David L. Carter, Ph.D.

School of Criminal Justice

Michigan State University

Law Enforcement Intelligence:

A Guide for State, Local, and Tribal Law Enforcement Agencies

This project was supported by Cooperative Agreement #2003-CK-WX-0455 by the U.S. Department of Justice

Office of Community Oriented Policing Services. Points of view or opinions contained in this document are

those of the author and do not necessarily represent the official position or policies of the U.S. Department of

Justice or Michigan State University. 

November 2004

David L. Carter, Ph.D.

Preface iii

intelligence function. Rather than being a manual to teach a person how to

be an intelligence analyst, it is directed toward that manager, supervisor, or

officer who is assigned to create an intelligence function. It is intended to

provide ideas, definitions, concepts, policies, and resources. It is a primera place to start on a new managerial journey.

Every effort was made to incorporate the state of the art in law

enforcement intelligence: Intelligence-Led Policing, the National Criminal

Intelligence Sharing Plan, the FBI Intelligence Program, the array of new

intelligence activities occurring in the Department of Homeland Security,

community policing, and various other significant developments in the

reengineered arena of intelligence.

A number of groups have provided important leadership in this field and

afforded me opportunities to learn from their initiatives and experiences.

These include the Global Intelligence Working Group (GIWG), Major City
iv Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

research needed for this project. My thanks also go to my COPS Project

Monitor Michael Seelman who provided support and facilitation to get the

project completed. Finally, I thank my wife Karen, and children Hilary,

Jeremy, and Lauren who put up with the time I worked on this and other

projects – you are always in my thoughts.

David L. Carter, Ph.D.

Michigan State University
with regard to intelligence records systems (as per 28 CFR, Part 23) and

liability issues.

Definitions and Perspective

At the outset, this guide defines and illustrates law enforcement

intelligence with respect to its current application to SLTLE. Because of

different jurisdictional responsibilities, federal law enforcement agencies

use slightly different definitions. These differences are explained and

illustrated to enhance information sharing and ensure clear

communications between federal and nonfederal law enforcement.

Because of global terrorism, the presence of SLTLE officers on Joint

Terrorism Task Forces (JTTF) and a more integrated role between the FBI

and SLTLE, discussion is provided on the meaning and implications of

national security intelligence as it relates to nonfederal law enforcement. 

Executive Summary v

agencies. 
Based on the foundation that has been built, the guide explains current

accepted practice of turning "information" into "intelligence." The

intelligence cycle and analytic process are explained in summary form to

provide the reader with an understanding of the processes. It is important

for executives and managers to understand the language and protocols to

effectively communicate with analysts and manage the intelligence

function.

A discussion of information technology provides some insights into

software requirements, networking issues, resources, security issues, and

the dynamics associated with open-source information and intelligence.

This is followed by a discussion of intelligence products, the different types

of intelligence analysis, and how these products are used for both

operations and management. Finally, dissemination or information sharingis discussed, particularly in light of the National Criminal Intelligence

Sharing Plan. 

vi Law Enforcement Intelligence: A Guide for State, Local and Tribal Law Enforcement Agencies
the recommendations of the National Criminal Intelligence Sharing Plan.

Networks and Systems

In today's digital world, the heart of effective information sharing is an

understanding of the various communications networks available to law

enforcement – some are evolving as this is written. The guide presents

information about critical secure networks and how law enforcement

officers can gain access to the networks. An important recommendation is

that all law enforcement agencies should have access to a secure

communications system that is based on Internet protocols (IP).

Intelligence products and advisories from federal agencies- the FBI and

Department of Homeland Security (DHS) in particular – essentially rely on a

secure IP system. The issues and processes are discussed in detail.

Executive Summary vii
py 

Unclassified (SBU) designation, the FBI Law Enforcement Sensitive (LES)

designation, and the DHS For Official Use Only (FOUO) designation.

Building on the classification and information security issues, the guide

discusses and illustrates the FBI Office of Intelligence products, FBI

counterterrorism programs, and multi-agency initiatives–specifically the

Terrorism Threat Integration Center (TTIC) and the Terrorist Screening

Center (TSC). Equally prominent in the discussion are the intelligence

products and advisories produced by the DHS. The FBI and DHS have

established a productive working relationship on intelligence matters,

embracing the need to be inclusive with state, local, and tribal law

enforcement agencies for two-way information sharing.

Intelligence products and services as well as contact information also are

provided for the Drug Enforcement Administration (DEA), El Paso

viii Law Enforcement Intelligence: A Guide for State, Local and Tribal Law Enforcement Agencies
contemporary, informative,

prescriptive, and resource

rich.

Executive Summary ix
x Law Enforcement Intelligence: A Guide for State, Local and Tribal Law Enforcement Agencies

and information exchange, as well as integration and streamlining the

use of Law Enforcement Online (LEO), Regional Information Sharing

Systems' RISS.net, and creation of the Anti-Terrorism Information

Exchange (ATIX).

• New operational expectations and training opportunities for intelligence

analysts, law enforcement executives, managers, and line officers.
Executive Summary xi

Terrorism Task Forces.

• Broader scrutiny of intelligence records and practices by civil rights

groups.

• Routinely use intelligence to make better tactical and strategic decisions.

• Increase regionalization in all aspects of the intelligence function as an

ongoing initiative of law enforcement agencies at all levels of

government.

• Ensure that non-law enforcement government officials and the

community understand what law enforcement intelligence is and the

importance of their role in the intelligence function.

COMMUNITY POLICING AND LAW ENFORCEMENT INTELLIGENCE 37

Intelligence-Led Policing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .41

Ethical Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .43

The Similarity to CompStat . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .43

The Flow of Illicit Commodities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .45

Public Education . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .46

Civil Rights Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .48

Community Members as Law Enforcement Volunteers . . . . . . . . . . . . . . . . . . . . .50

CONCLUSION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .51

CHAPTER 5: THE INTELLIGENCE PROCESS 55

The Intelligence Cycle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .63

INFORMATION MANAGEMENT AND INTELLIGENCE PROCESSES . . . . . . . . . . . . . . .64

Software to Aid the Intelligence Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .66

Information Technology Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .67

Information Technology Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .70

Open-Source Information and Intelligence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .70

CONCLUSION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .74

Table of Contents xiii
xiv Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

The Intelligence Analyst . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .110

TRAINING . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .111

Categories of Currently Available Intelligence Training Programs . . . . . . . . . . .115

Federal Bureau of Investigation College of Analytic Studies . . . . . . . . . . . . . . .115

Drug Enforcement Administration (DEA) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .116

Federal Law Enforcement Training Center (FLETC) . . . . . . . . . . . . . . . . . . . . . . . .116

General Counterdrug Intelligence Plan (GCIP) . . . . . . . . . . . . . . . . . . . . . . . . . . .118

IALEIA Foundations of Intelligence Analysis Training (FIAT) . . . . . . . . . . . . . . . .118

Other Programs and Training Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .118

INTELLIGENCE COURSES IN HIGHER EDUCATION . . . . . . . . . . . . . . . . . . . . . . . . . . .119

CONCLUSION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .121

CHAPTER 9: NETWORKS AND SYSTEMS 123

Regional Information Sharing System (RISS) . . . . . . . . . . . . . . . . . . . . . . . . . . . .126

Anti-Terrorism Information Exchange (ATIX) . . . . . . . . . . . . . . . . . . . . . . . . . . . . .128

Law Enforcement Online (LEO) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .130

Law Enforcement Intelligence Unit (LEIU) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .132

Information Sharing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .133
Specialized Counterterrorism Units . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .169

FBI Information Sharing and Operational Coordination Initiatives . . . . . . . . . . .170

Terrorism Threat Integration Center (TTIC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .170

Terrorist Screening Center . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .171

Consolidated Terrorist Screening Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . .172

Department of Homeland Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .173

Intelligence Analysis and Alerts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .173

Critical Infrastructure Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .174

Cyber Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .174

Indications and Warning Advisories . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .175

Drug Enforcement Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .180

Intelligence Products . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .181

El Paso Intelligence Center (EPIC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .182

National Drug Pointer Index (NDPIX) and National Virtual 

Pointer System (NVPS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .183

National Drug Intelligence Center (NDIC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .185

Intelligence Products . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .186

Table of Contents xv
Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

xvi
xvii

8-1 Intelligence Training Categories and Descriptions ......................................................114

9-1 Anti-Terrorism Information Exchange (ATIX) Welcome Screen ................................130

9-2 System Integration – HSIN Operations and Intelligence Integration .......................136

9-3 INTERPOL Notices..............................................................................................................139

9-4 Law Enforcement Intelligence Network (Iowa) ............................................................141

9-5 Georgia Information Sharing and Analysis Center.......................................................142

10-1 Traditional Collection vs. Requirements-Based Collection .........................................149

10-2 Threat Assessment Model for SLTLE ..............................................................................151

10-3 Intelligence Information Needs Template......................................................................154

10-4 "Baseline" Intelligence Information Needs Template...................................................155

11-1 DHS and Intelligence and Threat Assessment Processes .........................................176

11-2 DHS Operations Morning Brief ........................................................................................176

11-3 DHS Information Bulletin...................................................................................................177

11-4 DHS Physical Advisory ......................................................................................................178

11-5 DHS Cyber Advisory...........................................................................................................179

List of Figures

1

Introduction
CHAPTER O
Every law enforcement agency in the United States,

regardless of agency size, must have the capacity to

understand the implications of information collection, analysis,

and intelligence sharing. Each agency must have an

organized mechanism to receive and manage intelligence as

well as a mechanism to report and share critical information

with other law enforcement agencies. In addition, it is

essential that law enforcement agencies develop lines of

communication and information-sharing protocols with the

private sector, particularly those related to the critical

infrastructure, as well as with those private entities that are

potential targets of terrorists and criminal enterprises.

1
2 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

principles of intelligence discussed in this document apply beyond

terrorism and include organized crime and entrepreneurial crime of all

forms. Drug trafficking and the associated crime of money laundering, for

example, continue to be a significant challenge for law enforcement.

Transnational computer crime, particularly Internet fraud, identity theft

cartels, and global black marketeering of stolen and counterfeit goods, are

entrepreneurial crime problems that are increasingly being relegated to

SLTLE agencies to investigate simply because of the volume of criminal

incidents. Similarly, local law enforcement is being increasingly drawn into

human trafficking and illegal immigration enterprises and the oftenassociated crimes related to counterfeiting of official documents, such as

passports, visas, driver's licenses, Social Security cards, and credit cards.

Even the trafficking of arts and antiquities has increased, often bringing a

new profile of criminal into the realm of entrepreneurial crime. All require

an intelligence capacity for SLTLE, as does the continuation of historical

organized crime activities such as auto theft, cargo theft, and virtually any

other scheme that can produce profit for an organized criminal entity.
3

through the use of different organizational models. Related executive

decisions focus on staffing, particularly when there are fiscal limitations.

What kinds of information does the law enforcement agency need (e.g.,

intelligence requirements) from the federal government to most effectively

counter terrorism? How are those needs determined? How is the

information requested? When and in what form will the information be

received? Will a security clearance be needed to review the information

that an executive requests? These are critical questions of a police

executive.

From a policy and process perspective, what is meant by intelligence

sharing? What information can be collected? What information can be

kept in files? How long may it be kept in files? When does a person

Introduction

hard-won community policing RELATIONSHIPS.
4 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

• Committing resources, time, and energy from an agency to the

intelligence function

• Embracing and using contemporary technology, including electronic

access to information and an electronic communications capability

through a secure connection

• Having proactive people using creative thought to identify "what we don't

know" about terrorism and international organized crime

• Requiring a law enforcement agency to think globally and act locally

• Patience.
2

Enforcement Intelligence: 

Concept and Definition
CHAPTER T
7

In the purest sense, intelligence is the product of an analytic

process that evaluates information collected from diverse

sources, integrates the relevant information into a cohesive

package, and produces a conclusion or estimate about a

criminal phenomenon by using the scientific approach to

problem solving (i.e., analysis). Intelligence, therefore, is a

synergistic product intended to provide meaningful and

trustworthy direction to law enforcement decision makers

about complex criminality, criminal enterprises, criminal

extremists, and terrorists.
8 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

ppy

Moreover, there may be a compelling community safety reason to keep an

enquiry open to identify other criminal offenders – notably leaders – and

weapons that may be used.

Because of this broader role, the need to keep information secure and the

necessity of keeping records on individuals for whom evidence of criminal

involvement is uncertain or tangential,3

rigid guidelines must be followed.

These guidelines are designed to protect the constitutional rights of

citizens while at the same time permitting law enforcement agencies to

proceed with an inquiry for purposes of community safety. The guidelines

are also designed to facilitate accurate and secure information sharing

between law enforcement agencies because the nature of terrorism and

criminal enterprise threats are inherently multijurisdictional. Further, if law

enforcement agencies at all strata of government subscribe to the same

guidelines, information sharing can be more widespread because there is

surety that regardless of with whom the information is shared, the security

and integrity of the records will remain intact.

