Office of Inspector General 

U.S. Department of 

Homeland Security 

Washington, DC 20528

 

Improvements to Information Sharing 

are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 

DEPARTMENT OF HOMELAND SECURITY 

Office of Inspector General 

OIG-07-60 July 2007
 

Office of Inspector General 

U.S. Department of Homeland Security 

Washington, DC 20528

July 26, 2007 

Preface 

The Department of Homeland Security (DHS) Office of Inspector General (OIG) was established by 

the Homeland Security Act of 2002 (Public Law 107-296) by amendment to the Inspector General 

Act of 1978. This is one of a series of audit, inspection, and special reports prepared as part of our 

oversight responsibility to promote economy, efficiency, and effectiveness within the department. 

This report addresses the extent to which information sharing processes and procedures can be 

enhanced to better assist law enforcement efforts during disasters. It is based on interviews with 

employees and officials of relevant agencies and institutions, direct observations, and analyses of 

applicable documents. 

The recommendations herein have been developed according to the best knowledge available to our 

office, and have been discussed in draft with those responsible for implementation. It is our hope 

that this report will result in more effective, efficient, and economical operations. We express our 

appreciation to all of those who contributed to the preparation of this report. 

 

 

Richard L. Skinner 

Inspector General 
 

Table of Contents/Abbreviations 

EXECUTIVE SUMMARY .................................................................................................................. 1 

Background........................................................................................................................................... 3 

Results of Audit .................................................................................................................................... 5 

Public Safety and Security................................................................................................................ 5 

Access to FEMA Information....................................................................................................... 6 

Law Enforcement Requests .......................................................................................................... 8 

Disclosure of FEMA Disaster Recovery Assistance Files.......................................................... 10 

Direct Access for Public Safety and Security............................................................................. 11 

Steps to Improve Information Sharing........................................................................................ 13 

Recommendations........................................................................................................................... 15 

Fraud Detection............................................................................................................................... 16 

The Computer Matching and Privacy Protection Act................................................................. 16 

Issue for Congressional Consideration ........................................................................................... 18 

Management Comments and OIG Analysis ....................................................................................... 19 

 

Appendices 

Appendix A: Objectives, Scope, and Methodology................................................................. 21 

 Appendix B: Management Comments..................................................................................... 22 

 Appendix C: FEMA November 2004 System of Records Notice ........................................... 36 

 Appendix D: FEMA Guidance on Handling Law Enforcement Requests .............................. 40 

 Appendix E: FEMA July 2006 System of Records Notice ..................................................... 42 

 Appendix F: Major Contributors to this Report ...................................................................... 46 

 Appendix G: Report Distribution............................................................................................. 47 

Abbreviations 

DHS 

DOJ 

U.S. Department of Homeland Security 

U.S. Department of Justice 

FBI 

FEMA 

Federal Bureau of Investigation 

Federal Emergency Management Agency 

 HHS U.S. Department of Health and Human Services 

 HUD U.S. Department of Housing and Urban Development 

OIG 

USDA 

Office of Inspector General 

U.S. Department of Agriculture 
OIG 

Department of Homeland Security 

Office of Inspector General

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 1 

 

Executive Summary 

Law enforcement efforts to provide public safety and security, and detect disaster assistance fraud, 

are complicated by: (1) Federal Emergency Management Agency (FEMA) concerns about 

improperly disclosing Privacy Act-protected information; and (2) the Computer Matching and 

Privacy Protection Act, which prevents federal Inspectors General from expeditiously conducting 

computer matches among recipients of disaster assistance. 

Law enforcement agencies were not given direct access to FEMA disaster recovery assistance files 

to locate missing children, sex offenders, and fugitive felons following Hurricane Katrina. Instead, 

to obtain FEMA disaster recovery assistance files, the Federal Bureau of Investigation (FBI), the 

New Orleans District Attorney’s Office, and state and local law enforcement agencies were required 

to follow a time-consuming process, according to the Privacy Act’s general law enforcement 

exception. FEMA took 5 to 12 days, on average, and as many as 35 days, to fulfill law enforcement 

requests for critical information in support of public safety and security efforts. On March 1, 2006, 

or seven months after Katrina made landfall, the Department of Homeland Security (DHS) and the 

Department of Justice (DOJ) executed an agreement that provides law enforcement officials direct 

access to FEMA disaster recovery assistance files for fraud investigations. Also, on January 8, 2007, 

DHS and DOJ executed an agreement for the purpose of locating missing children displaced due to 

disasters. However, DHS and DOJ have not established an arrangement that provides law 

enforcement with direct access to FEMA disaster recovery assistance files for all public safety and 

security needs, such as identifying the whereabouts of registered sex offenders and fugitive felons 

following a disaster. 

