documentation of the
methodologies and procedures used to verify the accuracy of statistics
rests with the entities that have program oversight of the systems that
capture the data. The FBI further stated that much of the process for
reviewing statistic accuracy centers on trend analyses conducted in the
field and at FBI Headquarters and the FBI plans to continue this
process. The FBI also stated that one internal control it uses to verify
the accuracy of statistics is its inspection process which has identified
shortcomings in various statistical accomplishments. While these
controls are beneficial to improving the accuracy of reported statistics,
the controls alone were not sufficient to prevent the improper reporting
of statistics that we identified in this report. Therefore, we believe the
FBI needs additional controls to verify the accuracy of its terrorism
statistics. This recommendation can be closed when we receive
documentation showing the FBI’s additional methodologies and
procedures used to verify the accuracy of the statistics it reports.

EOUSA: Unresolved. EOUSA responded that it already maintains
documentation of the methodologies and procedures used to verify the
accuracy of the statistics it reports and refers to its response to the first
recommendation. As discussed in our analysis of EOUSA’s response to
Recommendation 1, EQUSA’s statistics were inaccurate even apart from
the issue related to the definition of its anti-terrorism code. Moreover,
we also found four statistics for which EOUSA stated that it had
established controls but the controls were not documented. EQUSA’s
response did not address this issue. Therefore, we do not agree that
EQUSA has already complied with this recommendation and believe
EOUSA should maintain documentation of the methodologies and
procedures used to verify the accuracy of its statistics. This
recommendation can be closed when we receive documentation showing
EOQUSA’s plans to maintain documentation of the methodologies and
procedures used to verify the accuracy of the statistics it reports.

138


February 3, 2005, the first reconstruction included three cases where the
investigations had been vacated and therefore should not have been
included on the list. When we met with Criminal Division officials to discuss
these cases, the officials agreed that these cases should not have been
included on the first reconstructed list and excluded the cases from the
second reconstructed list. Had we accepted the Criminal Division’s first
reconstructed list, then the Criminal Division would have included cases not
supported by the facts, contrary to its assertion that this could not occur.

We also disagree with the Criminal Division’s reference to audit
standards. We did not apply audit standards to the Criminal Division’s
responsibility to provide accurate statistics. Rather, the auditing standards
to which the Criminal Division refers are broad statements of auditors’
responsibilities and provide a framework for the conduct of audit work.®*
These auditing standards apply to work of government auditors, not the
work of Criminal Division managers. However, Criminal Division managers
(like other government managers) should be held to standards requiring that
significant events be clearly documented, that such documentation be
readily available for examination, and that statistics be monitored, validated,
and accurate. The Criminal Division’s difficulty in reconstructing support for
its numbers, and the ultimate inaccuracy of those numbers compared to
what it reported, does not show compliance with the standards to which all
managers should be held.

The Criminal Division also stated that the OIG report contains
inaccurate and potentially misleading statements. We disagree with the
Criminal Division and discuss below each of its concerns individually. First,
the Criminal Division stated that “Repeated statements that the Criminal
Division statistics were ‘inaccurate’ and ‘flawed’... will likely lead readers to
infer that the statistics were inflated.” We carefully wrote our report to
demonstrate both graphically and in the text the extent to which the
Criminal Division inaccurately reported its statistics by either under-reporting
or over-reporting. We believe that our description of the Criminal Division’s
statistics as both inaccurate and flawed is correct.

Second, the Criminal Division noted that we identified broad causes for
inaccurate statistics, including that the departmental components we
reviewed: (1) could not provide support for the numbers reported for the
statistics; (2) could not provide support for the terrorism link used to classify
statistics as terrorism-related; and (3) could not provide documentation to
show that some items counted in the statistic reported occurred in the

64 General Accounting office, Government Auditing Standards, GAO-03-673G,
June 2003.

133


THE DEPARTMENT OF JUSTICE’S
INTERNAL CONTROLS OVER TERRORISM REPORTING

EXECUTIVE SUMMARY

Since the September 11, 2001, terrorist attacks, the Department of
Justice's (Department) highest priority has been to deter, prevent, and
detect future terrorist acts. In part, the Department measures the success
of its counterterrorism efforts by reporting hundreds of terrorism-related
statistics in its performance plans and statistical reports, such as the:

e number of individuals charged as a result of terrorism
investigations,

e number of terrorism convictions,

* number of terrorism-related threats to transportation and facilities,
and

« number of terrorism-related threats to people and cities.

Congress and the Department management also use terrorism-related
statistics to make operational and funding decisions for Department :
counterterrorism activities, and to support the Department’s annual budget
requests.' For these and other reasons, it is essential that the Department
report accurate terrorism-related statistics.

The Department's Office of the Inspector General (O1G) initiated this
audit to determine if Department components and the Department as a
whole gather and report accurate terrorism-related statistics.

Terrorism-Related Statistics Reported by the Department

In transforming its mission after the terrorist attacks of
September 11, 2001, the Department established preventing terrorism and
promoting America’s security as its primary strategic goal. The Department
relies on its components, such as the Federal Bureau of Investigation (FBI),
the Criminal Division, the Executive Office for United States Attorneys
(EOUSA), and the United States Attorney's Offices (USAQ), to implement its
counterterrorism strategies. The Department and its components collect a

1 The Department received $3.6 billion in Fiscal Year (FY) 2006 for counterterrorism
activities, an increase of almost 400 percent over the $737 million received in FY 2001.


APPENDIX III

The Honorable Glenn A. Fine

allowing individual divisions to define production across multiple elements. We therefore
believe that the FBI has now implemented a system that improves our internal controls and
consistently and accurately tracks IAs produced.

4. U) Intelligence Bulletins

The OIG's analysis of Intelligence Bulletins focused on those issued in FY 2004.
As indicated in the Report, the FBI changed the formal Standard Operating Procedures in June of
2004 (the Report indicates that changes occurred in 2006). As a result of these new procedures,
on August 6, 2004, the FBI began publishing in the header of each new Intelligence Bulletin the
sequentially issued number for each publication. As of December 26, 2006, the FBI had issued
232 Intelligence Bulletins. The FBI believes that the new procedures have strengthened the
internal controls used to track the number of Intelligence Bulletins issued by the FBI and has
eliminated the problems that existed in FY 2004.

5. U) Intelligence Products Produced/Disseminated

The FBI's FY 2004 statistic providing the number of intelligence products
produced/disseminated to the United States Intelligence Community (and appropriate federal
agencies) involved several errors on our part. This statistical measure was poorly worded and led
to confusion about what it was actually intended to measure and report. For this reason, this was
the only time the measure was used. The FBI has not repeated its use in subsequent years. We
recognize that we did not develop a clear, well-defined metric to capture what was initially
intended to be reported. In the future, our new reporting systems and closer oversight will help
prevent such errors from reoccurring.

6. (U) Terrorist Threats

The Report also examined the FBI's tracking of the number of terrorist threats
received in FY 2003 and FY 2004. The FBI acknowledges that its internal controls were not
optimal during this period. While the Report indicated that since September 2004, the FBI has
utilized the Guardian Threat Management System (Guardian) to track terror threats, the Report
does not capture the full extent of the FBI's improved threat tracking capabilities since
September 3].

Before 9/11, no central collection system for threats existed within the FBI. After
9/11, Director Mueller established a policy requiring an FBI response to all terrorism threats and
mandating that the FBI pursue each threat to a logical conclusion. Concurrently, the Director
also created CT Watch within the Counterterrorism Division to serve as a situational awareness
center with an operational capacity to oversee the resolution of threats. During 2002, FBIHQ
leamed of threats through (1) field office reporting in the form of an Urgent Report to FBIHQ,
(2) less formal communications between field offices and FBIHQ, and (3) threat reporting
supplied by the Intelligence Community. The FBI recognized that this process, which
represented only the most significant threats and suspicious activity as evaluated by FBI field
office management, was inadequate. Thus, during 2003, the Counterterrorism Division began a
concentrated effort to establish a centralized reporting system to capture potential terrorism
threats and suspicious activity. This culminated in the release of the Guardian System in
July 2004.

103


accounts checks drawn upon closed accounts at other banks. They
would write checks to themselves or to the other participants and
then cash the checks. These checks would be cashed before the
initially deposited checks were returned because of “insufficient
funds.” As part of the scheme, the subject received payment from
the other participants for cashing their bad checks. The subject
pleaded guilty to bank fraud and was sentenced to 3 months with
credit for time served. The case file information provided by the
USAO contained no indication the subject was linked to terrorist
activity. When we asked an AUSA to provide additional information
to support a terrorism link, the AUSA told us that the subject was
Part of an investigation of credit card “bust-out” schemes and
financial support to terrorists, but the AUSA provided no
information to support that this subject was linked to financial
support to terrorists.

« The subject was charged with making false statements by asserting
on an application for an airport identification badge that he had not
been convicted of a felony when he knew that he had been so
convicted. The subject was convicted at trial of making false
statements and sentenced to 1 year on probation. The case file
information provided by the USAO contained no indication the
subject was linked to terrorist activity. When we asked an AUSA to
provide additional information to support a terrorism link, the AUSA
repeated the charge above and said that the subject was arrested
as part of the USAO’s infrastructure/transportation protection
initiative. The AUSA provided no additional information to support
a terrorism link.

e The subject, a Mexican national who had previously been convicted
of attempted theft and deported from the United States, was found
to be unlawfully in the United States. The subject pleaded guilty to
unlawfully reentering the United States after being deported and
was sentenced to 27 months in prison. The case file information
provided by the USAO contained no indication the subject was
linked to terrorist activity. When we asked an AUSA to provide
additional information to support a terrorism link, the AUSA did not
provide such a link and reiterated that the subject had illegally
reentered the United States after being deported.

We also found that 33 of the 301 sampled convictions, including
29 of the 273 convictions that were not linked to terrorism, did not occur in
the year reported and should not have been included in the FY 2003
statistic. This same issue occurred for 30 of the 166 sampled convictions in

52


Criminal Division: Unresolved. The Criminal Division concurred with
the recommendation but stated that it had existing procedures for
gathering, verifying, and reporting terrorism-related statistics in the
form of the Counterterrorism Section’s Circular on Terrorism Statistics
and in material discussing specific performance measures. According to
the Criminal Division, these mechanisms were supplemented by
gathering information through telephone and e-mail requests and
responses to and from terrorism prosecutors in the USAOs. The
Criminal Division stated that it believes there was nothing haphazard
about its system, which resulted in daily reporting of terrorism litigation
events by which Department leadership is kept current on such matters.

As discussed above, we found the Criminal Division’s procedures for
gathering, verifying, and reporting terrorism-related statistics resulted
in inaccurate statistics. The Criminal Division also did not have
procedures detailing the sources it would use to gather each statistic or
the methodologies it would use to verify the accuracy of those statistics.
As a result, the Criminal Division spent considerable resources during
two attempts to reconstruct the support for the statistics reported, and
in the end was unable to reconcile the numbers reported for each
statistic. As a result, this recommendation can be clased when we
receive documentation showing the Criminal Division has established
and documented internal control procedures for gathering, verifying,
and reporting terrorism-related statistics.

This recommendation was directed to the FBI, EQUSA, and Criminal
Division to maintain documentation to identify the source of all
terrorism-related statistics reported in official operational documents
such as budget requests, performance plans, statistical reports, and
others.

FBI: Resolved. The FBI stated that it will establish a process of
maintaining supporting documentation identifying the original source of
terrorism-related statistics and that its Counterterrorism and Finance
Divisions will work together to establish a formal process to maintain
supporting documentation and establish appropriate record retention
policy. This recommendation can be closed when we receive
documentation of the FBI’s process for maintaining documentation to
identify the source of all terrorism-related statistics reported in official
operational documents such as budget requests, performance plans,
statistical reports, and others.

EOUSA: Unresolved. EQUSA responded that it already maintains
documentation to identify the source of all terrorism-related statistics

136


following charts reflect defendants for which the USAOs did not provide
information of the terrorism link.*

OIG Analysis of Sample for | OIG Analysis of Sample for
EOUSA Statistic - Pending Terrorism and EOUSA Statistic - Pending Terrorism and
Anti-terrorism Cases at the end of FY al Anti-terrorism Cases at the end of FY 2003

600 aaa w | | 4007-555 =a
480 9 320 267
360 240
240 160

120 48 80 68

° | = |

Sampled Supported Overstated Sampled Supported Overstated
OIG Analysis of Sample for

EOUSA Statistic — Pending Terrorism and
Anti-terrorism Cases at the end of FY 2004
|

400 ;>—362

320

240

160
Eg

80

o

ienipiad ss Oversta!

Source: USAO annual statistical reports

and LIONS data, OIG interviews with EOUSA
and USAO staff, and analysis of documents
provided by EQUSA and USAO staff

The following are specific details for examples of unsupported cases.

« The subject was charged with: (1) falsely representing a social
security account number to be his own for the purpose of gaining
employment and a security badge at an airport, (2) using
fraudulent social security and immigration cards for the same
purpose, and (3) unlawfully entering an airport area, The subject
was convicted of unlawful entry into an airport area and was
sentenced to time served. The other two charges against the
subject were dismissed. The case file information provided by the
USAO contained no indication that the subject was linked to
terrorist activity. When we asked an AUSA to provide additional
information to support a terrorism link, the AUSA told us that the

*? As noted in footnote 41 on page 43, the numbers supported for these statistics
are based on a sample of transactions reported.

63


TABLE OF CONTENTS

INTRODUCTION ....
The Department’s Focus on Terrorism.
Counterterrorism Funding and Staffing
Audit Purpose and Scope......sceeeeecersenes

Prior Audits...
Department’s Response to Concerns about Inaccurate Terrorism-

Related Statistics 00... .ccccccccecsseesenseeeecersneeeesessuecereeaeesestenereeesansnese 7
OIG FINDING AND RECOMMENDATION G.................:::ssssesseeessseeeees 10

DEPARTMENT COMPONENTS LACK EFFECTIVE CONTROLS FOR
REPORTING ACCURATE TERRORISM STATISTICS
Our Audit Approach

FBI TERRORISM STATISTICS ........eccceecccesseeeeveeeaeseeeessnenssuseeaeseaeeesaaerens
Number of Terrorism-Related Convictions...
Intelligence Information Reports ..
Intelligence Assessments ....
Intelligence Bulietins ...
Intelligence Products Produced,
Terrorist Threats
Terrorist Threats to Transportation and Facilities and
Terrorist Threats to People and Cities..
Counterterrorism Threat Assessments.
10. Presidential Terrorist Threat Reports

WANA SYNE

EOUSA TERRORISM STATISTICS .........-00ee000
Inaccuracies in LIONS Data Reported by GAO ...
OIG Testing of EOUSA and USAO Terrorism-Related Statistics
Defendants in Cases Filed ...
Terrorism Convictions.......
Terrorism-Related Convictions
Defendants Sentenced to Prison.
Defendants Prosecuted ..
Defendants Found Guilty
Terrorism Cases Tried.......

Terminated Terrorism and Anti-Terrorism Cases
Pending Terrorism and Anti-Terrorism Cases..
10, Defendants for Terminated Terrorism and Anti-Terrorism

PONauawnre


APPENDIX III

code was introduced, immigration case filings totaled 13,676. The very next year, FY 2003,
immigration case filings jumped to 16,621, a 21 percent increase. Last year, in FY 2006,
immigration filings were up to 17,686. Thus, immigration case filings have not been converted
into anti-terrorism cases, but have continued to be coded separately.

Second, EOUSA has previously made clear to the OIG in writing its position that “a properly
coded anti-terrorism case [must] be part of a proactive initiative or operation that is driven by a
pre-existing strategy or goal which is reasonably designed to prevent or disrupt terrorism.
Reactive, or arrest-generated cases in such areas as immigration or document fraud are not
generally going to be coded as anti-terrorism cases.” EOUSA Memo to OIG, September 2006,
at 7-8. Thus, a typical border/immigration case, that is, a reactive, arrest generated case arising
from the arrest of an illegal alien who has illegally entered or re-entered the country, has not
been and will not be, without more, coded as an anti-terrorism case. Rather, a case arising from
a planned investigative effort designed specifically to deter potential terrorist activity at areas of
critical infrastructure vulnerability would be coded as anti-terrorism, even if the resulting cases
were brought against defendants who did not have links to terrorist activity.”

Methodology Concerns

EOUSA found certain aspects of the methodology used in the OIG review to be
inscrutable. First, regardless of the definitional issue discussed above, we believe that the OIG
report is inaccurate, or at best misleading, when it states that "EOUSA and the USAOs could not
accurately support the 11 EOUSA and USAO statistics we reviewed.” Report at ix. By the
Report’s own admission, that is untrue. The chart on pages x and xi show that, for three of the
eleven statistics (#5, 6, and 7), and four of the nineteen subcategories (adding #1.a.), the "number
supported" exceeded the number reported. In other words, EOUSA was under-
reporting. Under-reporting does not mean that the statistics were "not accurately supported.”
There was, in fact, support for each statistic reported, Thus, even apart from the pivotal issue of
the proper interpretation of the anti-terrorism definition, at a minimum, only eight of EOUSA’s
cleven statistics should be portrayed as “unsupported.”

Second, as described above, the primary issue in the report tums on OIG's new
interpretation that the defendant in an anti-terrorism case must have a link to terrorist activity in
order for the case to be properly coded. Yet nowhere does the report identify the criteria by
which OIG judges whether such a link to terrorism exists. The report appears to be based on
OIG’s subjective views as to whether an appropriate terrorism link exists.

The report states that OIG “looked for and accepted any evidence of a reasonable
terrorism linkage.” Report at 39; see also Report at xiii. Yet the report fails to accept that an
investigation or case referred by the JTTF must, by definition, involve either terrorist activity or

* We note that the report mistakenly asserts on page 39 that an EOUSA official told OIG that
“EOUSA could also properly code as anti-terrorism all cases arising from any illegal immigrants
arrested crossing the southwest border into the United States, but have not done so.” As
discussed above, that is not, and never has been, EOUSA’s position. OIG apparently
misunderstood the remark, which was intended to convey exactly the opposite of what OIG has
reported.

112


APPENDIX III

subcategory, the shortfall in documentation was “minor” according to the Report itself (page
81); the Criminal Division reported there were over 50 “material support to terrorism cases and
matters participated in or coordinated as of 1-31-03,” but provided documentation for 49. As the
chart reflects, ail of the other statistics in that category ~ “materia} support to terrorism cases and
Matters” ~ were fully supported.

Given these facts, we respectfully disagree with the conclusions found elsewhere in the
Report that the Criminal Division’s statistics were “unsupported.” For instance, on page v, the
chart says that the number of Criminal Division statistics “{nJot [s]upported” was “5 of 5.” That
is directly contradicted, however, ten pages later in the Report on page xv, and again on page 75.
The “total{]” number of “not supported” statistics (at iv and v) is also incorrect, as a result.
Assuming that the Report’s characterization of the EOUSA and FBI statistics is correct, the total
number of unsupported statistics among all three components is at most 19 of 26.

Likewise, in summarizing the Report’s conclusions, the OIG writes, “[i]n general, we
found that the Department components . . . could not support . . . its terrorism-related statistics.”
(at xvii). See also at 83 (“[T]he Department and its components could not support . . . terrorism-
related statistics accurately.”) Although we understand the desire to generalize, we believe the
Report’s attempt to do so creates a misimpression in this case because again, by the Report’s own
admission, the Criminal Division fully supported its statistics in all but one of nine subcategories
of statistics.

2. The Criminal Division Underreported Some of Its Terrorism-Related Statistics

We do not dispute the Report’s conclusion that the Criminal Division inaccurately
understated six of the nine subcategories of reported statistics. (See pp. xv and 75). As noted
above, there was a “minor” overstatement with respect to one subcategory (5.a.), and the
remaining two subcategories were reported accurately (3.a. and 5.b.).

Although, as the Report recognizes, two of six understatements were only “minor” (at 76
and 82), we agree that improvements in the collection and reporting of statistics are needed to
help prevent understatements in the future. The Report concluded that certain subcategories of
statistics were understated “primarily because the database used to track the statistics was
incomplete and not kept up-to-date” (at xv). That should not occur, and we fully agree that better
internal controls and procedures are warranted. As discussed in greater detail below, we have
already taken steps to institute these improvements.

Given the Report’s findings on understatements and the apparent cause for those
understatements (namely, that the relevant database was not always updated when new terrorism
Matters arose), we respectfully, but emphatically, disagree with the Report’s conclusion (at xvii
and 83) that the Division “could easily and unintentionally misreport in the opposite direction” to
overstate terrorism statistics. That is not correct, and the Report provides no support for this
troubling conclusion.

118


OIG Analysis of EOUSA Statistic -
Found Guilty - Defendants for
Program Activity Anti-terrorism
for FY 2002

eeeisiccs

Reported Supported Understated

Source: EOUSA and USAO budgets and
LIONS data, OIG interviews with EOUSA
and USAO staff, and analysis of documents
provided by EOUSA and USAO staff

See Statistic 1 in the EOUSA Terrorism Statistics section for a discussion of
why we did no further testing of this statistic and why the statistic was
inaccurately reported.

7. Terrorism Cases Tried

In the FY 2003 President’s Budget Request to Congress, EOUSA
reported that three terrorism cases were tried in FY 2001. However, the
LIONS data did not match the number reported in the annual budget request
as shown in the following chart.

OIG Analysis of EOUSA Statistic -
Terrorism Cases Tried in FY 2001

oy N We

Reported Supported Understated

Source: EQUSA and USAO budgets and
LIONS data, OIG interviews with EOUSA
and USAO staff, and analysis of documents
provided by EOUSA and USAO staff

See Statistic 1 in the EOUSA Terrorism Statistics section for a discussion of
why we did no further testing of this statistic. An EOUSA official indicated
that one case was not reported due to an oversight.

58


Statistic Reported
I ]

i Number Reported S15 6.a. Number of terrorism-related
i Number Supported threats tracked in FY 2003
7 ! 1 (see Chart Endnote 3 on
page 17)

4,499 6.b. Number of terrorism-related
threats tracked in FY 2004
4,049 (see Chart Endnote 3 on
page 17)

transportation and facilities
in FY 2004 (see Chart

a 7. Number of terrorism threats to
Endnote 4 on page 17)

820 (see Chart Endnote 4 on

820 8. Number of terrorism threats to
people and cities in FY 2004
page 17)

threat assessments produced
in FY 2004

}
63 | 9. Number of counterterrorism
51

Terrorist Threat Reports
produced in FY 2004

88 |) 10. Number of Presidential
77

8,000 7,000 6,000 5,000 4,000 3,000 2,000 1,000 0
Number Reported/Supported

Source: FBI budget requests and performance plans, OIG interviews with FBI staff, and
analysis of documents provided by FBI staff

Chart Endnotes

1. The number supported for this statistic is based on a sample of transactions reported.
Therefore, the number supported could be less than shown in the table and the
difference could be more based on a 100-percent review of transactions reported.

16


APPENDIX I

. We divided the 192 terrorism-related statistics into two categories
consisting of 123 operational statistics and 69 informational
statistics. The operational statistics represent terrorism-related
statistics reported in various documents including annual budgets,
annual financial statements, performance plans and assessments,
statistical reports, and other Department reports. The
informational statistics represent statistics used in various forms
such as speeches, press releases, and unclassified publications.

. We excluded the 69 informational statistics from our audit because
we judged them to be less significant to the war on terror than the
123 operational statistics.

. We excluded 16 of the 123 operational statistics from testing
because Department officials could not identify the source of the
statistic (See Appendix II). Without the source, we could not
determine whether internal controls had been established to
ensure the accuracy of the statistics reported.

. We excluded 48 of the 123 operational statistics from testing
because the statistics, or the systems supporting them, had been
previously reviewed by the OIG and recommendations made to
correct deficiencies identified.

. We used a risk level to decide which statistics to test by developing
a method to weigh the level of risk that the remaining 59
operational statistics were reported accurately. We came up with
the following six categories of risk and used a risk rating scale of
one to three within each category with one being relatively low risk
and three being relatively high risk.

OIG‘s Methodology for Measuring
Risk of Terrorism-Related Statistics

Risk Category/ Risk
Rating Elements Rating
1. Frequency of use
Reported 1 to 3 times 1
Reported 4 to 10 times 2
Reported 11 to 35 times 3

87


Assessments issued and no formalized procedures have been developed
since.

4. Intelligence Bulletins

The FBI Intelligence Bulletin is a finished intelligence product used to
disseminate information of interest, such as significant developments and
trends, to the intelligence and law enforcement communities in an article
format. Intelligence Bulletins do not address threat warning information.

Units within the National Threat Center Section (NTCS)?8 and the
Counterterrorism Analysis Section (CTAS)?° produced and disseminated
Intelligence Bulletins on behalf of the FBI during FY 2004 through FY 2006.
Within the NTCS, the Terrorist Watch and Warning Unit (TWWU) produced a
numbered series of Intelligence Bulletins intended primarily for U.S. law
enforcement agencies. The first such Bulletin was disseminated in February
2004, and in August 2004 TWWU began producing the bulletins jointly with
the Department of Homeland Security. TWWU tracked the details of its
Builetins in word processing files that captured the title, date of
dissemination, and subject matter of each bulletin. Within the CTAS during
FY 2004 and continuing through FY 2006, a GTAU staff member used a local
database application to track Intelligence Bulletins issued by all of the CTAS
units.

In its FY 2006 - FY 2011 Performance Plan, the FBI reported issuing 63
Intelligence Bultetins during FY 2004. As shown in the following chart, we
found that the word processing file used by the TWWU and the database
used by the GTAU to track Intelligence Bulletins issued did not match the
number reported in FY 2004.

28 The NTCS is responsible for producing cross-cutting analysis focusing primarily on
early warning of NTCS emerging terrorist threats to the United States. The NTCS is also
responsible for identifying long-term, threat-related issues that may affect FBI investigative
or operational strategy against terrorist targets. The NTCS is the Counterterrorism
Division’s focal point with the intelligence and law enforcement communities relative to the
coordination of domestic threats, including monitoring and facilitation of the passage of
threat information to federal, state, and local authorities.

29 The CTAS is responsible for tracking Intelligence Bulletins issued by the FBI. In
FY 2004, the CTAS was comprised of five units. They included: (1) GTAU,
(2} Domestic Sunni Extremism Analysis Unit (DSEAU), (3) Shia/Middle East Analysis Unit
(SMEAU), (4) Domestic Terrorism Analysis Unit (DTAU), and (5) Weapons of Mass
Destruction/Emerging Weapons Threat Analysis Unit (WMD/EWTAU). In August 2005, the
analytical component of the Threat Watch and Warning Unit (TWWU) was:
(1) transferred from NTCS to CTAS, and (2) merged with the WMD/EWTAU to form the
Threat Analysis Unit within CTAS.

23


* The subject was charged with knowingly and unlawfully possessing
a Resident Alien card (a document issued by the Department of
Homeland Security and used for entry into and as evidence of
authorized stay and employment in the United States). The case
file information provided by the USAO contained no indication the
subject was linked to terrorist activity. The subject pleaded guilty
to possession of a false immigration document and was sentenced
to time served in federal custody. When we asked an AUSA to
provide additional information to support a terrorism link, the AUSA
told us that this was a prevention case to restore the integrity of
the immigration identification systems and procedures in the United
States. The AUSA provided no additional information to link the
subject to terrorist activity.

« The subject was charged with making a false statement on an
airport security badge application. On the application he asserted
that during the 10 years preceding the date of the application he
had not been convicted of any disqualifying crimes listed on the
application when in fact he had been so convicted. The subject
pleaded guilty to making false statements and was sentenced to
4 months in prison with credit for time served. The case file
information provided by the USAO contained no indication the
subject was linked to terrorist activity. When we asked an AUSA to
provide additional information to support a terrorism link, the AUSA
told us that the subject was arrested as part of Operation Fly Trap,
which was an operation similar to Operation Tarmac and Operation
Plane View, where Department and other federal agents went into
the local airport and arrested individuals who used falsified
documents such as social security numbers, drivers’ licenses, and
other identification documents to gain employment at the airport
facilities. The AUSA provided no additional information that linked
the subject to terrorist activity.

« A Mexican national falsely identified himself as a U.S. citizen on an
employment eligibility verification form so he could obtain
employment in the United States. Subsequently, the subject filed a
Petition for Alien Relative using his real identity that wouid allow
him to reside and work legally in the United States. After the
petition was approved, the subject voluntarily submitted another
employment eligibility verification form to his employer using his
real identity and requested his employer change his payroll record
to reflect his true name. The subject told his employer that he had
been in the United States unlawfully until recently receiving
authorization from the U.S. government to reside and work in the

48


Second, the Criminal Division’s response stated that it takes issue with
the OIG’s conclusion that the Criminal Division did not have an effective
reporting system. It stated that “While we concede that the reported
statistics have not been maintained according to audit standards and the
supporting documentation was therefore not readily available, the fact that
this data could be successfully reconstructed actually demonstrated that
there were systems in place, and that systems could effectively provide the
basis for the reported numbers.”

We disagree. We were not applying “audit standards” to the Criminal
Division’s statistical reporting systems. However, it is clear that the Criminal
Division had inadequate internal controls on its reporting systems,
considering the fact that it took the Crimina! Division two tries at
reconstruction over a 6-month period to provide support for its numbers. As
described beginning on page 70 of this report, the Criminal Division initially
could not produce documentation for the statistics we sought to test. Staff
of the Criminal Division requested and were given time to reconstruct the
records. When the first reconstruction effort failed, the Criminal Division
requested and we allowed time for a second reconstruction effort.

The statistics reported continued to be inaccurate even after the
Criminal Division’s second attempt at reconstruction. While the numbers
were understated after the second reconstruction, we believe that under-
reporting numbers in official statistics also shows a troubling lack of internal
controls on the Criminal Division’s reporting systems.

With respect to the possibility of over-reporting its terrorism statistics,
the Criminal Division argued that “we do not believe, given our system, that
the Division could unintentionally report a terrorism-related matter that had
no basis in fact.” The Criminal Division then provided a lengthy discussion of
the coordination and documentation used in terrorism cases. Yet, until it
attempted to reconstruct support for its statistics, the Criminal Division had
not monitored the terrorism-related statistics that we tested and in fact
could not do so with the data available prior to the reconstructions. In
addition, internal controls did not exist to validate the Criminal Division’s
statistics. Under these circumstances, we believe that inaccurate reporting
in both directions is possible.

In fact, the Criminal Division’s first reconstruction attempt indicated
just the opposite. Specifically, the Criminal Division’s first reconstruction
included cases that were not supported by the facts and documentation for
seven of the nine times that the five statistics were reported. For example,
for statistic 2 on the number of individuals convicted or pleaded guilty
resulting from terrorism investigations from September 11, 2001, through

132


subject was linked to terrorist activity. When we asked an FBI
official to provide additional evidence to support a terrorism link,
the official provided no additional evidence and told us that, had the
bacteria actually been missing and not destroyed, the potential
would have existed for terrorists to get and use the missing

bacteria to perform a terrorist act. The subject was convicted of
making a materially false, fictitious, or fraudulent statement and
misrepresenting that hazardous materials were contained in the
missing package.

° A Bosnian subject fraudulently obtained a commercial driver’s
license. The case evidence provided to us by the FBI contained no
indication that the subject was linked to terrorist activity. The
subject was convicted of knowingly using a false social security
number on a commercial driver's license application. When we
asked an FBI official to provide additional evidence to support a
terrorism link, the official provided no additional evidence and told
us that the resulting conviction stopped the fraudulent activity and
could have prevented a terrorist from getting a commercial driver’s
license and using it to commit a terrorist act. The official also
stated that by opening the case as a domestic terrorism
investigation instead of a white-collar crime investigation the case
would get a higher priority.

We concluded that the FBI overstated the 206 terrorism-related
convictions reported for FY 2004 by at least 65. We believe the reported
convictions were overstated because the FBI initially coded the investigative
cases as terrorism-related when the cases were opened, but did not recode
the cases when no link to terrorism was established.

An FBI official told us that the fact that the individuals were not
charged with terrorism offenses and received light sentences does not mean
that: (1) the subjects were not linked to terrorism, or (2) the conviction of
the subjects did not prevent future terrorist acts from being committed.
However, while we accept the FBI’s statement in principle, and did consider
a connection to be terrorism-related if there was any evidence of a terrorism
link, we found none in many cases. Absent evidence of a terrorism link
these convictions should not be considered terrorism-related.

2. Intelligence Information Reports

The FBI's Intelligence Information Reports are the standard vehicle
through which all raw intelligence information is shared with national policy
makers and the intelligence and law enforcement communities. The reports

19


OIG Analysis of Sample for | OIG Analysis of Sample for
EOUSA Statistic - Terrorism- EOUSA Statistic - Terrorism-
related Convictions during FY 2003 related Convictions during FY 2004

400, 200 —

320 Ss 273 | «160

166
240 | 120
160 | 80
80 28 40
° = o -

129
37
Sampled Supported Overstated Sampled Supported Overstated

Source: EOUSA and USAO budgets and LIONS data, OIG interviews with EOUSA
and USAO staff, and analysis of documents provided by EOUSA and USAO staff

Below are specific details for examples of unsupported cases.

During a one-year period, the subject fraudulently opened various
credit card accounts under another person’s name. The subject
used the fraudulently obtained credit cards to make purchases and
obtain cash totaling more than $15,600. The subject pleaded guilty
to fraudulent use of access devices (credit cards) and was
sentenced to 8 months in prison. The case file information provided
by the USAO contained no indication the subject was linked to
terrorist activity. When we asked an AUSA to provide additional
information to support a terrorism link, the AUSA only commented
that this was a case of identity theft and referred us to an affidavit
by a United States Secret Service agent for the facts of the case.
We reviewed the affidavit and found that it contained no indication
that the subject was linked to terrorist activity.

The subject was charged with possessing a pistol while being an
alien illegally and unlawfully in the United States. The subject was
found guilty of being an alien unlawfully in the United States in
possession of a firearm and was sentenced to time served. The
case file information provided by the USAO indicated that the
subject was arrested as part of an absconder apprehension
initiative for being an alien who was ordered deported from the
United States but failed to leave. The case file information
contained no indication that the subject was linked to terrorist
activity. When we asked an AUSA to provide additional information
of a terrorism link, the AUSA provided no additional information.