2 "Information collection" in the

context of law enforcement

intelligence is the capture of

information based on a

reasonable suspicion of

criminal involvement for use

in developing criminal cases,

identifying crime trends, and

protecting the community by

means of intervention,

apprehension, and/or target

hardening.

3 This includes information that

would be in the intelligence

"Temporary File" as well as

"Non-Criminal Identifying

Information" as defined in 28

CFR Part 23.
9

improperly. Too often, intelligence is erroneously viewed as pieces of

information about people, places, or events that can be used to provide

insight about criminality or crime threats. It is further complicated by the

failure to distinguish between law enforcement intelligence and national

security intelligence. 

Pieces of information gathered from diverse sources, for example,

wiretaps, informants, banking records, or surveillance (see Figure 1-1), are

simply raw data which frequently have limited inherent meaning.

Intelligence is when a wide array of raw information is assessed for validity

Understanding Contemporary Law Enforcement Intelligence: Concept and Definition

Law enforcement intelligence, therefore, is the PRODUCT of an

analytic process that provides an INTEGRATED PERSPECTIVE to

disparate information about crime, crime trends, crime and security

threats, and conditions associated with criminality.”5
10 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

Often “information sharing” and “intelligence sharing” are used

interchangeably by persons who do not understand the subtleties, yet

importance, of the distinction. In the strictest sense, care should be taken

to use terms appropriately because, as will be seen in later discussions,

there are different regulatory and legal implications for “intelligence” than

for “information” (see Figure 1-2). As such, the subtleties of language can

become an important factor should the management of a law enforcement

agency's intelligence records come under scrutiny.
11

State and local law enforcement have consistently defined law

enforcement intelligence as containing the critical element of “analysis”

before any information can be characterized as “intelligence.” For

example, the Intelligence-Led Policing report funded by the Office of

Community Oriented Policing Services observes that:

...intelligence is the combination of credible information with

quality analysis–information that has been evaluated and from

which conclusions have been drawn.6

Similarly, the Global Intelligence Working Group, a project funded by the

Office of Justice Programs and is part of the Global Information Sharing

Initiative, discusses law enforcement intelligence by observing:

...the collection and analysis of information to produce an

intelligence end product designed to inform law enforcement

decision making at both the tactical and strategic levels.7

Understanding Contemporary Law Enforcement Intelligence: Concept and Definition

7 Global Intelligence Working

Group. (2003). National

Criminal Intelligence Sharing

Plan. Washington, DC:

Office of Justice Programs, 

p. 6.
12 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

ppgpp

efficacy and protection from liability on all aspects of law enforcement

duties. With respect to intelligence, CALEA's standards note:

Certain essential activities should be accomplished by an

intelligence function, to include a procedure that permits the

continuous flow of raw data into a central point from all sources; a

secure records system in which evaluated data are properly

cross-referenced to reflect relationships and to ensure complete

and rapid retrieval; a system of analysis capable of developing

intelligence from both the records system and other data sources;

and a system for dissemination of information to appropriate

components.11

It is clear not only from these discussions, but also from the legacy of law

enforcement intelligence of various national commissions examining

intelligence activities at the state and local level, that a common thread is

that information must be analyzed before it is classified as intelligence.”

Government Coordination

and Preparedness.

10 Office of Domestic

Preparedness. (2003). 

The Office of Domestic

Preparedness Guidelines for

Homeland Security.

Washington, DC: U.S.

Department of Homeland

Security. p.27.

11 Commission on Accreditation

of Law Enforcement

Agencies. (2002). Standards

for Law Enforcement

Accreditation. “Standard

51.1.1 - Criminal Intelligence.”

Washington, DC: CALEA.
13

qyppp

executives need to be aware of the different roles and the different context

when interpreting information. These differences are not in conflict, rather

they exist to support the different missions and responsibilities of agencies

at all levels of government. Similarly, the need for a different approach to

the “intelligence cycle” exists more for the FBI than for state, local, and

tribal law enforcement (SLTLE) because of different intelligence demands

(described in Chapter 5).

Understanding Contemporary Law Enforcement Intelligence: Concept and Definition

14 Robert Casey, Deputy

Assistant Director, FBI Office

of Intelligence. Personal

correspondence July 17,

2004.

...a COMMON THREAD is that analysis must be performed on

information before it is CLASSIFIED AS “INTELLIGENCE.”
14 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

NSI embodies both policy intelligence and military intelligence. Policy

intelligence is concerned with threatening actions and activities of entities

hostile to the U.S., while military intelligence focuses on hostile entities,

weapons systems, warfare capabilities, and order of battle. Since the fall

of the Soviet Union and the rise of threats from terrorist groups, both policy

and military intelligence have evolved to grapple with the character of new

threats. The organizations responsible for NSI are collectively known as

the Intelligence Community (IC) (see Figure 1-3).16

As seen in the definition and descriptions of NSI, there is no jurisdictional

concern for crime. As a result, constitutional restrictions that attach to

criminal cases that law enforcement faces on information collection,

records retention, and use of information in a raw capacity do not apply to

IC responsibilities where there is no criminal investigation.
15

details and background information. Nonetheless, it is a “slippery slope”

for SLTLE officers to rely on this information for a criminal investigation

because there is a strong likelihood that the methods of collecting the NSI

would not meet constitutional muster in a criminal trial. Even if it appeared

that constitutional standards may be met, there are other potential

problems of using the information in a criminal enquiry. Since the accused

in a criminal proceeding has the right to be confronted by his or her

accusers, the exercise of this right could compromise sensitive sources

and methods. While the Classified Information Procedures Act (CIPA)

provides a mechanism to deal with the process, some find that it is

cumbersome and may result in greater complications than would otherwise

be necessary.18

The next issue deals with constitutional law. If the information was

collected via NSI sources in a manner inconsistent with the Constitution, it

is likely, based on the “Fruits of the Poisonous Tree Doctrine,” that any

subsequent evidence developed during the course of that investigation

Understanding Contemporary Law Enforcement Intelligence: Concept and Definition

that position. I agree with the

9/11 Commission that

America needs a single

official to coordinate the

foreign and domestic activities

of the intelligence community

with authority over personnel

budgeting and policy. I am

working with members of

Congress to create this

position. And while we act,

the Director of Central

Intelligence will play an

expanded role.”

www.whitehouse.gov/news/rel

eases/2004/08/20040828.html 

18 The author has elected not to

discuss CIPA in any detail

because it deals with federal

investigations rather than

state, local, and tribal criminal

investigations. For the

person interested in further

exploring CIPA, see 

www.usdoj.gov/usao/eousa/foi

a_reading_room/usam/title9/c

rm02054.htm. 
16 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

Intelligence, and the U.S. Attorney General Guidelines, the FBI is the lead

agency in domestic intelligence collection. It is important that SLTLE

understand the distinction between the FBI's authority to both collect and

produce intelligence within the territory of the United States and the

authority of the Central Intelligence Agency (CIA), National Security

Agency (NSA), and other intelligence community members to collect in

foreign territories.20 The Department of Homeland Security can produce

intelligence as a result of analysis for dissemination to SLTLE. U.S. foreign

intelligence agencies, however, are prohibited from working with state and

local law enforcement in a manner that could be interpreted as “tasking

intelligence collection.” As a result, SLTLE should rely on their relationship

with the FBI in matters of intelligence collection in the territory of the U.S.,

including where those matters involve international terrorism activity.

Bivens v. Six Unknown

Agents 403 US 388 (1971) –

it would be difficult,

particularly under the

conditions of

counterterrorism.

20 The Coast Guard of the

Department of Homeland

Security is the only other IC

member authorized to collect

intelligence in U.S. territory.
17

y g 

timely fashion. The important point is that the consumer simply needs to

know the different definitions and the different context. With this

knowledge, information can be interpreted and used most effectively.

Chapter 2 also addressed the meaning of NSI and the complications it

conceivably can pose for SLTLE agencies. Once again, it is important to

understand the issues and parameters of each type of intelligence. The

proverbial bottom line is that understanding the definitions and their

application is an essential foundation for the remaining topics discussed

throughout the guide.

Understanding Contemporary Law Enforcement Intelligence: Concept and Definition

3

Intelligence: Past Practice and

Recommendations for Change
CHAPTER TH
21

Controversies have surrounded law enforcement intelligence

because of past instances where the police maintained records of

citizens' activities that were viewed as suspicious or anti-American,

even though no crimes were being committed. This, of course,

violates fundamental constitutional guarantees and offends the

American sense of fairness with respect to government

intrusiveness. Unfortunately, the boundary is not precise regarding

the types of information the police can collect and keep. Some

legal guidelines appear contradictory and the application of law to

factual situations is often difficult. Beyond the legal ramifications,

early intelligence initiatives by the police typically lacked focus,

purpose, and process. Important lessons can be learned from

these historical experiences that provide context and guidance for

law enforcement intelligence today.
22 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

Machine Gun Kelly, Al Capone – were the typical kinds of persons about

whom police agencies kept dossiers.

During the depression of the 1930s, little was done in the law enforcement

intelligence arena. Other priorities were simply higher; the pervasive threat

to the country was the economy, not criminality. Circumstances began to

change in the latter part of the decade as Communism – or the “Red

Scare” – became predominant. The police relied on the only system they

had used: the dossier.

In 1937, U.S. Representative Martin Dies (D-Texas) became the first

chairman of the House Committee on Un-American Activities. Dies, a

supporter of the Ku Klux Klan, fueled the fire of concern about Communism

in the United States, including labeling people as Communists that often

resulted in their loss of jobs and functional displacement from society.

Concern about Communism was pervasive, but was of secondary interest
23

Responding to expressions of public and governmental concern, local law

enforcement agencies began creating intelligence dossiers on persons

who were suspected Communists and Communist sympathizers, these

often became known as “Red Files.” Thus, police agencies were keeping

records about people who were expressing political beliefs and people

who were known to sympathize with these individuals. The fact that these

people were exercising their constitutional rights and had not committed

crimes was not considered an issue because it was felt that the presence

of and support for Communism within the nation was a threat to the

national security of the United States.21

The dossier system had become an accepted tool for law enforcement

intelligence; hence, when new over-arching challenges emerged, it was

natural for law enforcement to rely on this well-established mechanism for

keeping information. In the 1960s law enforcement met two challenges

where intelligence dossiers appeared to be an important tool: the Civil

A Brief History of Law Enforcement Intelligence: Past Practice and Recommendations for Change
24 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

prosecution. There is little doubt that law enforcement was creating and

keeping these dossiers with good faith to protect the community from

activities then viewed as threats; however, that faith does not mitigate

unconstitutional practices.

There was additional concern during this time because of the activist

nature of the U.S. Supreme Court during the era of Chief Justice Earl

Warren (1953 – 1969). Many of the liberal decisions of the Warren Court

were met with disfavor and the often-expressed belief that the Court's

decisions22 were “handcuffing the police.” With regard to the current

discussion, perhaps most important was that the Warren Court led a

generation of judicial activism and expanded interpretations of the

Constitution. Moreover, it symbolically motivated activist attorneys from

the 1960s to try new strategies for the protection of constitutional rights.

Among the most successful was reliance on a little-used provision of the

Civil Rights Act of 1871, codified as Title 42 of the U.S. Code, Section 1983,

Civil Action for Deprivation of Civil Rights.

states; Gideon v. Wainwright -

right to appointed counsel;

and Escobedo v. Illinois - right

to counsel when the process

shifts from investigatory to

accusatory.
25

Initial lawsuits focused on various patterns of police misconduct; for

example, excessive force and due process violations. The reach of

lawsuits against law enforcement grew more broadly with decisions

holding that the police chain of command could be held vicariously liable

for the actions of those under their command. Moving into the late 1960s

and early 1970s, this movement of lawsuits reached toward law

enforcement intelligence units. It was increasingly discovered that police

agencies were keeping intelligence files on people for whom there was no

evidence of criminality. The practice of keeping intelligence dossiers on a

contingency basis was found to be improper, serving no compelling state

interest and depriving those citizens of their constitutional rights. As a

result, the courts repeatedly ordered intelligence files to be purged from

police records and in many cases police agencies had to pay damage

awards to plaintiffs. The decisions also permitted citizens to gain access

to their own records. Many activists publicized their intelligence files as a

badge of honor, often to the embarrassment of the police.24 Law

enforcement intelligence operations were cut back significantly or

A Brief History of Law Enforcement Intelligence: Past Practice and Recommendations for Change

event such as a movie or the

theater. The citizen would

then pose a rhetorical

question, “Is this how you

want your tax dollars spent?”
26 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

After World War II, the major focus of the Intelligence Community(IC) was

to direct intelligence activities at the Soviet Union to prevent the perceived

threat of Soviet world domination.28 Accordingly, the congressional

commissions in charge of investigating the IC's operations at this time

were largely concerned with the IC's efficiency in conducting such

activities. The main focus of these investigations was to recommend ways

to improve the IC's structure, organization, and coordination. Indeed, most

of the recommendations made by the committees addressed deficiencies

in coordination and organization.29 Three specific commission

investigations made recommendations that were particularly relevant to

law enforcement intelligence. 