The Computer Matching and Privacy Protection Act prevented proactive fraud investigations by 

federal Inspectors General because it required a time-consuming review and approval process before 

computer matching could be performed. Computer matching to identify fraud following a disaster is 

crucial to mitigate recurring improper payments and to recover improperly disbursed funds. Only 

the U.S. Congress has the authority to exempt federal law enforcement agencies, including the 

Inspectors General, from the Computer Matching and Privacy Protection Act to support their efforts 

to identify and prevent fraud, waste, and abuse. Such an exemption would greatly facilitate the 

efforts of the federal law enforcement community to obtain and analyze federal disaster assistance 

records and identify those who attempt to defraud the government. 
OIG 

Department of Homeland Security 

Office of Inspector General

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 2 

 

We are recommending that the Administrator of the Federal Emergency Management Agency: 

1. Add specific routine uses to the System of Records Notice that authorizes the disclosure of 

FEMA disaster recovery assistance files for the purpose of locating registered sex offenders 

and fugitive felons in the aftermath of a disaster. 

2. Develop and execute agreements with DOJ, the coordinator for Public Safety and Security

under the National Response plan, to provide appropriate law enforcement entities direct 

access to FEMA disaster recovery assistance files for public safety and security efforts, 

including identifying the whereabouts of registered sex offenders and fugitive felons. 

3. Collaborate with DOJ to develop protocols, procedures, and processes to facilitate the 

appropriate sharing of information from FEMA disaster recovery assistance files among 

federal, state, local, and tribal law enforcement agencies that are responsible for ensuring 

public safety and security following a disaster. 
 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 3 

 

Background 

Hurricane Katrina struck the Gulf Coast in August 2005 and was the most destructive natural 

disaster in the history of the United States. It displaced hundreds of thousands of Gulf Coast 

residents, from the extremely vulnerable to the extremely dangerous. Among the displaced were 

approximately 5,000 missing children, more than 2,000 unaccounted registered sex offenders, 

and a multiplicity of fugitive felons. 

Congress provided approximately $82 billion dollars to multiple federal agencies for Gulf Coast 

disaster response and recovery. In the area of housing alone, there were four primary agencies 

that provided housing assistance: DHS, U.S. Department of Housing and Urban Development 

(HUD), U.S. Department of Agriculture (USDA), and U.S. Department of Health and Human 

Services (HHS). A recent USDA audit revealed that more than 44% of disaster victims received 

housing assistance from more than one federal agency. Furthermore, the Government 

Accountability Office estimated that DHS improperly disbursed between $600 million and $1.4 

billion disaster assistance after Hurricanes Katrina and Rita. 

The National Response Plan was implemented during Hurricane Katrina to deliver and apply 

federal resources and capabilities in support of the state and local government response. The 

National Response Plan is a comprehensive, national, all-hazards approach to domestic incident 

management across a spectrum of activities including prevention, preparedness, response, and 

recovery. It is meant to align Federal coordination structures, capabilities, and resources into a 

unified, all-discipline, and all-hazards approach to domestic incident management. 

DHS is responsible for coordinating federal operations within the United States to prepare for, 

respond to, and recover from terrorist attacks, major disasters, and other emergencies. DHS is 

also responsible for coordinating federal resources used in the prevention of, preparation for, 

response to or recovery from terrorist attacks, major disasters, or other emergencies. At the time 

of Hurricane Katrina, DHS was a coordinator, along with the DOJ, for the National Response 

Plan’s Emergency Support Function Thirteen – Public Safety and Security. 
 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 4 

 

The National Response Plan’s Emergency Support Function Thirteen – Public Safety and 

Security is intended to be the coordinating mechanism for providing federal-to-federal support or 

federal support to state and local authorities with respect to public safety and security capabilities 

and resources. It generally is activated in situations requiring extensive assistance to provide 

public safety and security and where state and local government resources are overwhelmed or 

are inadequate. According to the White House report regarding the federal response to 

Hurricane Katrina, law and order in New Orleans began to deteriorate almost immediately 

following Hurricane Katrina’s landfall. The city’s police were overwhelmed and federal law 

enforcement was ill-prepared and ill-positioned to respond efficiently and effectively to the 

crisis. 

The National Response Plan was updated in May 2006 and DHS was removed as a coordinator 

for Emergency Support Function Thirteen – Public Safety and Security, but remains a support 

agency responsible for providing data for operations that reside within DHS, such as FEMA 

disaster recovery assistance files. FEMA became part of DHS on March 1, 2003. 

FEMA’s mission is to lead the effort to prepare the nation for all hazards and effectively manage 

federal response and recovery efforts following any national incident. Under the authority of the 

Robert T. Stafford Disaster Relief and Emergency Assistance Act, FEMA provides financial 

assistance and, if necessary, direct services to eligible individuals and households who, as a 

direct result of a major disaster, have necessary expenses and serious needs and are unable to 

meet such expenses or needs through other means. Information collected from individuals 

applying for FEMA assistance is maintained in a system of records known as FEMA disaster 

recovery assistance files. 