The subject and others were part of a scheme to defraud federally
insured financial institutions by operating a check kiting scheme.
The subject and others would initially deposit into their own bank

51


APPENDIX I

Risk Category/ Risk
Rating Elements Rating
2. Internal controls
Established and documented
Established but not documented
Not established
3. Magnitude of the statistic
reported®
From 0 to 1,000 1
From 1,001 to 10,000 2
Greater than 10,000, to include
any dollar-related numbers,
percentages, and hours 3
4. Inconsistencies in statistics
reported
No inconsistencies
One inconsistency
Multiple inconsistencies
5. Reported in informational formats
by others
Reported by other than the Attorney
General, Deputy Attorney General, FBI 1
Director, or EQUSA
Reported by EQUSA 2
Reported by the Attorney General, Deputy
Attorney General, or FBI Director 3

es |r]

CN

6. Preciseness of the statistic

reported

No operational statistics in group are
precisely stated 1

Some operational statistics in group are
precisely stated 2

All operational statistics in group are
precisely stated 3

We calculated an overall average risk score for each of the
59 operational statistics by adding the risk rating assigned for each
of the six risk categories and then dividing this sum by six.

9. We selected the following 26 of the 59 operational statistics (FBI -
10, EOUSA - 11, Criminal Division - 5) for audit testing based on
the risk rating we calculated and on our judgment of the
significance of the statistic to the war on terror.

®° The magnitude of the statistic reported relates to the quantitative number
associated with the statistic. For example, a statistic reported as being 2 is probably less
likely to be inaccurate than a statistic reported as being 10,247.

88


APPENDIX III

terrorism when they should be coded as anti-terrorism cases because they “did not result in
terrorism-related convictions.” GAO Report, 03-266, at 13. The report then stated:

EOUSA policy guidance described antiterrorism conviction cases as those
resulting from efforts on the part of DOJ to prevent or disrupt a potential or actual
terrorist threat even where the offense is not obviously a federal crime of
terrorism that would be coded under one of EOUSA’s terrorism-related
classification codes. For example, the conviction of a defendant arrested and
subsequently convicted for identity fraud during a sweep of an airport, as part of
a DOJ effort to prevent or disrupt terrorist activity, would be counted as an
antiterrorism conviction,

GAO Report, 03-266, page 13, note 19. Italics added.

Thus, when it had the opportunity as part of its review, GAO chose to confirm, rather
than dispute, EOUSA’s interpretation of its anti-terrorism code. O1G’s interpretation of the anti-
terrorism code therefore differs not only from EOUSA’s and that of the USAOs, but with the
GAO’s interpretation as well.

Notwithstanding, in an effort to ensure greater clarity about the purpose and scope of the
anti-terrorism category code, EOUSA shall rename the code and will, after a prompt but
thorough internal discussion of the issue, modify the definition to make it more transparent.

OIG decms EOQUSA’s statistics “inaccurate” in Jarge measure because they exclude
Operation Tarmac cases, and cases from similar initiatives around the country, from the anti-
terrorism definition. If such cases were included in O1G’s interpretation, FOUSA expects that
its statistics would otherwise be deemed substantially accurate. EOUSA’s follow-up work in
response to OIG’s initial draft confirms this.

Upon receipt of O1G’s initial draft of this report, EOUSA asked for and received, in
August 2006, a list of all cases that OIG considered inaccurate or unsupported. In the three
weeks that OIG allotted for this follow-up effort, EOUSA went back to the eight USAOs from
which the cases originated and asked them to identify whether any of those cases, (1) were
referred by the JTTF; (2) were undertaken as part of an affirmative, proactive operation or
initiative, consistent with a pre-existing, planned strategy in the district to deter or prevent
terrorism; or (3) had defendants who had classified links to terrorist activity.

EOUSA inquired about these three criteria because if any of them exist, EQUSA would
consider the case to be properly coded as an anti-terrorism case. First, a case brought by FBI’s
Joint Terrorism Task Force, regardless of whether the defendant has verifiable links to terrorist
activity, is going to be, by definition, part of a proactive effort to prevent terrorism because that
is what the JTTF does.‘ Second, even if the JTTF is not involved, but the case is legitimately

* There are more than 100 FBI Joint Terrorism Task Forces (JTTFs) across the nation, including
at least one in each of the FBI’s 56 field offices. Sixty-five JTTFs were created after September
11,2001. The JITFs include FBI special agents, other federal agents, and state and local law

110


produced by the Terrorist Threat Integration Center (TTIC).?* The TMU then
manually entered the threats into a local database application. Since
September 1, 2004, threats classified up to the Secret level are entered by
many FBI components into the FBI's Guardian Threat Tracking System.*?
However, because Guardian is only classified up to the Secret level, a small
percentage of cases (less than 1 percent according to a TMU official) are still
entered in the TMU’s local database application. The Guardian system was
pilot tested in 8 FBI field offices beginning on July 8, 2004, and was on-line
in all 56 FBI field offices by the end of September 2004. By the end of
October 2004, the Guardian system was on-line in all 58 FBI Legal Attaché
offices throughout the world.** According to the TMU official, the Guardian
system now tracks all threats reported to the FBI, except those threats that
the field offices choose not to enter into the Guardian system. The use of
Guardian to report threat data in the future should significantly improve the
accuracy of the number of threats reported. For FY 2005, the Guardian
system contained 40,041 threats tracked by the FBI, which is significantly
greater than the number of threats reported as tracked in FY 2003 and

FY 2004. Guardian tracks these threats until they are mitigated and
resolved.

TMU officials told us the inaccuracy of the threats reported in the
FY 2006 budget could have resulted from how the Counterterrorism
Division’s Administrative Section requested the statistics. Initially, the
requests for the statistics were very broad such as “How many threats were
entered in the system?” Later, the requests for statistics were narrowed
down to “How many threats are you (TMU) tracking?” The TMU officials told
us they were not aware of how the requested information was being used by
the requestors. Other than how the Counterterrorism Division’s
Administrative Section requested the threat data, the officials did not know
why the threats were inaccurately reported for FY 2003 and FY 2004.

31 TTIC is a multi-agency center established in 2003 in which personnel from the
Central Intelligence Agency, the FBI, the Departments of Homeland Security and Defense,
and other agencies attempt to merge and analyze terrorist-related information collected
domestically and abroad to form a comprehensive picture of threats against the United
States.

32 The Guardian system is designed to make immediately available threat and
suspicious activity information to all system users, and provide all users with the capability
to search all incidents for threat trend analysis.

*° The FBI's Legal Attaché offices are offices staffed with FBI agents and support
staff in U.S. embassies and consulates.

29


database. We also requested support for the Deputy Chief’s manual count
for the last operational statistic we tested. The Deputy Chief provided us
with a list of terrorist financing cases that were prosecuted under various
U.S. Code sections. As we began to review the list, the Deputy Chief told us
that the list could not be used to provide support for the material support to
terrorism statistics reported because the cases identified in the list included
only cases where individuals had been charged. It did not include material
support to terrorism investigations or matters the Criminal Division was
currently working on. The Deputy Chief said that cases where no charges
were brought were included in the reported statistics but would not be
included on the terrorist financing list she provided.

The CTS Chief therefore requested more time to update the database
and reconstruct a list of terrorist financing cases, investigations, or matters
that the Criminal Division participated in or coordinated that would support
statistics reported. In March 2006, the CTS subsequently provided the
updated database and a list of terrorist financing cases, investigations, or
matters the Criminal Division participated in or coordinated.

For each of the five statistics tested, we reviewed evidence in support
of the March 2006 reconstructed data provided for each statistic, as well as
the internal controls in place to ensure the statistics were accurately
reported. We found that the Criminal Division’s reconstructed data did not
support the accuracy of the five statistics we tested in eight of the nine
times the statistics were reported. Specifically, our analysis of the
reconstructed data and supporting documentation showed that the statistics
were overstated six times, understated two times, and reported accurately
one time.

When we briefed the Criminal Division in August 2006 on our tests of
the March 2006 reconstructed data, the Deputy Assistant Attorney General
for the Criminal Division stated that while the Criminal Division needed to
strengthen its controls to gather, report, and document accurate terrorism
statistics, he believed the Criminal Division could provide the documentation
needed to support all the statistics reported. In August 2006, the Criminal
Division provided us another set of reconstructed lists to support the five
statistics we tested.

We compared the August 2006 reconstructed lists to the March 2006
reconstructed data provided by the Criminal Division and identified various
anomalies between the two lists such as: (1) data was on the March 2006
reconstructed lists and counted as meeting the criteria for the reported
statistic but was not on the August 2006 reconstructed lists, (2) data was on
the March 2006 reconstructed lists and not counted because it did not meet

71


lS

W@Number Reported
Number Supported

298

719

1,000 800 600 400
Number Reported/Supported

1,200

87

Statistic Reported

5. Number prosecuted - defendants
for program activity anti-terrorism
in FY 2002

. Number found guilty - defendants
for program activity anti-terrorism
in FY 2002 (see Chart Endnote 2 on
page 42)

3 | 7. Number of terrorism cases tried in

FY 2001

8.a. Number of terrorism and anti-
terrorism cases against defendants
that were terminated in FY 2003

8.b. Number of terrorism and anti-
terrorism cases against defendants
that were terminated in FY 2004

9.a. Number of terrorism and anti-
terrorism cases pending at the end
of FY 2002

9.b. Number of terrorism and anti-
terrorism cases pending at the end
of FY 2003

9.c. Number of terrorism and anti-
terrorism cases pending at the end
of FY 2004

| 10. Number of defendants the U.S.
Attorneys terminated terrorism and
anti-terrorism cases against in
FY 2004

11. Percentage of defendants whose
cases were terminated who were
convicted in FY 2003

Source: EOUSA and USAO budgets, annual statistical reports, and Legal Information Office
Network System (LIONS) data; OIG interviews with EOUSA and USAO staff; and analysis of

documents provided by EOUSA and USAO staff

We found that most of the inaccurate statistics occurred because the
USAOs coded the statistical data as terrorism or anti-terrorism related but

xi


internal controls to ensure the statistics were accurately gathered, classified,
and reported, or did not document the internal controls used.

After our initial review of the 192 statistics, we excluded 133 statistics
from our detailed review because: (1) the sources of the statistics could not
be determined;? (2) the statistics or supporting systems were previously
reviewed by the OIG and recommendations were made to correct
deficiencies identified; and (3) the statistics were used for informational as
opposed to operational purposes.*

Of the remaining 59 terrorism-related statistics, we selected 26 to test
whether the statistics were accurate. We selected these 26 statistics based
on our assessment of the significance of the statistic to the Department’s
counterterrorism efforts and based on the risk associated with reporting the
statistic inaccurately.> The statistics selected included 10 from the FBI
(reported 13 times), 11 from the USAOs (reported 20 times), and 5 from the
Criminal Division (reported 9 times).

To test the accuracy of these 26 statistics, we analyzed documentation
and conducted interviews with Department officials to determine if the
information reported for each statistic was accurate. In some cases we
reviewed documentation for each item counted in the statistic reported. In
other cases we reviewed documentation for a sample of the items counted.®

As summarized in the following table, we determined that the FBI,
EOUSA, and the Criminal! Division did not accurately report 24 of the 26
statistics we reviewed.

3 They include the number of: (1) disrupted donors related to terrorist financing,
(2) weapons of mass destruction cases initiated by the FBI and supported by the Hazardous
Material Response Unit, and (3) number of subpoenas and search warrants issued to gather
and cultivate detailed intelligence on terrorists in the United States. The statistics for which
sources could not be determined are listed in Appendix II.

4 Informational purposes included statistics used in speeches, press releases,
publications, and websites. Operational purposes included statistics used in budget
requests, performance plans, and annual financial statements and statistical reports,

5 More details of our selection methodology are contained in Appendix I.

§ For those statistics where we reviewed a sample of items counted, the number
supported could be less and the difference could be more based on a 100-percent review of

transactions reported.
iv


period reported or the provided evidence showed that some items counted in
the statistic reported did not occur in the period reported. The Criminal
Division argued that none of these explanations pertained to its statistics.

That is not correct. As noted above, the Criminal Division’s
reconstructed documentation did not support the statistics it reported
because they were inaccurately understated. Yet, even beyond the dispute
about the term “support,” it is clear that the Criminal Division’s statistics
included items that were included in the wrong period. On page 73 of the
report we summarized the Criminal Division’s transactions that we tested
which did not occur during the reporting period and therefore should not
have been included in this reporting period. While these numbers are small
and we characterize them as such in the report, this deficiency applies to the
Criminal Division’s statistics as well as to the other Department components.

Third, the Criminal Division objected to our explanation regarding how
it had to reconstruct the required support for its statistics, and it noted that
it provided us with assistance in understanding the information. The
Criminal Division concluded that “A full understanding of the audit and
reconciliation process must credit the efforts by the Counterterrorism
Section to supply the OIG with all the materials they requested and educate
them on each criminal investigation and prosecution so that they could
properly evaluate those materials in the context of the audit.” We agree
that Criminal Division staff provided us with requested materials and worked
with us to ensure our proper understanding of those materials. While we
appreciate these efforts (and similar efforts of the FBI and EOQUSA), we view
these efforts to be part of the Department’s routine compliance with the
information and assistance provisions of the Inspector General Act.© Such
interactions are common and are crucial to properly evaluate the wide range
of Departmental activities covered by our audits. That said, we believe that
the difficult and time consuming reconstruction process required by the
Criminal Division was a significant issue and is noteworthy of mention in the
OIG’s report.

The status of the recommendations related to Criminal Division statistics
is presented in Section D of this appendix.

5 See 5 U.S.C. §6 Authority of Inspector General; information and assistance from
Federal agencies;

134


in the Performance Plan did not reflect the statistic the FBI intended to
report. The reported number of 1,657 was intended to include only the
Intelligence Information Reports produced and disseminated by the
Counterintelligence Division rather than all intelligence products from the
whole FBI as reflected in the statistic description. The officials said that the
accurate number of Intelligence Information Reports for the
Counterterrorism Division was 1,667 and that 1,657 were reported as a
result of a clerical error. We were unable to verify the 1,667 reports officials
said should have been reported, and we found that support was available for
the 6,739 products officiais said were produced and disseminated during

FY 2004. Among the 6,739 were 4,682 Intelligence Information Reports
produced and disseminated by the Counterintelligence Division.

Officials of the IRCMU1 told us that the dissemination statistics
discussed here are an incomplete measure of FBI intelligence dissemination.
The officials said that Intelligence Information Reports are disseminated
through the FBI’s Communications Center via the Special Automated
Messaging Network, and for Intelligence Assessments and Intelligence
Bulletins through the use of distribution lists. As a separate process, the FBI
posts intelligence products to various websites that include Law Enforcement
On Line and Secure Internet Protocol Routed Network, among others, as
part of its ongoing effort to broadly share information that may be of value.

An IRCMU1 official told us that approximately 2,200 Intelligence
Information Reports had been produced as of September 30, 2004, but not
posted to various websites. While dissemination of the products occurs
primarily through other means, posting of the products to the websites is
important because it provides the U.S. intelligence and law enforcement
communities with researchable material and common access to intelligence
information. The IRCMU1 official told us that the divisions were not timely in
posting the Intelligence Information Reports to the websites because of a
shortage of personnel to do the posting. She identified 5,745 Intelligence
Information Reports that had been produced by the Counterterrorism
Division but not posted to the websites as of May 31, 2006. The IRCMU1
official said that as of November 2006 the problem of Intelligence
Information Reports not being posted to the websites in a timely manner
continued to exist.

In summary, the FBI did not accurately report the number of
intelligence products produced and disseminated to the U.S. intelligence and
law enforcement communities during FY 2004 because the title of the
reported statistic was poorly worded and did not represent the data that the
FBI intended to report. Directorate of Intelligence officials told us that after
FY 2004 the titles of statistics reported were changed to accurately reflect

26


5. Defendants Prosecuted

In the FY 2004 President's Budget Request to Congress, EQUSA
reported that 245 defendants were prosecuted in FY 2002 under its anti-
terrorism program activity. However, the LIONS data did not match the
number reported in the annual budget request as shown in the following
chart.

OIG Analysis of EOUSA Statistic -
Prosecuted - Defendants for
Program Activity Anti-terrorism
for FY 2002

Reported Supported Understated

Source: EOUSA and USAO budgets and
LIONS data, OIG interviews with EOQUSA
and USAO staff, and analysis of documents
provided by EOUSA and USAO staff

See Statistic 1 in the EOUSA Terrorism Statistics section for a discussion of
why we did no further testing of this statistic and why the statistic was
inaccurately reported.

6. Defendants Found Guilty

In the FY 2004 President’s Budget Request to Congress, EOQUSA
reported that 153 defendants were found guilty under its anti-terrorism
program activity during FY 2002. However, the LIONS data did not match
the number reported in the annual budget request as shown in the following
chart.

57


OIG Analysis of EOUSA Statistic - OIG Analysis of EOUSA Statistic -
Pending Terrorism and Anti-terrorism Pending Terrorism and Anti-terrorism
Cases at the end of FY 2002 Cases at the end of FY 2003

ua — 700; 637 —
640 | 560
480 Aan, 420 355
320 288 | 280 a——|
160 140

° ot} | 30:

Reported Supported Overstated _ Reported Supported Overstated
OIG Analysis of EOUSA Statistic -

Pending Terrorism and Anti-terrorism
Cases at the end of FY 2004

Source: USAO annual statistical reports

and LIONS data, OIG interviews with EOUSA
and USAO staff, and analysis of documents
provided by EOUSA and USAO staff

10. Defendants for Terminated Terrorism and Anti-Terrorism Cases

In the USAOs FY 2004 Annual Statistical Report, EOUSA reported that
the USAOs terminated terrorism and anti-terrorism cases against 643
defendants in FY 2004.°° We reviewed LIONS reports supporting the
number of defendants for which terrorism and anti-terrorism cases were
terminated during FY 2004. The LIONS data agreed with the number
reported in the Annual Statistical Report for FY 2004.

We then selected a judgmental sample of 294 of the 643 defendants
for which terrorism and anti-terrorism cases were terminated during FY 2004
and performed additional testing to determine the accuracy of the reported
number. We then requested that USAO officials provide information from
the case files to show the subject was linked to terrorist activity. If the case

55 EOUSA reported cases as terminated primarily when: (1) the case was dismissed,
(2) a judgment in the case was issued, or (3) the case was transferred to another USAO
district.

66


THE DEPARTMENT OF JUSTICE’S
INTERNAL CONTROLS OVER
TERRORISM REPORTING

U.S. Department of Justice
Office of the Inspector General
Audit Division

Audit Report 07-20
February 2007


APPENDIX I

Methodology for Sampling the FBI Statistic on Number of
Convictions

The FBI’s FY 2006 - FY 2011 Performance Plan includes a performance
goal to “Prevent, disrupt, and defeat terrorist operations before they occur.”
In its FY 2006 — FY 2011 Performance Plan, the FBI reported that its
investigations resulted in 206 convictions during FY 2004 towards the
achievement of this performance goal. To determine the accuracy of the
reported convictions, we:

« obtained a listing from the FBI showing details of the 206
convictions reported for FY 2004;

e selected a judgmental sample of 107 of the 206 convictions by
selecting all the convictions reported by the 7 FBI field offices with
the highest number of reported convictions (El Paso, Texas - 32;
Dallas, Texas - 22; Salt Lake City, Utah - 17; Atlanta, Georgia - 12;
Richmond, Virginia ~ 10; Philadelphia, Pennsylvania - 8; and
Charlotte, North Carolina - 6); and

* reviewed the case files and held discussions with the case agents
regarding whether the individuals were convicted of or pleaded
guilty to crimes under a terrorism statute, and how the convictions
met the FBI’s Performance Goal of “Prevent, disrupt, and defeat
terrorist operations before they occur.”

Methodology for Sampling EOUSA Statistics

For the 11 EOUSA operational statistics that we selected for detailed
testing that were reported 20 times, we obtained listings from the LIONS
system that is used to record data for the statistics reported. We then
compared the LIONS data to the number reported for each statistic to
determine if the LIONS data agreed with the reported number. Our
comparison showed the following.

92


APPENDIX III

EQUSA already currently maintains documentation to identify the source of terrorism-
related statistics, Please see the response to recommendation one above.

3. Maintain documentation of the procedures and systems used to gather or track the
statistics reported.

EOUSA already currently maintains documentation of the procedures used to gather or
track statistics. Please see the response to recommendation one above.

4 Maintain documentation of the methodologies and procedures used to verify the
accuracy of the statistics reported.

EOUSA already currently maintains documentation of the methodologies and procedures
used to verify statistical accuracy. Please see the response to recommendation one above.

‘5 Ensure that terrorism-related statistics are not reported unless evidence is maintained to
support the statistics.

This is a basic premise of any statistical reporting, and EOUSA fully agrees with it.
Please see the response to recommendation one above.

6. Establish and implement procedures to recode transactions in the LIONS system when
investigations that began as terrorism-related investigations do not link the case
defendants to terrorist activity.

EOUSA agrees that if the basic character of a given case changes over the course of its
investigation and/or prosecution, and if it would be inaccurate to report the case under the code it
was originally reported under, then the case should be recoded. However, EOUSA does not see
such situations arising very often. A defendant who once had links to terrorist activity will
always have or have had those links. Also, EQUSA would need to receive from the USAOs a
notice of change of code at some point prior to the close of the fiscal year in which the case was
finally terminated, since at that point the statistical recording of the case is finalized.

The question is what to do with cases where the defendant never had links to terrorism.
As indicated above, prior to this report, EQUSA and the USAOs were clear that such cases could
properly be coded as anti-terrorism cases so long as the case was brought as part of a pre-
existing operation, initiative or strategy legitimately intended to prevent terrorism in areas of
infrastructure vulnerability, or was otherwise referred to the USAO by the JTTF. Given OIG's
concer, however, EOUSA will modify and clarify its anti-terrorism code to eliminate any
confusion as to its meaning. Further, because certain anti-terrorism statistics are included in

115


Terrorism-related Statistics Reported by the
Department and its Components from
October 1, 2000, through September 30, 2005

20 statistics |
reported
33 times

49 statistics

16 statistics reported
reported
135 times 155 times
G Department
@FBI
oO Criminal Division
OG EOUSA |
124 statistics
reported
279 times

Source: Interviews with Department officials and Department documents

In testing the accuracy of these terrorism statistics, we excluded from
the 209 statistics 17 that were generated by agencies outside the
Department. For our initial testing of the remaining 192 statistics, we
interviewed Department officials from the FBI, the Criminal Division, EQUSA,
and other Department agencies to determine whether internal controls were
in place to ensure the 192 statistics were accurately gathered, classified, and

reported.

Through these interviews, we learned that the collection and reporting
of terrorism-related statistics within the Department is decentralized and
haphazard. Often, the official who reported the statistic gathered it through
telephone requests or e-mail to other Department staff. Also, for many of
the statistics reported, Department officials either had not established


APPENDIX I

Comparison of LIONS Data to Reported EOUSA Statistics

LIONS Data Agreed

Number With Number
Statistic Description Reported Reported
1. Number cases filed -— 365 in FY 2002 No
Defendants under the anti-
terrorism program activity 786 in FY 2003 Yes
725 in FY 2004 Yes®
2. Number of terrorism 103 in FY 2003 Yes
convictions
118 in FY 2004 Yes
3. Number of terrorism- 558 in FY 2003 Yes
related convictions
379 in FY 2004 Yes
4, Number of defendants 264 in FY 2003 Yes
sentenced to prison under
the anti-terrorism program 256 in FY 2004 Yes
activity
5. Number of defendants 245 in FY 2002 No

prosecuted under the anti-
terrorism program activity
6. Number of defendants found | 153 in FY 2002 No
guilty under the anti-
terrorism program activity

7. Number of terrorism cases 3 in FY 2001 No
tried
8. Number of terrorism and 682 in FY 2003 Yes
anti-terrorism cases against
defendants that were 504 in FY 2004 Yes
terminated
9, Number of terrorism and 737 in FY 2002 Yes
anti-terrorism cases pending
637 in FY 2003 Yes
719 in FY 2004 Yes
10. Number of defendants the | 643 in FY 2004 Yes

U.S, Attorneys terminated
terrorism and anti-
terrorism cases against

11. Percentage of defendants 87% in FY 2003 Yes
whose cases were
terminated that were
convicted

61 The 725 reported for FY 2004 was reported twice ~ once in the U.S, Attorneys
FY 2004 Annual Statistical Report and once in the FY 2006 President’s Budget Request to
Congress.

93


Summary Results: Review of Selected
Terrorism-Related Statistics Reported by
the Department and its Components

Number of Number of
Primary Statistics Times
Reporting Not Accurately | Inaccurately
Agency Reported Reported
FBI 8 of 10 11 of 13
EOUSA
(USAQs) 11 of 11 20 of 20
Criminal
Division 5 of 5 7 of 9
Totals 24 of 26 38 of 42

Source: OIG’s conclusion based on interviews with
Department officials and analyses of Department records

We also concluded that the FBI, EOUSA and the USAOs, and the
Criminal Division had not established effective internal controls to ensure the
statistics were accurately gathered, classified, and reported. Terrorism-
related statistics are considered in budgetary and operational decisions by
Department management, the President and Congress. Therefore, it is
essential that the Department and its component agencies make every effort
to ensure the accuracy of the statistics reported.

Our detailed testing of the accuracy of the 26 statistics reported is
discussed in the following sections.

FBI TERRORISM STATISTICS

We tested 10 FBI operational statistics reported 13 times from
October 1, 2000, through September 30, 2005. For each of the 10 statistics
tested, we reviewed evidence in support of each statistic, as well as the
internal controls in place to ensure the statistics were accurately reported.
As shown in the following charts, we found that the FBI did not accurately
report 8 of the 10 statistics we tested.

14


August 2006 or March 2006 reconstructed lists that the Criminal Division
officials said should be added to the August 2006 reconstructed lists.

Next, we selected a sample of the transactions included on the final
August 2006 reconciled reconstructed lists for each of the nine times the five
statistics were reported to test the support documentation. We requested
documentation from the Criminal Division to support that the transaction
was terrorism-related and that it occurred during the reporting period. The
Criminal Division provided documentation to support that all the transactions
tested were terrorism-related. However, as shown in the following table, the
Criminal Division provided documentation that showed a small number of
transactions tested did not occur during the reporting period and therefore
should not have been reported.

OIG Analysis of a Sample
Of Transactions Reported

Transactions Outside
Statistic Reported Tested Time Period
1. Individuals charged resulting from terrorism
investigations from 9-11-01 through 2-3-05 26 1

2. Individuals convicted or pleaded guilty
resulting from terrorism investigations from
9-11-01 through 2-3-05 15 ()
3.a. Individuals charged with material support
of terrorism or similar crimes from 9-11-01
through 8-5-04 45 1
3.b. Individuals charged with material support
of terrorism or similar crimes from 9-11-01
through 2-3-05 55 iL
4, Individuals convicted of material support of
terrorism or similar crimes from 9-11-01
through 2-3-05 28 0
5.a. Material support to terrorism cases and
matters participated in or coordinated as of
1-31-03 34 2
5.b. Material support to terrorism cases and
matters participated in or coordinated as of
1-31-04 46 2
5.c. Material support to terrorism cases and
matters participated in or coordinated from
10-1-02 through 9-30-03 71 2
5.d. Material support to terrorism cases and
matters participated in or coordinated from
10-1-03 through 9-3-04 76 2
Source: OIG interviews with Criminal Division staff, and analysis of documents provided
by Criminal Division staff

We discussed these inaccuracies with Criminal Division officials and
they agreed that the unsupported transactions should not have been included.

73


case file information provided by the USAO contained no indication
that the subject was linked to terrorist activity. When we asked an
AUSA to provide additional evidence to support a terrorism link, the
AUSA repeated the charges above and provided no additional
information of a terrorism link.

« The subject was charged with falsely representing a social security
number to be his own for the purpose of obtaining employment and
a security badge allowing him access to a secure area of an airport.
The case file information provided by the USAO contained no
indication that the subject was linked to terrorist activity. When we
asked an AUSA to provide an explanation of the subject’s link to
terrorism, the AUSA told us the subject was arrested as part of an
operation similar to Operation Tarmac. The AUSA provided no
additional explanation of a terrorism link. The charge against the
subject was subsequently dismissed.

« The subject was charged with: (1) conspiring with others to
produce identification documents affecting interstate commerce,
and (2) three counts of causing representatives of a Department of
Motor Vehicles to produce false identification documents by using a
false address on his application for the documents. The subject
pleaded guilty to one count of identification fraud and the other
three charges were dismissed. The subject was sentenced to time
served. The case file information provided by the USAO contained
no indication that the subject was linked to terrorist activity. When
we asked an AUSA to provide an explanation of the subject’s link to
terrorism, the AUSA told us that that the subject was arrested as
part of Project Facilitator, an operation to identify, arrest, and
convict individuals involved in identification fraud. The AUSA
provided no additional information to support the subject’s link to
terrorist activity.

We also found that 33 of the 294 cases, including 20 of the 229 that

were not linked to terrorism, either were not terminated during the year
reported or the USAOs could not provide documentation to show the cases
were terminated during the year reported.

Overall, considering both the defendants in cases that were not linked

to terrorism and the defendants in cases that were not terminated during
the year reported, EOUSA overstated the number of defendants for which

68


OIG Analysis of Terrorism-Related Statistics
Reported by the Criminal Division

= 7 Statistic Reported

1. Individuals charged resulting from
terrorism investigations from 9-11-01
through 2-3-05

2. Individuals convicted or pleaded guilty
resulting from terrorism investigations from
9-11-01 through 2-3-05

3.a. Individuals charged with material support
of terrorism or similar crimes from 9-11-01
through 8-5-04 (see Chart Endnote 1 on
page 74)

3.b. Individuals charged with material support of
terrorism or similar crimes from 9-11-01
through 2-3-05

4. Individuals convicted of material support of
terrorism or similar crimes from 9-11-01
through 2-3-05

5.a. Material support to terrorism cases and

matters participated in or coordinated as of
1-31-03 (see Chart Endnote 2 on page 75)

5.b. Material support to terrorism cases and
matters participated in or coordinated as of
1-31-04 (see Chart Endnote 3 on page 75)

Reported
Supported

More t|

5.c. Material support to terrorism cases and
matters participated in or coordinated from
10-1-02 through 9-30-03

5.d. Material support to terrorism cases and
matters participated in or coordinated from
10-1-03 through 9-3-04

600 500 400 300 200 100 0
Number Reported/Supported

Source: Criminal Division budgets, OIG interviews with Criminal Division staff, and analysis
of documents provided by Criminal Division staff

We determined that the statistics reported by the Criminal Division

were inaccurate primarily because the database used to track the statistics
was incomplete and not kept up-to-date. This database was incomplete
because the Criminal Division had not established formalized procedures to:
(1) instruct staff on what data should be reported in the database, and how
and when the data should be reported; or (2) validate the accuracy of the
information reported in the database.

xv


terrorist threats where the offense conduct is not obviously
a federal crime of terrorism. To the extent evidence or
information exists, in any form, reasonably relating the
case to terrorism or the prevention of terrorism (domestic
or international), the matter should be considered “anti-
terrorism.” For example, a case involving offenses such as
immigration violations, document fraud, or drug
trafficking, where the subject or target is reasonably linked
to terrorist activity, should be considered an “anti-
terrorism” matter or case. Similarly, a case of identity
theft and document fraud where the defendant’s
motivation is to obtain access to and damage sensitive
government facilities should be considered “anti-
terrorism.”

EOUSA’s definition indicates the anti-terrorism program activity is
meant to capture activity related to prevention or disruption of terrorist
threats where the conduct is not obviously a crime of terrorism. However,
the two examples cited indicate that the subject, target, or defendant must
be “reasonably linked to terrorist activity” to record the case under the anti-
terrorism program activity. Taken as whole, we believe this definition
establishes that a case or defendant must have some identifiable link to
terrorism to be categorized as an “anti-terrorism” case.

EOUSA disagrees with our interpretation of the definition of the anti-
terrorism program activity. EOUSA and USAO officials told us they believe
they correctly reported defendants under the anti-terrorism program activity
because almost all the defendants reported under this program activity were
arrested as the result of either operations carried out to prevent terrorism or
through JTTF activities.7° For example, Operation Tarmac was a worksite
enforcement operation launched in November 2001 at the nation’s airports.
During this operation, Department and other federal agents went into
regional airports and checked the immigration papers of airport workers.
The agents then arrested any individuals who used falsified documents, such
as social security numbers, drivers’ licenses, and other identification
documents, to gain employment. EOUSA officials told us they believe these
defendants are properly coded under the anti-terrorism program activity.
However, in response to our question, EOUSA’s Acting Deputy Director told
us that EOUSA could also properly code as anti-terrorism all cases arising
from any illegal immigrants arrested crossing the southwest border into the
United States, but have not done so. We do not agree that law enforcement

# The JTTFs are squads within the FBI's field offices that focus primarily on
addressing terrorism threats and preventing terrorist incidents.

38


OIG Analysis of Criminal Division Statistic -
Terrorist Financing or Material Support Investigations the

Criminal Division was Pursuing as of 1/31/04
500 450 400 350 300 250 200 150 100 50 0

More than 70 A- Reported
34 B - Supported on March 2006
Reconstructed List
| 71 C- Included on August 2006
| 7 Reconstructed List

Reconstructed List

E - Supported on Final Reconciled

| 7% D - Included on Final Reconciled
| ' Reconstructed List

72

F - Overstatement/Understatement
|

Source: Criminal Division budgets, OIG interviews with Criminal Division staff,
and analysis of documents provided by Criminal Division staff

OIG Analysis of Criminal Division Statistic -
Material Support to Terrorism Cases and Matters Participated

in or Coordinated from 10/1/02 through 9/30/03
500 450 400 350 300 250 200 150 100 50 0

70 A- Reported

|

| 30 B - Supported on March 2006
Reconstructed List

|

| C- Included on August 2006
Pad | Reconstructed List

102) D - Included on Final Reconciled
Reconstructed List

E - Supported on Final Reconciled
Reconstructed List

i
| u F - Significant Understatement
| = ra (E minus A)

100

Source: Criminal Division budgets, OIG interviews with Criminal Division staff,
and analysis of documents provided by Criminal Division staff

80


8. Terminated Terrorism and Anti-Terrorism Cases

In the USAQs FY 2003 and FY 2004 Annual Statistical Reports, EOQUSA
reported the following number of terrorism and anti-terrorism cases that had
been terminated against defendants.°!

e 682 during FY 2003
* 504 during FY 2004

We reviewed LIONS reports supporting the number of terrorism and
anti-terrorism cases that had been terminated against defendants for
FYs 2003 and 2004 and found that the LIONS data agreed with the numbers
reported in the annual statistical reports for both years.