In 1948, the Hoover Commission recommended developing better working

relationships between the Central Intelligence Agency (CIA) and the rest of

the IC. The commission had found a lack of coordination within the IC and

of a lack of information sharing which led to redundant intelligence

activities. In 1949, the Dulles Report recommended that the CIA provide

Church Commission.

27 For an explanation of the

Intelligence Community and

those departments and

agencies that are current

members see,

www.intelligence.gov/. 

28 R. Best. & H.A. Boerstling.

(1996). The intelligence

community in the 21st

century. House of

Representatives 104

Congress: Permanent Select

Committee on Intelligence.

www.access.gpo.gov/congres

s/house/intel/ic21/ic21018

.html

29 Ibid
27

committees inquiries toward what is now referred to as the era of public

investigations.

Intelligence Recommendations in the

Era of Public Investigations

During this era, investigations of the IC moved away from assessing the

efficiency of intelligence operations and toward assessing the legality and

the appropriateness of the actual operations conducted. As will be seen,

the recommendations made by three congressional committees would

result in major changes in both the jurisdiction and roles of IC members

with respect to law enforcement and national security intelligence. This

would lead to the separation of the two types of intelligence activities, the

so-called “wall between domestic and international intelligence.”

A Brief History of Law Enforcement Intelligence: Past Practice and Recommendations for Change
28 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

The Church Committee, an inquiry formed by the Senate in 1976, examined

the conduct of the IC in a broader fashion than did the Rockefeller

Commission.31 The recommendations made by this inquiry led to

jurisdictional reformations of the IC. Most of the recommendations were

directed at developing new operational boundaries for the FBI and CIA.

Out of the committee's 183 recommendations, the following illustrate how

law enforcement intelligence was separated from national security

intelligence:32

• The committee recommended that agencies such as the NSA, CIA, and

military branches not have the power to conduct domestic intelligence

operations (i.e., law enforcement intelligence functions). Specific

31 L. Johnson. (1985). A season

of inquiry: The Senate

intelligence investigation.

Lexington, KY: The University

Press of Kentucky. 

32 For a complete review of the

recommendations made by

the Church committee visit

www.derechos.net/paulwolf/c

ointelpro/churchfinalreportIId.

htm or for a more complete

review of the formation of the

Church committee see note

14. 

DID NOT MEAN that the AGENCIES SHOULD STOP

WORKING with each other.
29

agencies and within each agency.

Recommendations to improve law

enforcement intelligence, however, have not been limited to the federal

level. Such recommendations have also been made for state and local law

enforcement agencies.

Law Enforcement Intelligence at the

State, Local, and Tribal Levels

One of the first recommendations to address local law enforcement

intelligence came from the Warren Commission's 1964 report on the

assassination of President John F. Kennedy. While the majority of the

commission's recommendations were directed at federal agencies, notably

the Secret Service and FBI, it also recommended that these agencies work

more closely with local law enforcement. Specifically, the commission

called for increased information sharing and stronger liaison between local

and federal agencies.36

A Brief History of Law Enforcement Intelligence: Past Practice and Recommendations for Change

www.derechos.net/paulwolf/c

ointelpro/churchfinalreportIId.

htm. [6 April 2004].

34 Ibid

35 For example, because of the

regulations - or at least the

interpretation of the

regulations - FBI agents

working within the Foreign

Counter Intelligence Division

(FCI) were often barred from

sharing information with

agents working on criminal

investigations.

36 The Warren Commission

Report. (2003). Report of the

president's commission on

the assassination of

President John F. Kennedy.

New York: Barnes and Noble,

Inc. [Originally published in

1964].
30 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

• Each state should develop a centralized law enforcement intelligence

function with the participation of each police agency within the state.39

• States should consider establishing regional intelligence networks

across contiguous states to enhance criminal information-sharing

processes.40

• Every local law enforcement agency should establish its own intelligence

function in accordance with its respective state's intelligence function.41

Intelligence Function Operations

• Each state and local intelligence function should provide support to

federal agencies.

• Operational policies and procedures should be developed for each local,

state, and regional intelligence function to ensure efficiency and

effectiveness.42

• Each agency should have a designated official who reports directly to

the chief and oversees all intelligence operations.

38 National Advisory

Commission on Criminal

Justice Standards and Goals.

(1973). Police. Washington

D.C.: U.S. Department of

Justice, Law Enforcement

Assistance Administration. 

39 Ibid

40 National Advisory

Commission on Criminal

Justice Standards and Goals.

(1976). Report of the task

force on organized crime.

Washington DC: U.S.

Department of Justice, Law

Enforcement Assistance

Administration.

41 Ibid

42 Ibid
31

still viewed the intelligence function as important to police agencies. As a

result, new critical assessments of the intelligence function resulted in

more recommendations to improve its operations. A primary limitation of

state and local intelligence units was their inability to move beyond the

collection of information to a systematic method of analyzing the collected

data. The solution, then, was to have “the analytical function...guide the

data collection [procedure]” rather than vice versa.46

Another limitation of law enforcement intelligence was that many police

executives either did not recognize the value of intelligence and/or did not

have the skills necessary to use intelligence products effectively.

Furthermore, intelligence personnel did not possess the analytic (and often

reporting) skills needed to produce meaningful intelligence products. The

need for training was considered an important solution to this problem.

Another issue was that intelligence units tended to be reactive in nature,

often viewed as a repository of sensitive information rather than a

A Brief History of Law Enforcement Intelligence: Past Practice and Recommendations for Change

Office.

46 Ibid
32 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

For example, the Commission on the Accreditation of Law Enforcement

Agencies (CALEA) has recommended that every agency with an

intelligence function establish procedures to ensure that data collection on

intelligence information is “limited to criminal conduct that relates to

activities that present a threat to the community” and to develop methods

“for purging out-of-date or incorrect information.”47 In other words, the

CALEA standard identified the need for law enforcement agencies to be

...the development of the INTELLIGENCE-LED POLICING

concept and the creation of the NATIONAL CRIMINAL

INTELLIGENCE SHARING PLAN have been important

milestones in the evolution of law enforcement intelligence.
33

of concern was the effectiveness of information sharing by the FBI with

state and local law enforcement. The commission's staff report stated, in

part:

We heard complaints that the FBI still needs to share much more

operational, case-related information. The NYPD's Deputy

Commissioner for Counterterrorism, Michael Sheehan, speculated

that one of the reasons for deficiencies in this information sharing

may be that the FBI does not always recognize what information

might be important to others. ... Los Angeles Police Department

officials complained to us that they receive watered-down reports

from the FBI. ... We have been told that the FBI plans to move

toward a “write to release” approach that would allow for more

immediate and broader dissemination of intelligence on an

unclassified basis.48

Both of these issues are being addressed through the National Criminal

A Brief History of Law Enforcement Intelligence: Past Practice and Recommendations for Change

http://www.9-

11commission.gov/hearings/h

earing10/staff_statement_12.

pdf. 
34 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

Community Oriented Policing

Services, Washington, DC

(June 22, 2004).

50 National Commission on

Terrorist Attacks Upon the

United States. (2004). The

9/11 Commission Report.

Washington, DC: U.S.

Government Printing Office,

p. 390. Also available in full

online at www.9-11

commission.gov/report/

911Report.pdf.

51 Ibid., p. 427.

agencies, stating the following:

There is a growing role for state and local law enforcement

agencies. They need more training and work with federal

agencies so that they can cooperate more effectively with those

authorities in identifying terrorist suspects.50

The commission went on to recognize that: 

The FBI is just a small fraction of the national law enforcement

community in the United States, a community comprised mainly of

state and local agencies. The network designed for sharing

information, and the work of the FBI through local Joint Terrorism

Task Forces, should build a reciprocal relationship in which state

and local agents understand what information they are looking for

and, in return, receive some of the information being developed
35

While we have evolved in our expertise and professionalism, many of the

same issues remain. What are the lessons learned from history?

• Building dossiers full of raw, diverse information provides little insight;

analysis is needed to give meaning to the information.

• The improper collection of information can have a negative impact on

our communities, including a “chilling effect” on the constitutional right

of freedom of speech.

• To be effective, intelligence units must be proactive, developing unique

products and disseminating the products to appropriate personnel on a

consistent and comprehensive basis.

• A clear distinction is needed between law enforcement intelligence and

national security intelligence. While there is information that can

support the goals of both forms of intelligence, the competing

methodologies and types of information that may be maintained in

A Brief History of Law Enforcement Intelligence: Past Practice and Recommendations for Change

54 Ibid.
36 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

unless that information is used only as noncriminal identifying

information and is labeled as such.

• A full-time law enforcement intelligence function should be organized

professionally and staffed with personnel who are specifically trained in

analysis and intelligence product preparation.

• There must clear lines of communications between the intelligence unit

and decision makers.

• Law enforcement intelligence units must be evaluated regularly to

ensure functional utility and operational propriety.

• Information sharing remains an important priority with few major

improvements since the original recommendations in the 1964 Warren

Commission.
4

Integration of Community Policing

and Law Enforcement Intelligence
CHAPTER F
39

A common concern expressed by police executives is that the

shift toward increased counterterrorism responsibilities may

require a shift of resources away from community policing.

Instead the question should be how community policing and

counterterrorism should be integrated. As will be seen, there are

more commonalities between the two than one may intuitively

expect. Indeed, new dimensions of law enforcement intelligence

and counterterrorism depend on strong community relationships.

Crime will continue to be a critical responsibility for the police as

will the need for community support. Moreover, with increased

social tension as a result of this terrorism environment, the need

is even greater to maintain a close, interactive dialogue between

law enforcement and the community.
40 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

other. It is time to maximize the potential for community-policing

efforts to serve as a gateway of locally based information to

prevent terrorism, and all other crimes.55

Furthermore, the Office of Domestic Preparedness (ODP) Guidelines for

Homeland Security describes the roles community policing has in the

intelligence process. These include the following:

COMMUNITY POLICING has DEVELOPED SKILLS in many 

LAW ENFORCEMENT OFFICERS that directly support new

COUNTERTERRORISM RESPONSIBILITIES.
41

organization. In many ways, ILP is a new dimension of community policing,

building on tactics and methodologies developed during years of

community policing experimentation. Some comparisons illustrate this

point. Both community policing and ILP rely on:

• Information Management

– Community policing - Information gained from citizens helps define the

parameters of community problems.

– ILP - Information input is the essential ingredient for intelligence

analysis.

• Two-way Communications with the Public

– Community policing - Information is sought from the public about

offenders. Communicating critical information to the public aids in

crime prevention and fear reduction.

– ILP - Communications from the public can provide valuable information

for the intelligence cycle. When threats are defined with specific

Intelligence-Led Policing: The Integration of Community Policing and Law Enforcement Intelligence
42 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

when called upon, as agents will be reaching out to many across

the nation to help gather information and intelligence ... to be

aware of your surroundings and report anything suspicious ... to

“BOLO” [Be On the LookOut] for those pictured above. ... Have

you seen them in your communities? Have you heard that

someone might be helping them to hide? Do you have any idea

where they might be? If so, we need you to come forward.58

These words reflect the operational essence of the interrelationship of law

enforcement intelligence and community policing. Like community policing,

ILP requires an investment of effort by all components of the organization

as well as the community. Gone are the days when intelligence units

operated in relative anonymity. Based on the precepts of the ILP

philosophy and the standards of the NCISP, law enforcement intelligence is

an organization-wide responsibility that relies on a symbiotic relationship

with residents.

58 http://www.fbi.gov/
43

Intelligence-Led Policing: The Integration of Community Policing and Law Enforcement Intelligence

Figure 4-1: Comparison of CompStat and Intelligence-Led Policing

CompStat Commonalities Intelligence-Led Policing

Correlated goals and methodologies make both concepts complement each other

• Multijurisdiction

• Threat driven

• Criminal enterprises

and terrorism

• Commodity flow;

trafficking and

transiting logistics

• Strategic

• Disrupt enterprises

• Drives Operations

– JTTF

– Organized Crime

Investigations

– Task Forces

• Analysis of enterprise

MOs

• Single jurisdiction

• Incident driven

• Street crime and

burglary

• Crime mapping

• Time sensitive (24-

hour feedback and

response)

• Disrupt crime series

(e.g., burglary ring)

• Drives operations:

– Patrol

– Tactical Unit

– Investigators

• Analysis of offender

MOs

• Each have a goal of

prevention

• Each require...