 
 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 5 

 

Results of Audit 

Public Safety and Security 

The FBI, New Orleans District Attorney’s Office, state and local law 

enforcement agencies, and others responsible for public safety and 

security in the aftermath of Hurricane Katrina were not given direct access 

to FEMA disaster recovery assistance files to locate missing children, 

registered sex offenders, and fugitive felons. Direct access permits law 

enforcement to view FEMA files independently and instantly, in the 

performance of official duties. FEMA disaster recovery assistance files 

consist of Privacy Act-protected information provided by the applicant to 

obtain federal disaster assistance, such as the applicant’s name, social 

security number, and income information. Instead of direct access to 

FEMA disaster recovery assistance files, law enforcement was required to 

follow a protracted process to obtain this information under the general 

law enforcement exception to the Privacy Act. FEMA took 5 to 12 days 

on average to provide law enforcement with the information needed to aid 

public safety and security efforts, once FEMA received and approved the 

request. 

FEMA, in its August 2006 “After Action Report” on Hurricane Katrina, 

noted frustrations with information sharing among those directly involved 

with relief efforts. One individual commented, “Privacy Act prohibitions 

on sharing applicant data made it impossible to work together on 

resolution to issues ...DHS/FBI/FEMA/State coordination is essential 

relative to evacuees who committed crimes.” Another participant stated 

that, “Either the [Privacy] Act itself, or our interpretation of the Act needs 

to be reconsidered. We must have the ability to share information with 

state and local partners, as well as other federal partners. I think we are 

too restrictive in our internal interpretation of the Act.” 
 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 6 

 

DHS and DOJ did not resolve law enforcement’s need for direct access to 

FEMA disaster recovery assistance files following Hurricane Katrina, 

even though at the time both were coordinating agencies for the National 

Response Plan’s Emergency Support Function Thirteen, Public Safety and 

Security. FEMA faced intense criticism for denying or delaying law 

enforcement agencies’ access to FEMA disaster recovery assistance files 

to pursue public safety and security investigations. 

DHS and DOJ executed a memorandum of agreement in March 2006 that 

provided law enforcement officials direct access to FEMA disaster 

recovery assistance files solely for fraud investigations. FEMA 

determined that this arrangement was permissible according to the Privacy 

Act and was compatible with FEMA’s routine use for its disaster recovery 

assistance files. Routine uses are specified purposes for which federal 

agencies may disclose information contained in a Privacy Act-protected 

system of records. However, FEMA did not believe that it could disclose 

information to law enforcement for public safety and security 

investigations, such as missing children cases, under the routine uses 

contained in its November 2004 System of Records Notice. (See 

Appendix C for FEMA’s November 2004 System of Records Notice and 

the routine uses for FEMA disaster recovery assistance files in effect 

during Hurricane Katrina.) 

Access to FEMA Information 

FEMA officials told us that they did not provide law enforcement direct 

access to FEMA disaster recovery assistance files for public safety and 

security in the aftermath of Hurricane Katrina because they were 

concerned about improperly disclosing Privacy Act-protected information. 

The Privacy Act of 1974 is characterized as an omnibus code of fair 

information practices that regulates the collection, maintenance, use, and 

dissemination of personal information by federal executive branch 
 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 7 

 

agencies. It requires each agency to publish in the Federal Register a 

description of their systems of records and routine uses to make 

recordkeeping practices transparent, to notify individuals about the use of 

their personal information, and to assist individuals in finding such files 

maintained by the agency. 

In lieu of law enforcement’s direct access to FEMA disaster recovery 

assistance files, FEMA’s Chief Counsel issued a memorandum in October 

2005 that described the criteria and process that law enforcement agencies 

must fulfill to receive FEMA disaster recovery assistance files under the 

Privacy Act’s general law enforcement exception. (Appendix D contains 

FEMA’s guidance regarding a law enforcement agency’s request for 

FEMA records under the Privacy Act.) The process is as follows: 

1. The request must be made in writing to FEMA Counsel. 

2. The written request must come from the head of the requesting 

agency or an appropriate designee for the head of that agency. 

3. The written request must: (a) state the specific criminal or law 

enforcement activity and the legal basis for that activity for which 

the agency is seeking information; (b) identify the specific persons 

about whom the law enforcement agency is seeking information; 

and (c) identify the specific information about the listed persons 

that the law enforcement agency wants to receive. 

4. The memorandum further states: “If the written request does not 

address all of these requirements it is not a sufficient request, and 

we cannot process it.” 