We then selected a judgmental sample of the number of terrorism and
anti-terrorism cases terminated against defendants for FY 2003 and
FY 2004 and performed additional testing to determine the accuracy of the
reported numbers. We selected 364 of the 682 terrorism and anti-terrorism
cases terminated against defendants in FY 2003 and 240 of the 504
terrorism and anti-terrorism cases terminated against defendants in
FY 2004. We then requested that USAO officials provide information from
the case files to show the subject was linked to terrorist activity. If the case
file information provided did not show a terrorism link, we asked USAO
officials to provide additional information of a terrorism link. The
overstatements in the following charts reflect cases for which the USAOs did
not provide information of the terrorism link.>2

51 The USAOs Annual Statistical Reports contain: (1) narrative information
describing the USAO’s programs and initiatives, (2} summaries of some of the most
interesting and important cases that were handled by the USAQOs during the year, and
(3) statistical tables displaying both national and district caseload data. The USAOs
consider a case terminated primarily when the case is transferred to another USAO district,
the case is dismissed, or a judgment is issued in the case.

52 As noted in footnote 41 on page 43, the numbers supported for these statistics
are based on a sample of transactions reported.

59


disseminate potentially actionable intelligence to staff of the FBI, intelligence
community agencies, the White House, the State Department, the military,
and other selected federal agencies. The reports detail specific results of
classified intelligence collected on internationally based terrorist suspects
and activities. By design, the reports are not analyses or necessarily
validated intelligence, and are not broad assessments or estimates. The
FBI's Terrorism Reports and Requirements Section (TRRS) maintains a
database called Zeus that contains details of the Intelligence Information
Reports issued.*°

In the FY 2006 President’s Budget Request to Congress, the FBI
reported issuing 1,731 Intelligence Information Reports during FY 2003. In
the same budget request and in its FY 2006 - FY 2011 Performance Plan, the
FBI reported issuing 2,622 Intelligence Information Reports during
FY 2004.6 Because budget requests and performance plans are prepared
many months before the start of the fiscal year, the FBI usually reports
actual data for the fiscal year that is two years prior to the fiscal year for
which the budget requests and performance plans are prepared. As shown
in the following charts, we found that the Zeus database used by the TRRS
to track the number of Intelligence Information Reports did not support the
statistics reported for either FY 2003 or FY 2004.

25 The TRRS was established after the September 11 attacks to facilitate
information-sharing in an organized, systematic fashion. The TRRS mission is to support
U.S. government efforts to detect, disrupt, and prevent acts of terrorism by managing the
collection, evaluation, and dissemination of raw intelligence information on terrorism.

?6 Each year a President’s Budget Request to Congress is submitted that identifies
the funding needed to carry out the missions of the federal government for the year covered
by the budget. Performance plans are submitted each year with an agency's budget
request and includes performance goals and indicators for the fiscal year, a description of
the resources needed to meet the goals, and a description of how results will be verified and
validated. The 2,622 Intelligence Information Reports for FY 2004 was reported twice ~
once in the FY 2006 President’s Budget Request to Congress and once in the FY 2006 - FY
2011 Performance Plan.

20


OIG Analysis of FBI
Statistic - Counterterrorism

Threat Assessments Issued
in FY 2004
ll ——
bal 63
60° 51
il
207 wari = 12

Reported Supported Overstated

Source: FBI performance plans, OIG
interviews with FBI staff, and analysis
of documents provided by FBI staff

According to an official of the former TWWU, the TWWU inadvertently
reported 12 assessments issued during FY 2003 as being issued during
FY 2004. The former TWWU official told us that he is responsible for
recording and tracking the assessments in the word processing file. The
official said that he used an internal checklist to ensure the content of the
threat assessments was accurate and properly disseminated. The official
also said that he periodically checks the word processing file to ensure it is
accurate and up-to-date. However, we determined that the checklist did not
formalize the collection, verification, and reporting process for threat
assessments. At a minimum, the process should include controls such as
documenting: (1) the source of the statistic, (2) the procedures used to
track or gather the statistic, and (3) the methodologies and procedures used
to verify the accuracy of the statistic.

According to a TAU official, in June 2006, the CTAS established a new
tracking and monitoring intelligence production and dissemination system
where all Intelligence Bulletins, Intelligence Assessments, and other
intelligence products are logged into a spreadsheet application. As of
November 2006, the procedures on how to collect, verify, and report the
Intelligence Bulletins, Intelligence Assessments, and other intelligence
products issued were formalized in standard operating procedures at the unit
level, but had not been formalized at the section level other than a
production process checklist.

10. Presidential Terrorist Threat Reports

Presidential Terrorist Threat Reports, now known as National Terrorism
Bulletins, are produced by the National Counterterrorism Center from
intelligence products disseminated by agencies in the United States
intelligence community, including the Central Intelligence Agency, the FBI,

32


APPENDIX IIT

The Honorable Glenn A. Fine

Interna! Controls over Case Initiations

Examination of the detailed process for initiation of a counterterrorism
investigation further demonstrates the interna! controls exercised by the FBI to properly classify
as terrorism-related all convictions obtained through the investigative efforts of JTTFs. The FBI
has an established process for the initiation of counterterrorism operations. This process
conforms as apptopriate to the Alorney General's Guidelines for National Security Investigations
and the Attorney General's Guidelines for Criminal Investigations.

The FBI's Case Initiation Process

Upon receipt of information that points to an allegation or suspicion that an
individual or group potentially is involved in activity in support or execution of a terror plot,
Special Agents, Task Force Personnel, Intelligence Analysts and/or professional support
personnel, and a Field Supervisory Special Agent review the information in order to conduct a
threat assessment and to determine whether to initiate an investigation. Often, the Special Agent
in Charge or the Assistant Special Agent in Charge in the Field Office will review these new case
initiations for compliance with FBI standards and situational awareness requirements.

Headquarters Approval

Within 10 days of initiating the investigation, the field office must transmit a
summary of the predication to FBIHQ for review by substantive investigative supervisors.

If these supervisors determine that a terrorism nexus does not exist, FBIHQ will
advise the field office to reclassify the investigation and to move the case to a more appropriate
investigative team. Once FBIHQ agrees that the information properly warrants a terrorism
investigation, the JTTF conducts its investigation with the primary purpose being to detect,
penetrate, and disrupt terrorist networks and enterprise efforis. At the time that FBIHQ concurs
with the appropriate predication of each investigation the opening communication is transmitted
to the Department of Justice for review. After evaluating the totality of the investigative
findings, the FBI will pursue criminal charges as appropriate. Regardless of the nature of the
criminal charges, given the mission of the JTTFs and the requirement of a terrorism nexus to
ITTF investigations, the FBI correctly classifies as terrorism-related any conviction that results
from an appropriately predicated counterierrorism investigation and the work of counterterrorism
agents.

Enhanced Controls

In an effort to enhance the internal controls and improve centralized management
of investigations, the Counterterrorism Division last year implemented a case review process.
This process involves an FBIHQ review of each pending investigation every 90 to 120 days.
This review looks at investigative findings and facilitates a discussion with each field office on
their investigative plan and effort to mitigate any potential threat to national security.

101


indicates that stronger internal controls for verifying the accuracy of the
LIONS data are needed. Neither the semiannual certifications by the AUSAs
nor the triennial evaluation reviews have proven sufficient to ensure the
accuracy of the LIONS data.

OIG Testing of EQUSA and USAO Terrorism-Related Statistics

For each of the 11 statistics tested, we reviewed supporting evidence,
as well as the internal controls in place, to examine whether the statistics
were accurately reported. For a sample of the transactions reported for
each statistic we reviewed, we requested USAO officials provide
documentation from the case files to support that the transaction was
related to terrorism. If we could not identify a terrorism link from the initial
documentation provided, we asked the USAO officials to identify and provide
to us evidence of the terrorism link. We also reviewed the evidence
provided to determine if the transaction occurred during the period reported.
If the USAO officials did not identify the terrorism link or the transaction did
not occur in the period reported, we considered the transaction inaccurately
reported.

In August 2006, we briefed EOUSA officials on the results of our
testing that showed EOUSA did not accurately report the numbers reported
for any of the 11 statistics tested. EOUSA officials disagreed with our
conclusion that the statistics were inaccurately reported. The officials
requested additional time to review the transactions we questioned and
provide additional documentation to support the numbers reported. We
agreed with the request and EOQUSA subsequently provided additional
documentation that they believed supported most of the transactions we
questioned.

We reviewed the additional documentation and determined that it
supported only a minor number of the transactions we tested. We did not
accept much of the support provided by EOUSA officials because we disagree
with them on cases that can reasonably be counted in the “anti-terrorism”
category.

The EOUSA LIONS Manual defines the anti-terrorism program activity
as follows.

Any matter or case where the underlying purpose or object
of the investigation is anti-terrorism (domestic or
international). [Underlined in the originai.] This program
category is meant to capture United States Attorney Office
activity intended to prevent or disrupt potential or actual

37



APPENDIX III

Nevertheless, we have made improvements to these Teporting
mechanisms that have resulted in more accurate and up-to-date
statistics. We have revised both our Circular on Terrorism
Statistics and our Performance Measures. A copy of the revised
Circular was previously provided to the OIG, and we are
transmitting a copy of the revised Performance Measures by
separate cover.

Recommendation 2. Maintain documentation to identify the source of all terrorism-related
Statistics reported in official operational documents such as budget
requests, performance plans, statistical reports, and others.

Response: — The Counterterrorism Section concurs with this recommendation and intends to
maintain documentation in a more readily available manner to identify the source
of the statistics it reports.

Recommendation 3. Maintain documentation of the procedures and systems used to gather
or track the statistics reported.

Response: — The Counterterrorism Section concurs with this recommendation and intends to
maintain such documentation.

Recommendation 4. Maintain documentation of the methodologies and procedures used to
verify the accuracy of the statistics reported.

Response: — The Counterterrorism Section concurs with this recommendation. it will rely
primarily on the methodologies and procedures set forth in the recently updated
Circular on Terrorism Statistics which has been supplied to the OIG. The
additional systems described above will serve as back-up for the intemational
terrorism and terrorism-related cases database.

Recommendation 5. Ensure that terrorism-related statistics are not reported unless
evidence is maintained to support the statistics.

Response: — The Counterterrorism Section agrees that terrorism-related statistics should not be
Teported unless evidence is maintained to support the statistics,

122


and Department of Defense intelligence components.*° The reports are
provided to senior intelligence officials in the White House and U.S.
intelligence community agencies. The FBI’s Global Terrorism Analysis Unit
(GTAU) maintains a spreadsheet application that contains details of the
Presidential Terrorist Threat Reports issued.

In its FY 2006 - FY 2011 Performance Plan, the FBI reported that 88
Presidential Terrorist Threat Reports were issued during FY 2004. As shown
in the following chart, we found that the spreadsheet application maintained
by the GTAU to track the Presidential Terrorist Threat Reports issued did not
support the number issued for FY 2004.

OIG Analysis of FBI
Statistic - Presidential Terrorist
Threat Reports Issued in FY 2004

100

Al.

Reported Supported Overstated

Source: FBI performance plans, OIG
interviews with FBI staff, and analysis
of documents provided by FBI staff

A GTAU official told us the number of Presidential Terrorist Threat
Reports issued was overstated because: (1) the spreadsheet database was
probably queried for the statistic by calendar year or for another specific
time period instead of by fiscal year, and (2) the request for the statistic was
worded in such a way that it could produce different answers. However, the
GTAU official did not maintain documentation to show how the request for
the FY 2004 data was worded.

According to a GTAU official, the FBI units that issue the Presidential
Terrorist Threat Reports enter the reports issued into a database. The GTAU
relies on other FBI units to enter all the Presidential Terrorist Threat Reports
issued in the database. We found that no internal controls exist regarding
gathering and verifying the accuracy of Presidential Terrorist Threat Reports
tracked in the database. A GTAU official said that when she assumed her

35 While the National Counterterrorism Center is outside the control of the
Department of Justice, the FBI participates in the Center and tracks the number of
Presidential Terrorist Threat Reports issued by the Center.

33


OIG Analysis of EOUSA Statistic - | OIG Analysis of EOUSA Statistic -
| Terminated Terrorism and Anti-terrorism Terminated Terrorism and Anti-terrorism
Cases against Defendants in FY 2003 Cases against Defendants in FY 2004

1000 1000
900 ‘900
800 800
700 700
600 | 600
500 | 500
400 400
300 300
200 200
100 409

Reported Supported Overstated Reported Supported Overstated

Source: USAO annual statistical reports and LIONS data, OIG’s interviews of EOUSA
and USAO staff, and analysis of documents provided by EOUSA and USAO staff

9. Pending Terrorism and Anti-Terrorism Cases

In the USAOs FY 2003 and FY 2004 Annual Statistical Reports, EOUSA
reported the following number of pending terrorism and anti-terrorism cases
at the end of each year.

e 737 for FY 2002
¢ 637 for FY 2003
e 719 for FY 2004

We reviewed LIONS reports supporting the number of pending
terrorism and anti-terrorism cases for FYs 2002, 2003, and 2004 and found
the LIONS data agreed with the numbers reported in the annual statistical
reports for all 3 years.

We selected a judgmental sample of the pending terrorism and anti-
terrorism cases for FYs 2002, 2003, and 2004 and performed additional
testing to determine the accuracy of the reported numbers. We selected
487 of the 737 pending terrorism and anti-terrorism cases for FY 2002,

335 of the 637 pending terrorism and anti-terrorism cases for FY 2003, and
362 of the 719 pending terrorism and anti-terrorism cases for FY 2004. We
then requested that USAO officials provide information from the case files to
show the subject was linked to terrorist activity. If the case file information
provided did not show a terrorism link, we asked USAO officials to provide
additional information of a terrorism link. The overstatements in the

62


the criteria for the statistic reported but was counted on the August 2006
reconstructed lists, and (3) data was counted on the August 2006
reconstructed lists but was not on the March 2006 reconstructed lists. We
then met with Criminal Division officials and reconciled the differences
between the two sets of reconstructed data. As shown in the following table,
the reconciliation showed that the August 2006 reconstructed lists still were
inaccurate for seven of the nine times that the five statistics were reported,
although the data presented indicated the statistics had been understated,
not overstated as the previous data suggested.

OIG Reconciliation of the Criminal Division’s
August 2006 Reconstructed Lists

August 2006 Final Reconciled
Reconstructed Reconstructed
Statistic Reported List List Difference

1. Individuals charged resulting from
terrorism investigations from 9-11-01
through 2-3-05 382 383 1

2. Individuals convicted or pleaded guilty
resulting from terrorism investigations
from 9-11-01 through 2-3-05 216 216 it}

3.a. Individuals charged with material
support of terrorism or similar crimes
from 9-11-01 through 8-5-04 126 144 18

3.b. Individuals charged with material
support of terrorism or similar crimes

from 9-11-01 through 2-3-05 144 162 18

4. Individuals convicted of material support
of terrorism or similar crimes from
|___ 9-11-01 through 2-3-05 60 65 5

5.a. Material support to terrorism cases and
matters participated in or coordinated
as of 1-31-03 51 51 i}

5.b. Material support to terrorism cases and
matters participated in or coordinated
as of 1-31-04 71 74 3

5.c. Material support to terrorism cases and
matters participated in or coordinated
from 10-1-02 through 9-30-03 100 102 2

5.d. Material support to terrorism cases and
matters participated in or coordinated
from 10-1-03 through 9-3-04 122 124 2

Source: OIG interviews with Criminal Division staff, and analysis of documents provided
by Criminal Division staff

The differences between the final reconciled reconstructed lists and the
August 2006 reconstructed lists were either: (1) data that was counted on
the March 2006 reconstructed lists and not on the August 2006
reconstructed lists that the Criminal Division officials agreed should be added
back to the August 2006 reconstructed lists, or (2) data that was not on the

72


the data presented. In addition, the officials said that the FBI has improved
its statistical reporting system through the use of the FBI Intelligence
Dissemination System, which became operational in FY 2005 and helped
standardize production and collection of statistical data. The officials said
that in FY 2005 the Directorate of Intelligence has instituted a monthly
Program Review Process to provide a more mature system for gathering and
verifying program data. The officials told us that internal controls are now in
place for gathering and verifying the number of Intelligence Bulletins,
Intelligence Assessments, and Intelligence Information Reports that have
been posted to the websites by the four FBI divisions.

6. Terrorist Threats

The FBI's Counterterrorism Division oversees FBI counterterrorism
initiatives, and the Division’s Threat Monitoring Unit (TMU) supports the
FBI's role by receiving, assessing, and disseminating threat information and
suspicious activity. The TMU reports threats tracked to the Counterterrorism
Division’s Administrative Section.

In the FY 2006 President’s Budget Request to Congress, the FBI
reported 515 terrorism threats tracked during FY 2003, and 4,499 during
FY 2004. However, the number reported for FY 2003 represented only the
last 2 months of FY 2003 instead of the entire year. As shown in the
following charts, we found that the database used by the TMU to track
threats did not support the numbers reported for FY 2003 or FY 2004.

OIG Analysis of FBI Statistic - OIG Analysis of FBI Statistic -

Threats Tracked during Last 2 Threats Tracked during
Months of FY 2003 FY 2004
1000 a 5000; 4499
4049
800 4000
600 515 rere 3000
400 2000
200 re 450
o —___| G |
Reported Supported Overstated Reported Supported Overstated _

Source: FBI budget requests, OIG interviews with FBI staff, and analysis of
documents provided by FBI staff

The inaccuracies occurred primarily because the reported statistics
included threats that were counted multiple times. According to a TMU
official, the TMU reported threats being tracked each month and the
subsequent month’s count of threats tracked included threats counted during
previous months that were still being investigated and tracked. The threats

27


APPENDIX III

the prevention of terrorist activity. The JTTF’s mission is to prevent terrorist attacks before they
occur and to investigate actual acts of terrorism. Indeed, the report concedes that the “JTTFs?
focus originate[s} in concems regarding terrorism” (Report at xii). But why a case referral from
the JTTF is not by itself sufficient to code a matter or case as anti-terrorism is never explained.

The report also notes that it sought to “test the extent to which J TTF-referred cases
consistently had a link to terrorism” by requesting additional documentation on 21 JTTF-referred
cases. Report at 38. OIG determined that 13 of the 21 sample cases did not have an appropriate
link to terrorism, but the basis on which this judgment was made was not identified.

Third, OIG reports that for a small percentage of cases in statistics 1, 2, 3, 4, 8, 9, and 10,
the USAOs either erroneously reported certain statistical measures or “could not provide
documentation” to support the reported data. But OIG did not discuss or share with EOUSA the
actual case documentation it received from the USAOs that OIG used to support such findings.
Thus, these findings are not subject to transparent review.

For instance, the report asserts in statistic number | that “either [certain] cases were not
filed in the year reported or the USAOs could not provide documentation to show the cases were
filed in the year reported.” Report at 46. The report does not identify which basis is relied upon
for which case, and EOUSA is not confident that either assertion is factually accurate. On one
hand, the assertion implies that the USAOs did not have a copy of the charging document in
every case examined. But to the extent OIG did not obtain a copy of the charging document for
each case, we believe such a failure must result from a lack of communication with the USAQs,
hot because the USAOs do not have a copy of this most critical, public document, which is
necessary for any prosecution to go forward.

On the other hand, to the extent that OIG compared the “case date” field in LIONS with
original documents evidencing the actual date that a charging instrument was filed in court, it
would not be uncommon for the two dates to differ, and that difference should not be used to
assert that a case or data entry was inaccurate or unsupported. This is because the LIONS “case
date” field shows when the data was entered into the LIONS database, i.e., the date that the
docketer literally sat down at the computer and entered the data. A separate data field shows the
actual date that the indictment or other charging instrument was filed in court. We are unaware
if OIG was aware of this difference, and we are unaware of any discrepancy between the true
date the case was filed in court and such data in LIONS.”

Similarly, we note that there are appropriate and understandabie differences in the
LIONS data between the “disposition date” and the “sentencing date,” but that it was not clear

7 In order to report data on an annual basis, EOUSA protocol requires that case data be cut off at
the temporal close of the fiscal year. Data that is entered after the close of the fiscal year that
relates to events that occurred in the previous fiscal year, such as the actual filing of charges in
court, are not included as part of the previous fiscal year’s data. This is the standard used in
most annual data systems. Were it otherwise, there would be no finality to annual “year end”
data. A USAO could always go back and change the previously compiled totals for a prior fiscal
year, That is why the “case date” field is used when providing annual data.

113


APPENDIX II

Statistic Reported

Where Reported

13. Number of new AUSAs as a
result of building a long-term
counterterrorism policy

Attorney General Congressional
Testimony dated 4-1-03

14, Number of convictions or guilty
pleas resulting from 70
investigations into terrorist
financing

Attorney General Congressional
Testimony dated 3-6-03 and 4-1-03

15. Number of major alien
smuggling networks disrupted
as a result of the Department
disrupting potential terrorist
travel

Attorney General Congressional
Testimony dated 3-6-03 and 4-1-03

16. Number of subpoenas and
search warrants issued to gather
and cultivate detailed
intelligence on terrorists in the
U.S.

Attorney General Congressional
Testimony dated 3-6-03 and 4-1-03

97



APPENDIX III

The Honorable Glenn A. Fine

5. Ensure that terrorism-related statistics are not reported unless evidence is
maintained to support the statistics.

This is a basic premise of statistical reporting, with which the FBI fully agrees.
Consistent with the improved controls as described above, the FBI will not report slalistics which
can not be supported.

Sincerely,

Wut. T. Nulon—

Willie T. Hulon
Executive Assistant Director
National Security Branch

106


APPENDIX IIT

part of a national or district-wide, pre-existing strategy to prevent terrorism, the case should be
coded as an anti-terrorism case. Third, because the OIG had said it did not plan to review any
classified information, EOUSA wanted to be sure that any such classified links were at least
identified.

The results showed that overall, 81 percent of the cases that OIG considered unsupported
or inaccurate met at least one of these three criteria. Once these cases are considered to be
accurately coded, even assuming that all the remaining cases are inaccurately coded, then the
overall number of supported cases for most statistics would be well over 90 percent, a level that
OIG considers to be within normal statistical limits.

EQUSA’s analysis covered not only the cases that were coded as anti-terrorism, but the
majority of “terrorism-related” cases found in statistic number 3 as well. The “terrorism-related”
cases in statistic 3 are comprised of a majority of anti-terrorism cases as well as a smaller
number of terrorism hoaxes and terrorism financing cases, each of which have their own separate
program category code.*

Finally, the OIG report expresses concer that EOUSA’s definition of its anti-terrorism
code would “permit[] criminal cases arising from virtually any federal law enforcement effort,
including immigration violations or border enforcement activities, to be categorized as anti-
terrorism regardless of the actual circumstances.” Report at xiii; see also Report at 38-39.
OIG’s fear is unfounded. First, this has not occurred and the OIG report does not show or
purport to show that such a thing has occurred. Indeed, in FY 2002, the year the anti-terrorism

enforcement officers, The JTTFs have a two-fold mission: to prevent terrorist attacks before
they occur and to mount an immediate investigative response when an act of terrorism has
occurred. The prevention phase involves collecting, analyzing, and utilizing intelligence
gathered on groups or individuals whose presence may threaten U.S. persons or interests, to
prevent a terrorist act from occurring.

* The interpretation of the anti-terrorism definition does not affect statistic numbers 2 and 7,
which relate only to terrorism convictions and terrorism trials, respectively. EOUSA agrees that
the defendants in any terrorism-coded case must absolutely have an identifiable link to terrorist
activity. Our review of the terrorism cases in statistic 2 showed that a number of these
convictions were coded as terrorism cases when they could have been coded as anti-terrorism.
We note, however, that the overstatement in statistic 2 is much fess than it is for any of the other
statistics, and is a deviation just over 10 %. For statistic number 7, terrorism trials occurring in
FY 2001, we note that the total sample there was four terrorism trials, and there was a failure to
report one of the four. Such an error is a simple one-time reporting error, resulting in an under-
reported, not over-reported, statistic.

Certain other anti-terrorism statistics that were generated in FY 2002, numbers 1a, 5, and 6, were
also under-reported because, as explained in the OIG report, the anti-terrorism code was
introduced one month prior to the close of the fiscal year, and despite EQUSA’s request to the
USAOs to re-code cases by the close of the fiscal year, that effort took longer than one month
and the updated responses could not be included in the year-end data that went into the Annual

Report.

111


D. Status of Recommendations

1.

This recommendation was directed to the FBI, EQUSA, and Criminal
Division to establish and document internal control procedures for
gathering, verifying, and reporting terrorism-related statistics.

FBI: Resolved. The FBI generally agreed with the recommendation
but noted concerns about our analysis of terrorism-related convictions.
Those concerns are discussed in Section A of this appendix. However,
the FBI stated that it has improved oversight at FBI Headquarters and
enhanced policy guidance to strengthen its internal controls, which will
limit the improper reporting of terrorism-related statistics in the future.
This recommendation can be closed when we receive documentation of
the FBI’s enhanced policy guidance to strengthen its internal controls for
gathering, verifying, and reporting terrorism-related statistics.

EOUSA: Unresolved. EOUSA stated that it agrees with the
recommendation but believes that it is already complying with it.
EOUSA’s response reiterated the five tools that we explained in the
report it uses to ensure that the LIONS data is correct. However, as we
also explained in the report, the USAQOs are only required to use one of
the five tools - the United States Attorneys’ semi-annual self-
certification that the LIONS data is complete and accurate. EOUSA only
suggested that the USAQOs use the other four tools (case certifications
by events tooi, Alcatraz Case Certification report, AUSA workload
reports, and Alternate District Reporting Method). EOUSA’s response
also provided no data to indicate the extent to which the USAOs use
these suggested tools to ensure the accuracy of LIONS data. In
addition, EOUSA stated that the primary cause of the differences we
questioned is our interpretation of EOUSA’s definition for its anti-
terrorism code, and the differences were not the result of failures of
controls EOUSA has in place.

As discussed above, that is not correct. Some of the differences we
questioned were related to the anti-terrorism code, but EOUSA’s
statistics were still inaccurate apart from that issue. Moreover, we also
found four statistics for which EOUSA stated that it had established
controls but the controls were not documented. EOUSA’s response did
not address this issue. Therefore, we do not agree that EOQUSA has
already complied with this recommendation. This recommendation can
be closed when we receive documentation showing that EOUSA has
established and documented internal control procedures for gathering,
verifying, and reporting terrorism-related statistics.

135


Criminal Division: Resolved. The Criminal Division concurred with
the recommendation and intends to rely primarily on the methodologies
and procedures set forth in the recently updated Circular on Terrorism
Statistics. The Criminal Division will also use the additional systems
described above as back-up for the international terrorism and
terrorism-related cases database. This recommendation can be closed
when we receive documentation showing how the Criminal Division
plans to verify the accuracy of the statistics it reports.

This recommendation directed to the FBI, EOUSA, and Criminal Division
to ensure that terrorism-related statistics are not reported unless
evidence is maintained to support the statistics.

FBI: Resolved. The FBI agreed with this recommendation and stated
that it is the basic premise of statistical reporting. The FBI stated that it
will not report statistics which cannot be supported. This
recommendation can be closed when we receive documentation showing
how the FBI plans to ensure that terrorism-related statistics are not
reported unless evidence is maintained to support the statistics.

EOUSA: Unresolved. EOUSA responded that this recommendation is
the basic premise of any statistical reporting and that EOUSA fully
agrees with it. However, as noted in the report, we found that EOUSA
could not provide a listing from its LIONS system to match the numbers
reported for 4 of its 11 statistics. Moreover, we also found four
statistics for which EOUSA stated that it had established controls but the
controls were not documented. However, EOUSA did not address this
issue in its response. Therefore, we do not agree that EOUSA has
adequately addressed this recommendation. This recommendation can
be closed when we receive documentation showing EOQUSA’s plans to
ensure that terrorism-related statistics are not reported unless evidence
is maintained to support the statistics.

Criminal Division: Resolved. The Criminal Division concurred with
the recommendation and agrees that terrorism-related statistics should
not be reported unless evidence is maintained to support the statistics.
This recommendation can be closed when we receive documentation
showing how the Criminal Division plans to maintain documentation of
the procedures and systems used to gather or track the statistics it
reports.

This recommendation was directed to EOQUSA to establish and
implement procedures to recode transactions in the LIONS system when

139


variety of terrorism-related statistics measuring these counterterrorism
efforts.

We identified the terrorism-related statistics reported by the
Department and its components by:

e interviewing officials from the Department, the FBI, the Criminal
Division, and EOQUSA;

e analyzing budget submissions, congressional testimony,
performance plans, and other documents maintained by the
Department and its components; and

e viewing the website maintained by the Department at
www.lifeandliberty.gov to keep the public informed of the
Department's counterterrorism efforts.

In total, we identified 209 unique terrorism-related statistics that were
reported by the Department and its components 602 times from October 1,
2000, through September 30, 2005.* The following chart shows which
components reported these 209 statistics.

2 While some terrorism-related statistics were reported only once, most were
reported multiple times. Many of the statistics identified were also reported by more than
one agency. We calculated the total times the statistic was reported by adding the number
of times the statistic was reported by both the primary reporting agency and by other
agencies.


transparent.” We agree that this corrective action is needed, and we believe
EQUSA’s intended action is appropriate and responsible.

Third, to support its argument that the OIG is mistaken in its position
not to support inclusion of all Operation Tarmac-type cases as anti-terrorism
cases, EOQUSA cites a January 2003 report by the Government Accountability
Office (GAO) that allegedly “reviewed EOUSA’s terrorism statistics and
confirmed that Operation-Tarmac-type cases were properly coded as anti-
terrorism cases.” EOUSA further claims that “OIG’s interpretation of the
anti-terrorism code therefore differs not only from EQUSA’s and that of the
USAOs, but with the GAO's interpretation as well.”

In fact, the GAO report cited by EQUSA did not confirm that Operation
Tarmac-type cases were properly coded as anti-terrorism cases. Rather, the
GAO report concluded that the Department of Justice did not have sufficient
management oversight and internal controls in place to ensure the accuracy
and reliability of terrorism-related convictions.

However, upon receipt of EOUSA’s response, we contacted GAO
managers regarding the report language quoted by EQUSA. The GAO
managers stated that the GAO report should not be construed as an
endorsement of EOUSA’s classification of such cases as “anti-terrorism.”
GAO managers said their report neither confirmed that Operation-Tarmac-
type cases were properly coded as anti-terrorism cases or endorsed EOQUSA’s
use of the anti-terrorism code.

Fourth, similar to the FBI’s response, EOUSA claims that any case
investigated by a JTTF “regardless of whether the defendant has verifiable
links to terrorist activity, is going to be, by definition, part of a proactive
effort to prevent terrorism because that is what the JTTF does.” As noted in
our response to the FBI’s comments, we disagree with this argument. An
investigative lead may be pursued by the JTTF but the outcome of the
investigation may clear the defendant of any connection to terrorism while
finding other criminal activity. We believe it to be inaccurate to include all
such convictions as anti-terrorism simply because a JTTF pursued the
investigation rather than other investigators.

Fifth, EQUSA disputed “certain aspects of the methodology used in the
OIG review,” and argued that it was inaccurate or misleading to report that
EOUSA and USAO statistics were “unsupported” because some of the
statistics were under-reported rather than over-reported. EOUSA stated that
because 3 of the 11 statistics and 4 of the 19 subcategories were

129


APPENDIX I

Primary
Reporting System Used to Track
Description of Statistic Agency Statistic
12. Number of individuals | Criminal Counterterrorism Section’s
who have been Division database
convicted or pleaded
guilty as a result of
terrorism
investigations
13. Number of people Criminal Counterterrorism Section’s
charged with material | Division database
support of terrorism or
similar crimes
14. Number of people Criminal Counterterrorism Section’s
convicted of material Division database
support of terrorism or
similar crimes
15. Number of material Criminal Deputy Chief of
support to terrorism Division Counterterrorism Section’s
cases and matters the manual count based on e-mails
Criminal Division received from Counterterrorism
participated in or Section attorneys and the
coordinated Deputy for Terrorist Financing
16. Number cases filed - EOUSA EOUSA LIONS
defendants for
program activity anti-
terrorism
17. Number of terrorism EOUSA EOUSA LIONS
convictions
18. Number of terrorism- | EQUSA EQUSA LIONS
related convictions.
19. Number sentenced to | EOUSA EOUSA LIONS
prison ~ defendants
for program activity
anti-terrorism
20. Number prosecuted - | EOUSA EOUSA LIONS
defendants for
program activity anti-
terrorism
21. Number guilty ~ EOQUSA EOUSA LIONS

defendants for
program activity anti-
terrorism

90


| OIG Analysis of EOUSA Statistic - OIG Analysis of EOUSA Statistic -

Terrorism Convictions Terrorism Convictions
during FY 2003 during FY 2004

200 ——— — 150
160 | 125
120 203 t99
86 75
= 50
40} — 17 25
oO o

Reported Supported Overstated Reported Supported Overstated

Source: EOUSA and USAO budgets and LIONS data, OIG interviews with EQUSA
and USAO staff, and analysis of documents provided by EOQUSA and USAO staff

3. Terrorism-Related Convictions

In the FY 2005 and FY 2006 President's Budget Requests to Congress,
EOUSA reported 558 terrorism-related convictions for FY 2003 and 379
terrorism-related convictions for FY 2004.*° We reviewed LIONS reports
supporting the number of terrorism-related convictions for FYs 2003 and
2004 and found that the LIONS data agreed with the numbers reported in
the budget requests for both years.

We then selected a judgmental sample of the terrorism-related
convictions reported for FY 2003 and FY 2004 and performed additional
testing to verify the reported numbers. We selected 301 of the 558
terrorism-related convictions reported for FY 2003, and 166 of the 379
terrorism-related convictions reported for FY 2004. We then requested that
USAO officials provide information from the case files to show the subject
was linked to terrorist activity. If the case file information provided did not
show a terrorism link, we asked USAO officials to provide additional
information of a terrorism link. The overstatements in the following charts
reflect defendants for which the USAOs did not provide information of the
terrorism link.*”

“© EQOUSA reports terrorism-related convictions separately from terrorism
convictions. EOUSA defines a terrorism conviction as domestic and international incidents
that involve acts, including threats or conspiracies to engage in such acts, which are violent
or otherwise dangerous to human life and which appear to be motivated by an intent to
coerce, intimidate, or retaliate against a government or a civilian population. EOUSA
defines a terrorism-related conviction as incidents involving terrorism-related hoaxes,
terrorist financing, and a matter or case where the underlying purpose or object of the
investigation is anti-terrorism related.