– Organizational

flexibility

– Consistent

information input

– A significant analytic

component

• “Bottom-up” driven with

respect to operational

needs
44 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

people that may signify a threat or suggest the presence of a criminal

enterprise. The patrol officer must be trained59 to regularly channel that

information to the intelligence unit for input into the intelligence cycle for

analysis. Like community policing, this requires new responsibilities for

patrol officers and organizational flexibility to permit officers to explore

new dimensions of crimes and community problems that traditionally have

not been part of a patrol officer's responsibilities.

Similarly, to be effective, both community policing and ILP require feedback

on information analysis – whether it is crime analysis or intelligence

analysis – to be consistently informed of potential problems or threats that

may be encountered during the course of their shift.

In this regard, what types of information do street officers need from the

intelligence unit? Ideally, intelligence analysis should address four broad

questions:60

the terrorists attacks of

September 11, 2001, the FBI

developed a series of

interview questions for

persons who may have

knowledge about terrorism.

State and local law

enforcement were asked to

participate in the questioning

of some persons who were in

the U.S. on visas. There was

a mixed response, largely

based on the perspective of

local government leaders.

Despite this, the questions

were also intended to provide

insight and information for

officers. More information as

well as the protocol questions

can be found in: General

Accounting Office. (2003).

Justice Department's Project

to Interview Aliens After

September 11, 2001. Report

Number GAO-03-459.

Available at: www.gao.gov/.
45

consumer demand. Terrorists also rely on trafficking in illegal commodities:

explosives, weapons, false identity credentials, and money to support

terrorists' networks and cells. Historical evidence demonstrates that once

regular commodity flow networks are established, they typically will be

consistent and change infrequently. While conventional wisdom may

suggest that changing transaction processes will minimize the probability

of detection, in practice it is often difficult to change transaction

methodologies. Moreover, it is a fundamental characteristic of human

behavior to perform tasks in a consistent manner. As a result, commodity

flow patterns provide an avenue of consistent behavior that may be

recognized as evidence of unlawful activity.

In many cases, there is evidence of illegal commodity transactions “on the

streets” where direct observations of suspicious behaviors may be made

by officers. In other cases, law enforcement may need to educate the

public on what to look for and seek community input on such observations.

Once again, this relies on a trusting relationship between law enforcement

Intelligence-Led Policing: The Integration of Community Policing and Law Enforcement Intelligence
46 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

constitute suspicious behavior, the public can be more aware. With this

greater awareness, citizens will not only know what to look for, but also

what to report to the law enforcement agency.

The success of this process relies on three elements:

• Effective intelligence analysis.

• Effective information dissemination to street officers.

• Trusting relationships and effective communications between law

enforcement and community members.

This is the essence of the integration of community policing and

intelligence analysis.

Public Education

As noted previously, public education is critical for effective ILP. The

lessons learned from community policing provides important insights. The
47

Different segments of the community may have different needs. For

example, since 85 percent of America's critical infrastructure is owned by

the private sector, a special public education program may focus on threatrelated issues for this narrowly defined community. Conversely, a

completely different kind of public education may be directed toward

graduates of the CPA who may be trained to work as volunteers during

crises or a heightened alert status. Yet a different public education agenda

would be directed toward a particular ethnic or religious community within

a city. Each segment of the community has a different goal. In this case,

the business sector to harden potential targets, the CPA graduates to aid

Intelligence-Led Policing: The Integration of Community Policing and Law Enforcement Intelligence

INFRASTRUCTURE is owned by the private sector, a special

public education program may focus on THREAT-RELATED

ISSUES for this narrowly defined community. 
48 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

• Know how to observe.

• Know what is suspicious.

• Know how to report.

• Know what to report.

• Know what happens next.

To maximize the quality and quantity of information provided by the

community, law enforcement must provide a framework of knowledge. The

more that law enforcement can educate the community, the more robust

the feedback from the community.63 In this regard, Figures 4-2 and 4-3

illustrate a range of items that may be incorporated into a public education

program from both a topical and an outcome perspective.

Civil Rights Issues

A reality that law enforcement must face on matters related to law

enforcement intelligence is discussion of citizens' civil rights. Different

mink research facility and

caused more than $2 million

in damages. On December

31, 1999, a fire in MSU's

Agricultural Hall caused

$700,000 in damages and

destroyed years of research.

Earth Liberation Front (ELF)

claimed responsibility,

targeting genetic research. 

62 The threat assessment and

intelligence requirements will

be discussed in a later

chapter.

63 Ideally, the law enforcement

agency would be able to

provide feedback to the

citizen about information that

was reported. Many times

this is not feasible in the

“intelligence environment”;

however, it serves as positive

reinforcement to the citizen

when feedback is provided.
49

groups of citizens – some more vocal than others – have expressed

concerns at the national level concerning the USA PATRIOT Act and at the

local level concerning the types of personal information that is being

collected and retained in files at the local law enforcement agency. As part

of a public education effort, law enforcement officers should be informed

about civil rights issues and the agency's policies and responses to those

issues. Among the more common concerns expressed are the types of

Intelligence-Led Policing: The Integration of Community Policing and Law Enforcement Intelligence

• Safety checklist

• Communications information

• What “awareness” means

• Explain the Alert System

• How to help children cope

with fear

• Safety issues

• Equipment and resource

checklist

• Understand the Homeland

Security Advisory System and

its effect

– Law enforcement must be prepared for

information sharing with public

• Be aware, yet be fair

• Be cognizant of threats, but avoid

stereotyping and hyperbole 

• Information on how to talk/deal with

children regarding terrorism

– http://www.ed.gov/admins/

lead/safety/ emergencyplan/index.html 

– http://www.fema.gov/kids/

– http://www.atf.gov/kids/index.htm
50 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

the citizen volunteers.)

Obviously, an agency needs to develop some means to screen volunteers

as well as provide structure for their work agreement and for

administrative controls when they are performing activities on behalf of the

law enforcement agency. In this regard, an important resource is

Volunteers in Police Service (VIPS).65 The VIPS website provides a wide

array of resources, documents, policies, and tips that can make a law

enforcement volunteer program functional and easy to manage.

Volunteers with unique occupational experience may be particularly

valuable to the intelligence function. An attorney, accountant, people with

EXPERIENCE has shown that community volunteers can save the

agency money as well as often provide UNIQUE EXPERTISE. 
51

The prudent executive will explore these avenues as part of a

comprehensive, community-wide homeland security strategy. Because of

the concern for terrorism and Islamic extremism, the need to embrace all

elements of the community becomes an even higher priority. As noted by

the Muslim Public Affairs Council: 

“Ultimately, U.S. counterterrorism efforts will require a partnership

between policymakers and the American Muslim community...”67

Services.

http://www.cops.usdoj.gov/mi

me/open.pdf?Item=1046. 

67 Muslim Public Affairs Council.

(2003). A Review of U.S.

Counterterrorism Policy:

American Muslim Critique

and Recommendations.

Washington, DC: Muslim

Public Affairs Council, p. 8.

Intelligence-Led Policing: The Integration of Community Policing and Law Enforcement Intelligence
52 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

scheduling for training, and placement of volunteers 

Training in all areas will be offered and some immediate assignments will be

given. Ongoing training will be offered to maintain readiness. Volunteers working

outside of the police facilities will work in pairs only.

Structure:

The four companies would be designed to work in clearly defined areas. 

• Company “A” (Aviation Detail) - Assigned to the Aviation Police, assignments

would include: 

1. Information dissemination to airport visitors through the Airport 

Ambassadors program 

2. Assist in getting housing and/or transportation for stranded passengers in

the event of a crisis or if closure of the airport 

• Company “B” (Homeland Security Supplemental Services) - Assigned to the

MET for immediate assignments in various areas within the department to

ensure continued services and provide for newly identified needs: 

1. Daylight perimeter patrol of city facilities 

2. Parking control and building access control for police and other city 

facilities 

3. Work special events ( i.e., New Year's Eve - work the barricades with 

officers providing information to citizens and reporting disturbances) 
Intelligence-Led Policing: The Integration of Community Policing and Law Enforcement Intelligence 53

pgg

8. Maintain a “message board” for missing persons 

9. Call the families of officers and other emergency workers at an incident 

scene with reassurance and information 

10. Call neighborhood groups to enlist assistance as needed and contact 

congregational groups who have agreed to open facilities as shelters in 

each area command 

11. Chaplains would respond to the scene and provide services as outlined in 

their volunteer protocol 

12. Should dispatch fail, volunteers to go to each fire station to take calls and 

relay messages to officers 

How do you apply?

You must be at least 18 years old and live or work in the Austin area. The Civil

Defense Battalion requires its personnel to meet some physical demands. They

are:

1. Vision and hearing corrected to normal range. 

2. Ability to stand for 2 or more hours at a time. 

3. Ability to lift at least 20 pounds. 
54 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies
5

The Intelligence Process
CHAPTER F
57

In defining intelligence, it was previously noted that the key

factor that transforms information to intelligence is analysis.

The British National Crime Squad, when referring to

intelligence, observed the following: 

The processing of reliable intelligence is the

cornerstone of successful law enforcement. Analysis

organizes and interprets the intelligence in a way that

significantly enhances its value and the possibility of

its success in combating organized crime. Analysis

identifies and predicts trends, patterns or problem

areas requiring action.69
58 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

often are treated as a support unit, when they can proactively guide many

investigative functions. In reality, a police intelligence unit may be placed

best organizationally within an operations unit or division. The direct line of

communication and the high degree of interaction required between

intelligence analysts and investigators provide a richer interchange of

information and ideas, thereby enhancing the quality of analysis.

Intelligence analysis starts at the most basic level – collecting information

about the crime triangle: the offender, victim/commodity, and location – just

intelligence. For further

information on this survey,

Local Law Enforcement Role

in Preventing and

Responding to Terrorism, see

the PERF report at

http://www.policeforum.org/leg

islative.html#terrorism.

INTELLIGENCE ANALYSIS starts at the most basic level –

COLLECTING INFORMATION ABOUT THE “CRIME TRIANGLE”

– just as in the case of PROBLEM ORIENTED POLICING.
59

As the body of assessed information accumulates, the intelligence analyst

asks two questions: 

1. What does this information mean?

2. Can I prove it?

The Intelligence Process
60 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

set of variables?

• Is there any pattern or evidence in the ATM withdrawals or any credit

card purchases to show additional travel (such as driving to a location),

specific or unique purchases, consistency in cash or credit transactions

(either consistent amounts or amounts always ending even, full dollars,

no change)?

After determining answers to these questions, the analyst may start

drawing conclusions for which additional information is needed: Can the

hypotheses be corroborated with other evidence? To corroborate the

hypotheses, the analyst may request surveillance of the target(s), conduct

an interview, or obtain information from a confidential informant. The

analyst must also be looking for evidence of motive (N.B.,71 motive helps

explain the criminality and provide guidance on where to seek additional

evidence), intent (N.B., to establish the mens rea or criminal intent) as well

as specific criminal transactions (N.B., to document the actus reus or

physical act of the crime).
61

The Intelligence Process

enterprise or the commodity

flow.

73 BOLO = Be On the Look Out.

Figure 5-2: Link Diagram Illustration
62 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

ensure that intelligence is proactively shared with the people who need the

information, both inside the organization and with external agencies. Too

many times, intelligence units act as a sponge, absorbing information from

diverse sources, but are reluctant to share what they have gathered and

learned. This gate-keeping practice is dysfunctional, wastes resources,

and contributes to the reluctance of field personnel to submit information.

Having stated that the information must be shared, there are some caveats

about disseminating law enforcement intelligence. First, care must be

taken to ensure security of the information so that an investigation will not

be compromised. While this is a real concern, some intelligence units

become overly cautious. Like most things in life, there must be a

reasonable balance. A second concern is that tactical and operational

intelligence is often accusatory, but not conclusive. The amount of

information in a developing case may strongly suggest a person's criminal

activity but not meet the standard of probable cause. As such, the

intelligence may be used for further inquiry, gathering more information to

either expand or conclude the investigation. However, if the intelligence
63

organizationally and operationally the most efficacious approach.

The Intelligence Cycle

This brief summary of analysis followed a process known as the

intelligence cycle (Figure 5-4). It is an ongoing process that seeks

continuous input so that every new piece of information which meets the

standards of rigor can be added to the evidentiary picture. As is evident,

this can be a labor-intensive process which requires eclectic knowledge

and strong analytic ability to be successful.