FEMA told us that, in responding to information-sharing requests, a 

careful balance needs to be struck between protecting applicants’ privacy 

interests and other equally important purposes, including law enforcement 

inquiries. FEMA said it received numerous requests from law 

enforcement agencies that could not be fulfilled because the requests were 

not legally sufficient or did not demonstrate a violation or potential 
 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 8 

 

violation of law. FEMA said it successfully responded to approximately 

216 law enforcement requests. However, the process FEMA employed to 

respond to requests significantly delayed law enforcements’ access to 

information. 

Law Enforcement Requests 

FEMA took 5 to 12 days, on average, and as many as 35 days to respond 

to law enforcement requests for information to locate missing children and 

to pursue sex offenders and fugitive felons. The following graphs 

illustrate FEMA’s average response times for law enforcement requests 

based upon data provided to us by FEMA Office of Chief Counsel in 

September 2006. 

FEMA's Average Response Time to Law Enforcement 

Requests

5

6

10

12

12

0 2 4 6 8 10 12 14

Sex Offenders

Homicide

Fugitive Felons

Missing Children

Illegal Drugs

Case Type

Days to Fulfill Law Enforcement Requests
 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 9 

 

FEMA's Maximum Response Time to Law Enforcement 

Requests

19

24

29

29

35

0 5 10 15 20 25 30 35 40

Homicide

Illegal Drugs

Sex Offenders

Missing Children

Fugitive Felons

Case Type

Days to Fulfill Law Enforcement Requests

It took over 6 months for the FBI and the National Center for Missing and 

Exploited Children to resolve all Hurricane Katrina missing children 

cases. The FBI agent investigating missing children cases following 

Hurricane Katrina told us that it was, “burdensome and next to impossible 

to get access to FEMA data,” noting that the FBI could not, “receive 

information in a timely fashion.” For example, the FBI requested FEMA 

disaster recovery assistance files to locate missing children on April 20, 

2006, and the request was fulfilled 29 days later, on May 19, 2006. 

According to crime statistics relating to child abduction cases where the 

child is murdered, 99% are killed within the first 24 hours. The FBI agent 

told us that direct access to FEMA disaster recovery assistance files was 

needed to facilitate public safety and security investigations, particularly 

those involving missing children. 
 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 10 

Disclosure of FEMA Disaster Recovery Assistance Files 

DHS and FEMA could have arranged for the timely disclosure of FEMA 

disaster recovery assistance files to law enforcement following Hurricane 

Katrina for the purpose of locating missing children, sex offenders, and 

fugitive felons. Specifically, DHS and FEMA could have expedited 

information sharing through use of the Health or Safety exception to the 

Privacy Act and by promptly adding routine uses to its System of Records 

Notice to authorize the release of information for public safety and 

security investigations. 

The Health or Safety exception to the Privacy Act allows for the 

immediate disclosure of records under compelling circumstances affecting 

an individual’s health or safety. We asked FEMA why the Health or 

Safety exception was not used to disclose information to assist law 

enforcement in locating missing children, and FEMA said that this 

exception was used where appropriate. FEMA used the Health or Safety 

exception to provide the U.S. Postal Service with the current contact 

information of their evacuated employees so that they could determine that 

they were safe and inform them of their health and pay benefits. 

Additionally, FEMA provided information to the U.S. Postal Service for 

the purpose of forwarding mail to displaced Gulf Coast customers. 

FEMA could have added routine uses to its System of Records Notice to 

authorize the release of information for public safety and security 

investigations in as few as 40 days, according to statutory and regulatory 

guidelines. We asked FEMA why a routine use for public safety and 

security was not added promptly to its System of Records Notice 

following Hurricane Katrina, and FEMA told us it had very limited 

resources and was focused on accomplishing its mission to process 
 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 11 

requests for disaster assistance. Had a routine use been added to allow the 

release of information to locate missing children, sex offenders, and 

fugitive felons, DHS and DOJ could have executed an agreement that 

would have provided law enforcement direct access to FEMA disaster 

recovery assistance files for these purposes. 

Direct Access for Public Safety and Security 

DHS and DOJ have yet to make the necessary arrangements to provide 

federal, state, local, and tribal law enforcement direct access to FEMA 

disaster recovery assistance files to identify the whereabouts of registered 

sex offenders and fugitive felons in the aftermath of a disaster. Following 

Hurricane Katrina, FEMA denied repeated requests from the Mississippi 

State Police for the passenger list of the Carnival cruise ship Holiday. The 

cruise ship Holiday was used as a temporary shelter for Hurricane Katrina 

victims. 

The Mississippi State Police wanted the Holiday’s passenger list to 

determine if any of the area’s 200 missing sex offenders were residing in 

the shelter. A September 2005 email from a FEMA Field Attorney 

explained DHS’ position on disclosing such information: 

The manifest information of each Katrina Disaster victim (name and 

date of birth) provided to Carnival Cruise Line by FEMA is solely 

provided for purposes of making appropriate cabin assignments. 