‘7 As noted in footnote 41 on page 43, the numbers supported for these statistics
are based on a sample of transactions reported.

50


LIONS. In August 2006, we discussed with EOQUSA staff corrective actions
taken by the USAQs in response to the GAO recommendations.

An EQUSA official told us that EOUSA had taken steps to correct the
problem identified by GAO by establishing procedures, effective
October 22, 2004, for maintaining accurate and reliable caseload data. The
EQUSA official also said that the United States Attorneys were instructed via
memoranda from the Director of EQUSA to certify their respective caseload
data as far back as 1997. Those procedures were not documented as part of
the formal United States Attorneys’ Procedures unti! October 22, 2004. The
formalized procedures include several report tools that the Assistant United
States Attorneys (AUSAs) can use to ensure the accuracy of LIONS data
before certifying the data. The report tools include the: (1) Alcatraz Case
Certification, (2) Case Certification by Event, (3) AUSA Workload Reports,
and (4) Alternate District Reporting Methods.7° In September 2006 the GAO
noted the actions taken by EOQUSA and closed its recommendation.

The EOQUSA official also told us that the AUSAs are encouraged to use
the report tools to ensure accuracy of the LIONS data, but use of the report
tools is not required. The EOUSA official said that regardless of what the
AUSAs do to ensure the accuracy of the LIONS data, the United States
Attorneys must certify the accuracy of all cases, matters, and appeals in
LIONS twice a year. The EOUSA official also commented that the AUSAs
realize how important it is for them to properly code cases and they take
those responsibilities seriously. The EOUSA official said that in view of the
required certifications, they had not required the USAOs to implement
additional internal controls to ensure the accuracy of LIONS data. Moreover,
the EOUSA official told us that EOUSA conducts internal evaluation reviews
of the USAQs every 3 to 4 years using AUSAs from different USAOs than the
USAO being reviewed. Part of the review involves verifying whether the
USAs completed the semiannual certifications of the LIONS data, but the
reviews do not involve testing of the accuracy of LIONS data.

As detailed below, our testing showed that terrorism-related statistics
reported by EQUSA and the USAOs were not accurately reported. This

3° The Alcatraz Case Certification report is a case management software application
tool available to USAOs to assist in managing their district’s caseload in LIONS. The Case
Certification by Event report is a LIONS standard report that lists civil or criminal cases that
have been certified in LIONS by using the event code CERT. The AUSAs Workload Reports
are used to certify the accuracy of matter, cases, and appeals. The Alternate District
Reporting Methods allow USAQs to use district generated reports to certify caseloads
consistent with local work flow.

36


APPENDIX I

AUDIT OBJECTIVE, SCOPE, AND METHODOLOGY

Our objective was to determine if Department components and the
Department as a whole properly gather, classify, and report accurate
terrorism-related statistics. We conducted our audit in accordance with the
Government Auditing Standards and included such tests as were considered
necessary to accomplish our objectives. Our audit concentrated on, but was
not limited to, the period October 1, 2000, through September 30, 2005.

We performed audit work at the Department’s Office of Public Affairs,
the Federal Bureau of Investigation (FBI) headquarters, the Criminal Division
headquarters, the Executive Office for United States Attorneys (EOQUSA)
headquarters, and the Justice Management Division (JMD) headquarters, all
in Washington, D.C. We also conducted audit work at the following FBI field
offices and United States Attorney's Offices (USAQ).

FBI Field Offices

Atlanta, Georgia
Baltimore, Maryland
Charlotte, North Carolina
Dallas, Texas

El Paso, Texas
Philadelphia, Pennsylvania
Salt Lake City, Utah

USAQOs

Los Angeles,. California
Denver, Colorado
Washington, D.C.
Tampa, Florida
Detroit, Michigan
Newark, New Jersey
Houston, Texas
Alexandria, Virginia

We performed the following work at the Department's Office of Public
Affairs, FBI headquarters, EQUSA headquarters, Criminal Division
headquarters, and JMD headquarters:

85


FINDING AND RECOMMENDATIONS

DEPARTMENT COMPONENTS LACK EFFECTIVE
CONTROLS FOR REPORTING ACCURATE
TERRORISM STATISTICS

Department components did not accurately report
terrorism-related statistics in their annual budgets,
financial statements, performance plans, and statistical
reports. For most statistics we tested, the component
either could not provide support for the numbers reported
or could not identify the terrorism link used to classify
statistics as terrorism-related. Some of the statistics were
significantly overstated and some understated. We
concluded that the components lacked effective internal
controls to ensure accurate reporting of terrorism-related
statistics.

Our Audit Approach

We developed a universe of 209 terrorism-related statistics that were
reported by the Department and its components from October 1, 2000,
through September 30, 2005. The 209 statistics were reported at least 602
times. Seventeen of the 209 statistics were obtained from agencies outside
the Department, such as the Departments of Treasury, State, Defense, and
Homeland Security. Because these 17 statistics were not gathered by the
Department, we excluded them from our review. The 17 statistics
originating outside the Department accounted for 98 of the 602 times that
the 209 statistics were reported.

The remaining 192 terrorism-related statistics were reported by and
sourced to the FBI, the Criminal Division, the USAOs, and the Department as
a whole. We divided the 192 statistics into two groups. The first group
consisted of statistics used primarily for operational purposes that were
reported in annual budgets, annual financial statements, statistical reports,
and performance plans. The second group consisted of statistics used
primarily for informational purposes reported in speeches, press releases,
and unclassified publications. We classified 123 of the 192 statistics as
operational and the remaining 69 as informational.

For our initial testing, we interviewed Department officials from the

FBI, EOUSA, the Criminal Division, and other Department agencies to
determine whether internal controls were in place and documented to ensure

10


audit and inspection reports issued from September 2003 through
September 2005.1”

In a January 2003 report, the GAO reported on the Department's need
for better controls and oversight of terrorism-related statistics.‘® The GAO
reported that in FY 2001 the Department switched from using the FBI’s
terrorism-related conviction statistics to using those of EQUSA for its annual
report because of: (1) concerns raised by a newspaper article’s allegation
that the Department had inflated its terrorism numbers in its FY 2000

17 The nine reports are:

Department of Justice, Office of the Inspector Genera. Follow-up Audit of the Department
of Justice Counterterrorism Fund, Audit Report Number 03-33, September 2003

Department of Justice, Office of the Inspector General. Federa/ Bureau of Investigation
Casework and Human Resource Alfocation, Audit Report Number 03-37, September 2003

Department of Justice, Office of the Inspector General. The Federa/ Bureau of
Investigation’s Foreign Language Program - Translation of Counterterrorism and
Counterintelligence Foreign Language Material, Audit Report Number 04-25, July 2004

Department of Justice, Office of the Inspector General: Audit Report Number 04-39,
Internal Effects of the Federal Bureau of Investigation’s Reprioritization, September 2004

Department of Justice, Office of the Inspector General. The Federa/ Bureau of
Investigation’s Efforts to Hire, Train, and Retain Intelligence Analyst, Audit Report Number
05-20, May 2005

Department of Justice, Office of the Inspector General. Review of the Terrorist Screening
Center, Audit Report Number 05-27, June 2005

Department of Justice, Office of the Inspector General, Evaluation and Inspection Division.
The Department of Justice’s Terrorism Task Forces, Report Number I-2005-007, June 2005

Department of Justice, Office of the Inspector General. The Federal Bureau of
Investigation’s Foreign Language Translation Program Follow-Up,
Audit Report Number 05-33, July 2005

Department of Justice, Office of the Inspector General. External Effects of the Federal
Bureau of Investigation’s Reprioritization Efforts, Audit Report Number 05-37, September
2005

18 General Accounting Office. Justice Department, Better Management Oversight
and Internal Controls Needed to Ensure Accuracy of Terrorism-Related Statistics, GAO-03-
266, January 2003. On July 7, 2004, the GAO was renamed the Government Accountability
Office.


APPENDIX I

Terrorism-Related Statistics Selected for Detailed Testing

Primary
Reporting System Used to Track
Description of Statistic Agency Statistic
1. Number of Intelligence | FBI Terrorism Reports and
Information Reports Requirements Section’s database
issued
2. Number of threats FBI Threat Monitoring Unit’s
tracked spreadsheet database and
Guardian Threat Tracking
System
3. Number of threats to FBI Counterterrorism Watch’s
transportation and Operational! Support Log and
facilities Spreadsheet summary
4. Number of threats to FBI Counterterrorism Watch’s
people and cities Operational! Support Log and
spreadsheet summary
5. Intelligence FBI Global Terrorism Analysis Unit’s
Assessments issued database
6. Number of intelligence | FBI Intelligence Requirements and
Products produced/ Collection Management
disseminated to the Unit 1‘s spreadsheet
U.S. Intelligence
Community and
appropriate
federal elements
7. Number of FBI Global Terrorism Analysis Unit’s
Intelligence Bulletins database and the Threat Analysis
issued Unit's word processing file
8. Number of FBI Threat Analysis Unit’s word
Counterterrorism processing file
threat assessments
produced
9. Number of FBI Global Terrorism Analysis Unit's
Presidential Terrorist database
Threat Reports
produced
10. Number of convictions | FBI Integrated Statistical Reporting
and Analysis System
11. Number of individuals | Criminal Counterterrorism Section’s
charged as a result of | Division database

terrorism
investigations

89



« The case agents could explain and provide documentation to link
only 42 of the 107 convictions to the achievement of the FBI’s
performance goal. Only 4 of these 42 individuals were actually
convicted of or pleaded guilty to a crime under a terrorism statute.

« Seven of the remaining 65 convictions were erroneously entered
into the Automated Case Tracking System (ACS) twice.

Some examples of convictions that the FBI reported as helping achieve
its performance goal of preventing, disrupting, or defeating terrorist
operations before they occur, but for which the FBI could not provide
documentation to support a link to terrarism are as follows:

* The subject, an Iranian national, made false statements while being
interviewed by an FBI agent. The FBI agent’s summary of the case
indicated that no evidence of terrorism was discovered. However,
the subject was shown to be a pathological liar who was not able to
provide truthful information about anything. The FBI agent said
that none of the collateral interviews conducted uncovered any
terrorist activity. The subject was convicted of knowingly and
willfully making a materially false, fictitious, or fraudulent statement
or representation.

« The subject was employed by a state Department of Motor Vehicles
and was responsible for receiving and approving applications from
individuals for the issuance of driver’s licenses. In exchange for
money, the subject conspired with others to arrange for driver’s
licenses to be issued illegally to individuals who were not legally
qualified to abtain the driver's licenses. The case evidence provided
by the FBI contained no indication that the subject was linked to
terrorist activity. When we asked an FBI official to provide
additional evidence to support a terrorism link, the official provided
no additional evidence. The subject was canvicted of:

(1) conspiring to commit an offense against the United States or to
defraud the United States or any agency thereof, and (2) producing
a fraudulent identification document.

« The subject telephoned the local police department and reported
that 30 vials of Yersinia Pestis bacteria, the infectious agent of
bubonic plague, could not be located. During FBI questioning, the
subject admitted that he had accidentally destroyed the vials and
made up the story in an effort to account for the vials. The case
evidence provided to us by the FBI contained no indication that the

18


APPENDIX III

The Honorable Glenn A. Fine

systems and presents the information in a unified format and is available to all senior managers at
FBIHQ and our Field Offices. COMPASS is one illustration of the FBI's commitment to
improve and share statistical reporting with our senior managers. The buik of the information
captured in COMPASS is used intemally to identify trends and evaluate progress against our
defined strategic objectives. Over the past 12 months extensive efforts have been made to
redefine performance metrics that illustrate the FBI's achievements against strategic outcomes.

Many of the performance metrics currently under development wil] require new
information collection systems and this OIG report reinforces the need to clearly define policy
and process for the collection, verification and reporting of metrics.

1. (U) Number of Terrorism Related Convictions

In reviewing the FBI's calculation of terrorism-related convictions in FY 2004, the
Report states that the convictions are overstated because the FBI initially coded the investigative
cases as terrorism-related when the cases were opened, but did not recode cases based on the
actual conviction that resulted from the investigation. While we agree that a case must have a
terrorism nexus to be properly coded as terrorism-related, we do not agree that it must result in a
charge or conviction for a terrorism offense. To require the ultimate charge to be a terrorism
offense and to be coded as such would be at odds with the FBI's post 9/1} mission to prevent,
disrupt, and defeat terrorist operations before they occur. In pursuit of this mission the FBI's
counterterrorism strategy focuses resources at the detection, penetration and dismantlement of
terrorist enterprises. The law enforcement and intelligence communities recognize that
operatives of terror networks are often involved in precursor crimes such as illegal immigration,
passport and identity forgery, financial fraud and robbery to facilitate the movement of people,
fund operations, and procure weapons and explosives. The need to pursue criminal activity by
terrorists to fund their operations also provides the opportunity for detection and disruption of
planned attacks. Law enforcement officials with expertise on counterterrorism are in the best
Position to pursue these precursor crimes and link them potentially to a terror financing
operation. Today, the Joint Terrorism Task Forces (JTTFs) represent those law enforcement and
intelligence officials with the expertise to pursue these types of investigations.

The FBI has created over 100 JTTFs across the country, including at least one in
each of the FBI's 56 field offices. The JTTFs, which consist of FBI Special Agents, other federal
agents, and state and local law enforcement officers, have a two-fold mission: (1) to prevent
terrorist attacks before they occur and (2) to mount an immediate investigative response when an
act of terrorism has occurred. In order to prevent terrorist attacks from occurring, the JTTFs
aggressively investigate and prosecute individuals and groups who may pose a threat to U.S.
persons and interests. For a variety of reasons, often these prosecutions do not yield convictions
on terrorism offenses. However, this does not mean that the efforts of the JTTFs are not
terrorism-related. In each case, the FBI's management team must evaluate the value of successful
intelligence collection designed to detect, penetrate and dismantle terror networks before they
act. This evaluation often leads to a law enforcement action to pursue, for instance, a false
statement or immigration charge as the best way quickly to disrupt a potential terrorist plot and
resolve a properly predicated terrorism investigation. In other cases, the intelligence cost in
presenting all known evidence against an individual outweighs the benefit of pursuing terrorism
offenses. In either circumstance, the efforts of the JTTFs are by their nature terrorism related,
and for this reason, the FBI disagrees with the OIG's suggestion that the FB] should recode

99


APPENDIX III

there were systems in place, and that these systems could effectively provide the basis for the
Division’s reported numbers.

3. The OIG Should Correct Its Inaccurate and Potentially Misleading Statements

The Report contains other imprecise or inaccurate statements that we urge the OIG to
consider revising, in particular,

. Repeated statements that the Criminal Division statistics were “inaccurate” and
“flawed” (at xv, xvi, xvii, 71, 72, 74, 76, 79, 83), will likely lead readers to infer
that the statistics were inflated. That, of course, would be incorrect. Eight of the
nine reporied statistics were either accurate or understated. The one
oversiatement was, according to the Report, “minor.”

. In an attempt to summarize the Department’s shortcomings in its terrorism
reporting, the Report lumps all the statistics from FBI, EOUSA, and Criminal
Division together and makes the broad statement (at v and 13) that the statistics
could not be supported for three reasons: the components (1) could not provide
support for the numbers reported for the statistics; (2) could not substantiate the
terrorism link; and (3) could not provide documentation of the time period
represented. When questioned about the application of these generalizations to
the Criminal Division, the OIG conceded that (2) did not apply to the Criminal
Division but claimed that (1) and (3) applied at the outset of the audit. Thus the
OIG refused to alter this erroneous statement. Yet, elsewhere in the Report the
OIG clearly found that none of these applies to the Criminal Division. To the
contrary, the OIG found at the conclusion of the audit that the Criminal Division
provided documentation that the numbers reported were supported and, in fact,
support was provided to show that the Division understated the numbers reported,
Report at 72. Further, the OIG found that the Criminal Division established a link
to terrorism in all cases that the OIG tested. Report at 73. And, the OIG’s final
reconciliation established that the Criminal Division documented the time period
Tepresented with one minor variance. Report at 75. Thus these reasons are almost
entirely inapplicable to the Criminal Division: the Division was able to provide
support for all cases it reported; the Division supported a terrorism Link in all
cases, and the Division provided documentation as to the appropriate time period
for all but 2 out of nearly 400 reported cases.

. The Report makes much of the fact that the Criminal Division twice produced
documentation to support the reported statistics ~ once in March 2006 and once in
August 2006. As you know, the Criminal Division needed a second effort to
document the statistics hecause the documentation to support the statistics had to
be reconstructed from a variety of sources; it was not readily available, as it
admittedly should have been. That said, the August 2006 reconciled

120


Chart Endnotes — continued
2. This statistic includes defendants that either pleaded guilty or who were convicted. We
did not find where EOUSA reported this statistic for years after FY 2002.

1. Defendants in Cases Filed

In the FY 2004, FY 2005, and FY 2006 President's Budget Requests to
Congress, EOUSA reported the following number of defendants in cases filed
by the USAOs under the anti-terrorism program activity.

* 365 for FY 2002
¢ 786 for FY 2003
* 725 for FY 2004

We reviewed LIONS reports showing the number of defendants in
cases filed under the anti-terrorism program for these three fiscal years. For
FY 2002, the LIONS data did not match the number reported in the annual
budget request as shown in the following chart.

OIG Analysis of EOUSA Statistic -
Cases Filed - Defendants for
Program Activity Anti-terrorism
for FY 2002

Reported Supported Understated

Source: EOQUSA and USAO budgets and
LIONS data, OIG interviews with EOUSA
and USAO staff, and analysis of documents
provided by EOUSA and USAO staff

Because EOUSA could not provide a list from LIONS of the 365
defendants against whom cases were filed under the anti-terrorism program
activity in FY 2002, we did not perform additional testing of the LIONS data
provided. This situation also applies to the following discussions of
inaccurately reported statistics on defendants prosecuted (EOUSA Statistic 5
on page 57), defendants found guilty (EOUSA Statistic 6 on page 57), and
terrorism cases tried (EOUSA Statistic 7 on page 58).

42


APPENDIX II

OPERATIONAL TERRORISM STATISTICS FOR

WHICH DEPARTMENT OFFICIALS COULD NOT IDENTIFY

THE SOURCE OF THE STATISTIC

Statistic Reported

Where Reported

1. Number of Intelligence Reports
containing financial information in
support of on-going high-priority
terrorism investigations

FBI's FY 2005 President’s Budget
Request to Congress

2. Number of disrupted donors
related to terrorist financing

FBI’s FY 2005 President’s Budget
Request to Congress

3. Number of disrupted fundraisers
related to terrorist financing

FBI’s FY 2005 President’s Budget
Request to Congress

4, Number of disrupted facilitators
related to terrorist financing

FBI’s FY 2005 President’s Budget
Request to Congress

5. Number of disrupted financial
intermediaries related to terrorist
financing

FBI‘s FY 2005 President’s Budget
Request to Congress

6. a. Number of calls received on the
FBI’s 1-800 Tip-line

FBI's FY 2003 President’s Budget
Request to Congress

6. b. Number of cails received and
processed during the operation of
the Tip-Line

FBI Congressional Testimony dated
4-23-02

7. Number of events conducted by
the Strategic Information and
Operations Center

FBI's FY 2003 President’s Budget
Request to Congress

8. Number of analytical work
products furnished to the
International Terrorism Program

FBI's FY 2003 President’s Budget
Request to Congress

9. Number of weapons of mass
destruction cases initiated by the
FBI and supported by the
Hazardous Material Response Unit

FBI's FY 2003 President’s Budget
Request to Congress

10. Number of FBI Forecasts:
Drivers and threat reports
issued

FBI's FY 2006 - FY 2011 Performance
Plan

11. Number of weapons of mass
destruction/emerging weapons
threat-related intelligence
assessments issued

FBI's FY 2006 - FY 2011 Performance
Plan

12. Number of weapons of mass
destruction related incidents for
which the Laboratory Response
Network for Bioterrorism has
analyzed evidence

FBI's FY 2003 President’s Budget
Request to Congress

96



OIG Analysis of EOUSA Statistic - | OIG Analysis of EOUSA Statistic -

| Terminated Terrorism and Anti-terrorism Terminated Terrorism and Anti-terrorism

338

eT
3:

Fi
oasesee

Cases against Defendants in FY 2003 Cases against Defendants in FY 2004

Sampled Supported Overstated i Sampled Supported Overstated

Source: USAO annual statistical reports and LIONS data, OIG’s interviews of EOUSA
and USAO staff, and analysis of documents provided by EOUSA and USAO staff

The following are specific details for examples of unsupported cases.

The subject was charged with making false statements by asserting
on an application for an airport identification badge that, during the
10 years preceding the date of application, the subject had not
been convicted of any disqualifying crimes listed on the application
when the subject knew otherwise. The subject had been convicted
and sentenced in January 1998 for the crime of carrying a
concealed weapon in a vehicle. The subject pleaded guilty to the
charges of making a false statement and was sentenced to time
served and placed on supervised release for 1 year. The
information provided by EOUSA contained no indication that the
subject was linked to terrorist activity. We asked EOUSA to provide
an explanation and evidence of the subject’s link to terrorism, but
EOUSA did not provide any additional evidence.

The subject was charged with knowingly and willfully using and
providing others a false, forged, counterfeit, mutilated and altered
Passport. The subject pleaded guilty to forgery and false use of a
Passport and was sentenced to 10 months in prison with 3 years
supervised release. The information provided by EOUSA contained
no indication that the subject was linked to terrorist activity. We
asked EOUSA to provide an explanation and evidence of the
subject's link to terrorism, but EOUSA did not provide any
additional evidence.

The subject was charged with: (1) possession of resident alien
cards that were forged, counterfeited, altered, and falsely made
under the pretense of using the resident alien cards to stay and
obtain employment in the United States; (2) forging, counterfeiting,

60


Summary of Analyses of Internal Controls for Terrorism-Related Statistics
Reported by the Department and its Components

Internal Interna!
controls controis
Primary established established but Internal
Reporting and not controls net

Agency Type Statistic | documented | documented2* | established { Totals
Department Operational 1 3 0 4
Informational 6 1 7 14
FBI Operationat 47 tL 10 68
Informational 6 4 3 13
Operational 3 1 10 14
Informational oO ie) ie) ie]
Operational 16 4 it} 20
Informational 0 0 9 0
Totals Operational 67 9 20 106
Informational 12 5 10 27

Source: For each of the 133 statistics summarized in this table, we interviewed officials and
asked if internal controls had been established regarding the gathering, classification, and
reporting for each statistic. When we were told that internal controls had been established,
we requested copies of the documentation.

After the initial testing, we focused our detailed testing on the 123
operational statistics that we considered to be most central to the
Department’s counterterrorism objectives. For each of the 123 operational
statistics, we interviewed Department officials to identify the source of the
statistics, the information systems used to gather and report the statistics,
and the internal controls established to verify the accuracy of the statistics
gathered and reported. We excluded 16 operational statistics for which
Department officials could not identify the source.** Because Department
officials could not identify the source of these 16 statistics, we could not
determine if the statistics were accurately reported or whether adequate
internal controls were established to ensure their accuracy.

Twelve of the 16 statistics were reported in various FBI budget
requests or performance plans and the remaining 4 were reported in budget
related testimony by the Attorney General. These included the number of:
(1) disrupted donors related to terrorist financing, (2) weapons of mass
destruction cases initiated by the FBI and supported by the Hazardous
Material Response Unit, and (3) subpoenas and search warrants issued to
gather and cultivate detailed intelligence on terrorists in the United States.

23 For five of the FBI statistics (four operational and one informational), we
determined that internal controls had been established but the reporting officials could not
readily determine whether the controls were documented. We included these five statistics
in the column for internal controls established but not documented.

4 Appendix II contains a description of the 16 statistics and where each statistic
was reported.

12


people charged with material support of terrorism or similar crimes from
September 11, 2001, through February 3, 2005.

4. Individuals Convicted of Material Support of Terrorism or Similar
Crimes

In the FY 2006 President’s Budget Request to Congress, the Criminal
Division reported that 57 people were convicted of providing material
support of terrorism or similar crimes from September 11, 2001, through
February 3, 2005. As shown in the following chart, we found the updated
database maintained by the CTS to track these statistics did not match the
number reported.

OIG Analysis of Criminal Division Statistic -
Individuals Convicted of Material Support of Terrorism

Or Similar Crimes from 9/11/01 through 2/3/05
500 450 400 350 300 250 200 150 100 50 0

|57 [NII A- Reported

} B - Supported on March 2006
Reconstructed List

‘60 C- Included on August 2006
|| j Reconstructed List

D - Included on Final Reconciled
Reconstructed List

65 E - Supported on Final Reconciled
| Reconstructed List

syF- Significant Understatement
| | (E minus A)

| a4

|

Source: Criminal Division budgets, OIG interviews with Criminal Division staff,
and analysis of documents provided by Criminal! Division staff

As a result, the Criminal Division significantly understated the number
of individuals convicted of material support of terrorism or similar crimes
from September 11, 2001, through February 3, 2005.

5. Material Support to Terrorism Cases and Matters Participated in or
Coordinated

In various President’s Budget Requests to Congress, the Criminal
Division reported that it:

e was currently working with the USAOs in over 50 material support

to terrorism investigations as of January 31, 2003 (FY 2004
President’s Budget Request to Congress);

78


did not support that a case showed any reasonabie link to terrorist activity.®
EOUSA’s definition of the anti-terrorism program activity is not clear
regarding the link to terrorism. The definition indicates the anti-terrorism
program activity is meant to capture activity related to prevention or
disruption of terrorist threats where the conduct is not obviously a crime of
terrorism. However, the definition’s two examples indicate that the subject,
target, or defendant must be reasonably linked to a terrorist activity to
record the case under the anti-terrorism program activity. Taken as a
whole, we believe this definition establishes that a case or defendant must
have some identifiable link to terrorism to be categorized as being “anti-
terrorism.”

EOUSA disagrees with our interpretation of the definition of the anti-
terrorism program activity. EOUSA and USAO officials told us they believe
they correctly reported defendants under the anti-terrorism program activity
because almost all the defendants reported under this program activity were
arrested as the result of either operations carried out to prevent terrorism or
through Joint Terrorism Task Force (JTTF) activities.? For example,
Operation Tarmac was a worksite enforcement operation launched in
November 2001 at the nation’s airports. During this operation, Department
and other federal agents went into regional airports and checked the
immigration papers of airport workers. The agents then arrested any
individuais who used falsified documents, such as social security numbers,
drivers’ licenses, and other identification documents, to gain employment.
EOUSA officials told us they believe these defendants are properly coded
under the anti-terrorism program activity. We do not agree that law
enforcement efforts such as these should be counted as “anti-terrorism”
unless the subject or target is reasonably linked to terrorist activity.

We acknowledge that some law enforcement operations and the JTTF’s
focus originate in concerns regarding terrorism. In fact, with the

® The LIONS Manual states that the anti-terrorism program activity is meant to
capture USAO activity intended te prevent or disrupt potential or actual terrorist threats
where the offense conduct is not obviously a federal crime of terrorism. The manual
provides that to the extent evidence or information exists, in any form, reasonably relating
the case to terrorism or the prevention of terrorism, the matter should be considered anti-
terrorism. The manual provides two examples that demonstrate that the subject, target, or
defendant should be reasonably linked to a terrorist activity to be reported under the anti-
terrorism program activity: (a} a case involving offenses such as immigration violations,
document fraud, or drug trafficking where the subject or target is reasonably linked to
terrorist activity; (b) a case of identity theft and document fraud where the defendant's
motivation is to obtain access to and damage sensitive government facilities.

° The JTTFs are squads within the FBI's field offices that focus primarily on
addressing terrorism threats and preventing terrorist incidents.

xii


altering, and falsely making resident alien cards for use in residing
and obtaining employment in the United States; (3) possession of
document making equipment with the intent of making false U.S.
identification documents, Social Security Administration cards, and
resident alien cards; and (4) possession with the intent to use five
or more U.S. identification cards, approximately 1,236 blank Social
Security Administration cards, and 1,698 blank resident alien cards.
The subject pleaded guilty to making and possessing with the intent
to use false U.S. identification documents and was sentenced to 2
years in prison and 3 years supervised released. The information
provided by EOUSA contained no indication that the subject was
linked to terrorist activity. We asked EOUSA to provide an
explanation and evidence of the subject’s link to terrorism, but
EOQUSA did not provide any additional evidence.

« During a one-year period, the subject knowingly and with intent to
defraud used several unauthorized credit cards to make purchases
totaling $1,000 or more using falsely obtained driver’s licenses.
The subject pleaded guilty to conspiracy to commit access device
fraud and was sentenced to 37 months in prison and 3 years
supervised release. The information provided by EOUSA contained
no indication the subject was linked to terrorist activity. We asked
EOUSA to provide an explanation and evidence of the subject's link
to terrorism, but EOQUSA did not provide any additional evidence.

We also found that 42 of the 364 cases sampled for FY 2003, including
34 of the 315 that were not linked to terrorism, were either not terminated
at the end of the year reported or the USAOs could not provide
documentation to show the cases were terminated at the end of the year
reported. This same issue occurred for 13 of the 240 cases sampled for
FY 2004, alt of which were included in the 201 cases that were not linked to
terrorism.

Overail, considering both the cases not linked to terrorism and the
cases not terminated in the year reported, EOUSA overstated the terrorism
and anti-terrorism cases terminated against defendants in FY 2003 and
FY 2004 as shown in the following charts.

61


file information provided did not show a terrorism link, we asked USAO
officials to provide additional information of a terrorism link. The
overstatements in the following charts reflect defendants for which the
USAOs did not provide information of the terrorism link.°©

OIG Analysis of Sample for
EOUSA Statistic - Defendants for
Terminated Terrorism and Anti-

terrorism Cases in FY 2004

Sampled Supported Overstated

Source: USAO annual statistical report

and LIONS data, OIG interviews with EOUSA
and USAO staff, and analysis of documents
provided by EOUSA and USAO staff

The following are specific details for examples of unsupported cases.

e The subject was charged with falsely representing a social security
number to be his own for the purpose of obtaining employment with
a company and receiving an access badge to a stadium for a Super
Bowl game. The subject pleaded guilty to fraudulent use of a social
security number and was sentenced to time served. The case file
information provided by the USAO contained no indication that the
subject was linked to terrorist activity. When we asked an AUSA to
provide an explanation and evidence of the subject’s link to
terrorism, the AUSA did not provide any additional explanation or
evidence.

¢ The subject was charged with: (1) fraudulently stating his name on

an application for a Department of Motor Vehicles identification
card, (2) fraudulently providing a false address and false social
security number on the same application, and (3) falsely
representing a social security number to be his when he knew it
was not. The subject pleaded guilty to the charge of misusing a
social security number and was sentenced to 3 years probation.
The other two charges against the subject were dismissed. The

5® As noted in footnote 41 on page 43, the numbers supported for these statistics
are based on a sample of transactions reported.

67


e number of terrorism-related convictions during FY 2004,
« Counterterrorism Threat Assessments issued during FY 2004, and
e Presidential Terrorist Threat Reports issued during FY 2004.
By contrast, the FBI significantly understated the number of:
* Intelligence Assessments issued during FY 2004,
e Intelligence Bulletins issued during FY 2004,
« Intelligence products produced/disseminated during FY 2004, and
e terrorist threats tracked during FY 2003 and FY 2004.

We determined that the FBI statistics were inaccurate for the following
reasons.

e« The number of terrorism-related convictions was overstated
because the FBI initially coded the investigative cases as terrorism-
related when the cases were opened, but did not recode cases
when no link to terrorism was established.

« The differences between the numbers of Intelligence Information
Reports reported in the budget and performance plan and the FBI’s
database likely resulted from the wording of how the database was
queried by the FBI. An FBI official also told us that the number of
Intelligence Information Reports reissued, corrected, and recalled,
or additional information added to the Intelligence Information
Reports, could also have affected the accuracy of the number of
Intelligence Information Reports tracked in the database.

« The inaccurate reporting of the number of Intelligence Assessments
issued likely occurred because: (1) FBI staff did not enter
Intelligence Assessments in the database in a timely manner, and
(2) the database was queried by calendar year or other time
periods instead of by fiscal year.

© The inaccuracies in the number of Intelligence Bulletins issued were

attributable to a lack of formalized procedures on how to collect,
verify, and report the Intelligence Bulletins.

viii


APPENDIX I

Number Transactions
Statistic Description Reported Sampled
. Number of terrorism and anti- | 682 in FY 2003 364
terrorism cases against
defendants that were 504 in FY 2004 240
terminated
. Number of terrorism and anti- | 737 in FY 2002 487
terrorism cases pending
637 in FY 2003 335
719 in FY 2004 362
. Number of defendants the 643 in FY 2004 294
U.S. Attorneys terminated
terrorism and anti-terrorism
cases against
. Percentage of defendants 87% in FY 2003 364
whose cases were
terminated that were
convicted

95


support a terrorism link, the AUSA told us that the subject was part
of an investigation of credit card “bust-out” schemes and financial
support to terrorists, but the AUSA provided no information to
support that this subject was linked to financial support to
terrorists. The case against the subject was subsequently
dismissed.

* The subject knowingly entered into a marriage for the purpose of
evading the immigration laws of the United States. The subject
pleaded guilty to marriage fraud and was sentenced to 3 years
probation with the first 6 months to be served under home
confinement. The case file information provided by the USAO
contained no indication the subject was linked to terrorist activity.
When we asked an AUSA to provide additional information to
support a terrorism link, the AUSA did not provide any additional
information.

We also found that 127 of the 487 cases sampled for FY 2002,
including 117 of the 439 that were not linked to terrorism, were either not
pending at the end of the year reported or the USAOs could not provide
documentation to show the cases were pending at the end of the year
reported. This same issue occurred for:

e 122 of the 335 cases sampled for FY 2003, including 107 of the 267
that were not linked to terrorism; and

« 191 of the 362 cases sampled for FY 2004, including 161 of the 271
that were not linked to terrorism.

Overall, considering both the defendants not linked to terrorism and
the defendants not convicted in the year reported, EOUSA overstated
the number of terrorism-related convictions for FY 2003 and FY 2004 as
shown in the following charts.°*

54 As noted in footnote 41 on page 43, the numbers supported for these statistics
are based on a sample of transactions reported.