The fundamental point to draw from this discussion is that pieces of

information gathered through the collection process are not intelligence.

Rather, intelligence is the knowledge derived from the logical integration

and assessment of that information and is sufficiently robust to enable law

enforcement to draw conclusions related to a particular crime.

The Intelligence Process
64 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

yygp

Intelligence Cycle – information that is important for state, local, and tribal

law enforcement (SLTLE) personnel to understand to be effective

consumers of the FBI intelligence products and communicate effectively on

matters related to FBI intelligence operations.

INFORMATION MANAGEMENT AND

INTELLIGENCE PROCESSES74

Information is the currency of intelligence. In the era of digital

communications and networking, it is virtually impossible to deal with the

management and sharing of information without considering technological

implications. Technology and information transcend a number of

boundaries which are often blurred. Internet protocols (IP), for example,

are often critical for collecting, analyzing, and sharing information.

The sections that follow serve as a primer for information technology and

intelligence. Concepts, trends, resources, and issues are discussed to

provide familiarization to the manager.

components. Rather, the

references are illustrations to

supplement discussion of the

issues.
The Intelligence Process 65

process.

5. ANALYSIS AND PRODUCTION: Analysis and production is the converting of

raw information into intelligence. It includes integrating, evaluating, and

analyzing available data, and preparing intelligence products. The

information's reliability, validity, and relevance is evaluated and weighed.

The information is logically integrated, put in context, and used to produce

intelligence. This includes both “raw” and “finished” intelligence. Raw

intelligence is often referred to as “the dots”. ... “Finished” intelligence

reports “connect the dots” by putting information in context and drawing

conclusions about its implications.

6. DISSEMINATION: Dissemination...is the distribution of raw or finished

intelligence to the consumers whose needs initiated the intelligence

requirements. The FBI disseminates information in three standard products –

FBI Intelligence Information Reports, FBI Intelligence Bulletins, and FBI

Intelligence Assessments) described and illustrated in Chapter 11). FBI

intelligence customers make decisions – operational, strategic, and policy –

based on the information. These decisions may lead to the levying of more

requirements, thus continuing the FBI intelligence cycle.

From: FBI Office of Intelligence. The FBI Intelligence Cycle: Answering the

Questions.... A desk reference guide for FBI employees. (Pamphlet form).

(July 2004).
66 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

pen register can be entered and compared, complete with different

graphing options, to identify associations and trends. Virtually any kind

of data can be analyzed and converted to bar graphs, scatter plots, line

charts, area charts, radar graphs, surface charts, and other graphing

options to aid in data interpretation and presentation.

• Mapping Programs: Inexpensive mapping software, such as Microsoft

Streets and Maps, can be useful for both analysis and presentation of

intelligence data. The maps can be used for strategic intelligence

illustrations of any geographic-based variable of interest (e.g., people,

groups, meetings, commodity distribution, trafficking of contraband). In

addition, programs such as these have integrated databases which,

although typically limited in character, nonetheless provide sufficient

capability to include descriptive information about entries on the map.

(see Figure 5-6 as an illustration.)

• Statistical Programs: For strategic analysis, statistical software with a

graphic capability is very useful. Perhaps the best known, and most

powerful, is SPSS.78 To be most effective, the SPSS user must have a

sp?Item=512. See also,

SEARCH technical

assistance:

www.search.org/programs/tec

hnology/.

76 See the summary of

Information Technology

Initiatives of the U.S. Office of

Justice Programs at

http://it.ojp.gov/topic.jsp?topic

_id=85 as well as the

International Association of

Chiefs of Police Technology

Clearinghouse at

http://www.iacptechnology.org/. 

77 For examples of databases,

see

dir.yahoo.com/Computers_

and

Internet/software/databases/.

78 www.spss.com/
67

Investigative Analysis Software.79 As illustrated in Figure 5-7, the

software integrates a number of features that aid in the analysis of data.

For a law enforcement agency that is able to have an intelligence analyst

on staff, analytic software is an essential investment.

Information Technology Management

There are additional technology concerns beyond those of software

described above. The increasingly lower costs of networking technology,

the commonality of Internet Protocols for information sharing, the ability to

share not only text but also images, audio, and video, and the ease of

access to information contribute to the growth of law enforcement

intranets and extranets for secure information sharing. As agencies

develop these networks, two important elements must be kept in mind:

Security and compatibility.

With the pervasive presence of computer crime and unauthorized network

intrusions,80 it is essential to build exceptional security into any network.

The Intelligence Process
68 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

• Establishment of data security management policies.

Figure 5-7: Illustration of I2 Analysis Screens*

*Copyright © 2004 i2 Ltd. All Rights Reserved. The Visual Space, Capital Park, Fulbourn, Cambridge, CB1 5XH, UK
69

technological controls instituted to monitor the use and control of

restricted data related to remote storage media (e.g., disks, CDs, thumb

drives, etc.).

Following these procedures will not only protect intelligence records, they

will meet the data security standards of 28 CFR Part 23.

On the issue of compatibility, a report from the Global Justice Information

Sharing Initiative observed the following: 

During the past 30 years, the lack of standards for linking justice

information systems has been responsible for a substantial part of

the high costs involved with information exchange and has

contributed significantly to the associated difficulties of

exchanging information between justice agencies. Now that a

variety of organizations have acknowledged the importance of

The Intelligence Process

to recognize and accept any

credential previously

identified as trustworthy. For

example a LEO user could

pass seamlessly between

networks with a single signon once that user was

validated to the network. This

would enable network users

to integrate between

networks without the need to

sign on and off each of them

separately.
70 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

 SEARCH  The National Consortium for Justice Information and

Statistics85

• Crime Mapping Analysis Program86

• Crime Mapping and Problem Analysis Laboratory of the Police

Foundation87

• Office of Justice Program Information Technology Website.88

Open-Source Information and

Intelligence

Volumes of information have been written on open-source intelligence.89

The intent of the current discussion is to simply familiarize the law

enforcement manager with the open-source concept and its application to

a law enforcement agency.

Open-source information is any type of lawfully and ethically obtainable

information that describes persons, locations, groups, events, or trends.

National Law Enforcement

and Corrections Technology

Center. (2001). A Guide for

Applying Information

Technology to Law

Enforcement. Washington,

DC: Office of Science and

Technology, National Institute

of Justice (Available at:

http://www.nlectc.org/pdffiles/

infotechguide.pdf.)

84 http://www.nw3c.org/

85 http://www.search.org/

86 http://www.nlectc.org/

cmap/justnet.html

87 http://www.policefoundation.

org/docs/crime_mapping.html

88 http://it.ojp.gov/index.jsp

89 As one example, see

http://www.oss.net.
71

fee or a registration requirement 

• Search engines of Internet site contents.98

The main qualifier that classifies information as open source is that no

legal process or clandestine collection techniques are required to obtain

the data. While open-source data has existed for some time, networking

has increased its accessibility significantly. For example, if an analyst was

preparing a strategic intelligence report on trends in international

terrorism, the analyst may go to the websites of the U.S. Department of

State Counterterrorism Office,99 the FBI terrorism reports,100 and the Israeli

Defense Force terrorism statistics center101 to download the various reports

The Intelligence Process

government?kywd,

http://www.thecre.com/links/fe

dgov-links.html,

http://www.firstgov.gov/Topics/

Reference_Shelf.shtml and

http://www.firstgov.gov/Citizen

/Topics/PublicSafety.shtml. 

95 See http://www.fas.org. 

96 See http://www.lib.umich.edu

/govdocs-stats-pilot/ and

http://www.ojp.usdoj.gov/bjs/. 

97 See as an example

http://www.accudatalists.com/i

ndex1.cfm. 

98 Beyond the commonly used

Internet search engines such

as Google, Lycos, Yahoo, Ask

Jeeves, and others, a unique

web search site is

http://www.itools.com/. 

retained in an agency's INTELLIGENCE FILES.
72 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

Importantly, open-source information about individuals must still meet the

criminal predicate requirement to be retained in an agency's intelligence

files. The key is not the source of the information, but what is being

retained by a law enforcement agency about a person. Illustrations of

issues to consider include the following:

• What types of open-source information about a person should be kept on

file by the police concerning a “person of interest” who is not actually a

suspect?

• How aggressive should a police agency be in gaining open-source

information on people who expressly sympathize and/or support a

terrorist group as determined by statements on a web page, but do not

appear to be part of a terrorism act nor active in the group?

• How does a police agency justify keeping information on a person when

a suggestive link between the suspicious person and a terrorist group

has been found through open-source research, but not a confirmed link

site/homepage.asp?clr=1&sl=

EN&id=-8888&force=1

102 http://www.splcenter.org

103 http://www.stormfront.org/
73

Marketing data available through subscription from many companies and

even news searches – notably through the comprehensive databases of

Lexis-Nexis108 – can provide a surprising amount of detail about people

which, when analyzed, presents a detailed profile that may be useful in

varying aspects of an investigation. In addition, university libraries offer a

wide array of research and resource tools that are often available at no

cost.109

The fact that information is open source should not dissuade a law

enforcement officer or analyst from using it. Indeed, there is often very

high-quality, insightful evidence available from open sources. So much so,

that the 9/11 Commission, in its Final Report, recommended that a new

Open Source Agency be added to the U.S. intelligence structure.110 For

example, news services have global networks of sophisticated

communications and informants with trained staff to conduct research and

investigate virtually all issues that would be of interest to a consuming

The Intelligence Process

pesoas cottg, ad

committed, or was about to

commit a crime.

105 http://www.autotrack.com/

106 http://www.accurint.com

107 http://www.lexis-nexis.com/

risksolutions/lawenforcement/ 

108 http://www.lexis-nexis.com/

109 As an example, see

http://www.lib.msu.edu/harris2

3/crimjust/index.htm and

http://er.lib.msu.edu/. 

110 National Commission on

Terrorist Attacks Upon the

United States. (2004). The

9/11 Commission Report.

Washington, DC: U.S.

Government Printing Office,

p. 413. Also available in full

online at http://www.9-

11commission.gov/report/911

Report.pdf. 
74 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

CONCLUSION

This chapter familiarized the reader with terminology and concepts that

transform information to intelligence. Most law enforcement officers will

not be involved in the analytic process; however, understanding that

process provides important insights into understanding the kinds of

information an intelligence analyst needs and what kind of output can be

Police LEADERSHIP must ensure that intelligence is proactively

SHARED with the people who need the information–both inside

the ORGANIZATION and with EXTERNAL AGENCIES.
75

expected.

This led into a discussion of software and technology issues that may be

used in support of the SLTLE intelligence function. Needs will vary by

agency; hence, the discussion was a broad buffet of software and

technology tools from which a manager may begin making resource

decisions. Finally, transcending the line between analysis and technology,

open-source information and intelligence was discussed with respect to its

use, value, resources, and limitations.

The reader should take away from this chapter a thorough understanding

The Intelligence Process

6

Classifications, Products, and

Dissemination
CHAPTER S
79

A range of terms describe different types of law enforcement

intelligence. A brief discussion of these as they relate to state,

local, and tribal law enforcement (SLTLE) will provide some

context for the reader when these terms are encountered.
80 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

To accomplish its goals, intelligence and critical information need to be

placed in a report format that maximizes the consumption and use of the

information. The report should do the following:

1. Identify the targeted consumer of the information (patrol officers,

administrators, task force members, others).

2. Convey the critical information clearly.

3. Identify time parameters wherein the intelligence is actionable.

4. Provide recommendations for follow-up.111

Such products are a series of regularly produced intelligence reports that

have a specific format and type of message to convey. They are most

useful when each product has a specific purpose; is in a consistent, clear,

and aesthetic format; and contains all critical information the consumer

needs and no superfluous information. The types of products will vary by

the character of the agency (e.g., state/local, urban/rural, large/small) as
81

SLTLE often find a need to maintain information, in either raw or finished

form that can place them in a controversial position. For purposes of

community safety, law enforcement needs to maintain information on some

people and organizations for two reasons: (1) The have the potential to

commit crimes and (2) They pose a bona fide threat, although the

parameters of that threat are often difficult to specify. Their actions are

monitored and affiliations recorded to help prevent future crimes and/or

build a future criminal case. Inherently problematic is the idea of a future

crime: what is the rationale for keeping information on a person who has

not committed a crime, but might do so? Essentially, if there is a

compelling interest for community safety, an effective argument can be

made to maintain records on individuals who threaten that safety as long

as reasonable justification can be presented to show a relationship to

criminality.