Accordingly, there is no blanket authorization for Carnival to provide 

the list to police without an express written release from each of 

passengers to whom the record pertains, or pursuant to a routine use, 

or pursuant to a Privacy Act of 1974 (Privacy Act) exception. A law 

enforcement request exception to the Privacy Act requires that the 

police have some evidence of a violation of a law. Blanket screening 
 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 12 

of passengers for criminal backgrounds would not meet this threshold 

and release of the manifest information is not related to the provision 

of disaster assistance for the passengers as within an appropriate 

routine use. This issue has been raised to the DHS Privacy Office 

Counsel which agrees that such blanket releases of information to law 

enforcement are not authorized. 

The Mississippi State Police did not agree with this reasoning. They 

maintained that criminal convictions are a matter of public record and that 

checking the passenger list for occupants with criminal convictions would 

be prudent and reasonable to ensure public safety and security. 

A federal employee working on the Holiday reported in October 2005 that, 

"A pedophile had just been removed from the Holiday a second time. 

After removal from the ship the first time, he was allowed to board again. 

He was observed by ship security to be around the video arcade and teen 

lounge, and observed touching young girls.” 

This federal employee, the following month, received additional 

instructions for the release of passenger information: “law enforcement 

needs to provide in writing their statutory authority to obtain any 

information, and a list of names they want checked as sex offenders or 

wanted fugitives. In other words, we can check any names they give us 

against our manifest, but cannot give them a manifest to check against 

their database.” 

A senior official with the Louisiana State Police told us that they were also 

denied access to FEMA disaster recovery assistance files for individuals 

residing in FEMA’s temporary housing sites. He said that not having 

access to this information affected their ability to ensure the safety of the 

shelter and surrounding communities. This issue was deemed of such 

great importance that Louisiana enacted a law that now requires each 

shelter to notify law enforcement of any evacuee who is a registered sex 
 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 13 

offender. The law was so widely supported that it passed the Louisiana 

Legislature without a single “No” vote. However, the Louisiana State 

Police official acknowledged that this law does not compel the federal 

government or FEMA to share information. 

 

Steps to Improve Information Sharing 

Steps have been taken to improve information sharing since Hurricane 

Katrina, but arrangements to provide law enforcement direct access to 

FEMA disaster recovery assistance files for all public safety and security 

efforts have not been established. Additionally, the protocols, procedures, 

and processes for sharing public safety and security information among 

federal, state, local, and tribal law enforcement have not been developed 

by either DHS or DOJ. 

FEMA has provided the Hurricane Katrina Fraud Task Force direct access 

to FEMA disaster recovery assistance files for the purpose of investigating 

fraud. The Hurricane Katrina Fraud Task Force was established in 

September 2005 to deter, detect, and prosecute instances of fraud related 

to Hurricane Katrina. Task members include the DOJ, United States 

Attorneys' Offices, the FBI, federal Inspectors General, and various 

representatives of state and local law enforcement. FEMA told us they 

could provide the Hurricane Katrina Fraud Task Force direct access to 

FEMA disaster recovery assistance files because FEMA’s November 2004 

System of Records Notice contained a routine use that was applicable to 

fraud. 

In July 2006, nearly 1 year after Hurricane Katrina, FEMA added a routine 

use to its system of records notice for the purpose of locating missing 

children, reuniting families, and addressing public safety and security 

matters. The addition of these routine uses facilitates the release of FEMA 
 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 14 

disaster recovery assistance files to federal agencies, state and local 

governments, or law enforcement entities in the event of circumstances 

involving an evacuation, sheltering, or mass relocation, and for purposes 

of identifying and addressing public safety and security issues, but they do 

not provide direct access. Furthermore, the July 2006 System of Records 

Notice does not explicitly authorize the disclosure of records for purposes 

of locating sex offenders and fugitive felons. Doing so would remove 

ambiguity and obviate the need to rely on the Privacy Act’s law 

enforcement exception, with its protracted procedural requirements for the 

release of information. (Appendix E contains FEMA’s July 2006 System 

of Records Notice and the revised routine uses for FEMA disaster 

recovery assistance files.) 

According to Public Law 109-295, section 640a, FEMA may disclose 

information to law enforcement agencies for public safety and security: 

“In the event of circumstances requiring an evacuation, sheltering, or mass 

relocation, the Administrator may disclose information in any individual 

assistance database of the Agency in accordance with section 552a(b) of 

title 5, United States Code (commonly referred to as the ‘Privacy Act’), to 

any law enforcement agency of the Federal Government or a State, local, 

or tribal government in order to identify illegal conduct or address public 

safety or security issues, including compliance with sex offender 

notification laws.”. Additionally, the U.S. Congress included language in 

section 689c(e), that instructs FEMA to enter into a memorandum of 

understanding with the DOJ, the National Center for Missing and 

Exploited Children, the Department of Health and Human Services, 

American Red Cross, and other relevant private organizations that will 

enhance the sharing of information to facilitate reuniting displaced 

individuals with their families. 