65


APPENDIX I

Primary

Reporting System Used to Track

Description of Statistic Agency Statistic

22. Number of terrorism EOUSA EQUSA LIONS
cases tried

23. Number of terrorism EOUSA EOUSA LIONS
and anti-terrorism
cases against
defendants that were
terminated

24. Number of terrorism EQUSA EOUSA LIONS
and anti-terrorism
cases pending

25. Number of defendants | EQUSA EOUSA LIONS
that the U.S.
Attorneys terminated
terrorism and anti-
terrorism cases
against

26. Percentage of EOUSA EOUSA LIONS
defendants whose
cases were terminated
that were convicted

10. We interviewed Department officials and reviewed supporting
documentation to determine whether the 26 operational statistics
were accurately reported.

At the FBI field offices and USAOs visited, we interviewed FBI and
USAO officials and reviewed case file documentation to determine whether
the following FBI and USAO statistics were accurately reported.

For the Criminal Division statistics we reviewed, we initially reviewed
reconstructed data provided to us in March 2006 by the Criminal Division to
support the numbers reported. In August 2006 we discussed with Criminal
Division officials our audit results that showed the statistics reported by the
Criminal Division were not accurately reported. The Criminal Division
believed it could support all the numbers reported so we agreed to review
additional support that the Criminal Division said it could provide. In August
2006, the Criminal Division provided another set of reconstructed lists to
support the statistics we tested. We met with Criminal Division officials and
reconciled the March 2006 data to the August 2006 data. We then selected
a sample of transactions for each statistic and analyzed supporting
documentation provided by the Criminal Division to ensure the cases
reported were linked to terrorism and occurred during the reporting period.

91


2. Individuals Convicted or Pleaded Guilty Resulting from Terrorism
Investigations

In the FY 2006 President’s Budget Request to Congress, the Criminal
Division reported 195 individuals were convicted or pleaded guilty as a result
of terrorism investigations from September 11, 2001, through February 3,
2005. As shown in the following chart, we found the Criminal Division’s final
reconciled reconstructed list of individuals convicted or pleading guilty did
not match the number reported.

OIG Analysis of Criminal Division Statistic -
Individuals Convicted or Pleaded Guilty

Resulting from Terrorism Investigations
500 450 400 350 300 250 200 150 100 50 0

| 195 A- Reported
| boy . B - Supported on March 2006
Reconstructed List
| 246 - C- Included on August 2006
Reconstructed List
216 D - Included on Final Reconciled

1 Reconstructed List
ey £ - Supported on Final Reconciled
Reconstructed List

| F - Significant Understatement
21 a (E minus A)

Source: Criminal Division budgets, OIG interviews with Criminal Division staff,
and analysis of documents provided by Criminal Division staff

As a result, the Criminal Division understated by a significant amount
the number of individuals who were convicted or pleaded guilty as a result of
terrorism investigations from September 11, 2001, through February 3,
2005.

3. Individuals Charged with Material Support of Terrorism or Similar
Crimes

The CTS also oversees the investigation and prosecution of terrorist
financing matters. This includes material support cases such as those that
involve funds being provided to support terrorist activities. The CTS collects
statistics related to these cases for inclusion in its annual budgets. In the
FY 2006 President’s Budget Request to Congress, the Criminal Division
reported that:

* more than 89 people were charged in material support prosecutions
and terrorist financing investigations from September 11, 2001,
through August 5, 2004; and

76


OIG Analysis of Sample for OIG Analysis of Sample for
EOUSA Statistic - Cases Filed - EOUSA Statistic - Cases Filed -
Defendants for Program Activity Defendants for Program Activity
Anti-terrorism for FY 2003 Anti-terrorism for FY 2004

300 ~ 268
240
180

) :
| 320 7
180 240
120 88 | | 160 116 |
60 | 80
S Sampled Supported Overstated ° Sampled Supported Overstated

Source: EQUSA and USAO budgets and LIONS data, OIG interviews with EOUSA
and USAO staff, and analysis of documents provided by EOUSA and USAO staff

Below are specific details for examples of unsupported cases. In each
case, we reviewed information in the case file provided by the USAOs to
determine if it established a link to terrorism. If the case file information did
not show a terrorism link, we asked the USAO officials to provide additional
evidence of a terrorism link. In each example, the USAOs did not provide
information that the subject was linked to terrorist activity.

* The subject, in exchange for money, arranged six marriages
between aliens, primarily Tunisian nationals, and U.S. citizens. The
subject was sentenced to 12 months and 1 day on each of six
counts of aiding and abetting marriage fraud to be served
concurrently. The case file information provided by the USAO
contained no indication that the subject or the six aliens were linked
to terrorist activity. When we asked an AUSA to provide additional
information to support a terrorism link, the AUSA commented that
the subject aided, abetted, counseled, commanded, induced, and
procured fraudulent marriages of Middle Eastern and African males,
but the AUSA provided no information to link the subject to
terrorism.

¢ In another case of marriage fraud, a subject entered into a
marriage for the purpose of evading the immigration laws. The
subject filed on his own behalf a Petition for Alien Relative
requesting lawful permanent alien status based on his fraudulent
marriage to a U.S. citizen. The subject pleaded guilty to marriage
fraud and was sentenced to time served. When we asked an AUSA
to provide additional information to support a terrorism link, the
AUSA told us that: (1) the case was categorized as anti-terrorism
based on evidence or information which relates to the “prevention
of terrorism,” and (2) the evidence or information is identical or

44


defendants whose terrorism and anti-terrorism cases were terminated and
who were convicted (EOUSA Statistic 11 on page 69).

:

1,200

1,000

OIG Analysis of Terrorism-Related Statistics

Reported by EOUSA

365
ee
|
786
588

725
oak =

Number Reported
Number Supported

465

558

800 600
Number Reported/Supported

40

1.a.

1.b.
lc.

Statistic Reported

Number of cases filed -
defendants for program activity
anti-terrorism in FY 2002

Number of cases filed -
defendants for program activity
anti-terrorism in FY 2003

. Number of cases filed -

defendants for program activity
anti-terrorism in FY 2004 (see
Chart Endnote 1 on page 41)

. Number of terrorism convictions

in FY 2003

. Number of terrorism convictions

in FY 2004

. Number of terrorism-related

convictions in FY 2003

. Number of terrorism-related

convictions in FY 2004

. Number sentenced to prison -

defendants for program activity
anti-terrorism in FY 2003

. Number sentenced to prison —

defendants for program activity
anti-terrorism in FY 2004


° number of Presidential Terrorist Threat Reports produced. !

The Department and its components regularly report such statistics in
budgets, annual financial statements and statistical reports, the Office of
Management and Budget’s (OMB) Performance Assessment Rating Tool,
performance plans, congressional testimony, speeches, press releases,
publications, and websites. '*

Counterterrorism Funding and Staffing

Department resources devoted to preventing terrorism and promoting
the nation’s security have increased from approximately $737 million in
Fiscal Year (FY) 2001 to approximately $3.6 billion in FY 2006, an increase of
almost 400 percent. The counterterrorism resource increases have been
shared among the Department’s components that combat terrorism, with
the FBI receiving the largest share of the increase, as shown in the following
chart.

Growth of Fundin
from FY 2001 through 2006
(in Millions)

ay $1,129

BFY 2006
Criminal GFY 2001
Division
$1,589
USAOs $1,317
arr ere (
0 500 1000 1500 2000

Source: Budget data from the FBI, Criminal Division,

and EOUSA. FBI dollars are for the counterterrorism program
only. Criminal Division and USAO dollars are for the

entire organizations.

1 Presidential Terrorist Threat Reports, now known as National Terrorism Bulletins,
are produced by the National Counterterrorism Center from intelligence products
disseminated by agencies in the United States intelligence community, including the Central
Intelligence Agency, the FBI, and the Department of Defense intelligence components.

12 The OMB’s Performance Assessment Rating Tool is used to identify the strengths

and weaknesses of federal programs and to develop funding and management decisions
aimed at making the programs more effective.

2


547 threats reported for FY 2004 were for only 9 months of the year,
from January through September 2004. A Unit official told us that
threat data for all of FY 2004 was not reported because of the timing
of the request from the Counterterrorism Division’s Administrative
Section. According to the Unit official, the Unit began capturing
threats in May or June 2004. In December 2004 or January 2005, the
Counterterrorism Division‘s Administrative Section requested the
threat data for FY 2004. At that time, the Unit had begun identifying,
categorizing, and counting the threats prior to May or June 2004 but
had not completed the process. Therefore, the Unit reported the
threat data for the 9 months (January 2004 through September 2004)
that had been completed. As a result, the FBI significantly
understated the threats to transportation and facilities reported for

FY 2004.

Threats to People and Cities. In its FY 2006 - FY 2011 Performance
Plan, the FBI reported 820 threats were made to people and cities
during FY 2004. The spreadsheet used by the FBI’s Counterterrorism
Watch Unit to track the number of threats to people and cities agreed
with the number of threats reported in the FBI’s FY 2006 - FY 2011
Performance Plan for FY 2004. However, as was the case for threats
to transportation and facilities, the 820 threats to people and cities
reported for FY 2004 were for only 9 months of the year. As a result,
the FBI significantly understated the threats to people and cities
reported for FY 2004.

9. Counterterrorism Threat Assessments

Counterterrorism Threat Assessments are essentially the same as

Intelligence Assessments, except for those jointly written with other
agencies.*4 The FBI’s TWWU maintained a word processing file that contains
details of the Counterterrorism Threat Assessments issued.

In its FY 2006 - FY 2011 Performance Plan, the FBI reported 63

Counterterrorism Threat Assessments were issued during FY 2004. As
shown in the following chart, we found that the word processing file
maintained by the TWWU to track the number of Counterterrorism Threat
Assessments issued did not support the number reported for FY 2004.

34 A former TWWU official told us that the FBI no longer uses the term

Counterterrorism Threat Assessments and these products are now called Intelligence
Assessments.

31


» Number of terrorism and anti-terrorism cases pending at the end of
FY 2002, FY 2003, and FY 2004;

e¢ Number of defendants the U.S. Attorneys terminated terrorism and
anti-terrorism cases against in FY 2004; and

* Percentage of defendants whose cases were terminated that were
convicted in FY 2003.

EQUSA is responsible for tracking and analyzing data related to the
work of the 94 USAOs in the development of budget and litigative priorities.
EOUSA reports in its annual budgets and statistical reports based on data
entered by the USAOs into the LIONS system. The LIONS system is a
database with on-line capabilities that permit the USAOs and EOUSA to
compile, maintain and track information relating to defendants, crimes,
criminal charges, court events, and witnesses.

Inaccuracies in LIONS Data Reported by GAO

In its January 2003 report entitled Justice Department, Better
Management Oversight and Internal Controls Needed to Ensure Accuracy of
Terrorism-Related Statistics, the GAO addressed the USAOs’
misclassifications of conviction data in LIONS as terrorism-related despite a
semiannual effort by EQUSA requiring managers in the USAOs to certify the
accuracy of the case data. EOUSA noted that new anti-terrorism codes were
not established until August 2002, one month prior to the end of the fiscal
year. EOUSA officials attributed discrepancies to limited time for the USAOs
to thoroughly reevaluate caseload and investigative data dating back to the
beginning of FY 2002 and to reclassify the applicable cases. The GAO
recommended that the Attorney Generali, in accordance with federal internal
control standards, implement a formal system to oversee and validate the
accuracy of case classification and conviction data entered in LIONS by the
USAOs.

As part of this audit, we contacted the GAO to determine the status of
this recommendation. According to a GAO staff member, EOUSA was
required to provide Congress with a written response within 60 days of the
report's issuance in January 2003. The GAO staff member said that the GAO
did not believe that EOUSA’s letter to Congress, dated April 7, 2003, showed
adequate actions had been taken by the USAOs to correct the classification
problem GAO identified. Specifically, according to the GAO staff member,
EQUSA did not show that it had established a formal system to oversee and
validate the accuracy of the case classification and conviction data entered in

35


subject was arrested as part of an operation similar to Operation
Tarmac where Department and other federal agents went into the
local airport and arrested individuals who used falsified documents
such as social security numbers, drivers’ licenses, and other
identification documents to gain employment at airport facilities.
The AUSA provided no additional information that linked the subject
to terrorist activity.

The subject was charged with possessing a handgun while being an
alien unlawfully in the United States. The subject was found guilty
of being an illegal alien in possession of a firearm and was
sentenced to 18 months in prison. However, the case was appealed
and the charge was subsequently dismissed. The case file
information provided by the USAO contained no indication that the
subject was linked to terrorist activity. When we asked an AUSA to
provide additional information of a terrorism link, the AUSA
provided no additional information.

The subject was charged with making false statements by asserting
on an application for an airport identification badge that, during the
10 years preceding the date of application, the subject had not
been convicted of any disqualifying crimes listed on the application
when the subject knew otherwise. The case file information
provided by the USAO contained no indication that the subject was
linked to terrorist activity. When we asked an AUSA to provide
additional information of a terrorism link, the AUSA said the subject
was arrested as part of Operation Fly Trap, an operation similar to
Operation Tarmac where Department and other federal agents went
into the local airport and arrested individuals who used falsified
documents such as social security numbers, drivers’ licenses, and
other identification documents to gain employment at airport
facilities. The AUSA provided no additional information or
explanation that linked the subject to terrorist activity. The case
against the subject was subsequently dismissed.

The subject was the president of a travel company that was
asserted to be a collusive merchant involved in a scheme to defraud
credit card companies. Two credit cards in the name of another
individual were charged at the travel company 10 times during a
4-week period for a total of $12,500. The credit card issuer
eventually closed the accounts for nonpayment and wrote off the
balances. The case file information provided by the USAOQ
contained no indication the subject was linked to terrorist activity.
When we asked an AUSA to provide additional information to

64


terrorism groups can include white supremacists, black separatists, animal
rights/environmental extremists, anarchists, anti-abortion extremists,
militias, and other anti-government extremists. While we agree that these
groups can engage in terrorism, we also believe that these groups can
engage in criminal activities such as drug trafficking that are unrelated to
terrorism.

When reviewing files of FBI cases it listed as terrorism convictions, we
looked for any demonstrated link to terrorism and did not consider
membership in a white supremacist group alone sufficient to establish such a
link. As with the JTTF cases, we believe the FBI should be able to
demonstrate a terrorism link in such cases, and if it cannot point to any
evidence to indicate that such a link exists, the FBI should not code the case
as terrorism-related.

In addition, according to the FBI’s response, 2 of the 35 disputed
cases involved threats to the public and were appropriately counted as
domestic terrorism cases. One of the cases involved an individual who sent
a federal judge letters that stated they were contaminated with Anthrax.
Contrary to the FBI’s belief, we considered this case to have a terrorism link
and did not question how it was coded. However, the other case involved an
individual who telephoned local police and reported that 30 vials of Yersinia
Pestis bacteria, the infectious agent of bubonic plague, could not be located.
When the FBI questioned the individual, he admitted that he had
accidentally destroyed the vials and made up the story in an effort to
account for the vials. Because the case agent could provide no evidence
that this incident was linked to terrorism, we do not believe it was properly
reported as a terrorism-related conviction.

The FBI's response did not provide an explanation for the remaining
four cases disputed by the OIG as having a link to terrorism.

In the remaining sections of its response, the FBI acknowledged other
inaccurate FBI statistics but described how it had strengthened controls
relating to the statistics.

The status of the recommendations related to FBI statistics is
presented in Section D of this appendix.

B. EOUSA Response

In its comments on the report, EOUSA agreed that the report raised
important issues regarding what constitutes an “anti-terrorism case” and
that EOUSA must provide the clearest possible statistical picture of the

126


APPENDIX IIT

We do not believe, given our system, that the Division could unintentionally report a
terrorism-related matter that had no basis in fact. Each matter is documented extensively, As we
explained to the OIG audit team, the Counterterrorism Section coordinates extensively with the
United States Attorneys’ Offices on terrorism-telated matters, in accordance with a January 2005
directive from the Deputy Attomey General and as recently incorporated into the United States
Attomey’s Manual. This coordination includes specific notification, consultation, and approval!
requirements that obligate the United States Attomeys’ Offices to apprise and discuss with the
Counterterrorism Section specific actions and milestones with respect to terrorism investigations
and prosecutions. For each approval requirement, the Counterterrorism Section prepares a
written memorandum to the Office of the Assistant Attomey General that analyzes the Tequested
action and provides a recommendation. Copies of these memoranda are niaintained in the files
of the Counterterrorism Section and serve as record of decisions and a source of information on
terrorism matters. Much of this coordination is accomplished through the Anti-Terrorism
Advisory Council Coordinators in each U.S. Attomney’s Office and their counterparts in the
Counterterrorism Section, the National Anti-Terrorism Advisory Council Coordinator and the
Regional Coordinators. These individuals form a nationwide network which provides, among
other things, a mechanism for exchanging and transmitting information on terrorism cases and
investigations. Through this network, the Counterterrorism Section obtains current reporting on
a daily basis of significant litigation events in terrorism cases. This information is reported to
Department officials and circulated back out to prosecutors in the field through a Daily Report,
which serves as another repository of information that forms the basis for our terrorism statistics.
In addition, for cases in which a Counterterrorism Section prosecutor is involved, a record is
opened in the Criminal Division’s Automated Case Tracking System (ACTS), which serves as
another data source. This is supplemented by more detailed case summaries maintained by the
Counterterrorism Section which consist of more detailed case profiles on specific significant
terrorism cases. The Counterterrorism Section also established procedures relative to the
international terrorism and terrorism-related cases database when it assumed responsibility for
this function from the Office of the Assistant Attomey General for the Criminal Division. These
procedures are set forth in a Circular dated January 6, 2006, and revised on August 8, 2006,
copies of which were supplied to the OIG.

Documentation of this kind inust exist — and the Report found did exist — for each of the
reported statistics. While it is true that there were particular terrorism-related matters that were
documented but went unreported, it does not follow as a matter of logic or fact that the converse
is therefore also true — that a terrorism-related matter could be reported unintentionally but
neither exist nor have documentation. We urge the OIG to delete this unsupported finding.

We also take issue with the OIG’s conciusion (at 83) that “The extensive efforts required
by the Criminal Division to reconstruct reported statistics demonstrates that the Division had no
effective reporting system. ...” See also Report at xvii (“the Division had no accurate basis for
its reported numbers”). While we concede that the reported statistics have not been maintained
according to audit standards and the supporting documentation was therefore net readily
available, the fact that this data could be successfully reconstructed actually demonstrated that

119


Moreover, the Criminal Division provided varying sets of data to us
regarding its statistics. Because the Criminal Division had not established
effective procedures to gather and report accurate terrorism data, the
Criminal Division had difficulty providing us a stable or reliable list of cases
reported for each of the five statistics we reviewed. When we initially
requested information to support the statistics we tested, a Criminal Division
official told us that she could not readily provide lists to match the numbers
reported because: (1) the database used to support the first four statistics
tested was not up-to-date, and (2) the list the Criminal Division had for the
last statistic tested did not include all the relevant cases.

As a result, in response to our initial findings about the inaccuracy of
its statistics, the Criminal Division requested more time to update the
database and reconstruct a list of terrorist financing cases, investigations, or
matters that the Criminal Division participated in or coordinated that would
support statistics reported. In March 2006, the Criminal Division’s
Counterterrorism Section (CTS) provided the updated database and lists.
We reviewed evidence in support of the March 2006 reconstructed data and
found that the Criminal Division’s reconstructed data did not support the
accuracy of the five statistics we tested for eight of the nine times the
statistics were reported. Specifically, our analysis of the reconstructed data
and supporting documentation showed that the statistics were overstated six
times, understated two times, and reported accurately one time.

In August 2006, we briefed the Criminal Division on the results of our
testing of the March 2006 reconstructed data. The Deputy Assistant
Attorney General for the Criminal Division stated that while the Criminal
Division needed to strengthen its controls to gather, report, and document
accurate terrorism statistics, he believed the Criminal Division could provide
the documentation needed to support all the statistics reported. In August
2006, the Criminal Division provided us another set of reconstructed lists to
support the five statistics we tested.

After extensive analysis and discussions with the Criminal! Division, we
determined the August 2006 reconstructed data was also inaccurate for
seven of the nine times the statistics were reported. The August 2006
reconstructed lists were inaccurate because either: (1) data from the March
2006 reconstructed lists was not included on the August 2006 reconstructed
lists but should have been; or (2) relevant data was missing from both the
August 2006 and March 2006 reconstructed lists. We reviewed these
concerns with Criminal Division officials who agreed that the August 2006
reconstructed lists were incorrect based on the inaccuracies we identified.

xvi


APPENDIX III

documentation is entirely valid. No one has suggested otherwise, and it is
unfortunate that the Report emphasizes the interim documentation and
reconciliation. In addition, the Report tells only half the story of the reconciliation
process. If the OIG believes it is necessary to account for each step in
reconstructing the data, the Report should state that the Counterterrorism Section
was fully engaged in working through this reconciliation process with the OIG,
pointing out to the OIG staff when the OIG double counted certain cases, when
they failed to count cases of a continuing nature because a single miiestone m the
case had been reached, and when they confused a case and a matter. A full
understanding of the audit and reconciliation process must credit the efforts by the
Counterterrorism Section to supply the OIG with all the materials they requested
and educate them on each criminal investigation and prosecution so that they
could properly evaluate those materials in the context of the andit.

We urge the OIG to correct these deficiencies in the Report.

4 Recommendations

We agree that improved controls will improve our ability to readily substantiate the
statistics reported. As we discuss in greater detail below, these improved controls are now in
place. Consequently, we believe the Department has satisfied the recommendations in the report
in regard to the Criminal Division statistics and that no further action in this regard is required.

Recommendation 1. Establish and document internal control procedures for gathering,

Response:

verifying, and reporting terrorism-related statistics.

The Counterterrorism Section concurs with this Tecommendation, subject to the
following comments. As discussed above, the Criminal Division had existing
procedures for gathering, verifying and reporting terrorism-related statistics which
it discussed with the OIG auditors, even though this information is largely absent
from the Report. These procedures were set forth, in part, in a Counterterrorism
Section (CTS) Circular on Terrorism Statistics and in material discussing specific
Performance Measures, which was provided to the OIG. These mechanisms were
supplemented by gathering information through telephone and email requests and
Tesponses to and from terrorism prosecutors in U.S. Attorneys’ Offices around the
country through the communication network established by the Anti-Terrorism
Advisory Council Coordinators in the field and the National and Regionat
Coordinators in the Counterterrorism Section. We believe there was nothing
haphazard about this system, which resulted in daily reporting of terrorism
litigation events in the CTS Daily Report, a fundamental mechanism by which
Department leadership is kept current on such matters.

121


efforts such as these should be counted as “anti-terrorism,” unless as the
LIONS Manual indicates, the subject or target is reasonably linked to
terrorist activity.

For many of the transactions we found to be without a link to
terrorism, EOUSA staff said the transactions were supported because the
related cases were referred to the USAOs by a JTTF. To test the extent to
which JTTF-referred cases consistently had a link to terrorism, we
judgmentally sampled 21 JTTF-referred transactions and requested
additional documentation on the related cases to show a reasonable link to
terrorist activity. EOUSA supported a terror link for only 8 of 21 sampled
JTTF-referred transactions. Based on this test, some JTTF cases show a link
to terrorism, but we do not consider the remaining JTTF-referred
transactions supported simply because those cases were referred by a JTTF.

We also acknowledge that operations such as Operation Tarmac and
JTTF cases originate in concerns regarding terrorism. However, EQUSA
could fairly and accurately report the successes of these operations without
implying that all of the resulting cases are terrorism related. We are
concerned that EQUSA’s view of the anti-terrorism category permits criminal
cases arising from virtually any federal law enforcement effort, including
border enforcement activities, to be categorized as anti-terrorism regardless
of the actual circumstances. In our review of the statistics reported by
EOUSA, we looked for and accepted any evidence of a reasonable terrorism
linkage. However, we found many cases involving offenses such as
immigration violations, document fraud, or drug trafficking, where the
investigation showed that the subject or target had no link at all to terrorist
activity, but the case was classified as an anti-terrorism case. In accordance
with EOUSA’s anti-terrorism definition, we did not accept those cases as
having support for coding in the anti-terrorism category.

After updating our results based on the additional documentation
provided by EOUSA and based on our understanding of the anti-terrorism
definition, we concluded that EOUSA and the USAOs did not accurately
report the 11 statistics we tested as shown in the charts in the following
sections of this report. The practice of classifying cases as anti-terrorism
related affects the discussion of inaccurately reported statistics on
defendants in cases filed (EOUSA Statistic 1 on page 42), terrorism
convictions (EOUSA Statistic 2 on page 46), terrorism-related convictions
(EQUSA Statistic 3 on page 50), defendants sentenced to prison (EOUSA
Statistic 4 on page 53, terminated terrorism and anti-terrorism cases
(EQUSA Statistic 8 on page 59), pending terrorism and anti-terrorism cases
(EOQUSA Statistic 9 on page 62), defendants for terminated terrorism and
anti-terrorism cases (EOUSA Statistic 10 on page 66), and percentage of

39


Summary Results: Review of Selected
Terrorism-Related Statistics Reported by
the Department and its Components

Number of Number of
Primary Statistics Times
Reporting Not Accurately | Inaccurately
Agency Reported Reported
FBI 8 of 10 11 of 13
EOUSA

(USAQs) 11 of 11 20 of 20
Sof 5 7of9
Totals 24 of 26 38 of 42

Source: O1G’s conclusion based on interviews with
Department officials and analyses of Departmental records

Some of these statistics were significantly overstated or understated,
while others were overstated or understated by minor amounts. The
statistics were inaccurately reported for various reasons, including that the
components: (1} could not provide support for the numbers reported for the
statistics; (2) could not provide support of the terrorism link used to classify
statistics as terrorism-related; and (3) could not provide documentation to
show that some items counted in the statistic reported occurred in the
period reported or the evidence provided showed that some items counted in
the statistic reported did not occur in the period reported. We summarize
our findings by component in the following sections.

FBI Terrorism Statistics

As shown in the following chart, the FBI did not accurately report 8 of
the 10 FBI statistics we reviewed.


airport facilities. The AUSA provided no additional information that
linked the subject to terrorist activity.

* The subject submitted a fraudulent application for a driver's license.
The subject pleaded guilty to identification fraud and was sentenced
to 3 months in prison. The case file information provided by the
USAO contained no indication the subject was linked to terrorist
activity. When we asked an AUSA to provide additional information
to support a terrorism link, the AUSA told us that the subject was
arrested as part of Project Facilitator, an operation to identify,
arrest, and convict individuals involved in identification fraud. The
AUSA provided no additional information to support the subject's
link to terrorist activity.

We also found that 9 of the 81 defendants for FY 2003, including
6 of the 56 defendants not linked to terrorism, were either not sentenced in
the year reported or the USAOs could not provide documentation to show
the defendants were sentenced in the year reported. This same issue
occurred for 19 of the 91 defendants for FY 2004, including 11 of the 55 that
were not linked to terrorism, as either the defendants were not sentenced in
the year reported or the USAOs could not provide documentation to show
the defendants were sentenced in the year reported.

Overall, considering both the defendants not linked to terrorism and
the defendants not sentenced to prison in the year reported, EQUSA
overstated the number of defendants sentenced to prison under program
activity | anti-terrorism for FY 2003 and FY 2004 as shown in the following
charts. *

OIG Analysis of EOUSA Statistic - OIG Analysis of EOUSA Statistic -
Sentenced to Prison - Defendants Sentenced to Prison - Defendants
for Program Activity Anti-terrorism for Program Activity Anti-terrorism
for FY 2003 for FY 2004
|
300 || 3005
240 || 2405
180 | | 180)
120 | 120
60 60
5 — =) i

Reported Eupported Overstated Reported Supported Overstated

Source: EOUSA and USAO budgets and one data, OIG interviews with EOUSA
and USAO staff, and analysis of documents provided by EQUSA and USAO staff

5° As noted in footnote 41 on page 43, the numbers supported for these statistics
are based on a sample of transactions reported.

56


the 192 statistics were accurately gathered, classified, and reported.?#
Through the interviews, we learned that the Department’s collection and
reporting of terrorism-related statistics is haphazard. Often, the official who
reported the statistic gathered the statistic through telephone requests or
e-mail to other Department staff. Also, for many statistics reported,
Department officials either had not established internal controls to accurately
gather, classify, and report the statistics, or did not document the internal
controls used.

For the 192 statistics reviewed, 2 were based on survey instruments
sent by EOUSA to the 93 United States Attorneys. For these two statistics,
we did not assess the extent that internal controls were established over this
survey process. Two other statistics simply reported that an annual threat
forecast was disseminated or that an anti-terrorism task force was
established in each of the 94 USAOs. Therefore we did not assess the extent
that internal controls were established over these processes. In addition, we
could not determine if internal controls were established and documented for
55 other statistics because the reporting agency officials either could not
explain where the statistics originated or could not readily determine the
controls established and documented. For the remaining 133 statistics, the
status of internal controls is shown in the following table. As noted in the
table, controls for some statistics were both established and documented as
required, Controls for other statistics were either established but not
documented or not established at all.

22 Internal control is a major part of managing an organization. It comprises the
plans, methods, and procedures used to meet missions, goals, and objectives and, in doing
$0, supports performance based management. Internal control and all transactions and
other significant events need to be clearly documented, and the documentation should be
readily available for examination. The documentation should appear in management
directives, administrative policies, or operating manuals and may be in paper or electronic
form. All documentation and records should be properly managed and maintained.

11


and performed additional testing to determine the accuracy of the reported
numbers. We selected 81 of the 264 defendants sentenced to prison in

FY 2003, and 91 of the 256 defendants sentenced to prison in FY 2004. We
then requested that USAO officials provide information from the case files to
show the subject was linked to terrorist activity. If the case file information
provided did not show a terrorism link, we asked USAO officials to provide
additional information of a terrorism link. The overstatements in the
following charts reflect defendants for which the USAOs did not provide
information of the terrorism link.*°

OIG Analysis of Sample for | OIG Analysis of Sample for
EOUSA Statistic - Sentenced to EOUSA Statistic - Sentenced to
Prison - Defendants for Program Prison - Defendants for Program
Activity Anti-terrorism Activity Anti-terrorism
for FY 2003 for FY 2004
100 100 a : ——
80
oo 56 |
ose 25
20
5 — oo
Supported Overstated Sampled Supported Overstated

Source: EOUSA and USAO budgets and LIONS data, OIG interviews with EOUSA
and USAO staff, and analysis of documents provided by EOUSA and USAO staff

Below are specific details for examples of unsupported cases.

e The subject submitted false employment information to credit card
companies when applying for multiple credit cards. As part of a
scheme to defraud the credit card companies, the subject provided
the fraudulently obtained credit cards to a co-conspirator who
began making purchases with the cards to develop a credit history
and establish higher credit limits. The subject would pay the credit
card companies for the credit card charges to further develop the
credit history for the cards. After the credit limits on the cards
were maximized, the co-conspirators would take the cards to
collusive merchants who, in exchange for a portion of the fraud
proceeds, charged the cards through their merchant credit card
terminals to make it appear that goods or services were being
purchased when no such purchases were made. The merchants
would run up the fraudulent charges until the credit card limits were
exhausted. Neither the subject nor the co-conspirators would
reimburse the credit card companies for the charges. The credit

* As noted in footnote 41 on page 43, the numbers supported for these statistics
are based on a sample of transactions reported.

54


understated rather than overstated, these statistics therefore were
“supported.”

In our view, a statistic reported to Congress and to the public by the
Department of Justice is unsupported if the Department cannot provide
support for the accuracy of that number, regardless of whether it is under-
reported or over-reported. However, in order to avoid a non-productive
disagreement about the meaning of the word “supported” in this context,
the OIG has decided to change the wording in the report to state that
various statistics are “inaccurate” rather than “unsupported.” However, the
O1G’s ultimate conclusion remains that in all 11 of the terrorism statistics we
examined, EQUSA did not report its numbers accurately. Congress,
Department managers, and the public need accurate terrorism statistics in
order to assess the Department's work, and Department statistics that are
either under- or overstated are unacceptable.

Sixth, when discussing our methodology EOQUSA made various
arguments that the OIG did not identify the criteria used to question the
reporting of certain statistics or that we did not provide sufficient details of
the transactions questioned for EOUSA to determine if the transactions were
accurately reported or not. For example, EOQUSA stated that we did not
identify in the report the criteria we used to judge whether cases reported as
anti-terrorism cases were linked to terrorism. EOUSA is incorrect. The
report explains that our judgment of whether such a terrorism link existed
was based on whether or not the USAOs could provide any evidence that
tied the subjects to terrorist activity. We accepted as evidence of a
terrorism link virtually any written or verbally-provided indication of a
terrorism connection. Although we asked for written documentation, in
practice we accepted USAO and EOUSA officials’ verbal explanations of the
terrorism links.

Moreover, after we provided the draft report to EOUSA and discussed
the report with EOUSA officials at the audit closeout meeting, we provided
EOUSA with comprehensive lists showing every case we questioned for each
statistic we reviewed. The listings identified whether the case was
questioned for lack of a link to terrorism, lack of documentation to show the
case was reported in the proper period, or both reasons.

In addition, EOUSA stated that we did not explain why we did not
accept that cases referred to the USAOs by the JTTFs were properly coded as
anti-terrorism cases. EOQUSA further stated that we determined that 13 of
21 sampled JTTF cases did not have an appropriate terrorism link, but that
we did not identify the basis we used to make this judgment. Again, EOUSA
is incorrect. We asked USAO and EOUSA officials for documentation of such

130


provide information from the case files to show the subject was linked to
terrorist activity. If the case file information provided did not show a
terrorism link, we asked USAO officials to provide additional information of a
terrorism link. The overstatements in the following charts reflect defendants
for which the USAOs did not provide information of the terrorism link.**

OIG Analysis of Sample for OIG Analysis of a Sample for
EOUSA Statistic - Terrorism Convictions EOUSA Statistic - Terrorism Convictions
during FY 2003 during FY 2004
00 100 — ~-—-—-
80 75 |
a |
50 40
40 30 |
oy 7 13 25 21 19 |
° im. !}
Sampled Supported —_ Overstated Sampled Supported Overstated

Source: EOQUSA and USAO budgets and LIONS data, OIG interviews with EOUSA and USAO
staff, and analysis of documents provided by EOUSA and USAO staff

Below are specific details for examples of unsupported cases.