In this type of intelligence there is no product, per se, but regularly

prepared and disseminated operational records on people and groups who

Law Enforcement Intelligence Classifications, Products and Dissemination
82 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

operational intelligence. In the wake of the terrorists attacks in New York,

Washington, and Pennsylvania, the U.S. Department of Justice began

identifying people who entered the United States under the grant of entry

afforded by various types of visas. Some were detained for several weeks

on civil immigration violations. Others were detained on grounds that they

had conspired with the terrorist, had materially assisted the terrorists, or

had knowledge of the terrorist's plans. In an effort to expand the

investigation, for both resolution of the September 11 attacks and to

prevent future attacks, the FBI began a systematic identification of specific

people who had entered the U.S. on a visa with the intent of interviewing

the visa holders.114 Evidence of knowledge about any aspect of the

terrorists' attacks was not a precursor for a person to be interviewed. 

Because of the potential for civil litigation and ethical concerns about the

propriety of these interviews, some police departments – beginning with

Portland and Corvallis, Oregon – declined to comply with the FBI's request

to assist in the interviews. It is probable that future conflicting interests

will emerge in the war on terror and the prudent police manager must

helped plan or commit

terrorism or anybody capable

of or willing to commit

terrorism.

...have sympathy for the

September 11 hijackers or

other terrorists and the

causes they support.

...have heard of anybody

recruiting people to carry out

terrorism against the United

States, or if anyone has tried

to recruit them.

...know anyone who has

received financing or training

for terror activities.

...are willing to provide

information in the future.

...know anyone capable or

developing any biological or

chemical weapon such as

anthrax.
83

from the country if the person(s) involved is(are) not United States

citizen(s).

Strategic intelligence examines crime patterns and crime trends for

management use in decision making, resource development, resource

allocation, and policy planning. While similar to crime analysis, strategic

intelligence typically focuses on specific crime types, such as criminal

enterprises, drug traffickers, terrorists, or other forms of complex

criminality. Strategic intelligence also provides detailed information on a

specified type of crime or criminality.113 For example, terrorists cells114

related to Al-Qaeda within the United States might be described to the

extent possible on their characteristics, structure, philosophy, numbers of

members, locations, and other distinguishing characteristics. Similarly, a

strategic intelligence report may document attributes of “eco-extremists”115

by describing typical targets and methods used in their attacks. This

information helps police understand the motivations of the intelligence

targets and can help in deploying investigative resources, developing

Law Enforcement Intelligence Classifications, Products and Dissemination

The activities of the cell may

change, but that is

determined by hierarchical

leaders external to the cell,

not a cell member.

115 The eco-extremist movement

represents environmental

activism that is aimed at

political and social reform

with the explicit attempt to

develop environmentalfriendly policy, law, and

behavior. As stated by one

group, “The work of Green

social transformation is only

partially a matter of electoral

and legislative victories. A far

more important aspect of this

work involves a fundamental

retooling of the basic cultural

values and assumptions that

have led us to our current

ecological and social

problems.”
84 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

needed to address changing threats; and permit insight when there is a 

change in the threat level within a specific community or region.

On this last point, the federal government created the color-coded

Homeland Security Advisory System (HSAS) to provide information to

communities when indications and warnings (I&W) arise resulting from the

analysis of collective intelligence. A formal and deliberate review process

occurs within the interagency process of the federal government before a

decision is made to elevate the threat level. The HSAS continues to be

refined116 and adjustments are made in line with security enhancements

across the major critical infrastructure sectors. Additionally, as

intelligence is assessed and specific areas are identified, the HSAS is

sufficiently flexible to elevate the threat within the specific sector, city, or

region of the nation. This was not something that could have been done in

the infancy of the Department of Homeland Security or at the creation of

the HSAS. As the intelligence capacity of the DHS continues to mature,

along with the FBI's increased domestic intelligence capability supported

by state and local law enforcement intelligence, threats can be targeted on

115 (Cont.)

http://www.well.com/user/sme

ndler/green/grnculture.htm

As is the case with virtually

any political or religious

group, the eco-extremists

also have members who

commit acts of terrorism in

the name of ecological

conservation, such as the

Environmental Liberation

Front's (ELF) arsons of

condominiums in the Rocky

Mountains. 

116 As an example, for the first

time the HSAS was raised for

a specific target (financial

institutions) in specific areas

(Washington, DC; northern

New Jersey, and New York

City) in the summer of 2004.
85

Policies need to be established for the types of information that will be

disseminated and to whom. Critical to appropriate dissemination of

information is understanding which persons have the “right to know” and

the “need to know” the information, both within the agency and externally.

In some cases, there may need to be multiple versions of one product. For

example, an unclassified public version of a report may be created to

advise citizens of possible threats. A second version may be “Law

Enforcement Sensitive” and provide more detailed information about

potential suspects that would be inappropriate to publicize.118

When considering disseminating sensitive material, a law enforcement

organization should impose the “Third Agency Rule.” This means that any

recipient of intelligence is prohibited from sharing the information with

another (i.e., third) agency. This affords some degree of control and

accountability, yet may be waived by the originating agency when

appropriate.

Law Enforcement Intelligence Classifications, Products and Dissemination

report there may be a

summary of critical

information, without a

description of sources and

methods that is below a

designated line on the report.

This portion may be “torn off”

of the report, making it

Sensitive But Unclassified

(SBU) and may be

disseminated to law

enforcement personnel who

do not have a security

clearance as “Law

Enforcement Sensitive”.
86 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

Mueller, Homeland Security Secretary Tom Ridge, and the Global

Information Sharing Initiative,121 the plan provides an important foundation

on which SLTLE agencies may create their intelligence initiatives. The

intent of the plan is to provide local police agencies (particularly those that

do not have established intelligence functions) with the necessary tools

and resources to develop, gather, access, receive, and share intelligence

information.

Following a national summit on information-sharing problems funded by the

Office of Community Oriented Policing Services of the Department of

Justice, the International Association of Chiefs of Police (IACP) proposed

the development of a plan to overcome five barriers that inhibit intelligence

sharing: 

1. Lack of communication among agencies.

2. Lack of equipment (technology) to develop a national data system.

3. Lack of standards and policies regarding intelligence issues.

pr/2004/May/04_ag_328.htm

121 http://it.ojp.gov/topic.jsp?

topic_id=8
87

• Develop working relationships with other professional law

enforcement organizations to obtain assistance with the

implementation of intelligence training standards in every state

(Recommendation #19)

• Identify an “architectural” approach to ensure interoperability among

the different agencies' intelligence information systems

(Recommendation #23)

• Develop centralized site that allows agencies to access shared data

(Recommendation #28)

2. Individual Agency Requirements

• Adopt the minimum standards for Intelligence-Led Policing and

develop an intelligence function (Recommendation #1)

• Provide criminal intelligence training to all levels of personnel

3. Partnerships

• Form partnerships with both public and private sectors to detect and

prevent attacks on infrastructures (Recommendation #7)

Law Enforcement Intelligence Classifications, Products and Dissemination
88 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

and to guide the investment of resources in information systems that will

further this goal. The strategy identifies how the Department of Justice will

support the implementation of the Plan. 

• The newly established Criminal Intelligence Coordinating Council (CICC)

under Global will serve to set national-level policies to implement the Plan

and monitor its progress on the state and local level. The CICC will work with

the Department's Law Enforcement Information Strategy Initiative and with

the Justice Intelligence Coordinating Council, created by a directive of the

Attorney General, to improve the flow of intelligence information among

federal, state, and local law enforcement agencies. 

• The Federal Bureau of Investigation (FBI) has built an enterprise-wide

intelligence program to fulfill its responsibility to get vital information about

those who would do us harm to those who can act to prevent that harm. To

that end, the FBI has built robust intelligence production and sharing

processes enabled by technologies developed and operated by the Criminal

Justice Information Systems (CJIS) Division. The FBI has established an

intelligence requirements process to both drive its investigative work

against common threats and to satisfy the information needs of the larger

U.S. national security community, including other partners in law

enforcement. This process ensures that the FBI produces not only the

information it can produce, but also the information it must produce to

safeguard the nation. 
Law Enforcement Intelligence Classifications, Products and Dissemination 89

Justice XML Data Dictionary. All federal grant programs to criminal justice

agencies will also include a special condition calling for the use of this

standard. 

• The Department of Justice, through the FBI, Office of Justice Programs

(OJP) and the Office of Community Oriented Policing Services (COPS), is

providing training and technical assistance to criminal justice policy leaders,

law enforcement professionals, and information technology professionals in

standards and policies to enable information sharing, improve the use of

intelligence by law enforcement, and build systems that tie into the nation's

existing information-sharing networks. 

• The Department of Justice is investing in research and development of new

tools and methods to improve the use of intelligence in law enforcement.

This work includes the continued development of XML standards, new

analytical tools, security standards, and policing methods to improve the

safety and effectiveness of police officers. In addition, through OJP and

COPS, the Department is sponsoring pilot projects across the nation to

improve the interoperability of information systems and show the impact of

improved information sharing on fighting crime and terrorism. 

Source: http://www.fbi.gov/dojpressrel/pressrel04/factsheet051404.htm 
90 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

those products that are distributed from federal sources, regional

intelligence centers, and other entities. Without effective dissemination,

much of the value of intelligence is lost. All too often, patrol officers,

private security, and citizens are excluded from dissemination. Certainly,

there must be careful evaluation of the types of information that is

disseminated, but nonetheless, a broad array of recipients should be

included in the dissemination process.

important that law

enforcement executives and

intelligence managers monitor

legislative and regulatory

activity related to this

provision. If revisions to the

regulation are implemented, it

is highly recommended that

appropriate personnel from

SLTLE agencies attend new

training programs that will be

available. Training will be

available at no charge,

funded by the Bureau of

Justice Assistance. See

http://www.iir.com. 
7

Managing the Intelligence Function
CHAPTER S
93

function to manage. With the growing symbiosis among

federal and state, local, and tribal law enforcement (SLTLE),

adoption of the National Criminal Intelligence Sharing Plan and

the growth of networked intelligence information systems,

along with the responsibility to keep the homeland secure,

virtually every law enforcement agency in the country needs

to develop some type of intelligence capacity. That capacity

may be a full-scale unit or one person who serves part time as

an agency's point of contact to receive and disseminate

critical information. In some form, an intelligence capacity has

become a de facto requirement for U.S. law enforcement

agencies. As a result, new intelligence processes for SLTLE

provides challenges such as the following to the executive: 
94 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

regulations incumbent on the law enforcement intelligence community.

• A secure electronic communications system for sending and receiving

information that is Law Enforcement Sensitive (LES) and For Official Use

Only (FOUO). Several systems are available, including Law Enforcement

Online (LEO), RISS.net, Anti-Terrorism Information Exchange (ATIX),

National Law Enforcement Telecommunications System (NLETS), and

Joint Regional Information Exchange System (JRIES) – some of which

are available at no charge to the user. With the growth of the XML

standard,123 access to these systems will be essential for the most

accurate information sharing.

• Established policies for information collection, reporting, and

dissemination. If an agency of any size is going to maintain intelligence

records, the agency must have policies in place to control that data or

risk exposure to liability. In many cases, adoption of the Law

Enforcement Intelligence Unit (LEIU) File Guidelines (see Appendix B)

will serve the purpose.
95

enforcement intelligence (LEI) unit. Administrators and managers must

examine the following:

• The need for the LEI unit

• How it functions every day

• Issues of resource acquisition, deployment, and management

• Future agency needs for the intelligence function.

Properly organized and staffed, the intelligence function serves as an

internal consultant to management for resource deployment. It should be

designed as an integrated and organic element of the law enforcement

organization, not a distinct function. Intelligence defines the scope and

dimensions of complex criminality – including terrorism – facing the

jurisdiction and provides alternatives for policy responses to those

problems. Importantly, it also serves as a focal point for information

sharing and dissemination to maximize community safety. Some law

enforcement agencies have been reluctant to fully develop an intelligence

Managing the Intelligence Function
96 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

intelligence analysis as a management resource.

As a consequence of several factors, the Zeitgeist – or “spirit of the times”

– is now present for American law enforcement to embrace law

enforcement intelligence of the 21st century. Many SLTLE agencies have

established a legacy of proactive law enforcement through the use of

community policing and its activities of problem solving, CompStat, crime

analysis, effective internal and external communications, multidisciplinary

responses to crime, and a “bottom-up” approach for operational direction.

Moreover, since 9/11, there has been a greater development of resources

and training to make intelligence activities more easily adapted and

functional. Finally, the law enforcement intelligence function has become

professionalized through greater involvement of academic institutions,

federal initiatives, and long-standing activities by groups such as the

International Association of Law Enforcement Intelligence Analysts

125 For more information on

these organizations see their

respective web pages at

http://www.ialeia.org and

http://www.leiuhomepage.org. 
97

Resource allocation is always a difficult process because it typically

involves diminishing one function to develop another. In most cases, the

creation of a new unit will not come with a new appropriation of funding to

fully staff and operationalize it; therefore, part of the resource allocation

process is to determine where the intelligence function fits in the

organizational priorities of the law enforcement agency.