DHS and DOJ have collaborated since May 2006 to execute a 

memorandum of agreement that provides law enforcement direct access to 

FEMA disaster recovery assistance files for the purpose of locating 
 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 15 

missing children displaced due to disasters. The agreement was executed 

on January 8, 2007. However, similar agreements that would provide 

federal, state, local, and tribal law enforcement direct access to FEMA 

disaster recovery assistance files to identify the whereabouts of registered 

sex offenders and fugitive felons following a disaster have not been 

executed. 

It is obvious that law enforcement cannot wait days or weeks to receive 

information needed to protect the public. DHS’ role, as a support agency 

for the National Response Plan’s Emergency Support Function Thirteen – 

Public Safety and Security, should facilitate law enforcement access to 

FEMA disaster recovery assistance files for the purpose of securing 

FEMA shelters and protecting disaster victims and the general public from 

sex offenders and felons. 

Recommendations 

We are recommending that the Administrator of the Federal Emergency 

Management Agency: 

1. Add specific routine uses to the System of Records Notice that 

authorizes the disclosure of FEMA disaster recovery assistance files 

for the purpose of locating registered sex offenders and fugitive felons 

in the aftermath of a disaster. 

2. Develop and execute agreements with DOJ, the coordinator for Public 

Safety and Security under the National Response plan, to provide 

appropriate law enforcement entities direct access to FEMA disaster 

recovery assistance files for public safety and security efforts, 

including identifying the whereabouts of registered sex offenders and 

fugitive felons. 
 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 16 

3. Collaborate with DOJ to develop protocols, procedures, and processes 

to facilitate the appropriate sharing of information from FEMA 

disaster recovery assistance files among federal, state, local, and tribal 

law enforcement agencies that are responsible for ensuring public 

safety and security following a disaster. 

Fraud Detection 

The Computer Matching and Privacy Protection Act, which establishes 

procedural safeguards for computerized matching of Privacy Actprotected information, prevented federal Inspectors General from 

immediately performing computer matching to identify Hurricane Katrina 

disaster assistance fraud because it required an extensive review and 

approval process before interagency computer matching could be 

performed. 

According to the Inspector General Act of 1978, it is the responsibility of 

each Inspector General to conduct, supervise, or coordinate all matters 

relating to the promotion of economy and efficiency, and the prevention 

and detection of fraud and abuse in programs and operations administered 

or financed by their agency. Computer matching is the retroactive, 

automated comparison of two computerized databases. It can be used to 

identify relationships that indicate possible instances of fraud. In contrast 

to manual searches, computer matching provides the capability to analyze 

massive volumes of data quickly and inexpensively. 

The Computer Matching and Privacy Protection Act 

The President’s Council on Integrity and Efficiency and the Executive 

Council on Integrity and Efficiency conduct interagency and inter-entity 

audits, inspections, and investigations to promote economy and efficiency 

in federal programs and operations and address more effectively 
 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 17 

government-wide issues of fraud, waste, and abuse. These two councils 

recently reported to Congress that the requirements of the Computer 

Matching and Privacy Protection Act prevented the initiation of several 

proactive fraud investigations relating to Hurricane Katrina. Moreover, 

members of the Hurricane Katrina Fraud Task Force told us that computer 

matching is an invaluable tool for fraud investigations. However, a 

computer matching agreement generally takes several months to execute, 

thereby forcing the Hurricane Katrina Fraud Task Force to rely on manual 

searches within numerous disaster assistance databases. 

Meeting the requirements of the Computer Matching and Privacy 

Protection Act is time-consuming: 

(1) A computer matching agreement must include a cost/benefit analysis, 

statement of purpose, explanation of legal authority, description of 

records to be matched, procedures to be followed in providing 

individual notice and verifying information produced in the matching 

program, procedures for record retention and for ensuring security of 

the records matched and the resulting matches, and statement of 

prohibitions on duplication and further disclosure of records involved 

in the match. 

(2) Interagency concurrence must be obtained. 

(3) The agreement must be approved by a Data Privacy and Integrity 

Board. 

(4) Congress and the Office of Management and Budget must be notified 

at least 40 days prior to implementation. 

(5) A notice of the computer matching agreement must be published in the 

Federal Register at least 30 days prior to implementation. 

An exemption from the Computer Matching and Privacy Protection Act 

for federal Inspectors General would improve the efficacy of fraud 

investigations, the identification and subsequent mitigation of improper 
 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 18 

payments, and would facilitate the thorough assessment of internal 

controls. 