The subject was charged with: (1) making a false statement on an
airport security badge application by indicating he had not been
convicted of a disqualifying crime, when in fact he had; and

(2) possessing with the intent to distribute 34 grams of crack
cocaine. The subject pleaded guilty to possession of crack cocaine
with the intent to distribute and was sentenced to 70 months in
prison. The charge for making a false statement on an airport
security badge application was dismissed. The case file information
provided by the USAO contained no indication the subject was
linked to terrorist activity. When we asked an AUSA to provide
additional information to support a terrorism link, the AUSA told us
that the subject was arrested as part of Operation Plane View,
which was an operation similar to Operation Tarmac where
Department and other federal agents went into the local airport and
arrested individuals who used falsified documents such as social
security numbers, drivers’ licenses, and other identification
documents to gain employment at airport facilities. The AUSA
provided no additional information that linked the subject to
terrorist activity.

** As noted in footnote 41 on page 43, the numbers supported for these statistics
are based on a sample of transactions reported.

47


Terrorism-Related Statistics Reported by the
Department and its Components from
October 1, 2000, through September 30, 2005

20 statistics
reported
33 times

49 statistics
reported
155 times

16 statistics
reported
135 times

. §§ Department
oa FBI
279 times 0 Criminal Division
[] EOUSA

Source: Interviews with Department officials and Department documents

From the 209 terrorism-related statistics, we excluded 150 statistics
from detailed review because:

e the statistics were generated by agencies outside the Department
(17),

e the source of the statistics could not be identified by Department
officials (16),*°

e the OIG previously reviewed the statistics or supporting systems
and made recommendations to correct deficiencies identified (48),
and

5 They include the number of: (1) disrupted donors related to terrorist financing,
(2) weapons of mass destruction cases initiated by the FBI and supported by the Hazardous
Material Response Unit, and (3) subpoenas and search warrants issued to gather and
cultivate detailed intelligence on terrorists in the United States. The statistics for which
sources could not be determined are listed in Appendix II.

4


OIG Analysis of FBI OIG Analysis of FBI

Statistic - Intelligence Statistic - Intelligence
Information Reports Issued Information Reports Issued
in FY 2003 in FY 2004

oS ma 1638 |
1600 2400
1200 1800
800 1200
400 3 600
oC en __| ry

Reported Supported Overstated Reported Supported Understated

Source: FBI budget requests and performance plans, OIG interviews with FBI
staff, and analysis of documents provided by FBI staff

According to the TRRS officials, draft intelligence reports are submitted
through the FBI's Intelligence Information Reports Dissemination System
(FIDS). Once the reports are submitted through FIDS, the report data is
recorded in the Automated Case Tracking System (ACS). The Intelligence
Information Reports are prepared from the draft intelligence reports,
approved by management, and issued to agencies outside the FBI. The
intelligence report data is then uploaded from the ACS and logged into the
Zeus database. According to TRRS officials, the Intelligence Information
Reports are uploaded and verified monthly against information contained in
the Zeus database. However, this quality control process for uploading and
verifying the information is not documented and does not appear to prevent
the inaccurate reporting of Intelligence Information Reports issued.

A TRRS official told us that the differences between the numbers
reported in the budget and performance plan and the Zeus database could
have resulted from how the database was queried based on how the initial
request for the Intelligence Information Reports was worded. However, the
official could not provide documentation to show how the initial request was
worded or how the database was queried to meet the request. The official
also told us that the number of Intelligence Information Reports reissued,
corrected, and recalled, or additional information added to the Intelligence
Information Reports, could also have affected the accuracy of the number of
Intelligence Information Reports tracked in the Zeus database for FY 2003
and FY 2004.

3. Intelligence Assessments

The FBI's Intelligence Assessments are finished intelligence products
resulting from the intelligence analysis process. Intelligence Assessments
contain analyses of various types of intelligence data and are disseminated
to the FBI, intelligence community agencies, the White House, the State

21


cul

WiNumber Reported
Number Supported

1,000

and USAO staff

719

800

400
Number Reported/Supported

Source: EOQUSA and USAO budgets, annual statistical reports, and LIONS data; OIG
interviews with EOQUSA and USAO staff; and analysis of documents provided by EQUSA

200

87
86

Statistic Reported

5. Number prosecuted - defendants
for program activity anti-terrorism
in FY 2002

6. Number found guilty - defendants
for program activity anti-terrorism
in FY 2002 (see Chart Endnote 2 on
page 42)

7. Number of terrorism cases tried in
Fy 2001

8.a. Number of terrorism and anti-
terrorism cases against defendants
that were terminated in FY 2003

8.b. Number of terrorism and anti-
terrorism cases against defendants
that were terminated in FY 2004

9.a. Number of terrorism and anti-
terrorism cases pending at the end
of FY 2002

9.b. Number of terrorism and anti-
terrorism cases pending at the end
of FY 2003

9.c. Number of terrorism and anti-
terrorism cases pending at the end
of FY 2004

10. Number of defendants the U.S.
Attorneys terminated terrorism and
anti-terrorism cases against in
FY 2004
11. Percentage of defendants whose
cases were terminated that were
convicted in FY 2003
0

Chart Endnotes
1, The 725 reported for FY 2004 was reported twice - once in the U.S. Attorneys
FY 2004 Annual Statistical Report and once in the FY 2006 President's Budget Request to

Congress.

41


Performance Report,’® and (2) an effort to report conviction statistics that
would be less likely to be misinterpreted. Prior to FY 2002, the FBI and
EOUSA used different criteria to classify cases and resulting convictions as
terrorism-related, resulting in differences in how each entity ultimately
classified a case. Consequently, the total number of convictions classified by
the FBI and EOUSA as terrorism-related differed. Also, because EOUSA
prosecutes federal cases, its classification system only includes federal
convictions, while the FBI’s classification system also includes convictions in
state, local, and international courts obtained with the FBI’s investigative
assistance. The GAO reported that the Department did not have sufficient
management oversight and internal controls in place to ensure the accuracy
and reliability of terrorism-related conviction statistics included in its annual
performance reports.

In a March 2004 report, the GAO reported on: (1) the guidance and
procedures followed by federal law enforcement agencies regarding counting
investigations and arrests, and (2) how investigations and arrests statistics
are used.*° The report also discussed whether multiple agencies were
counting and reporting the same investigations and arrests. The GAO
concluded that law enforcement agencies often count the same
investigations and arrests resulting from joint operations and present these
statistics in their public documents and budget justifications. The GAO also
observed that: (1) none of the law enforcement agencies reviewed have a
central repository of joint investigations and arrests, and (2) not all of the
agencies distinguish between unilateral and joint arrests and investigations
within their databases. The GAO concluded that making this distinction
would help Congress when making budget decisions related to these
agencies.

Department's Response to Concerns about Inaccurate Terrorism-
Related Statistics

From December 2004 through April 2005, senior Department officials
provided written responses to post-hearing questions from the Senate

19 Mark Fazlollah and Peter Nicholas, “U.S. Overstates Arrests in Terrorism,” The
Philadelphia Inquirer, December 16, 2001.

20 General Accounting Office, Federal Law Enforcement, Information on the Use of
Investigation and Arrest Statistics, GAO-04-411, March 2004, The GAO reviewed six federal
agencies: the Drug Enforcement Administration; the FBI; the United States Marshals
Service; the former U.S. Customs Service and the Immigration and Naturalization Service,
now part of the Department of Homeland Security; and the United States Postal Inspection
Service.


Second, we disagree with EQUSA’s argument that all convictions in
cases like Operation Tarmac were properly counted as anti-terrorism
convictions given EQUSA’s stated definition of the anti-terrorism program
category. Moreover, we believe that if EOUSA wanted to count such cases it
should have made its definitions and descriptions of the type of cases that it
was counting as anti-terrorism case transparent. We believe that a fair
reading of EOUSA’s definition of the anti-terrorism program category would
not indicate that such cases should be included.

EQUSA’s definition of the anti-terrorism program category states that
the category: (1) includes any matter or case where the underlying purpose
or object of the investigation is anti-terrorism related, (2) is meant to
capture activity intended to prevent or disrupt potential or actual terrorist
threats where the offense conduct is not a federal crime of terrorism, and
(3) includes any matter where evidence or information exists in any form
reasonably relating the case to terrorism or the prevention of terrorism. The
definition goes on to provide examples of cases that should be included
under this category, such as immigration fraud, but also sates that the
subject or target must be “reasonably be linked to terrorist activity.” Thus,
in Operation Tarmac, which resulted in immigration charges, the definition
suggest that the subjects must also reasonably be linked to terrorism. As
EOUSA acknowledges, most of those subjects in Operation Tarmac cases
were not. Moreover, none of EQUSA’s anti-terrorism statistics reported to
Congress in the President’s budgets and in its statistical reports included an
explanation of what EOUSA meant by “anti-terrorism” or whether the cases
reported were actually linked to terrorist activity.

We recognize that efforts like Operation Tarmac may be intended to
deter potential terrorists, as well as a wide range of other criminal activity.
However, we believe that including all Operation Tarmac cases under its
anti-terrorism category — without explanation - does not clearly provide full
information to Congress and the public about EOQUSA’s statistics. Rather,
simply suggesting that because “hundreds of these cases were brought
around the country specifically to deter potential terrorists from infiltrating
regional airports” does not, in our mind, justify labeling all these cases as
“anti-terrorism” absent a more identifiable link to terrorist activity. Instead,
EQUSA has an obligation to clearly articulate the types of cases it is
including in these categories.

We also note that after making these arguments about our analysis of
its statistics, EOQUSA stated that “Notwithstanding, in an effort to ensure
greater clarity about the purpose and scope of the anti-terrorism category
code, EQUSA shall rename the code and will, after a prompt but thorough
internal discussion of the issue, modify the definition to make it more

128


Considering the results of our testing of the sample transactions
reported, the following chart shows that we found that all five statistics were

reported inaccurately by the Criminal Division, although the statistics appear
to be inaccurately understated.

OIG Analysis of Terrorism-Related Statistics
Reported by the Criminal Division

Statistic Reported

1. Individuals charged resulting from
terrorism investigations from 9-11-01
through 2-3-05

2. Individuals convicted or pleaded guilty
resulting from terrorism investigations from
9-11-01 through 2-3-05

3.a. Individuals charged with material support
of terrorism or similar crimes from 9-11-01
through 8-5-04 (see Chart Endnote 1 on
page 74)

3.b. Individuals charged with material support of
terrorism or similar crimes from 9-11-01
through 2-3-05

4. Individuals convicted of material support of

terrorism or similar crimes from 9-11-01
through 2-3-05

Over 50 5.a. Material support to terrorism cases and

matters participated in or coordinated as of

1-31-03 (see Chart Endnote 2 on page 75)

More than 70 5.b. Material support to terrorism cases and
, matters participated in or coordinated as of
1-31-04 (see Chart Endnote 3 on page 75)

5.c. Material support to terrorism cases and
matters participated in or coordinated from

i] Reported

Supported |
| | 113

_ Mol e than 89
143

161

100 10-1-02 throuah 9-30-03
121 5.d. Material support to terrorism cases and
422 matters participated in or coordinated from

10-1-03 through 9-3-04

600 500 400 300 200 100 0
Number Reported/Supported

Source: Criminal Division budgets, OIG interviews with Criminal Division staff, and
analysis of documents provided by Criminal Division staff

Chart Endnotes

1. For this statistic, the Criminal Division reported the number as “more than 89” instead of an
exact number.

74


reported each month of the fiscal year were then added together to come up
with the total threats tracked during the year. Consequently, the total
threats reported as tracked during FY 2003 and FY 2004 included duplicate
threats.

Through further discussions with TMU officials, we also determined the
total number of threats reported as tracked during FY 2003 and FY 2004 did
not include all of the threats tracked by the FBI. The reported threats
included only threats tracked by the TMU and, according to a TMU official,
this accounted for only about 40 percent of the threats actually tracked by
the FBI. The TMU official said that the remaining 60 percent of threats
tracked by the FBI were tracked by FBI field offices during FY 2003, and by
the field offices, the FBI’s Counterterrorism Watch Unit, and the FBI‘s
International Terrorism Operations Sections during FY 2004.° As a result,
the number of threats actually tracked by the FBI during FY 2003 and
FY 2004 was significantly understated.

In addition to inaccurately reporting the threats tracked, the
FY 2006 President’s Budget Request to Congress significantly overstated the
change between the number of threats tracked during FY 2003 and FY 2004.
As discussed previously, the FBI reported 515 threats tracked for FY 2003
but the number reported represented only the last 2 months of FY 2003.
The FBI reported 4,499 threats tracked for FY 2004 and reported an 800
percent increase in threats tracked for FY 2004 (4,499 FY 2004 threats
minus 515 FY 2003 threats divided by 515 FY 2003 threats). But since the
threats reported for FY 2003 were for 2 months and the threats reported for
FY 2004 were for 12 months, the percent change from FY 2003 to FY 2004
was significantly overstated.

According to a TMU official, from September 1, 2003, until
August 31, 2004, the TMU tracked threats received by reviewing e-mails,
phone calls, and threat matrix reports. Threat matrix reports are daily
reports that identify various threats against the United States and are

30 The FBI’s Counterterrorism Watch Unit and International Terrorism Operations
Section are part of the FBI Counterterrorism Division and support the FBI’s counterterrorism
mission. The Counterterrorism Watch Unit is the FBI’s 24-hour global command center for
terrorism prevention operations. The FBI's International Terrorism Operations Sections
{ITOS) are split into two sections known as ITOSI and ITOSII. ITOSI supports, coordinates,
and provides oversight of FBI international counterterrorism operations related to al Qaeda
and other Sunni extremist groups. ITOSII supports, coordinates, and provides oversight of
FBI international counterterrorism operations related to other groups, such as Hezbollah,
HAMAS, and Palestinian Islamic Jihad, as well as the terrorist threats from state sponsors of
terrorism.

28


terrorism and anti-terrorism cases were terminated in FY 2004 as shown in
the following chart.°”

OIG Analysis of EOUSA Statistic -
Defendants for Terminated Terrorism
and Anti-terrorism Cases in FY 2004

| 700 643 — a

560

401
242

-E ia

Reported Supported Overstated

Source: USAO annual statistical report

and LIONS data, OIG interviews with EOUSA
and USAO staff, and analysis of documents
provided by EOUSA and USAO staff

11. Percent of Defendants Whose Terrorism and Anti-Terrorism
Cases Were Terminated and Who Were Convicted

In the USAO FY 2003 Annual Statistical Report, EOUSA reported that
87 percent of the defendants whose terrorism and anti-terrorism cases were
terminated in FY 2003 were convicted. EOUSA based this statistic on the
number of defendants associated with the 682 terminated cases in
FY 2003 (Statistic Number 8). As noted in our analysis of EOUSA Statistic
Number 8 on pages 59 through 62, we could only identify EOUSA‘s
documentation support for 359 terrorism and anti-terrorism cases
terminated in FY 2003. We analyzed the 359 cases and found that
388 defendants were associated with the cases, of which 333 had been
convicted. Therefore, we calculated that 86 percent of the defendants
whose terrorism and anti-terrorism cases were terminated in FY 2003 were
convicted. Therefore, EOUSA overstated the percent of the defendants
whose terrorism and anti-terrorism cases were terminated in FY 2003 who
were convicted by 1 percent in the FY 2003 Annual Statistical Report.

CRIMINAL DIVISION TERRORISM STATISTICS

We tested the following five operational statistics that the Criminal
Division reported in the FY 2006, FY 2005, or FY 2004 President’s Budget
Request to Congress.

57 As noted in footnote 41 on page 43, the numbers supported for these statistics
are based on a sample of transactions reported.

69


We also found that for 34 of the 268 sampled defendants for
FY 2003, including 16 of the 180 defendants not linked to terrorism, either
the cases were not filed in the year reported or the USAOs could not provide
documentation to show the cases were filed in the year reported. This same
issue occurred for 68 of the 338 sampled defendants for FY 2004, including
30 of the 222 defendants not linked to terrorism, as either the cases were
not filed in the year reported or the USAOs could not provide documentation
to show the cases were filed in the year reported.

Overall, considering both the defendants not linked to terrorism and
the cases not filed in the year reported, EQUSA overstated the number of
defendants in cases filed under the anti-terrorism program activity for
FY 2003 and FY 2004 as shown in the following charts.*

OIG Analysis of EOUSA Statistic - | OIG Analysis of EOUSA Statistic -
Cases Filed - Defendants for | Cases Filed - Defendants for
Program Activity Anti-terrorism Program Activity Anti-terrorism
for FY 2003 for FY 2004
900 ns ca
720 640
540 480 | acs
360 | 320 260
180 { | 160 -
o oo a
|

Reported Supported Overstated

Source: EOUSA and USAO budgets and LIONS data, OIG interviews with EOUSA
and USAO staff, and analysis of documents provided by EOUSA and USAO staff

2. Terrorism Convictions

In the FY 2005 and FY 2006 President’s Budget Requests to Congress,
EOUSA reported 103 terrorism convictions for FY 2003 and 118 terrorism
convictions for FY 2004. We reviewed LIONS reports supporting the number
of terrorism convictions for FYs 2003 and 2004 and found that the LIONS
data agreed with the numbers reported in the budget requests for both
years.

We then selected a judgmental sample of the terrorism convictions
reported for FY 2003 and FY 2004 and performed additional testing to
determine the accuracy of the reported numbers. We selected 30 of the 103
terrorism convictions reported for FY 2003, and 40 of the 118 terrorism
convictions reported for FY 2004. We then requested that USAO officials

3 As noted in footnote 41 on page 43, the numbers supported for these statistics
are based on a sample of transactions reported.

46


* Number of individuals charged as a result of terrorism
investigations from September 11, 2001, through February 3,
2005;

¢ Number of individuals who have been convicted or pleaded guilty as
a result of terrorism investigations from September 11, 2001,
through February 3, 2005;

* Number of individuals charged with material support of terrorism or
similar crimes from September 11, 2001, through August 5, 2004,
and from September 11, 2001, through February 3, 2005;°°

« Number of individuals convicted of material support of terrorism or
similar crimes from September 11, 2001, through February 3,
2005; and

« Number of materia! support investigations the Criminal Division
participated in or coordinated: (1) as of January 31, 2003, (2) as
of January 31, 2004, (3) from October 1, 2002, through
September 30, 2003, and (4) from October 1, 2003, through
September 30, 2004.

The Criminal Division’s Counterterrorism Section (CTS) oversees the
investigation and prosecution of terrorism-related offenses. The CTS uses
two methods for accumulating data for the five Criminal Division statistics
we tested. For the first four statistics tested, the CTS maintains a local
database application for tracking and reporting. For the last statistic tested,
a CTS official performs a quarterly manual count of data she receives from
CTS attorneys and the Deputy for Terrorist Financing regarding the material
support to terrorism cases or matters the Criminal Division was working
on.

We initially requested information from the database to support the
first four operational statistics we tested. The Deputy Chief of CTS
responded that the database was not up-to-date and that she could not
reconcile the numbers reported for the four operationa! statistics to the

58 This statistic was reported twice - once as a cumulative number from
September 11, 2001, through August 5, 2004; and second as a cumulative number from
September 11, 2001, through February 3, 2005. Because the numbers reported were
cumulative, the later statistic includes the number reported for the first statistic.

53 The Criminal Division investigations into terrorism-related offenses are referred to
as “matters” if no charges have been filed. Once charges have been filed, the investigation
is referred to as a “case.”

70


APPENDIX IIT

The Honorable Glenn A. Fine

OIG Report focused. With that in mind, the FBI responds to the recommendations below as
follows:

1. Establish and document internal control procedures for gathering, verifying,
and reporting terrorism-related statistics.

Although the FBI agrees with the OIG on the importance of internal controls, a
portion of the O1G Report concems the definition of a terrorism-related conviction. As discussed
above, the FBI believes that its current system of classifying as terrorism-related all convictions
that arise from investigations that have a terrorism nexus is appropriate. There were isolated
exceptions noted by the OIG involving investigations of passport, VISA and identification fraud
originally captured within the Domestic Terrorism Program. Improved oversight at FBIHQ and
enhanced policy guidance have strengthened the intemal controls and wil} limit these instances in
the future.

The FBI has established and documented internal control procedures for
gathering, verifying, and reporting terrorism-related statistics. In the development and
improvement of our information systems we will continue to ensure that audit functions exist and
that statistical reporting wil! provide adequate details for review and analysis.

2. Maintain documentation to identify the source of all terrorism-related statistics
reported in official operational documents such as budget requests, performance plans, statistical
reports, and others.

The FBI will establish a process of maintaining supporting documentation
identifying the original source of terrorism-related statistics. The Counterterrorism Division and
the Finance Divisions will work together to establish a formal process to maintain supporting
documentation and establish appropriate record retention policy.

3. Maintain documentation of the procedures any systems used to gather or track
the statistics reported.

As noted in the response above the Counterterrorism and Finance Divisions will
establish a process to maintain the supporting documentation which will provide an audit trail on
the systems utilized and any unique procedures followed to accurnulate the data.

4. Maintain documentation of the methodologies and procedures used to verify
the accuracy of the statistics reported.

The FBI documentation of the methodologies and procedures used to verify
statistical accuracy rests with the entities that have program oversight of the systems that capture
the data. Much of the process for reviewing statistical accuracy centers on the trend analysis
conducted in the field and at FB!HQ which identifies anomalies for further review. The FB! will
continue this process. One of the internal controls exercised by the FBI involves the formal
Inspection Process which conducts tests of transactions to include statistical reporting. In the
past the Inspection Division has identified shortcomings by entities reporting statistical
accomplishments.

105


APPENDIX IIT

istics Are “Inaccurate”: or “Unsupported” Is Based
Primarily on OIG’s New interpretation of the Anti-Terrorism Program Category Code.

OIG interprets EOUSA’s anti-terrorism program category code to require that defendants
in anti-terrorism cases have an identifiable tink to terrorist activity.’ Neither EOUSA nor the
United States Atlomeys’ Offices, the primary drafters and users of the anti-terrorism coding
definition, have ever required such a link.

OIG’s interpretation would essentially limit the anti-terrorism program code to cases
charging non-terrorism crimes against defendants who have an identifiable link to terrorist
activity. Such cases are currently included within the anti-terrorism case definition. But the
definition was intended to capture a much broader group of proactive cases that have been
affirmatively and intentionally brought to deter and prevent terrorism, particularly in areas of
critical infrastructure vulnerability, regardless of whether the defendant has any links to terrorist
activity.

OIG’s interpretation is simply that — its interpretation. It is not the interpretation that the
drafters intended or the users of the anti-terrorism code have employed.’

* Program category codes are used to label cases so that they can be sorted and compiled by
EOUSA for statistical purposes. EOUSA collects data on all criminal cases investigated and
charged by each of the 94 United States Attomeys’ Offices. Case data are entered from each
individual United States Attorney’s Office and are sent to a centralized database at EOUSA
known as LIONS (Legal Information Office Network System).

* EOUSA introduced the anti-terrorism program category code in August 2002. The code, which
was defined by EOUSA and the Criminal Division, was intended to create a label for those
investigations and cases undertaken to disrupt or prevent terrorism, which was then and is now
the Department's highest priority. The definition is as follows:

Any matter or case where the underlying purpose or object of the investigation is anti-
terrorism related (domestic or international). This program category is meant to capture

United States Attomey Office activity intended to prevent or disrupt potential or actual
terrorist threats where the offense conduct is not obviously a federal crime of terrorism.
To the extent evidence or information exists, in any form, reasonably telating the case to
terrorism or the prevention of terrorism (domestic or international), the matter should be
considered “anti-terrorism.” For example, a case involving offenses such as immigration
violations, document fraud, or drug trafficking, where the subject or target is reasonably
linked to terrorist activity, should be considered an “anti-terrorism” matter or case.
Similarly, a case of identity theft and document fraud where the defendant’s motivation
is to obtain access to and damage sensitive government facilities should be considered
“anti-terrorism.” [Underline in original.]

In drafting and employing the code, we have operated with the understanding that the

definition includes cases that are brought to prevent and disrupt potential terrorist activity,
whether or not the target or defendant is linked to terrorist activity. Given the emphasis

108


(OIG Analysis of Terrorism-Related
Statistics Reported by the FBI

i Number Reported
@ Number Supported

6,7:

8,000 7,000 6,000 5,000 4,000 3,000 2,000 1,000 0
Number Reported/Supported

|

2,622

2,679

1,731
1,638

15

206
141

Statistic Reported

1. Number of terrorism-related
convictions in FY 2004 (see
Chart Endnote 1 on page 16)

2.a. Number of Intelligence

Information Reports issued
in FY 2003

2.b. Number of Intelligence
Information Reports issued
in FY 2004 (see Chart
Endnote 2 on page 17)

3. Number of Intelligence
Assessments issued in
FY 2004

4. Number of Intelligence
Bulletins issued in FY 2004

5. Number of intelligence
products produced/
disseminated in FY 2004


investigations that began as terrorism-related investigations do not tink
the case to terrorist activity.

EOUSA: Unresolved. EOUSA agreed that a case should be recoded if
it changes over the course of its investigation and it would be inaccurate
to report the case under the code it was originally reported under.
However, EQUSA commented that it does not see such situations arising
very often. EOUSA also stated that cases brought as part of an
operation to prevent terrorism are properly coded as anti-terrorism.
However, EOUSA said it plans to modify and clarify its anti-terrorism
code definition to eliminate any confusion as to its meaning.

As discussed above, we disagree with EOUSA's analysis of this issue.
Simply reporting the results of prevention operations as anti-terrorism
in the Department’s annual budgets without explaining that the majority
of the subjects had no ties to terrorist activity and were arrested for
immigration violations or identity theft does not clearly and fairly
characterize these operations. This recommendation can be closed
when we receive documentation showing EOUSA has established and
implemented procedures to clarify in the LIONS system the type of
cases included in the anti-terrorism category, and to clarify what these
statistics represent.

140


OIG Analysis of Terrorism-Related Statistics
Reported by EOUSA Statistic Reported

1.a. Number of cases filed -
defendants for program activity
anti-terrorism in FY 2002

365
1,11

1.b. Number of cases filed -
defendants for program activity
anti-terrorism in FY 2003

1.c. Number of cases filed
defendants for program activity
anti-terrorism in FY 2004 (see
Chart Endnote 1 on page 41)

. Number of terrorism convictions
in FY 2003

7

o Number Reported
Number Supported

. Number of terrorism convictions
in FY 2004

558 3.a. Number of terrorism-related
281 convictions in FY 2003

. Number of terrorism-related
convictions in FY 2004

379,

. Number sentenced to prison -
defendants for program activity
anti-terrorism in FY 2003

. Number sentenced to prison -
defendants for program activity
anti-terrorism in FY 2004

1,200 1,000 800 600 400 200 1)
Number Reported/Supported


APPENDIX III

Thank you again for the opportunity to provide comments to the Report.

Sincer

‘Alée S. Fisher
Assistant Attomey General
Criminal Division

fomXlE, lf =

Kenneth L. Wainstein
Assistant Attorney General
National Security Division

123


a terrorism link, and we accepted verbal explanations if they were offered.
For the 13 sampled cases, no terrorism link was provided in writing or
verbally by the USAOs or EOUSA other than the explanation that these cases
were JTTF matters and therefore by their nature constituted terrorism-
prevention cases. As explained previously, we do not accept this logic.

EOUSA also claimed that we failed to share with it case documentation
we received from the USAOs to support findings that EOUSA reported cases
in the proper year. This statement is also inaccurate. For each statistic we
reviewed, we provided EOQUSA a comprehensive listing showing whether the
case was questioned because of a lack of a terrorism link, lack of
documentation to show the case was appropriately included in the year
reported, or both reasons. EOUSA staff did not provide support to prove
that the cases we questioned were reported in the proper year.

Finally, EQUSA stated that the OIG failed to provide it with the
information it needed to identify individual cases discussed in the report and
therefore it was impossible for EOUSA to reply to the examples on a case-
by-case basis. EOUSA’s statement is incorrect. As previously noted, for
every statistic we reviewed we provided EOUSA with a comprehensive listing
showing the case and the reason it was questioned. Consequently, we
believe that EOUSA had the information - as well as the time it needed — to
research each case and determine whether our conclusions were accurate.

The status of the recommendations related to EOUSA statistics is
presented in Section D of this appendix.

C. Criminal Division Response

The Criminal Division also disagreed with our findings, although it
concurred with each of our recommendations.

First, the Criminal Division argued that because it understated six of
the nine statistics we reviewed, its numbers were fully “supported.” As we
discussed in the analysis of EOUSA’s response, we disagree with this
argument. We believe it is unacceptable for the Criminal Division of the
Department of Justice to provide inaccurate statistics describing its work,
regardiess of whether the numbers are under- or over-reported. However,
as discussed previously, in order to avoid a non-productive disagreement
about the accuracy of the word “supported” in this context, the OIG has
changed its wording in the report to “inaccurate” statistics rather than
“unsupported” statistics.

131


and refers to its response to the first recommendation. As noted in our
report, we identified 16 statistics for which the source of the statistics
could not be identified. Four of these 16 statistics were reported in
Attorney General Testimony and appeared to be statistics that may have
been collected by EOUSA or USAOs. Therefore, we believe that EOUSA
needs to maintain documentation to identify the source of all statistics,
even those reported in non-EOQUSA documents but originating with
EOUSA. This recommendation can be closed when we receive
documentation showing EOUSA’s plans to maintain documentation to
identify the source of all terrorism-related statistics reported in official
operational documents such as budget requests, performance plans,
statistical reports, and others.

Criminal Division: Resolved. The Criminal Division concurred with
the recommendation and said it intends to maintain documentation in a
more readily available manner to identify the source of the statistics it
reports. This recommendation can be closed when we receive
documentation showing how the Criminal Division plans to maintain
documentation to identify the source of the terrorism-related statistics it
reports.

This recommendation was directed to the FBI, EOUSA, and Criminal
Division to maintain documentation of the procedures and systems used
to gather or track the statistics reported.

FBI: Resolved. The FBI stated that its Counterterrorism and Finance
Divisions will establish a process to maintain supporting documentation
that will provide an audit trail on the systems utilized and any unique
procedures followed to accumulate the data. This recommendation can
be closed when we receive documentation showing the FBI's process to
maintain documentation of the procedures and systems used to gather
or track the statistics it reports.

EOUSA: Unresolved. EOUSA responded that it already maintains
documentation of the procedures and systems used to gather or track
the statistics it reports and referred to its response to the first
recommendation. As discussed in our analysis of EOUSA’s response to
Recommendation 2, because EOUSA provides statistics for use in other
documents or speeches, such as Attorney General Testimony, it should
maintain documentation of the procedures and systems used to report
such statistics. This recommendation can be closed when we receive
documentation showing EOUSA’s plans to maintain documentation of
the procedures and systems used to gather or track the statistics it
reports.

137


7. Terrorist Threats to Transportation and Facilities and
8. Terrorist Threats to People and Cities

The FBI’s Counterterrorism Watch Unit (Unit), which is part of the
FBI’s Counterterrorism Division, monitors and tracks suspicious incidents
and threats received through e-mails and telephone calls from FBI field
offices, FBI Executive staff, Legal Attaché offices, state and local law
enforcement, and other sources. The Unit records the suspicious incidents
and threats in an electronic file called an Operational Support Log. An
Intelligence Analyst in the Unit periodically reviews the Operational Support
Log and, using his or her judgment and experience, decides how each threat
should be categorized. Two categories of threats are threats to
transportation and facilities and threats to people and cities. After the
Intelligence Analyst reviews all the entries in the Operational Support Log,
the analyst enters the categorization of the threats into a local spreadsheet
application. This application is the source of threat data reported in the
FBI's annual performance plans. After the threats are categorized, the Unit
disseminates the threats to the appropriate FBI offices for investigation.

We found that the Counterterrorism Watch Unit has not established
adequate internal controls to ensure that the threats are properly
categorized. The Unit’s Watch Commander reviews the Operational Support
Log entries to ensure that all the suspicious incidents and threats are
included, but no one reviews the Intelligence Analyst’s decisions on how the
threats are categorized. Initially, the Acting Unit Chief told us there are
standard operating procedures in place, but we found those procedures do
not provide controls for ensuring the accurate categorization of the threats.
The Counterterrorism Watch Unit issued additional standard operating
procedures in July 2006 for the unit operations. We found that the new
standard operating procedures contained no internal controls to ensure the
accurate categorization of threats. The procedures provide for the Watch
Commander to review the log entries to ensure that all suspicious incidents
and threats are included. However, the procedures do not include steps for
a supervisor to review the Intelligence Analyst’s decisions on how the threats
are categorized.

Threats to Transportation and Facilities. In its
FY 2006 - FY 2011 Performance Plan, the FBI reported 547 threats

were made to transportation and facilities during FY 2004. The
spreadsheet used by the FBI’s Counterterrorism Watch Unit to track
the number of threats to transportation and facilities agreed with the
number of threats reported in the FBI’s FY 2006 - FY 2011
Performance Plan for FY 2004. However, we determined that the

30


¢ The inaccurate reporting of the number of intelligence products
issued occurred because no internal controls are in place for
gathering and verifying the number of Intelligence Bulletins,
Intelligence Assessments, and Intelligence Information Reports that
have been posted to websites by the four FBI divisions. In addition,
the FBI did not validate the accuracy of the information posted by
the divisions to ensure that all the intelligence information products
are posted.

« The number of terrorism threats tracked in FY 2003 and 2004 was
inaccurate primarily because the reported statistics included threats
that were counted multiple times. In addition, according to an FBI
official, the total threats tracked during FY 2003 and FY 2004 did
not include about 60 percent of the threats tracked by FBI field
offices, the FBI’s Counterterrorism Watch Unit, or the FBI‘s
International Terrorism Operations Sections.

« The number of threat assessments issued was inaccurately reported
because the FBI inadvertently reported some assessments issued
during FY 2003 as being issued during FY 2004.

« The number of Presidential Terrorist Threat Reports issued was
overstated because the spreadsheet database appears to have been
queried by calendar year or for another time period instead of by
fiscal year, and the request for the statistic was worded in a way
that could produce different answers.

EOUSA and USAO Terrorism Statistics

As shown in the following chart, EQUSA and the USAOs did not
accurately report the 11 EQUSA and USAO statistics we reviewed.