The mission is the role that the unit fulfills in support of the agency's overall

mission. It specifies in general language what the unit is intended to

accomplish and establishes the direction and responsibility for the LEI unit

for which all other administrative actions and activities are designed to

fulfill. Figure 7-1 presents a sample mission statement for a law

enforcement agency's intelligence unit.

A goal is the end to which all activity in the unit is directed. It is broad

based, yet functionally oriented. Importantly, the goal must be missionManaging the Intelligence Function

See also the on-line

performance management

database of the Royal

Canadian Mounted Police at

http://www.rcmplearning.org/fr-welc.htm. 

127 A good illustration of a law

enforcement needs

assessment and how it can

be performed, which includes

multiple applications is:

Healy, J.J., Superintendent,

International Training and

Peacekeeping Branch, Royal

Canadian Mounted Police.

http://www.rcmplearning.org/docs/ecdd1134.

htm. 
98 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

Sample Intelligence Mission Statement

The mission of the Intelligence Unit of the Hypothetical Police Department is to

collect, evaluate, analyze, and disseminate intelligence data regarding criminal

activity in this city/county and any criminal activity in other jurisdictions that

may adversely effect on this city/county. This includes providing processes for

collating and analyzing information collected by operational units of the law

enforcement agency. The Intelligence Unit will furnish the Chief of Police with

the necessary information so that Operations Units charged with the arrest

responsibility can take the necessary enforcement action.

Sample Intelligence Goals

1. The Intelligence Unit shall supply the Chief of Police with accurate and

current strategic intelligence data so that the Chief will be kept informed of

changing criminal activity in the jurisdiction.
99

must be developed conceptually and stipulated by policy.

Responsibility reflects how the authority of a unit or individual is used for

determining if goals have been accomplished and the mission fulfilled in a

manner that is consistent with the defined limits of authority. The unit and

its members must be held accountable for its charge and administrative

mechanisms must be set in place to assess the degree to which the unit is

meeting its responsibilities.

IACP Model Policy on Criminal

Intelligence. 

The International Association of Chiefs of Police (IACP) has taken a

Managing the Intelligence Function

The Intelligence Unit recognizes the delicate balance between the individual

rights of citizens and the legitimate needs of law enforcement. In light of this

recognition, the unit will perform all of its intelligence activities in a manner

that is consistent with and upholds those rights.
100 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

 Accessing the system to make inquiries

• Defining standards for identifying and classifying “Non-Criminal

Identifying Information”

• Entering data in the criminal intelligence system

• Reviewing data quality and propriety

• Purging

• Disseminating intelligence.

Even if 28 CFR Part 23 guidelines do not apply to a specific law

enforcement agency, use of the guideline and these policies is good

practice for the agency to follow.

Auditing the Intelligence Function

Perhaps one of the best ways to understand management of the

intelligence unit is to examine the variables used in the audit process.

Appendix C is an audit questionnaire created by the author that includes
101

government agencies, such as public health or emergency services. These

various relationships have different dynamics related to needs,

responsibilities, and limitations on access to information. As such, the

parameters of each formal partnership should be articulated in a formal

partnership agreement.

Broadly speaking, two types of partnerships are related to the intelligence

function. These are the following:

• Users: Organizations with which information and/or intelligence

products are shared. Users are consumers.

Managing the Intelligence Function

Critical information is shared through collaboration,

typically with other law enforcement agencies, but often with
102 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

to pay a monthly fee, adhere to 28 CFR Part 23, and agree to the Third

Agency Rule. Failure to meet these standards would result in ending

access to the system.

• Mutual Aid Pact (MAP): The MAP is an agreement that is in place to

deal with special circumstances, rather than an ongoing service, and

establishes the agreed-on conditions when one agency would provide

assistance to another. Oftentimes assistance is reciprocal, except for

real costs that may be incurred in extended activities. As an

intelligence-related example, two law enforcement agencies may agree

to aid each other when conducting a surveillance. 

• Memorandum of Understanding (MOU): The MOU is more detailed and

involves a partnership in an activity. Essentially a contract, the MOU

would specify all obligations and responsibilities and typically share

liabilities in the endeavor. For example, if multiple agencies agree to

develop a regional intelligence center, the MOU may be a fairly detailed

document outlining all aspects of governance, management, structure,

funding, accountability, and operations of the center.
103

Sources for Intelligence Management

and Resource Trends

Effective management of an intelligence unit requires that the manager be

constantly informed of emerging issues, technologies, and trends. This is a

difficult process; however, one of the more effective methods is to monitor

online newsletters of reliable organizations. Topics can range from actions

and activities of extremists groups to new products and new policy and

legislation. As an illustration (not an endorsement), some of the more

substantive news letters include (in alphabetical order) the following:

• Anti-Defamation League http://www.adl.org/learn/default.htm – there

are two newsletters – the Law Enforcement Newsletter and the

Breaking News

• Center for Digital Government (three newsletters; one specifically on

homeland security)

Managing the Intelligence Function
104 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

• Information Warfare and Cyberterrorism

http://www.iwar.org.uk/mailman/listinfo/infocon/ 

• Israeli Defense Force Intelligence and Terrorism Research Center

http://www.intelligence.org.il/eng/main.htm#

• National White Collar Crime Center http://www.nw3c.org/contact.cfm

(One can sign up for both the electronic and print versions of the

newsletter on this page.)

• PoliceOne.com (Law Enforcement News)

http://www.policeone.com/policenews/ (newsletter subscription on

right side of home page)

• Saudi-U.S. Relations Information Service (quite a bit of information on

terrorism http://www.saudi-us-relations.org/newsletter/saudi-usnewsletter.html (subscription box on left side under menu items)

• Southern Poverty Law Center

http://www.splcenter.org/center/subscribe.jsp

• Terrorism Central Newsletter
105

agency. It is just as true that some substantive knowledge of the unit or

function must also be developed. Criminal investigation commanders need

to understand caseload differentials for crimes, patrol commanders must

know minimum staffing requirements to handle calls for service, and traffic

commanders must understand traffic analysis and its application to

selective enforcement. It is no different with the intelligence commander.

This chapter identified critical substantive elements of the intelligence

function that will aid the law enforcement manager to manage this activity

more effectively.

Managing the Intelligence Function

8

Human Resource Issues 
CHAPTER E
109

Who should perform the intelligence function in a state, local,

and tribal law enforcement (SLTLE) agency and what

qualifications should that person have? This question is

impossible to answer conclusively because it depends on

myriad variables tied to the attributes of a given law

enforcement agency. The agency's size, jurisdiction, the

priority intelligence is given, resource flexibility, competing

crime and calls for service issues, and collective bargaining

agreements must be calculated into the formula. Rather than

provide for the ideal situation, this chapter will present issues

and guidelines that will enable the law enforcement executive

to make an informed decision about options available for

staffing the intelligence function.
110 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

An ongoing issue is whether the intelligence analyst will be sworn or

nonsworn. Different agecies use different models, each with its

advantages and disadvantages.132 Those who advocate that the intelligence

analyst position would be best served by a nonsworn employee argue that

the nonsworn analyst's characteristics and background may provide a

The intelligence analyst is a professional who takes varied

facts, documentation of circumstances, evidence, interviews,

and any other material related to a crime and places them into a

logical and related framework for the purpose of developing a

criminal case, explaining a criminal phenomenon, or describing

crime and crime trends.
111

enforcement street experience.

Other factors not related to the conceptual responsibilites will enter the

equation such as the compensation package, collective bargaining

agreement, civil service regulations, organizational culture, the candidate

pool, and so forth. This is a critical position requiring an effective analytic

capability and care should be taken to hire the “the right person” to fit the

agency's needs. It should not be, as has too often been the case, an

appointment of convenience or a “reward appointment” to a good clerical

person who has “worked hard for the department.” Professional output

from the intelligence unit will occur only if the position is filled by a

professional analyst.

TRAINING

The Bureau of Justice Assistance-funded Criminal Intelligence Training

Coordination Strategy (CITCS) Working Group, conducted a needs

Human Resource Issues
112 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

Clearly, intelligence training currently represents the proverbial mixed bag

of content, availability, and structure. The content or subject matter of law

enforcement intelligence can be divided in two broad categories.134 The

first category is protocols and methodology of the intelligence process.

This includes subjects such as information collection methodologies; laws

and regulations associated with intelligence records systems; analytic

methods and tools; intelligence reporting structures and processes; and

intelligence dissemination. Essentially, these elements constitute the

discipline of law enforcement intelligence.

The second category is somewhat more amorphous. Broadly speaking,

this is subject matter expertise. It includes understanding the motives,

methods, targets, and/or commodities of criminal intelligence targets.

Intelligence researchers and analysts must have subject matter knowledge

of the types of enterprises that are being investigated and the context

within which these enterprises occur. Whether the target crime is

134 Carter, David L. and Richard

N. Holden. (2004). “Chapter

2: Law Enforcement

Intelligence.” Homeland

Security for State and Local

Police. Englewood Cliffs, NJ:

Prentice Hall.
113

Training programs continue to emerge on intelligence related topics, 

particularly since the Office of State and Local Government Coordination

and Preparedness of the Department of Homeland Security is preparing to

fund a series of new training programs on various aspects of

counterterrorism, including intelligence.135 Perhaps the best single source

to monitor training programs of all types is through the Bureau of Justice

Assistance Counterterrorism Training website136 which includes not only

training opportunities but funding and related information as well.

Human Resource Issues

agencies will have access to

no-cost training to help create

an intelligence capacity within

their department, regardless

of size. For more information

see:http://intelligenceprogram.

msu.edu. 

136 http://www.counterterrorism

training.gov

Perhaps the best single source to monitor training programs of

all types is through the BUREAU OF JUSTICE ASSISTANCE

COUNTERTERRORISM TRAINING website which includes not

only training opportunities but also funding and related information.
114 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

Management Issues

for Intelligence

Specialized Training

ggyg

researchers”. In each of the cases, the curricula are

similar. Notable among these courses are the 2-week

DEA FLEAT course and the FLETC intelligence course.

One program, offered at the Regional Counterdrug

Training Academy at NAS Meridian, Mississippi is

specifically labeled as being an intelligence course for

managers.137 Some other courses could be labeled as

such, but were more likely to be “issues” courses. In

some cases, intelligence issues for managers have been

discussed in broader venues, such as in courses offered

by the FBI National Academy.

This training focuses on a narrow aspect of the entire

intelligence process. The best known of these courses is

the Criminal Intelligence Analysis course offered by

Anacapa Sciences, Inc.,138 that focuses exclusively on the

“analysis” component of the intelligence cycle. Other

courses that fall into this category are generally “software

courses” such as classes on how to use a particular type

of intelligence software (typically either analytic software

or databases).
115

to focus on terrorism as its top priority. This necessitated a number of

changes in the Bureau, including expanding its law enforcement

intelligence capability and working closely with state and local law

enforcement agencies on terrorism investigations through Joint Terrorism

Task Forces (JTTF) and Field Intelligence Groups (FIG). Among the needs

precipitated by these changes was a significant broadening of the capacity

for intelligence analysis among FBI personnel as well as among state and

local JTTF and FIG intelligence staff. The FBI's College of Analytic Studies

(CAS), created in 2002 and located at the FBI Academy, is a seven week

course that focuses on analysis functioning and tradecraft for terrorism,

counterintelligence, and criminal intelligence analysis as well as specific

FBI intelligence systems and practices related to terrorism. Twenty-five

percent of each session of course capacity is reserved for state and local

law enforcement personnel who have federal security clearances and are

working with the JTTF in their region.140

Human Resource Issues

140 Some variation in the 25%

state-local training allocation

may occur in the short term

as the FBI significantly

increases the number of

Intelligence Analysts being

hired by the Bureau.
116 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

(DEA)

The DEA has long been recognized for the quality of training provides

through the Intelligence Training Unit of the DEA Academy at Quantico,

Virgina. DEA intelligence training focuses on information research and

intelligence analysis through the 9-10 week (it varies) Basic Intelligence

Research Specialist (BIRS) program. DEA also offers an advanced

intelligence training program as well as specialized programs related to the

use of different data bases and the classified DEA proprietary intelligence

computer system, MERLIN.

Because of the DEA's historic role of working with state and local law

enforcement agencies, and the inherent need for intelligence in the

Organized Crime Drug Enforcement Task Forces (OCDETF) and the High

Intensity Drug Trafficking Areas (HIDTA), DEA developed a 4-week Federal

Law Enforcement Analyst Training (FLEAT) program specifically directed

toward state and local law enforcement agencies. The program is offered
117

specialized classes to further enhance their skills, ultimately earning an

Intelligence Analyst certificate after 4 to 6 weeks of total training.