Issue for Congressional Consideration 

Only the U.S. Congress has the authority to exempt federal law 

enforcement agencies, including Inspectors General, from the Computer 

Matching and Privacy Protection Act to support their efforts to identify 

and prevent fraud, waste, and abuse in an expeditious manner. Such an 

exemption would greatly facilitate the efforts of the federal law 

enforcement community to obtain and analyze federal disaster assistance 

records for the purpose of promoting integrity in federal disaster assistance 

programs and detecting, preventing, and prosecuting disaster benefit fraud. 
Appendix A 

Objectives, Scope, and Methodology 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 19 

Management Comments and OIG Analysis 

The Privacy Office generally concurred with our recommendations regarding appropriate routine 

uses of FEMA disaster recovery assistance files, agreements to effectuate the routine uses, and 

protocols to facilitate the routine uses. FEMA agreed that a process must be implemented that 

minimizes any delay in getting information needed to the appropriate law enforcement agency. We 

consider all three recommendations resolved because steps are being taken to implement them. 

However, these recommendations will remain open until they have been fully implemented. 

Recommendation 1: Add specific routine uses to the System of Records Notice that authorizes the 

disclosure of FEMA disaster recovery assistance files for the purpose of locating registered sex 

offenders and fugitive felons in the aftermath of a disaster. 

FEMA Response: FEMA believes that the amended System of Records Notice of July 2006, 

specifically, the broadened routine uses that applies to law enforcement requests, already includes 

facilitating law enforcement access for the purpose of locating registered sex offenders and fugitive 

felons in the aftermath of a disaster. 

OIG Analysis: We agree that the amended System of Records Notice of July 2006 facilitates law 

enforcement access to FEMA disaster recovery assistance files. However, adding specific routine 

uses to the Systems of Records Notice for the purpose of locating registered sex offenders and 

fugitive felons in the aftermath of a disaster would remove ambiguity concerning the disclosure of 

FEMA records for such purposes. We consider this recommendation resolved but open until routine 

uses to the System of Records Notice are added that specifically authorize the disclosure of FEMA 

disaster recovery assistance files for the purpose of locating registered sex offenders and fugitive 

felons in the aftermath of a disaster. 

Recommendation 1 – Resolved – Open 

Recommendation 2: Develop and execute agreements with DOJ, the coordinator for Public Safety 

and Security under the National Response plan, to provide appropriate law enforcement entities 

direct access to FEMA disaster recovery assistance files for public safety and security efforts, 

including identifying the whereabouts of registered sex offenders and fugitive felons. 

FEMA Response: FEMA thinks it appropriate to grant law enforcement entities direct “limited” 

access to their disaster recovery assistance files so long as certain prerequisites are first met. First, a 

written memorandum of agreement is entered into by both FEMA and the respective law 

enforcement agency. Secondly, the law enforcement agency’s personnel meet all federal electronic 

systems security and identity verification requirements. Third, that the law enforcement agency’s 
Appendix A 

Objectives, Scope, and Methodology 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 20 

authorized employees be trained in FEMA’s system. Fourth, that they be granted only limited “read 

only” access to only the information necessary for the respective entity’s specific law enforcement 

purposes. FEMA is currently working on executing a memorandum of agreement with the U.S. 

Marshals Service to address the public safety and security needs of identifying and apprehending sex 

offenders and fugitive felons. FEMA is proposing to provide the U.S. Marshals Service direct 

"limited" access to FEMA's information for these specific law enforcement functions. FEMA is 

currently exploring more information-sharing agreements for the purpose of identifying and 

addressing public safety and security issues. 

OIG Analysis: This recommendation is resolved but will remain open until FEMA demonstrates 

that an agreement has been executed with the U.S. Marshals Service, and other DOJ components as 

appropriate, to provide direct access to FEMA disaster recovery assistance records for public safety 

and security efforts, including identifying the whereabouts of registered sex offenders and fugitive 

felons. 

Recommendation 2 – Resolved – Open

Recommendation 3: Collaborate with DOJ to develop protocols, procedures, and processes to 

facilitate the appropriate sharing of information from FEMA disaster recovery assistance files among 

federal, state, local, and tribal law enforcement agencies that are responsible for ensuring public 

safety and security following a disaster. 

 

FEMA Response: FEMA is currently addressing this recommendation and has already developed 

protocols, procedures, and processes to facilitate the appropriate sharing of information with two 

DOJ components. 

OIG Analysis: This recommendation is resolved but will remain open until FEMA demonstrates 

that protocols, procedures, and processes are established that facilitate the appropriate sharing of 

information from FEMA disaster recovery assistance files among federal, state, local, and tribal law 

enforcement agencies responsible for ensuring public safety and security following a disaster. 

Recommendation 3 – Resolved – Open

The objective of our audit was to determine the adequacy of DHS’ information sharing processes 

and procedures for Hurricane Katrina, and to determine what enhancements are needed to support 

law enforcement efforts. 
Appendix A 

Objectives, Scope, and Methodology 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 21 

We conducted our audit from April through December 2006 and reviewed agency documents, 

analyzed pertinent policies and procedures, interviewed cognizant officials, and evaluated internal 

controls. 