OIG Analysis of FBI
| Statistic - Intelligence Bulletins
Issued in FY 2004

=) ——__—

63 208 41
a
| Reported Supported Understated
Source: FBI performance plans, OIG
interviews with FBI staff, and analysis
of documents provided by FBI staff

According to an official of the former TWWU, once Intelligence
Bulletins were approved for dissemination during FY 2004 data regarding the
Bulletins was entered in the word processing files for tracking. The former
TWWU used an internal checklist that guided an analyst through the stages
of Bulletin production, review, dissemination, and administrative upkeep.
However, the checklist was not accompanied by an explanation of
responsibilities and processes for collecting, verifying, and reporting the
Intelligence Bulletins issued. During FY 2004, and continuing through
July 2005, a TWWU staff member provided monthly to a GTAU Official the
number of Bulletins issued.

The problems with tracking Intelligence Bulletins are like those with
tracking Intelligence Assessments, according to a GTAU official. The FBI
units that issue the bulletins either enter their details into a database or
provide the GTAU staff the details and the GTAU staff enters them in the
database. The GTAU official relies on the originating FBI units to either
enter all the Intelligence Bulletins in the database or notify the GTAU official
of the bulletins. There are no internal controls in place for gathering and
verifying the accuracy of Intelligence Bulletins tracked in the database. A
GTAU official responsible for accumulating the statistic said that when she
began her job in February 2004, there were no formalized procedures on
how to collect, verify, and report the Intelligence Bulletins issued and no
formalized procedures have been developed since.

According to a Threat Analysis Unit (TAU) official, in June 2006 the
CTAS established a new tracking and monitoring intelligence production and
dissemination system where all Intelligence Bulletins, Intelligence
Assessments, and other intelligence products are logged into a spreadsheet
application. As of November 2006, the procedures on how to collect, verify,

24


APPENDIX III

The Honorable Glenn A. Fine

With Guardian, the FBI has mandated all field offices to enter threats and
suspicious activity in a near-real time manner. In addition to collecting threat and suspicious
activity reporting, Guardian also serves as a repository for the investigative steps and
investigative results achieved by each field office. The FBI deployed an improved version of
Guardian (version 2.0) in the fall of 2006, and it serves as a continuation of a centralized threat
management system with enhanced metrics and tracking capabilities. Since July 2004, the FB)
has captured over 80,000 threats and suspicious activities reports in Guardian and Guardian 2.0.
Moreover, the FBI has created the Threat Resolution Unit within the National Threat Center
Section, whose sole mission is the review and oversight of efforts to collect and resolve
counterterrorism threats. Thus, the FBI's system for tracking terrorist threats has improved
markedly since FY 2004, which is the last period that the OIG reviewed.

7. (U) Terrorist Threats to Transportation and Facilities and 8. (U)
Terrorist Threats to People and Cities

As with Category 6, Terrorist Threats, the FBI acknowledges that its internal
controls regarding the tracking of threats to transportation and facilities as well as to people and
cities were not optimal during the period that OIG reviewed. However, the development and
implementation of Guardian and Guardian 2.0, which occurred after FY 2004, provides
significant internal controls, and demonstrates the FBI's commitment to maintaining accurate
records and statistics. The Guardian 2.0 application provides additional guidance on the
categorization of threats and the field office selections are review by FBIHQ daily.

9 {U) Counterterrorism Threat Assessments

The OIG's analysis identified a clerical error that resulted in the overstatement of
12 Threat Assessments in FY 2004. Threat assessments actually produced in 2003 were
included by mistake in the statistics for FY2004.

10, (U) Presidential Terrorist Threat Reports

The O3G's analysis identified a clerical error involving the reporting of
Presidential Terrorist Threat Reports in FY 2004. This statistic appears to have involved the
reporting of calendar year figures rather than fiscal year figures. As part of the evolution of the
national intelligence reporting process, Presidential Terrorist Threat Reports are now produced as
acommunity product by the National Counterterrorism Center and are now labeled as National
Terrorism Bulletins.

Recommendations

All of the OIG's recommendations below outline important and necessary controls
for the accurate reporting of terrorism statistics. Indeed, the FB! believes that the steps taken
since 9/11, as outlined above, reflect our agreement with and adoption of most of the IG's
recommendations. As described above, as part of the FBI's substantial reorganization and
restructuring after September 11, 2001, the FBI has made improvements to its statistical
reporting systems, specifically the case management and supporting information technology
programs. Thus, the FBI believes that its internal controls over terrorism statistics today are
much improved over the controls that existed in FY 2003 and FY 2004, the period on which the

104


Audit Purpose and Scope

In this audit, we examined the FBI's, the Criminal Division’s, EOUSA’s,
and the USAOs'’ terrorism-related statistics to determine if they were
accurately gathered and reported. We identified the terrorism-related
statistics reported by the Department and its components by:

¢ interviewing officials from the Department, the FBI, the Criminal
Division, and EOUSA;

* analyzing budget submissions, congressional testimony,
performance plans, and other documents maintained by the
Department and its components; and

e viewing the website maintained by the Department at
www.lifeandliberty.gov to keep the public informed of the
Department’s counterterrorism efforts.

In total, we identified 209 unique terrorism-related statistics reported
by the Department and its components from October 1, 2000, through
September 30, 2005. To assess whether these statistics were accurate, we
examined the internal controls for 192 of the 209 terrorism-related
statistics.'> The 209 statistics were reported at least 602 times during the
period as shown in the following chart.

13 Seventeen of the 209 statistics were obtained from agencies outside the
Department, such as the Departments of State, Treasury, Defense, and Homeland Security.
Because these 17 statistics were not gathered by the Department, we excluded them from
our review.

** While some terrorism-related statistics were reported only once, most were
reported multiple times. Many of the statistics identified were reported by more than one
agency. The total times the statistic was reported is the number of times (both operational
and informational) the statistic was reported by the primary reporting agency and by other
agencies.


Thus, during our audit, the Criminal Division made two attempts to
reconstruct support for the terrorism-related statistics we reviewed. We
carefully evaluated each attempted reconstruction and found each to be
significantly flawed. At the end of this process, we determined that the
Criminal Division understated the five statistics we tested eight of the nine
times the statistics were reported. The extensive efforts required by the
Criminal Division to reconstruct reported statistics demonstrates that the
Division had no accurate basis for its reported numbers and could easily and
unintentionally misreport in the opposite direction, absent the
implementation of effective procedures for gathering and reporting statistics.

Conclusion and Recommendations

In general, we found that the Department components and the
Department as a whole did not accurately report terrorism-related statistics.
The Department components lacked adequate internal controls for
gathering, verifying, and reporting terrorism-related statistics.

To assist the Department and its components in improving the internal
controls to ensure the accuracy of its reported terrorism-related statistics,
we recommend that the FBI, Criminal Division, and EOUSA:

(1) establish and document the internal control procedures for gathering,
verifying, and reporting terrorism-related statistics; (2) maintain
documentation to identify the source of all terrorism-retated statistics
reported, (3) maintain documentation of the procedures and systems used
to gather or track the statistics reported, (4) maintain documentation of the
methodologies and procedures used to verify the accuracy of the statistics
reported, and (5) ensure that terrorism-related statistics are not reported
unless evidence is maintained to support the statistics. In addition, we
recommend that EOUSA and the USAOs establish procedures to recode
transactions in the LIONS system when investigations that began as
terrorism investigations do not ultimately link the defendant to terrorist
activity.

xvii


OIG Analysis of Terrorism-Related
Statistics Reported by the FBI

| ] Statistic Reported
@ Number Reported 206 | | 1. Number of terrorism-related
convictions in FY 2004 (see
@ Number Supported 141 Chart Endnote 1 on page 16)

2.a. Number of Intelligence
Information Reports issued
in FY 2003

oar

1,638

2.b. Number of Intelligence
Information Reports issued
in FY 2004 (see Chart
Endnote 2 on page 17)

2,622
2,679

bi

Assessments issued in

|
133 || 3. Number of Intelligence
| FY 2004

|

Bulletins issued in FY 2004

| | 63 || 4. Number of Intelligence
| 104

1,657 5. Number of intelligence
products produced/
6,73 disseminated in FY 2004

| Jeti | | | | |
8,000 7,000 6,000 5,000 4,000 3,000 2,000 1,000 0
Number Reported/Supported



APPENDIX III

Department budget requests,” EOUSA will work with all necessary Department components to
ensure that any reporting of anti-terrorism statistics is labeled in as clear a manner as possible.

* Statistics for the number of terrorism and anti-terrorism defendants charged, the number of
terrorism and terrorism-related convictions obtained, and the number of terrorism and anti-
terrorism defendants sentenced, have been included in recent Department budget requests since
FY 2004.

116


APPENDIX I

For the 16 times where numbers reported for the 8 statistics agreed
with the LIONS data, we performed additional testing to determine if the
data recorded in LIONS was accurate. We selected a judgmental sample for
each of the 16 times the 8 statistics were reported by:

e obtaining a spreadsheet showing the number of transactions
reported for each statistic by a United States Attorney’s District
Office,

« calculating the total number of transactions reported for each
district office for all 16 times the statistics were reported,

e selecting the 8 district offices that reported more than 200 total
transactions for the 16 times the statistics were reported, and

« reviewing all the transactions reported by these 8 district offices for
each of the 16 times the statistics were reported.

The following table shows the number of transactions selected for each
of the 16 times the 8 statistics were reported.

Sampies Selected for EOUSA Statistics Where the
LIONS Data Matched the Statistic Reported

Number Transactions
Statistic Description Reported Sampled
1. Number cases filed — 786 in FY 2003 268
Defendants under the anti-
terrorism program activity 725 in FY 2004° 338
2. Number of terrorism 103 in FY 2003 30
convictions
118 in FY 2004 40
3. Number of terrorism- 558 in FY 2003 301
related convictions
379 in FY 2004 166
4. Number of defendants 264 in FY 2003 81
sentenced to prison under the
anti-terrorism program 256 in FY 2004 91
activity

& The 725 reported for FY 2004 was reported twice — once in the U.S. Attorneys
FY 2004 Annual Statistical Report and once in the FY 2006 President’s Budget Request to
Congress.

94


FY 2004, including 20 of the 129 convictions that were not linked to
terrorism, as either the convictions did not occur in the year reported or the
USAOs could not provide documentation to show the convictions occurred in
the year reported.

Overall, considering both the defendants not linked to terrorism and
the defendants not convicted in the year reported, EQUSA overstated the
number of terrorism-related convictions for FY 2003 and FY 2004 as shown
in the following charts. *®

OIG Analysis of EOUSA Statistic - OIG Analysis of EOUSA Statistic -
| Terrorism-related Convictions Terrorism-related Convictions
during FY 2003 during FY 2004
1000 — ——ee

| 00 400

| — oe

soo 240

ae 281 "277 eee

= i Hm ~ :

100

oO - I
Reported Supported Overstated Supported Overstated

Source: EOUSA and USAO budgets and LIONS data, OIG interviews with EOUSA
and USAO staff, and analysis of documents provided by EOUSA and USAO staff

4. Defendants Sentenced to Prison

In the FY 2005 and FY 2006 President’s Budget Requests to Congress,
EOUSA reported the following numbers of defendants sentenced to prison
under its anti-terrorism program activity.

e 264 for FY 2003
¢ 256 for FY 2004

We reviewed LIONS reports supporting the number of defendants in
cases filed by the USAOs under the anti-terrorism program activity for
FYs 2003 and 2004 and found that the LIONS data agreed with the numbers
reported in the budget requests for both years.

We then selected a judgmental sample of the defendants sentenced to
prison under the anti-terrorism program activity for FY 2003 and FY 2004

*® As noted in footnote 41 on page 43, the numbers supported for these statistics
are based on a sample of transactions reported.

53


Judiciary Committee regarding the accuracy of terrorism-related statistics.2*
Subsequent to each of these hearings, the Assistant Attorney General for the
Office of Legislative Affairs provided the Department’s response to additional
questions resulting from the hearings. In response to post-hearing
questions from the October 21, 2003, hearing, the Assistant Attorney
General said:

I note that the fact that a defendant was not charged with
and convicted of a terrorism offense, or publicly linked to
terrorism by the FBI, does not mean that law enforcement
had no concerns or evidence regarding that individual's
connection with terrorism. Likewise, the fact that an alien
was deported rather than prosecuted does not mean that
he had no knowledge of, or connection to, terrorism. In
certain cases, evidence of a defendant's knowledge of, or
connection to, terrorist activity may not be sufficient to
prove a terrorism crime beyond a reasonable doubt, or
proving a criminal offense may require the disclosure of
sensitive sources or classified information. In situations
like these, the best alternative from a national security and
law enforcement perspective is to charge the defendant
under other applicable criminal statutes, or — if the
defendant is an alien eligible for removal - to remove him
from the United States and do our best to ensure that he
does not return. While these alternatives do not yield
sentences as lengthy as those imposed upon defendants
convicted of terrorism offenses, they help the Department
achieve its top priority: the detection, prevention, and
disruption of terrorist activity.

In response to post-hearing questions from the May 5, 2004, and
September 22, 2004, hearings, the Assistant Attorney General provided a
similar response.

We agree that defendants charged or convicted of non-terrorism
offenses may have a link to terrorism. However, defendants should not be
reported in terrorism-related statistics unless some support is available for

21 The post-hearing questions arose in connection with the: (1) October 21, 2003,
hearing before the Senate Judiciary Committee on “Protecting Our National Security From
Terrorist Attacks: A Review of Criminal Terrorism Investigations and Prosecutions;”

{2) May 5, 2004, hearing before the Senate Judiciary Committee on “Aiding Terrorists: An
Examination of the Material Support Statutes;” and (3) September 22, 2004, hearing before
the Senate Judiciary Committee on “A Review of Counter-Terrorism Legislation and
Proposals, Including the USA PATRIOT Act and the SAFE Act.”

8


terrorism and anti-terrorism work being done by United States Attorneys’
Offices. Toward that end, EQUSA agreed to rename its anti-terrorism
program category-code and “modify and clarify its definition, in order to
eliminate any misunderstanding regarding its meaning.” EOUSA also
acknowledged that several of its statistics were inaccurate such as statistic 5
on defendants prosecuted in FY 2002, and statistic 6 on defendants found
guilty in FY 2002, and it agreed to review its internal controls over terrorism
statistics to determine what improvements can be made.

However, EOQUSA objected to the OIG’s findings regarding several of its
terrorism statistics, and EOUSA also raised concerns regarding the
methodologies we used in reaching our conclusions. We present below our
analysis of EOUSA’s comments.

EQUSA noted that the OIG interpreted EOUSA’s anti-terrorism program
category code definition to require that defendants in anti-terrorism cases
have an identifiable link to terrorist activity. EOQUSA claimed that the OIG’s
interpretation would not capture a “much broader group of proactive cases
that have been affirmatively and intentionally brought to deter and prevent
terrorism, particularly in the areas of critical infrastructure vulnerability,
regardless of whether the defendant has any links to terrorist activity.” In
support of its argument, EOUSA pointed to Operation Tarmac cases, as well
as all cases worked by JTTFs, as examples of anti-terrorism cases. It also
argued that the OIG “deems EOUSA’s statistics ‘inaccurate’ in large measure
because they [the OIG] exclude Operation Tarmac cases, and cases from
similar initiatives around the country, from the anti-terrorism definition.”

First, as a factual matter EOUSA‘s argument is incorrect that its
statistics were “in large measure” inaccurate because of the dispute over
inclusion of cases like Operation Tarmac. After receiving EOUSA’s response,
we reviewed how many of the disputed cases in the anti-terrorism statistics
related to Operation Tarmac or similar operations. In fact, we determined
that even if such cases were counted as anti-terrorism cases, EOUSA’s
statistics would still be significantly inaccurate. We analyzed 9 of the 11
EOUSA statistics which were reported 16 times. Our analysis showed that,
even giving credit for Operation Tarmac and similar cases, as well as all
cases worked by JTTFs, 8 of the 9 EOQUSA statistics remained significantly
inaccurate. Only one changed from significantly overstated to overstated by
a minor amount. For the 14 times the other 8 statistics were reported, the
percentage error changed but it did not change the statistic from a
significant error to a minor error. Thus, notwithstanding this disputed
interpretation, EOQUSA’s statistics remained significantly inaccurate.

127


Department’s current top priority being to prevent, disrupt, and defeat
terrorist operations, much of the Department’s current law enforcement
effort originates in terrorism concerns. We also believe that EQUSA could
fairly and accurately report to the Department, the Congress, and the public
the successes of these operations without inaccurately implying that all of
the resulting cases are terrorism related. We are concerned that EOUSA’s
view of the anti-terrorism category permits criminal cases arising from
virtually any federal law enforcement effort, including immigration violations
or border enforcement activities, to be categorized as anti-terrorism
regardless of the actual circumstances. In our review of the statistics
reported by EOUSA, we looked for and accepted any stated terrorism
linkage. However, we found many cases involving offenses such as
immigration violations, standard document fraud, or drug trafficking, where
the subject or target showed no link at all to terrorist activity. Therefore, in
accordance with EOUSA’s anti-terrorism definition, we did not accept those
cases as having support for coding in the anti-terrorism category.

In general, we found that EOQUSA and the USAQs had not established
effective internal control procedures for verifying the accuracy of the Legal
Information Office Network System (LIONS) data to ensure statistics
reported based on LIONS data were accurate.’° More specific reasons for
the inaccurate statistics included:

e The statistics on terrorism convictions were inaccurately reported
because the USAQs categorized the cases against the defendants
under the anti-terrorism program activity when the case was filed
but did not change the categorization based upon further
investigation or based on the actual evidence found or offenses for
which the defendants were convicted.

e The number of defendants in cases filed under the anti-terrorism
program activity was inaccurate because the number included
defendants that the USAOs could not provide support for a
terrorism link. In addition, the number reported included cases
filed in a year other than the year reported or for which the USAOs
could not provide documentation to show when the case was filed.
These same problems contributed to the inaccurate statistics on
terrorism convictions, terrorism-related convictions, defendants
sentenced to prison, terrorism and anti-terrorism cases against
defendants that were terminated, terrorism and anti-terrorism
pending, defendants for which terrorism and anti-terrorism cases

10 The LIONS system is a database with on-line capabilities that permits the USAOs
and EQUSA to compile, maintain, and track information relating to defendants, crimes,
criminal charges, court events, and witnesses.

xiii


convictions for which the FBI could not provide support for any link to
terrorism.

The FBI’s response also described the work of Joint Terrorism Task
Forces (JTTFs) and asserted that all cases worked by a JTTF are “by their
nature terrorism related.” The FBI stated that it therefore disagrees that it
should “recode investigations that the JTTFs handle based on the type of
criminal charges filed at the conclusion of the case.”

The FBI misconstrues our finding. We do not believe that the case
should be recoded based solely on the ultimate criminal charge, and we
recognize that cases that have a link to terrorism might not result in
terrorism charges. On the other hand, cases that the JTTFs pursue, based
on an initial lead, might ultimately find no link to terrorism even if the JTTF
finds other criminal conduct during the course of its investigation. For
example, the JTTF may investigate a terrorism lead and subsequently clear
the defendant of any connection to terrorism, but the JTTF might uncover
evidence that the defendant committed some unrelated criminal conduct
such as marriage fraud. Contrary to the implication of the FBI’s argument,
the resulting conviction should not be considered a terrorism-related
conviction solely because the JTTF handled the case.

We agree with the FBI that, after weighing the alternatives, a false
statement or immigration case may present the best outcome to disrupt a
terrorist plot rather than pursuing strict terrorism-related charges. But the
FBI should be able to demonstrate a terrorism link in the cases it lists as
“terrorism-related convictions,” regardless of whether the JTTF worked the
case. In short, just because the case was worked by a JTTF does not mean
that all its convictions necessarily contain a link to terrorism.®

In its response, the FBI also stated that it had reviewed the 65
convictions we identified in the report as not having a demonstrated link to
terrorism and agreed that 30 of the convictions were improperly reported.
However, the FBI stated that it believes the remaining 35 cases were
properly coded as terrorism-related. While the FBI did not provide sufficient
detail in its response for us to reconcile its analysis of the 35 cases to our
audit work, it appears that 29 of the 35 cases pertain to narcotics
convictions of white supremacist gang members. The FBI stated that these
investigations “focused on fully identifying and disrupting the members of
this organization whose declared mission was to train and prepare for future
violent race conflicts.” We are aware the FBI considers that domestic

63 This issue is also discussed in the section of our analysis examining EOUSA’s
comments.

125


We believe the Department should not report terrorism-related statistics
unless it maintains evidence to support the statistics.

For the remaining 107 operational statistics, we eliminated 48 from
testing in this audit because the statistics or the systems supporting them
had been previously reviewed by the OIG and recommendations for
improvement made, where appropriate.

From the remaining 59 operational statistics, we selected 26 statistics
for detailed testing based on our assessment of the significance of the
statistic to the Department’s counterterrorism efforts and of the risk
associated with reporting the statistic inaccurately. The 26 operational
statistics included:

e 10 from the FBI that were reported 13 times (see FBI Terrorism
Statistics section of this report),

« 11 from the USAOs that were reported 20 times (see EOQUSA
Terrorism Statistics section of this report), and

e 5 from the Criminal Division that were reported 9 times (see
Criminal Division Terrorism Statistics section of this report).

We found that the FBI, EOUSA, and the Criminal Division either:
(1) could not provide documentation to support the numbers reported for
the statistics, (2) could not provide documentation of the terrorism link used
to classify statistics as terrorism-related, or (3) provided documentation to
show that the occurrence of the transactions reported did not always agree
with the period reported. Some of the statistics were significantly
overstated or understated, while others were overstated or understated by
minor amounts.

As summarized in the following table, the FBI, EOUSA, and the
Criminal Division did not accurately report 24 of the 26 statistics we
reviewed.

13


The FBI, EQUSA, and the Criminal Division did not accurately report 24

of the 26 statistics we reviewed. Some of the statistics reported were
overstated, while others were understated. These inaccuracies are
important because Department management and Congress need accurate
terrorism-related statistics to make informed budgetary and operational
decisions.

Recommendations:

To help ensure accurate collection and reporting of terrorism statistics,

we recommend that the FBI, EOQUSA, and the Criminal Division:

1.

Establish and document internal control procedures for gathering,
verifying, and reporting terrorism-related statistics.

. Maintain documentation to identify the source of all terrorism-related

statistics reported in official operational documents such as budget
requests, performance plans, statistical reports, and others.

. Maintain documentation of the procedures and systems used to gather or

track the statistics reported.

. Maintain documentation of the methodologies and procedures used to

verify the accuracy of the statistics reported.

. Ensure that terrorism-related statistics are not reported unless evidence is

maintained to support the statistics.

We recommend that EOUSA and the USAOs:

6.

Establish and implement procedures to recode transactions in the LIONS
system when investigations that began as terrorism-related investigations
do not link the case defendants to terrorist activity.

82


APPENDIX IV

OFFICE OF THE INSPECTOR GENERAL ANALYSIS AND
SUMMARY OF ACTIONS NECESSARY TO CLOSE THE REPORT

We provided the draft report to the FBI, EOUSA, and the Criminal
Division for their comments, which are included in Appendix III. Our
analysis of each component's response is provided in Sections A through C
of this appendix. In Section D of this appendix, we summarize the status of
each recommendation and discuss the actions necessary to close the
recommendation.

A. FBI Response

The FBI concurred generally but not entirely with our findings, and it
agreed with all of our recommendations.

The FBI stated that it agreed fully with the OIG that it must collect and
maintain accurate statistics. The FBI’s response then discussed its
reorganization and restructuring since the September 11, 2001, terrorist
attacks. It stated that many of the apparent weaknesses in statistical
reporting occurred during this period and were an outgrowth of the FBI's
reorganization and restructuring. The FBI also provided an extensive
discussion of new procedures it is implementing to ensure the accuracy of its
reporting of terrorism-related convictions. We believe that, if fully
implemented and followed, the FBI’s procedures can help improve the
accuracy of its future statistics.

However, the FBI objected to certain aspects of our findings. In its
discussion of the number of terrorism-related statistics, the FBI stated that it
agreed that while a case must have a terrorism nexus to be properly coded
as terrorism-related, the ultimate charge or conviction need not be for a
terrorism offense to properly be included as a terrorism statistic.

We agree with that point and in our report stated that cases could
have a terrorism link and be properly counted as a terrorism conviction even
if the ultimate charge was not for a terrorism offense. As we note on page
19 of the report, we counted convictions as being terrorism-related as long
as the FBI provided to us any evidence that the case had a terrorism link,
regardless of the ultimate charge.

However, for many cases the FBI could not provide us with any such
evidence of a link to terrorism. For example, pages 18-19 of the report
provide examples of four cases included in the FBI's terrorism-related

124


Chart Endnotes - continued
2. For this statistic, the Criminal Division reported the number as “over 50” instead of an exact
number.

3. For this statistic, the Criminal Division reported the number as “more than 70” instead of an
exact number.

As detailed on the following pages, some of the reported statistics
were misreported by significant margins and others by minor amounts. The
CTS’s Deputy Chief said the statistics were inaccurately reported primarily
because the database used to track the statistics was incomplete and not
kept up-to-date. We found that CTS had not established formalized
procedures to: (1) instruct staff on what data is to be reported in the
database, and how and when the data is to be reported; and (2) validate the
accuracy of the information reported in the database.

1. Individuals Charged Resulting from Terrorism Investigations

The CTS oversees the investigation and prosecution of domestic and
international terrorism cases. In the FY 2006 President’s Budget Request to
Congress, the Criminal Division reported 375 individuals were charged as a
result of terrorism investigations from September 11, 2001, through
February 3, 2005. As shown in the following chart, we found the Criminal
Division’s final reconciled reconstructed list of individuals charged did not
match the number reported.

OIG Analysis of Criminal Division Statistic -
Individuals Charged Resulting

from Terrorism Investigations
‘500 450 400 350 300 250 200 150 100 50 0

375 A- Reported

B - Supported on March 2006
Reconstructed List

C - Included on August 2006
Reconstructed List

D - Included on Final Reconciled
Reconstructed List

E - Supported on Final Reconciled
Reconstructed List

fae 7 F - Minor Understatement
t eae A Nl) Ee (E minus A)

‘Source: Criminal Division budgets, OIG interviews with Criminal Division staff,
and analysis of documents provided by Criminal Division staff

As a result, the Criminal Division understated by a minor amount the
number of individuals charged as a result of terrorism investigations from
September 11, 2001, through February 3, 2005.

75


were terminated, and percentage of defendants whose cases were
terminated that were convicted.

« The statistics reported for defendants prosecuted, defendants found
guilty in FY 2002, and terrorism cases tried in 2001, were
inaccurate because EOUSA provided a listing from its LIONS system
that did not reconcile to the numbers reported and EQUSA could not
explain the differences. EOUSA’s explanation for these differences
is discussed on page 43.

In August 2006, we briefed EOUSA officials regarding the findings of
this audit. The Legislative Counsel for EQUSA argued that the defendants in
cases coded under the anti-terrorism code were not required to have a link
to terrorism. The official stated that the cases focused on the prevention of
terrorism activities in line with the Department’s number one goal of
terrorism prevention.

Criminal Division Terrorism Statistics

As shown in the following chart, the Criminal Division under-reported
most of its statistics, based on the support it eventually provided to us.

xiv


OIG Analysis of Criminal Division Statistic -
Material Support to Terrorism Cases and Matters Participated

in or Coordinated from 10/1/03 through 9/30/04
500 450 400 350 300 250 200 150 100 50 0

121 [EE 4 - Reported
|

B - Supported on March 2006
Reconstructed List

C- Included on August 2006
Reconstructed List

D - Included on Final Reconciled
Reconstructed List

— - Supported on Final Reconciled
Reconstructed List

| | | | | 4) F - Minor Understatement
(E minus A)

Source: Criminal Division budgets, OIG interviews with Criminal Division staff,
and analysis of documents provided by Criminal Division staff

As a result, the Criminal Division significantly understated the number
of material support to terrorism cases and matters it participated in or
coordinated during FY 2003. The Criminal Division overstated by a minor
amount the number of material support to terrorism investigations the
USAOs were working on as of January 31, 2003. The Criminal Division
understated by a minor amount the number of material support to terrorism
cases and matters it participated in or coordinated during FY 2004. The
Criminal Division accurately reported the number of terrorist financing or
material support investigations it was pursuing as of January 31, 2004.

In sum, during our audit the Criminal Division made two attempts to
reconstruct support for the terrorism-related statistics we reviewed. We
carefully evaluated each attempted reconstruction and found each to be
significantly flawed. At the end of this process, we determined that the
Criminal Division understated the five statistics we tested eight of the nine
times the statistics were reported. The extensive efforts required by the
Criminal Division to reconstruct reported statistics demonstrates that the
Division had no effective reporting system and could easily and
unintentionally misreport in the opposite direction, absent the
implementation of effective procedures for gathering and reporting statistics.

OIG Conclusions

Based on our testing, we found that the Department and its
components did gather, classify, and report terrorism-related statistics
accurately. The statistics were reported inaccurately primarily because
Department components lacked internal controls for gathering, verifying,
and reporting terrorism-related statistics.

81


APPENDIX I

1. We developed a universe of 209 unique terrorism-related statistics
reported by the Department and its components by:

e interviewing key FBI, EQUSA, Criminal Division, and JMD
personnel regarding internal and external documents in which
terrorism-related statistics are reported;

e searching the Department’s websites for congressional testimony
and speeches containing terrorism-related statistics; and

« reviewing the documents identified through interviews and
searches for terrorism-related statistics.

2. We reviewed documentation and interviewed Department officials
to identify each of the 209 terrorism-related statistics reported for:

e the period covered by the statistic;

e the key FBI, EQUSA, Criminal Division, and Department
personnel responsible (source) for tracking and reporting the
statistic and what mechanisms (automated systems, case files,
spreadsheets, and databases) were used to track the statistics;

e the processes used to report the statistics and the internal
controls established to ensure the accuracy of the reported
statistics; and

e how the statistic is used (operational decisions or informational
purposes).

3. We excluded 17 of the 209 terrorism-related statistics from audit
testing because we determined the statistics were reported by the
Department but sourced to agencies outside the Department. The
remaining 192 terrorism-related statistics were reported by and
sourced to the FBI (121), EQUSA (20), the Criminal Division (14),
and the Department as a whole (37).

86


APPENDIX IIT

The Honorable Glenn A. Fine

2. (U) Intelligence Information Reports

The OIG Report next examined the tracking of Intelligence Information Reports
(IRs) issued by the FBI in FY 2003 and FY 2004. IIRs represent an intelligence report in the
form of an electronic teletype message that provides for timely dissemination of unevaluated, raw
intelligence within the US inteltigence and federal law enforcement communities. The FBI
believes that the statistics reviewed by the IG demonstrate that adequate internal controls existed
in FY 2003 and 2004. Specifically, O1G determined that the FBI reported issuing 1,731 IRs in
FY 2003, while the OIG found support for 1,638. Thus, according to the Report, the FBI
overstated by 93, or 5.7%. For FY 2004, the OIG indicates that the FB! reported issuing 2,622
[IRs, with support found by the OIG for 2,679, yielding an underreporting of 57, or 2.1%.
Viewed together, the FBI reported issuing 4,353 HRs in FY 2003 and FY 2004, while the OIG
found support for 4,317, an overstatement of 36, or less than 1%. More importantly, however,
the FBI's system for tracking the number of IIRs issued has improved since FY 2004.

Prior to September 11, 2001, the FBI's Counterterronsm Program had produced
very few IIRs, and there was no formal process for the collection and dissemination of IIRs
prepared by FBI field offices. Beginning in 2002, the FBI began to create an embedded
intelligence process across all investigative programs. This restructuring was advanced with the
creation of the Directorate of Intelligence in February 2005, as part of the FBI's National Security
Branch. The mission of the Directorate of Intelligence is to embed the intelligence cycle within
the FBI and to create the supporting infrastructure necessary to successfully execute the
intelligence mission.

Since FY 2004, the last period that the OIG examined, the FBI has instituted a
system for more accurately measuring and recording IIR dissemination. Since the period
examined by the Report, the FBI has created the Intelligence Report Disseminations System
(FIDS), an automated tracking system that electronically connects all FBI Field Offices and
FBIHQ. FIDS transmits ITR documents between the participants in the IIR process and allows
them fo track the progress of HRs. FIDS became operational on November 15, 2004, which is
beyond the period under review by the OIG. Additionally, in 2006, the FB! developed an
accurate, viable performance measure which counts IIR dissemination by its messaging system.
This metric was not in use in FY 2004, but now reports on a monthly basis IIR dissemination by
investigative program, including the Counterterrorism Program. This metric is now used by the
FBI to report HR statistics to external authorities for all program areas, and supersedes the
“number of [IRs issued” dala reported by individual programs. Accordingly, although the FBI
believes that review of the statistics for FY 2003 and FY 2004 indicates that certain controls
existed to track the number of IRs disseminated, the FBI has improved considerably its systems
of internal controls in this area, demonstrating the FBI's commitment to the accurate reporting of
statistical accomplishments.

3. (U) Intelligence Assessments

The OIG's analysis of Intelligence Assessments (IAs) focused on those issued
during FY 2004. At that time, each investigative division was responsible for tracking
production of its own Intelligence Assessments (IAs). Since late 2006, the Directorate of
Intelligence has assumed responsibility for tracking the approved production af IAs. The
Directorate of Intelligence has a dedicated unit, the Strategic Analysis and Production Unit
(SAPU), which acts as a focal point for collection of statistics on IA production, as opposed to

5

102


United States. The subject pleaded guilty to making a false claim of
citizenship and was sentenced to 4 months in prison with credit for
time served. The case file information provided by the USAO
contained no indication that the subject was linked to terrorist
activity. We asked an AUSA to provide an explanation of the
subject's link to terrorism, but the AUSA did not provide any
additional explanation.

We found that the statistics for terrorism convictions were inaccurately
reported primarily because the USAOs categorized the cases against the
defendants under the anti-terrorism program activity when the case was
filed but did not change the categorization based upon further investigation
or based on the actual offenses for which the defendants were convicted.
This situation also applies to the following discussions of inaccurately
reported statistics on: (1) terrorism-related convictions, (2) sentenced to
prison, and (3) defendants for whom terrorism and anti-terrorism cases
were terminated.

We also found that 6 of the 30 sampled convictions, including 2 of the
13 convictions that were not linked to terrorism, did not occur in the year
reported and should not have been included in the FY 2003 statistic. This
same issue occurred for 3 of the 40 sampled convictions in FY 2004,
including 1 of the 19 defendants not linked to terrorism, as either the
convictions did not occur in the year reported or the USAOs could not
provide documentation to show the convictions occurred in the year
reported.

Overall, considering both the defendants not linked to terrorism and
the defendants not convicted in the year reported, EOUSA overstated the
number of terrorism convictions for FY 2003 and FY 2004 as shown in the

following charts.*°

45 As noted in footnote 41 on page 43, the numbers supported for these statistics
are based on a sample of transactions reported.

49


card companies would subsequently pay the merchants, unaware
that they were paying for bogus charges. The subject pleaded
guilty to conspiracy to commit credit card fraud and was sentenced
to 60 days in prison. The case file information provided by the
USAO contained no indication the subject was linked to terrorist
activity. When we asked an AUSA to provide additional information
to support a terrorism link, the AUSA told us that the subject was
part of an investigation of credit card “bust-out” schemes and
financial support to terrorists, but the AUSA provided no
information to support that this subject was linked to financial
support to terrorists.

The subject was charged with falsely representing a social security
number to be his own for the purpose of gaining employment and a
security badge at an airport. The subject pleaded guilty to misuse
of a social security number and was sentenced to 10 months in
prison. The case file information indicated that the subject was
arrested as part of an operation similar to Operation Tarmac where
Department and other federal agents went into the local airport and
arrested individuals who used falsified documents such as social
security numbers, drivers’ licenses, and other identification
documents to gain employment at airport facilities. When we asked
an AUSA to provide additional information to support a terrorism
link, the AUSA provided no additional information that linked the
subject to terrorist activity.

The subject was charged with: (1) making a false staternent by
asserting on an application for a social security card that neither he
nor anyone acting on his behalf had ever filed for or received a
social security number before when he had previously received a
social security number; and (2) two counts of using a social security
number to obtain payments or benefits to which he was not
entitled. The subject pleaded guilty to one count of using a social
security number with intent to deceive and was sentenced to 3
years probation. The other two charges against the subject were
dismissed. The case file information provided by the USAO
contained no indication the subject was linked to terrorist activity.
When we asked an AUSA to provide additional information to
support a terrorism link, the AUSA told us that the subject was
arrested as part of Operation Plane View, which was an operation
similar to Operation Tarmac where Department and other federal
agents went into the local airport and arrested individuals who used
falsified documents such as social security numbers, drivers’
licenses, and other identification documents to gain employment at

55


11. Percent of Defendants Whose Terrorism and Anti-Terrorism
Cases Were Terminated and Who Were Convicted ..........cccccceeessees 69

CRIMINAL DIVISION TERRORISM STATISTICS
1, Individuals Charged Resulting from Terrorism Investigations...
2. Individuals Convicted or Pleaded Guilty Resulting from
Terrorism Investigations ..
3. Individuals Charged with Material Support of Terrorism or

Similar Crimes ......ccccesssecccesccssensreeseessaeescssaceeseseneessetaeeesssaeeneesss 76
4. Individuals Convicted of Material Support of Terrorism or

SiMIAr CrIMECS ..... ccc eccecessecssceseseenaeeaeeeaaeeeeaetseeeeeeceseutnesssssseeanees 78
5. Material Support to Terrorism Cases and Matters

Participated in or Coordinated ...........ccssseseeseessecceccenseeersneverssenees 78

OIG Conclusions ....
Recommendations..

STATEMENT ON COMPLIANCE WITH LAWS AND REGULATIONS ...... 83
ACRONYMS. ....... 0. eee ccccceenceet ener eee cece eee e teen ee eee e ee RHEE OOOH HEHE SADE EAOS eA EAAaES 84
APPENDIX I —- AUDIT OBJECTIVE, SCOPE, AND METHODOLOGY ...... 85
APPENDIX II - OPERATIONAL TERRORISM STATISTICS FOR
WHICH DEPARTMENT OFFICIALS COULD NOT IDENTIFY THE
SOURCE OF THE STATISTIC ................ccesssseeeeeseseeeeusneeeesneaeeesanens 96

APPENDIX III - DEPARTMENT COMPONENT RESPONSES TO THE
DRAFT AUDIT REPORT. ..................:cccccseeccceeeeeeceeeeseeaeseu sansa eesne reas 98

APPENDIX IV - OFFICE OF THE INSPECTOR GENERAL ANALYSIS
AND SUMMARY OF ACTIONS NECESSARY TO CLOSE THE
REPORT ....... cocci cee cece eee ence cette eee ne en en Enea EEE EDS SOP EE EEE SO SE EEE OEE EOE SEE 124


STATEMENT ON COMPLIANCE WITH
LAWS AND REGULATIONS

As required by the Government Auditing Standards, we tested the
Department’s processes, controls, and records to obtain reasonable
assurance that the Department complied with laws and regulations that, if
not complied with, could have a material effect on the Department’s ability
to accurately report terrorism-related statistics. Compliance with laws and
regulations applicable to the Department's reporting of such statistics is the
responsibility of Department management. An audit includes examining, on
a test basis, evidence about compliance with laws and regulations. The
specific laws and regulations we reviewed included the relevant portions of:

« Office of Management and Budget Circular A-123, Management
Accountability and Control; and

« United States Attorneys’ Manual.

Except for instances of non-compliance identified in the Finding and
Recommendations section of this report, the Department complied with the
laws and regulations cited above. With respect to those activities not tested,
nothing came to our attention that caused us to believe that the Department
was not in compliance with the laws and regulations cited above.

83


e the statistics were used exclusively for informational as opposed to
operational purposes (69).?®

Of the remaining 59 terrorism-related statistics, we judgmentally
selected 26 statistics for detailed testing based on our assessment of the risk
associated with reporting the statistic inaccurately and of the significance of
the statistic to the Department's counterterrorism efforts. The statistics
selected included 10 from the FBI, 5 from the Criminal Division, and 11 from
the USAOs. We then analyzed documentation provided by the components
and conducted interviews of component officials to confirm the accuracy of
the statistics sampled. We did not test any of the statistics reported by the
Department as a whole because the Department reported those statistics for
informational purposes, and we decided to focus our efforts on the statistics
used for operational purposes.

More details about our methodology for evaluating the accuracy of the
terrorism-related statistics reported by the Department and its components
are contained in the Objectives, Scope, and Methodology in Appendix I. The
results of our audit work and testing are reported in the Finding and
Recommendations section of the report.

Prior Audits

Several previous audits and inspections by the OIG and Government
Accountability Office (GAO) have reviewed or touched upon the accuracy of
terrorism-related statistics reported by the Department.

As previously stated, the OIG reviewed 48 terrorism-related statistics
or supporting systems and made recommendations to correct deficiencies
identified. The results of these reviews were included in nine

16 Informational purposes included statistics such as those used in speeches, press
releases, publications, and websites. Operational purposes included statistics such as those
used in Department and component budget requests, performance plans, and annual
financial statements and statistical reports.


job in February 2004, there were no formalized procedures for collecting,
verifying, and reporting the Presidential Terrorist Threat Reports issued and
no formalized procedures have been developed since.

EOUSA TERRORISM STATISTICS

We tested the following 11 operational statistics that EOUSA reported
in either the President’s Budget Requests to Congress for FY 2004, FY 2005,
and FY 2006, or the USAOs FY 2004 Annual Statistical Report.

¢ Number of cases filed - defendants for program activity anti-
terrorism in FY 2002, FY 2003, and FY 2004;7°

« Number of terrorism convictions in FY 2003 and FY 2004;>”

* Number of terrorism-related convictions in FY 2003 and
FY 2004; 78

« Number prosecuted - defendants for program activity anti-
terrorism in FY 2002;

« Number found guilty - defendants for program activity anti-
terrorism in FY 2002;

e¢ Number of terrorism cases tried in FY 2001;

« Number sentenced to prison ~- defendants for program activity anti-
terrorism in FY 2003 and FY 2004;

« Number of terrorism and anti-terrorism cases against defendants
that were terminated in FY 2003 and FY 2004;

36 The number reported for FY 2004 was reported twice - once in the U.S. Attorneys
FY 2004 Annual Statistical Report and once in the FY 2006 President’s Budget Request to
Congress.

37 EOUSA defines a terrorism conviction as domestic and international incidents that
involve acts, including threats or conspiracies to engage in such acts, which are violent or
otherwise dangerous to human life and which appear to be motivated by an intent to
coerce, intimidate, or retaliate against a government or a civilian population.

38 EQUSA defines a terrorism-related conviction as incidents involving terrorism-

related hoaxes, terrorist financing, and a matter or case where the underlying purpose or
object of the investigation is anti-terrorism related.

34


* was pursuing more than 70 terrorist financing or material support
investigations as of January 31, 2004 (FY 2005 President’s Budget
Request to Congress);

¢ participated in or coordinated 70 material support to terrorism
cases and matters from October 1, 2002, through September 30,
2003 (FY 2006 President’s Budget Request to Congress); and

* participated in or coordinated 121 material support to terrorism
cases and matters from October 1, 2003, through September 30,
2004 (FY 2006 President’s Budget Request to Congress).

As shown in the following charts, the support provided by the CTS
regarding these statistics varied over time.

OIG Analysis of Criminal Division Statistic -
Material Support to Terrorism Investigations the USAOs
were Working on as of 1/31/03
500 450 400 350 300 250 200 150 100 50 0

Over 50 = A- Reported

18 B - Supported on March 2006
Reconstructed List

|
| 51 C- Included on August 2006
|

Reconstructed List

D - Included on Final Reconciled
Reconstructed List

E - Supported on Final Reconciled

bs] Reconstructed List

F - Minor Overstatement
(A minus E)

51

1

Source: Criminal Division budgets, OIG interviews with Criminal Division staff,
and analysis of documents provided by Criminal Division staff

79


Chart Endnotes - continued

2. The 2,622 reported for FY 2004 was reported twice - once in the classified portion of
the FY 2006 President’s Budget Request to Congress and once in the FBI's
FY 2006 ~ FY 2011 Performance Plan. Thus the statistic was inaccurately reported
twice.

3. According to an FBI official, the reported threats included only threats tracked by the
FBI's Threat Monitoring Unit and accounted for only about 40 percent of the threats
actually tracked by the FBI. The FBI official said that the remaining 60 percent of
threats were tracked by FBI field offices during FY 2003, and also by the FBI’s
Counterterrorism Watch Unit, and the FBI’s International Terrorism Operations
Sections during FY 2004. As a result, the number of threats actually tracked by the
FBI during FY 2003 and FY 2004 was significantly understated.

4. The threats reported for FY 2004 were for only 9 months, from January through
September 2004. An FBI official told us that threat data for all of FY 2004 was not
reported because of the timing of the request from the Counterterrorism Division’s
Administrative Section. The official said his unit began capturing threats in May or
June 2004, and in December 2004 or January 2005 the Administrative Section
requested the threat data for FY 2004. The official said that at that time his unit had
begun identifying and counting the threats prior to May or June 2004 but had not
completed the process. Therefore, he reported the threat data for the 9 months
(January through September 2004) that had been completed. Thus, the FBI
understated the threats in this category for FY 2004 since data was not reported for
2S percent of the fiscal year.

1. Number of Terrorism-Related Convictions

The FBI’s FY 2006 - FY 2011 Performance Plan includes a performance
goal to “Prevent, disrupt, and defeat terrorist operations before they occur.”
In its FY 2006 — FY 2011 Performance Plan, the FBI reported that its
investigations resulted in 206 convictions during FY 2004 towards the
achievement of this performance goa!. To determine the accuracy of the
reported convictions, we first obtained a listing from the FBI’s Integrated
Statistical Reporting and Analysis System showing details of the 206
convictions reported for FY 2004. We then selected a judgmental sample of
107 of the 206 convictions by selecting all the convictions reported by the
7 FBI field offices with the highest number of reported convictions (El Paso,
Texas - 32; Dallas, Texas - 22; Salt Lake City, Utah - 17; Atlanta, Georgia -
12; Richmond, Virginia - 10; Philadelphia, Pennsylvania ~ 8; and Charlotte,
North Carolina - 6). Next, we reviewed the case files and held discussions
with the case agents regarding whether the individuals in these 107 cases
were convicted of or pleaded guilty to terrorism-related crimes, and how the
convictions met the FBI’s performance goal of “Prevent, disrupt, and defeat
terrorist operations before they occur.” We found that:

17


APPENDIX III

CRIMINAL DIVISION RESPONSE

U.S. Department of Justice

Washington, DC. 20530

JAN 16 any

Glenn Fine

Inspector General

U.S. Department of Justice
Washington, DC 20530

Re: _ Response to the Office of the Inspector General’s Report on the Department of
Justice’s Interna! Controls over Terrorism Reporting in Regard to Statistics
Maintained by the Criminal Division

Dear Mr. Fine:

Thank you for the opportunity to provide comments on the Office of the Inspector
General (“OIG”) Report on the Department of Justice’s Internal Controls over Terrorism
Reporting (“the Report”). We share your interest in ensuring that the Department accurately
accounts and reports its investigations and casework related to terrorism and terrorist threats.

Here, we address only that portion of the Report that discusses statistics maintained by.
the Critninal Division.' We do not address issues or recommendations directed to the Executive
Office of United States Attorneys or to the Federal Bureau of Investigation.

1 The Criminal Division Had Documentation To Support Its Reporting.

We agree with the Report’s conclusion (at 73) that “{t]he Criminal Division provided
documentation to support that al] the transactions tested were terrorism-related.” The chart on
pages xv and 75 similarly shows that eight of nine reported subcategories of statistics were fully
“{s]upported.” The Criminal Division provided supporting documentation that matched or, in
some instances, exceeded the number of incidents reported. In other words, according to the
Report, the Criminal Division either accurately stated or understated the number of terrorism-
related defendants, cases, or matters in all but one subcategory (namely, 5.a.). For that one

' We note that the Criminal Division statistics, which were originally maintained by
the Office of the Assistant Attorney General of the Criminal Division and
subsequently transferred to the Counterterrorism Section, have been maintained
by the National Security Division since September 28, 2006, when the Division
was established and incorporated the Counterterrorism Section.

117


INTRODUCTION
The Department's Focus on Terrorism
After the terrorist attacks of September 11, 2001, the Department of
Justice (Department) made the prevention of terrorism and promotion of
America’s security its primary strategic goal. The Department established
the following three objectives to accomplish this goal.

e Prevent, disrupt, and defeat terrorist operations before they occur.

e Investigate and prosecute those who have committed, or intend to
commit, terrorist acts in the United States.

« Combat espionage against the United States by strengthening
counterintelligence capabilities.

An ongoing challenge for the Department is to effectively manage its
resources to implement these objectives. To meet this management
challenge, the Department must establish controls to ensure that reliable
and timely information is obtained, maintained, reported, and used for
decision-making.

The Department and its component agencies gather, classify, and
report a wide range of terrorism-related statistics. Some examples of
terrorism statistics reported by the Department and its components are:

« number of individuals charged as a result of terrorism
investigations,

« number of terrorism cases tried,

¢ number of individuals charged with material support of terrorism or
similar crimes,

* number of terrorism convictions,
e« number of threats to transportation and facilities,

« number of threats to people and cities, and


similar to the criteria for identifying potential terrorist cases listed in
a November 2001 memorandum from the Assistant

Attorney General for the Criminal Division.*? However, the AUSA
provided no details of the evidence or information to support a link
to terrorist activity. Absent information of the subject’s link to
terrorism, the reporting of this subject as terrorism-related was
unsupported.

The subject was charged with dealing firearms without a license.
The case was pending at the time of our review. The case file
information provided by the USAO contained no indication that the
subject was linked to terrorist activity. When we asked an AUSA to
provide additional information to support a terrorism link, the AUSA
told us that the case should not have been coded as an
anti-terrorism case.

To obtain a passport, a Mexican national falsely identified himself in
a passport application as another individual. The subject pleaded
guilty to making a false statement in a passport application and was
sentenced to time served. The case file information provided by the
USAO contained no indication that the subject was tinked to
terrorist activity. We asked an AUSA to provide an explanation of
the subject’s link to terrorism, but the AUSA did not provide any
additional explanation.

The subject was charged with: (1) obtaining naturalization
unlawfully by making false representations on a naturalization
application, and (2) making a false statement in a passport
application. At the time of our audit fieldwork, the case against this
subject was pending. The case file information provided by the
USAO contained no indication that the subject was linked to
terrorist activity. When we asked the AUSA to provide additional
information to support a link to terrorist activity, the USAO provided
no additional information.

#2 The November 13, 2001, memorandum sent to Anti-terrorism Task Force
Coordinators identified categories of actions that past terrorist cases have involved such as
using false or multiple identification and travel documents, attending paramilitary and
firearms training, photographing and surveillance of landmarks, using the computer and
Internet to communicate, and committing immigration fraud. For each category, the
Memorandum described examples of terrorist-related activity from prior terrorism cases.
However, the memorandum emphasized that any one criterion alone would not likely
support a reasonable conclusion that terrorist activity or potential terrorist activity was

45


APPENDIX III

which date OIG used to compare against the actual date of the sentencing. In short, again,
further communication between OIG and the USAOs or EOUSA, as well as a review by EQUSA
of the actual case data that OIG relied upon, could have resolved these issues.

Finally, although much of EOUSA’s section of the report is comprised of narrative
discussions of individual cases, OIG has never identified the particular cases that go with each
narrative discussion. Thus, it is impossible to reply to the cited examples on a case-by-case
basis.

Recommendations

All of OIG’s recommendations below outline important and necessary controls for the
accurate reporting of terrorism statistics. However, EOUSA believes that it has been and is now
in compliance with most of the recommendations. As described above, the thrust of OIG’s
Teport as to EOUSA tums on the definition of the anti-terrorism code. It is not clear to EOUSA
how tighter controls on reporting procedures would have changed the coding of the anti-
terrorism statistics that OIG believes are miscoded. With that in mind, EOUSA responds to the
recommendations below as follows:

i Establish and document internal control procedures for gathering, verifying, and
reporting terrorism-related statistics.

EOUSA agrees with this recommendation but believes that it is already complying with it. As
noted in the report, United States Attorneys are already required to certify twice yearly that the
LIONS data in their district is correct. There are a variety of tools available to ensure that the
LIONS data is correct. Primary among them is the Unites States Attomeys’ Procedure (USAP)
3-16.130.001, which was updated most recently in September, 2006. This USAP requires each
United States Attomey to certify twice a year, on April 1 and October 1, that the LIONS data
entered by that office is complete and accurate. The procedure applies to all USAO employees
who have responsibilities for case coding and data entry, including docket personnel, system
managers, secretaries and line attorneys and their supervisors. The procedures also include the
“case certification by events” tool, the Alcatraz Case Certification report, the AUSA workload
reports, and the Altemate District Reporting Method.* Although OIG asserts that these controls
are insufficient (Report at 36), it was not a failure of these controls that caused the vast majority
of the anti-terrorism statistics to be miscoded. Rather, as discussed ahove, that was primarily
caused by a difference of opinion over how to interpret the anti-terrorism code. EOUSA will,
however, within the next three months review these controls to determine if there are
improvements that can be made.

2. Maintain documentation to identify the source of ail terrorism-related statistics reported

in official operational documents such as budget requests, performance plans, statistical
reports, and others.

* USAOs are also provided with a 637 page LIONS User’s Manual that outlines in detail the
appropriate ways to enter data into the LIONS system.

114


APPENDIX III

DEPARTMENT COMPONENT RESPONSES
TO THE DRAFT AUDIT REPORT

FBI RESPONSE

U.S. Department of Justice

Federal Bureau of Investigation

Washington, D. C. 20535-8001

January 16, 2007

The Honorable Glenn A. Fine
Office of the Inspector General
United States Department of Justice
Room 4322

950 Pennsylvania Avenue, N.W.
Washington, D.C. 20530

SUBJECT: RESPONSE TO OIG REPORT ON TERRORISM STATISTICS
Dear Mr. Fine:

This letter is submitted by the Federal Bureau of Investigation (FBI) in response to
the audit report by the Office of Inspector General (O1G) entitled, The Department of Justice's
Interna! Controls over Terrorism Reporting (hereinafter the Report).

The FBI appreciates the opportunity to comment and agrees fully with O1G that
the FBI must collect and maintain accurate statistics on the important national security work
being done at FBI Headquarters (FBIHQ) and in our Field Offices and Legats around the globe.
Before we address the specific points raised in the Report, we offer some general comments
applicable to all ten statistics reviewed by OIG.

First, since the period examined by the Report, the FB! has modified and
improved substantially the systems and intemal controls related to terrorism reporting. Please
bear in mind that following September 11, 2001, the FBI underwent a substantial reorganization
and restructuring, and many of the apparent weaknesses in statistical reporting discussed in the
Report occurred during, and were an outgrowth of, that reorganization and restructuring. The
backbone of the FBI's statistical reporting system is the case management and supporting
information technology systems. As you are aware, these systems as a whole are being upgraded
as part of our Sentinel project and were not originally designed to capture and report on the
enhanced requirements developed as part of the FBI's reorganization and restructuring after
September 11, 2001. The FBI recognized this challenge in 2002 and began a concentrated effort
to build supporting systems that capture and report on the organization's upgraded intelligence
mission and to embed additional internal controls. The FBI has made significant progress in the
development and implementation of these systems.

Also since the time period examined by the Report, the FBI has made significant

strides in the devetopment of a new central management information system known as
COMPASS. COMPASS accumulates statistical accomplishments from various stand alone

98


APPENDIX III

The Honorable Gienn A. Fine

investigations that the ITTFs handle based on the type of criminal charges ultimately filed at the
conclusion of the case.

The OiG Investigative Sampie

The OIG shared with the FBI its audit sample in regards to the classification of
terrorism convictions. It is important to note that the entire sample involves cases classified by
the FBI as domestic terrorism investigations. Indeed, there were no international terrorism
investigations within the sample pool.

The sample poo! of 206 convictions involved the work of seven FBI field offices.
Within the sample pool, the Report identified 65 convictions that could not be supported as
terrorism-telated. Within this sample, 23 of the 65 convictions challenged by the OIG represent
the outcome of 12 investigations into Fraud and Related Activity involving Passports, VISAs and
Identity Documents. These investigations did involve individuals and groups involved in the
trafficking of fraudulent documents. Upon review, these investigations did not have a direct tie
to known domestic terrorism groups, although the follow-on prosecutions did focus on violations
of the False Identification Crime Control Act of 1982. This error appears to have been caused by
a lack of understanding and clear program guidance on the pursuit of violations involving the
False Identification Crime Control Act of 1982. The FBI has provided greater oversight to its
field offices involving all domestic terrorism investigations and has strengthened controls over
the classification of these investigations.

Of the 65 convictions challenged by the OIG, 33 convictions involve five
investigations of criminal activity associated with domestic terrorism. One of the investigations
involved a group of self-proclaimed white supremacists. The investigation focused on fully
identifying and disrupting the members of this organization whose declared mission was to tain
and prepare for future violent race conflicts. This investigation led to the successful prosecution
of 29 members and the disruption of this organization. Each of these white-supremacist gang
members was prosecuted for illegal narcotics distribution. The remainder of the sample pool
included one investigation predicated on letters sent to a Federal District Court Judge stating the
letters were contaminated with Anthrax and a second investigation was predicated on a report of
missing vials of Yersinia Pestis bacteria. Both investigations led to prosecutions of individuals
who fabricated a threat to the public. The FBI does not agree that the results of these domestic
terrorism investigations should be reclassified because a terrorism charge was not used by the
prosecutors. The seven remaining prosecutions challenged involve duplications and appear to be
clerical errors.

In 2004 and 2005, the FBI's Counterterrorism Division provided field offices with
additional policy guidance on the investigations of matters within the Domestic Terrorism
Program. Today fraud casts involving passports, VISAs and identification documents would not
be pursued within the Domestic Terrorism Program without predication involving a domestic
terrorist connection. In the past year, FBIHQ has initiated case file reviews involving the
Domestic Terrorism investigative portfolio to ensure compliance with policy. This additional
oversight of domestic terrorism criminal investigations provides improved internal controls to
ensure proper predication and greater collaboration on the timely and successful resolution of
these cases. In the future greater effort will be made to differentiate between International and
Domestic Terrorism statistics.

100


T] Number Reported
|i Number Supported

4,499

820
820

63

51
88
77

8,000 7,000 6,000 5,000 4,000 3,000 2,000 1,000 0
Number Reported/Supported

Statistic Reported

6.a. Number of terrorism-related

threats tracked in FY 2003
(see Chart Endnote 3 on
page 17)

6.b. Number of terrorism-related

threats tracked in FY 2004
(see Chart Endnote 3 on
page 17)

7. Number of terrorism threats to
transportation and facilities
in FY 2004 (see Chart Endnote 4
on page 17)

8. Number of terrorism threats to

people and cities in FY 2004
(see Chart Endnote 4 on
page 17)

9. Number of counterterrorism

threat assessments produced
in FY 2004

10. Number of Presidential

Terrorist Threat Reports
produced in FY 2004

Source: FBI budget requests and performance plans, OIG interviews with

FBI staff, and analysis of documents provided by FBI staff

As shown in the previous charts, we found that the FBI significantly

overstated the number of:”

? We considered the misreporting of a statistic as significant if the statistic was

either overstated or understated by 10 percent or more.
vii


¢ 113 people were charged with material support of terrorism or
similar crimes from September 11, 2001, through February 3,
2005.

As shown in the following charts, the support provided by the CTS
regarding these statistics varied over time.

OIG Analysis of Criminal Division Statistic -
Individuals Charged with Material Support of Terrorism

Or Similar Crimes from 9/11/01 through 8/5/04
500 450 400 350 300 250 200 150 100 50 0

More than | A- Reported

| B - Supported on March 2006
110 ©” Reconstructed List

126 C - Included on August 2006
Reconstructed List

1 =e D - Included on Final Reconciled
] 1 Reconstructed List

143 (e== Sra) E - Supported on Final Reconciled
Reconstructed List

F - Overstatement/Understatement

Source: Criminal Division budgets, OIG interviews with Criminal Division staff,
and analysis of documents provided by Criminal Division staff

OIG Analysis of Criminal Division Statistic -
Individuals Charged with Material Support of Terrorism

Or Similar Crimes from 9/11/01 through 2/3/05
500 450 400 350 300 250 200 150 100 50 0

A- Reported

B - Supported on March 2006
Reconstructed List

C - Included on August 2006
Reconstructed List

D - Included on Final Reconciled
Reconstructed List

E - Supported on Final Reconciled
Reconstructed List

F - Significant Understatement
(E minus A)

Source: Criminal Division budgets, OIG interviews with Criminal Division staff,
and analysis of documents provided by Criminal Division staff

As a result, the Criminal Division accurately reported that more than
89 individuals were charged in material support prosecutions and terrorist
financing investigations from September 11, 2001, through August 5, 2004.
However, the Criminal Division significantly understated the number of

77


Department, the military, and other selected federal agencies. The FBI’s
Global Terrorism Analysis Unit (GTAU) maintains a local database application
that contains details of the Intelligence Assessments issued.?”

In its FY 2006 - FY 2011 Performance Plan, the FBI reported issuing
133 Intelligence Assessments during FY 2004. As shown in the following
chart, we found that the database used by the GTAU to track the Intelligence
Assessments issued did not match the number reported for FY 2004.

OIG Analysis of FBI
Statistic - Intelligence
| Assessments Issued
in FY 2004
1900 + — ———

200 |

600

400

200 | _133 cas

7
Reported Supported Understated

Source: FBI performance plans, OIG
interviews with FBI staff, and analysis
of documents provided by FBI staff

A GTAU official told us that the inaccurate reporting of Intelligence
Assessments issued likely occurred because: (1) staff did not enter
Intelligence Assessments in the database in a timely manner, and (2) the
database was queried by calendar year or other specific time periods instead
of by fiscal year. However, the official could not provide documentation to
show how the database was queried to derive the number of assessments
reported.

According to a GTAU official, the FBI units that issue the Intelligence
Assessments enter the details of the assessments issued into a database.
The GTAU relies on the originating FBI units to enter all the Intelligence
Assessments in the database. There are no internal controls in place for
gathering and verifying the accuracy of Intelligence Assessments tracked in
the database. The GTAU official responsible for accumulating the statistic
said that when she began her job in February 2004 there were no formalized
procedures on how to collect, verify, and report the Intelligence

2? The GTAU is part of the FBI’s Counterterrorism Division and performs analyses of
information related to international terrorist groups not covered by other analytical units
that have bases of operations in Africa, Asia, Europe, Latin America, and North America.

22


APPENDIX IIT

More importantly, however, OIG seems not to grasp the fundamental purpose of an anti-
terrorism case or the need for such a code. A properly coded anti-terrorism case is brought
specifically to deter potential terrorism, particularly in areas of critical infrastructure
vulnerability. The fact that the defendants who are ultimately prosecuted may not have ties to
terrorist activity is irrelevant to the coding of the case. It is the deterrent effect of the
prosccution on potential terrorists that justifies the anti-terrorism case label.

Following the September 11" attacks, it has become clear that airports, subway stations,
and bus and train depots are vulnerable to terrorist activity. Other infrastructure weaknesses
include an insufficiently secure visa and passport documentation system that has allowed easy
access to this country by fraudulent means. Cases that are specifically brought in order to deter
potential terrorist activity in these and other areas are properly coded as anti-terrorism, even if
the defendant is not a terrorist or linked to terrorist activity.

Operation Tarmac, discussed on page 39 of the OIG report, is a good example of the type
of initiative that should properly be coded as anti-terrorism. Operation Tarmac was an
affirmative, national initiative in which the FBI and other investigative agencies reviewed
employment documentation and alienage status of airport employees at regional airports across
the country. Most criminal cases resulting from Operation Tarmac and other similar initiatives
have resulted in prosecutions for immigration violations and identity theft, and the vast majority
of these defendants had no ties to terrorist activity. Yet hundreds of these cases were brought
around the country specifically to deter potential terrorists from infiltrating regional airports.

OJG’s exclusion of Operation-Tarmac-type cases from EOUSA’s anti-terrorism code
takes no account of their valuable deterrent effect. This exclusion is particularly ironic because
in January 2003, the GAO issued a report—GAOQ-03-266—that reviewed EQUSA’s terrorism
statistics and confirmed that Operation-Tarmac-type cases were properly coded as anti-terrorism
cases. In its report, the GAO criticized EOUSA for having too many cases coded as outright

(underlining) on the first sentence, it is fair to say that the focus of the coding decision is on the
purpose of the investigation or case, not on the target or defendant. The definition nowhere
States that a defendant must have links to terrorist activity.

OIG’s interpretation focuses on the examples rather than the general rule. Although the
examples do discuss the nature or motivation of the defendant, the examples are merely that,
permissible examples. They do not supersede, in our view, the general rule stated in the first
three sentences, particularly where the rule itself explicitly slates that it is intended to capture
conduct that is not obviously a federal crime of terrorism.

Interestingly, the OIG report does state that “a case or defendant must have some
identifiable link to terrorism to be categorized as an ‘anti-terrorism’ case.” Report at 38, italics
added. EOUSA could agree with that statement were it intended to include the deterrent purpose
for which a case is brought. But it is clear that OIG did not accept cases “where the
investigation showed that the subject or target had no link at all to terrorist activity,” regardless
of the deterrent purpose of the case. Report at 39, italics added.

109


ACRONYMS

Acronym Description

ACS FBI's Automated Case Tracking System

AUSA Assistant United States Attorney

CTAS FBI's Counterterrorism Analysis Section

cTs Criminal Division’s Counterterrorism Section

Department Department of Justice

DSEAU FBI’s Domestic Sunni Extremism Analysis Unit

DTAU FBI’s Domestic Terrorism Analysis Unit

EOUSA Executive Office for United States Attorneys

FBI Federal Bureau of Investigation

FIDS FBI's Intelligence Information Reports
Dissemination System

FY Fiscal Year

GAO Government Accountability Office

GTAU FBI’s Global Terrorism Analysis Unit

IRCMU1 FBI’s Intelligence Requirements and Collection
Management Unit 1

ITOS International Terrorism Operations Section

IMD Justice Management Division

ITTF Joint Terrorism Task Force

LIONS Legal Information Office Network System

NTCS National Threat Center Section

OIG Department of Justice Office of the Inspector
General

OMB Office of Management and Budget

SMEAU FBI’s Shia/Middle East Analysis Unit

TAU FBI's Threat Analysis Unit

TMU FBI's Threat Monitoring Unit

TRRS FBI's Terrorism Reports and Requirements
Section

TrIc Terrorist Threat Integration Center

TWWU FBI’s Terrorist Watch and Warning Unit

Unit (FBI's Counterterrorism Watch Unit)

USAO United States Attorneys Office

WMD/EWTAU | FBI's Weapons of Mass Destruction/Emerging

Weapons Threat Analysis Unit

84



and report the Intelligence Bulletins, Intelligence Assessments, and other
intelligence products issued were formalized in standard operating
procedures at the unit level, but had not been formalized at the section level
other than a production process checklist.

5. Intelligence Products Produced/Disseminated

The FBI produces and disseminates various intelligence products
designed to inform the U.S. intelligence and law enforcement communities of
terrorist-related activities and issues. As previously discussed, these
intelligence products include Intelligence Information Reports, Intelligence
Assessments, and Intelligence Bulletins. The intelligence products are
disseminated to U.S. intelligence and law enforcement communities by
posting them on various community websites. The FBI's Intelligence
Requirements and Collection Management Unit 1 (IRCMU1), which is part of
the FBI’s Directorate of Intelligence, maintains a spreadsheet application
containing details of all Intelligence Information Reports, Intelligence
Assessments, and Intelligence Bulletins disseminated by the FBI for use by
the U.S. intelligence and law enforcement communities.

In its FY 2006 — FY 2011 Performance Plan, the FBI reported that
1,657 intelligence products were produced and disseminated to the
intelligence community and other federal entities during FY 2004. As shown
in the following chart, we found that the spreadsheet used by the IRCMU1 to
track the intelligence products disseminated by the FBI did not match the
number reported for FY 2004.

OIG Analysis of FBI
Statistic - Intelligence Products
Produced/Disseminated
in FY 2004

7000 6739

3 su
4000

3000

2000 1657

1000

Reported Supported Understated

Source: FBI performance plans, OIG
interviews with FBI staff, and analysis
of documents provided by such staff

According to IRCMU1 officials, the accurate number of all intelligence

products produced and disseminated by the FBI in FY 2004 was 6,739.
However, the officials also said that the description of the statistic included

25