Our fieldwork extended to various federal, state, and local agencies, and nongovernmental 

organizations, including the National Center for Missing and Exploited Children and the American 

Red Cross. We interviewed officials from components within DHS, including FEMA, the Office of 

Policy, the Office of Intelligence and Analysis, the DHS Privacy Office, the DHS Office of General 

Counsel, and various other components within DHS. Furthermore, we interviewed federal officials 

at the FBI, USDA, HHS, HUD, Internal Revenue Service, DOJ, Department of Labor, Social 

Security Administration, Small Business Administration, and U.S. Postal Service. We also 

interviewed various state and local officials, including the Mississippi State Police, the Louisiana 

State Police, and a Louisiana State Representative. We held discussions with the U.S. Attorney for 

the Middle District of Louisiana, and other officials on the Hurricane Katrina Fraud Task Force. In 

all, we met with 118 officials. Also, we examined approximately 4,000 pages of documentation 

relating to information sharing, including federal law, policies, and lessons learned from Hurricane 

Katrina. 

We acknowledge the cooperation and courtesies extended to the audit team during the course of this 

audit. We conducted this audit under the authority of the Inspector General Act of 1978, as 

amended, and according to generally accepted government auditing standards. 
Appendix B 

Management Comments 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 22 
Appendix B 

Management Comments 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 23 
Appendix B 

Management Comments 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 24 
Appendix B 

Management Comments 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 25 
Appendix B 

Management Comments 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 26 
Appendix B 

Management Comments 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 27 
Appendix B 

Management Comments 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 28 
Appendix B 

Management Comments 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 29 
Appendix B 

Management Comments 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 30 
Appendix B 

Management Comments 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 31 
Appendix B 

Management Comments 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 32 
Appendix B 

Management Comments 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 33 
Appendix B 

Management Comments 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 34 
Appendix B 

Management Comments 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 35 
Appendix C 

FEMA November 2004 System of Records Notice 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 36 
Appendix C 

FEMA November 2004 System of Records Notice 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 37 
Appendix C 

FEMA November 2004 System of Records Notice 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 38 
Appendix C 

FEMA November 2004 System of Records Notice 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 39 
Appendix D 

FEMA Guidance on Handling Law Enforcement Requests 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 40 
Appendix D 

FEMA Guidance on Handling Law Enforcement Requests 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 41 
Appendix E 

FEMA July 2006 System of Records Notice 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 42 
Appendix E 

FEMA July 2006 System of Records Notice 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 43 
Appendix E 

FEMA July 2006 System of Records Notice 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 44 
Appendix E 

FEMA July 2006 System of Records Notice 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 45 
Appendix F 

Major Contributors to this Report 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 46 

Norman Brown, Supervisory Program Analyst, Department of Homeland 

Security, Office of Disaster Assistance Oversight 

Devin Polster, Audit Manager, Department of Homeland Security, Office of 

Disaster Assistance Oversight 

John Meenan, Senior Auditor, Department of Homeland Security, Office of 

Disaster Assistance Oversight 
Appendix G 

Report Distribution 

Improvements to Information Sharing are Needed to Facilitate Law 

Enforcement Efforts During Disasters 

 Page 47 

Department of Homeland Security

Secretary 

Deputy Secretary 

Chief of Staff 

Deputy Chief of Staff 

General Counsel 

Executive Secretary 

Assistant Secretary for Public Affairs 

Assistant Secretary for Policy 

Assistant Secretary for Legislative and Governmental Affairs 

Administrator, FEMA 

Undersecretary for Management 

Chief Privacy Officer 

Chief Information Officer 

Chief Security Officer 

Chief Information Security Officer 

DHS OIG Liaison 

FEMA Audit Liaison 

Chief Privacy Officer 

Department of Justice

Deputy Attorney General 

Office of Management and Budget

Chief, Homeland Security Branch 

DHS OIG Budget Examiner 

Congress

Congressional Oversight and Appropriations Committees, as appropriate
Additional Information and Copies 

To obtain additional copies of this report, call the Office of Inspector General 

(OIG) at (202) 254-4199, fax your request to (202) 254-4305, or visit the OIG 

web site at www.dhs.gov/oig. 

OIG Hotline 

To report alleged fraud, waste, abuse or mismanagement, or any other kind of 

criminal or noncriminal misconduct relative to department programs or 

operations: 

• Call our Hotline at 1-800-323-8603; 

• Fax the complaint directly to us at (202) 254-4292; 

• Email us at DHSOIGHOTLINE@dhs.gov; or 

• Write to us at: 

DHS Office of Inspector General/MAIL STOP 2600, Attention: 

Office of Investigations - Hotline, 245 Murray Drive, SW, 

Building 410, Washington, DC 20528.