In addition, FLETC also assessed the need for intelligence training and, in

light of the mandate for state and local law enforcement to be involved in

counterterrorism efforts, defined the need for intelligence training to focus

on different responsibilities: intellligence analysts, managers, and

intelligence “awareness” for line-level personnel.144 As a result, the FFI has

worked cooperatively with the FLETC National Center for State and Local

Law Enforcement Training to conduct a needs assessment among state

and local law enforcement agencies and develop intelligence courses that

meet their needs. As of this writing, a 2-day intelligence awareness

course, specifically for nonanalyst SLTLE agencies has been developed

and will be offered beginning in the fall of 2004 at no cost at geographically

decentralized locations throughout the U.S.145

Human Resource Issues

nterapp/editorial/editorial_009

4.xml.

144 Manzi, Merle. Intelligence

Program Coordinator,

Financial Fraud Institute,

Federal Law Enforcement

Training Center. Intelligence

Training for State and Local

Law Enforcement Agencies in

Support of Homeland

Security. An internal concept

paper. (May 2003).

145 See http://www.fletc.

gov/ffi/index.htm. 
118 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

IALEIA Foundations of Intelligence

Analysis Training (FIAT)147

The five day FIAT program was developed and is offered by the

International Association of Law Enforcement Intelligence Analysts. Given

the expertise that exists in the IALEIA membership and the extent to which

the association has been working on analyst training issues, this course

provides a compact yet highly substantive training experience. The

program is offered throughout the U.S.

Other Programs and Training

Resources

Law enforcement intelligence training continues to evolve, and a number of

important initiatives are now underway to deliver improved basic and

specialized training at the state and local levels. In addition to the
119

SLTLE agencies meeting those stipulations, the guidelines can be an

important tool for minimizing risk to liability and ensuring that all

intelligence record keeping is consistent with constitutional standards. A

comprehensive training program, funded by the Bureau of Justice

Assistance, is available to SLTLE agencies at no charge.153

Beyond these programs, several COPS Regional Community Policing

Institutes (RCPIs) offer a range of counterterrorism training programs,

some of which include components of intelligence awareness training.

Agencies should contact the RCPI in their region to determine training

program offerings.154

INTELLIGENCE COURSES IN HIGHER

EDUCATION

In recent years, there has been increasing recognition in the academic

community of the need for coursework in law enforcement intelligence that

Human Resource Issues

office. In addition, the

Washington-Baltimore HIDTA

often lists a wide range of

training programs, including

those that are intelligence

related. See

http://www.hidta.org/training/la

w_enforcement.asp. 

151 Florida Department of Law

Enforcement, Training

Division, Post Office Box

1489, Tallahassee, FL 32302,

Phone: 850-410-7373.

152 See

http://www.iir.com/slatt/trainin

g.htm. 

153 For the course description,

schedule and enrollment, see

http://www.iir.com/28cfr/Traini

ng.htm. 

154 The RCPI for a specific

service area and appropriate

contact information can be

located on the interactive

map at

http://www.cops.usdoj.gov/def

ault.asp?Item=229. 
120 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

designed to provide the necessary background for students to pursue

careers as research and/or intelligence analysts relating to national

security or criminal investigative activities in government agencies and

private enterprise. 

Established in 1963, the Joint Military Intelligence College (JMIC) is located

at Bolling Air Force Base and is attached to the Defense Intelligence

Agency (DIA).157 JMIC is a highly respected institution in the Intelligence

Community offering both an accredited baccalaureate and master's degree

in intelligence studies. Its mission has been to serve national security and

military intelligence needs. Recognizing the integration of law enforcement

processes associated with transnational terrorst investigations, JMIC

offered a course entitled “Counternarcotics Policy and Intelligence” in

spring 2004. The course director was Visiting Professor of Law

156 See

http://www.mercyhurst.edu/un

dergraduate/academicprograms/index.php?pt=riap. 

157 See http://www.dia.mil/Jmic/.
121

Human Resource Issues
122 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies
9

Networks and Systems
CHAPTER N
125

Essential to effective intelligence is the ability to access and

share information readily. A number of resources and systems

are currently available to state, local, and tribal law

enforcement (SLTLE) agencies that permit access to federal

intelligence products, regional and local intelligence products,

current news and events, and secure email. Many resources

are available to law enforcement organizations for a minimal, if

any, fee. Regardless of the degree of sophistication of any

system, it is essential that a law enforcement organization

have some form of secure email and access to a Sensitive But

Unclassified (SBU) network to receive current advisories to

maximize information sharing.
126 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

E-mail: info@magloclen.riss.net

• Mid-States Organized Crime Information Center (MOCIC) (Illinois, Iowa,

Kansas, Minnesota, Missouri, Nebraska, North Dakota, South Dakota,

and Wisconsin. The center also has member agencies in Canada)

1610 E. Sunshine Drive, Suite 100

Springfield, MO 65804

Phone: 417.883.4383

Email: info@mocic.riss.net

• New England State Police Information Network (NESPIN) (Connecticut,

Maine, Massachusetts, New Hampshire, Rhode Island, and Vermont. The

center also has member agencies in Canada)

124 Grove Street, Suite 305

Franklin, MA 02038

Phone: 508.528.8200 

Email: info@nespin.riss.net
127

Canada, Australia, and Guam)

1825 Bell Street, Suite 205

Sacramento, CA 92403

Phone: 916.263.1186

Email: info@wsin.riss.net

The regional approach allows each center to offer support services

tailored to the needs of member agencies, though the centers also provide

services and products that are national in scope and significance. Typical

targets of RISS-member agencies' activities are terrorism, drug trafficking,

violent crime, cybercrime, gang activity, and organized crime. While the

RISS network is funded by the U.S. Bureau of Justice Assistance, it is

controlled by its member agencies. As a result, state and local law

enforcement agencies establish priorities as well as decisions related to

services, such as secure client email systems.

Networks and Systems
128 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

RISS operates a secure intranet, known as RISS.net, to facilitate law

enforcement communications and information sharing nationwide. RISS

local, state, federal, and tribal law enforcement member agency personnel

have online access to share intelligence and coordinate efforts against

criminal networks that operate in many locations across jurisdictional lines.

In September 2002, the FBI Law Enforcement Online (LEO) system

interconnected with RISS. In October 2003, the RISS/LEO interconnection

was recommended in the National Criminal Intelligence Sharing Plan

(NCISP) as the initial Sensitive But Unclassified (SBU) communications

backbone for implementation of a nationwide criminal intelligence-sharing

capability. The plan encourages agencies to connect their systems to

RISS/LEO.

Anti-Terrorism Information Exchange

(ATIX)

In April 2003, RISS expanded its services and implemented the Anti-
129

military, emergency services, etc.). 

In each individual community section on the website, users can establish

collaborative electronic conference services, virtual bulletin boards, and

live chat rooms. Member groups also create most of the ATIX site's content

and bulletin board posts. Each conference has a live chat feature where

users can post conversation threads and discuss topics. An on-screen

paging function permits users to notify others if they need to shift a

conversation to the telephone or to a face-to-face discussion.

ATIX is informative, user-friendly, and an important resource for law

enforcement agencies of any size. The site requires access to the Internet

and a Virtual Private Network (VPN) to permit secure communications. To

obtain access to ATIX, the potential user must contact the applicable RISS

center and request enrollment from the appropriate state coordinator. 

Networks and Systems
130 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

Law Enforcement Online (LEO)161

LEO is an online service operated by the FBI for law enforcement, first

responders, and criminal justice officials. Approximately 32,500 members

have been on LEO since its inception in1995. All that is required for use is

Internet access and the FBI VPN. 

After logging on to the LEO site, resources that are available include:

• Topical Focus Area: Custom web-type pages that provide a secure

community area for general information related to the law enforcement

profession using text, graphics, audio, and video. 

• Law Enforcement Special Interest Groups: Segmented areas with

multilevel controlled access for specialized law enforcement groups that

have their own members.
131

used any time of the day or night at the users own pace with

instructional feedback

In addition, FBI Intelligence Assessments, FBI Intelligence Bulletins, and

FBI Intelligence Information Reports are available on the LEO website as

well as other items of interest related to the FBI intelligence program. To

obtain access to LEO, contact the training coordinator at the local FBI Field

Networks and Systems

... FBI Intelligence ASSESSMENTS, FBI Intelligence

BULLETINS, and FBI Intelligence INFORMATION REPORTS

are available on the LEO WEBSITE as well as other items

of interest related to the FBI intelligence program.
132 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

Coordinating Agency (i.e., the California Department of Justice which

houses LEIU data) make up the executive board. The board is the

governing body of LEIU, and, as such, establishes policy and passes on the

admission of all members, and is governed by a constitution and bylaws.

LEIU membership is limited to law enforcement agencies of general

jurisdiction having an intelligence function. To become a member, an

agency head submits a written application. The applying agencies must be

sponsored by an LEIU member. Each member agency head appoints an

LEIU representative as the contact for the Law Enforcement Intelligence

Unit. 

Virtually any type of information that may be lawfully retained in law

enforcement intelligence records may be exchanged as long as the

recipient meets the need-to-know and right-to-know standards.

Importantly, to keep intelligence records consistent with legal standards,

Justice, P.O. Box 163029,

Sacramento, CA 95816-3029.
133

Homeland Security Operations Center (HSOC) to collect and disseminate

information between DHS and federal, state, tribal, and local agencies

involved in counterterrorism. 

• JRIES is focused on information exchange and real-time collaboration

among federal, state, tribal, and local authorities. 

• JRIES includes information analysis tools and capabilities to support

distributed collaborative analysis and reporting across federal, state,

tribal and local law enforcement and intelligence.

• JRIES meets all applicable security requirements and has achieved

system accreditation by the Intelligence Community. 

• JRIES currently is deployed to more than 100 federal, state, and local

entities with many more connecting every month.

This communications capability delivers to states and major urban areas

real-time interactive connectivity with the DHS Homeland Security

Operations Center. This secure system significantly strengthens the flow of

Networks and Systems
134 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

• Interactive collaboration tool (live text or voice)

• Supports requests for information

• Link and temporal analysis

• Daily and periodic reporting

• Suspicious incident/pre-incident indicator data

• Data display on maps (national, state, county, city)

• Critical Infrastructure Protection (CIP) repository

• Strategic analysis on terrorist threats, tactics, and weapons. 

Homeland Security Information

Network 

The next generation of JRIES is the Homeland Security Information

Network (HSIN). The HSIN will deliver real-time interactive connectivity

among state and local partners and with the DHS HSOC through JRIES.

This increased connectivity will result in more effective communications

and more efficient responses to deter, detect, prevent, or respond to
135

Within the counterterrorism mission, JRIES, RISS.net, and LEO are

complementary programs, and DHS will continue to work closely with law

enforcement. The HSIN will post its daily reports and warnings directly to

RISS.net via a JRIES interface. Combining JRIES' real-time collaboration

capability and state-of-the-art portal technology with RISS.net's legacy

databases will enhance the capabilities of DHS law enforcement partners. 

Priority capabilities of this expanded information exchange system will

include the following: 

Communications 

• Low-cost, always-on connectivity 

• End-to-end encrypted communications. 

Collaboration / Analysis 

Networks and Systems
136 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

Figures 9-2 illustrates the intelligence interrelationship of the HSIN with

other networks as well as the integration of intelligence and operations. 

A long-term goal of the HSIN is to have seamless connectivity among the

different portals that serve the law enforcement and homeland security

communities.

National Law Enforcement

Telecommunications System (NLETS)164

The National Law Enforcement Telecommunication System (NLETS) was

created by state law enforcement agencies nearly 35 years ago as a
137

records, FAA registrations, NDPIX,vehicle impounds, and import/export

files. The system also includes terminal-to-terminal messaging and

broadcast capabilities (such as an Amber Alert).

Accelerated Information Sharing for

Law Enforcement (AISLE)

The next generation of NLETS is Accelerated Information Sharing for Law

Enforcement (AISLE). The intent of AISLE is to accelerate information

sharing for the entire U.S. law enforcement community by adopting and

deploying XML166 Web Services technology for interstate inquiries and

responses. Like the Global Justice Information Sharing Initiative, it also

seeks to promote the common XML standard for law enforcement

information systems. Essentially, AISLE seeks to move NLETS completely

into the most advanced realms of networking to enhance information

sharing.

International Criminal Police

Networks and Systems

integrating diverse resources.

The second generation is

XML, Extensible Mark-up

Language, which has all the

features of HTML and

provides significantly

increased searching and

comparison characteristics.

167 The INTERPOL General

Secretariat site is

http://www.interpol.int/. 
138 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

Central Bureaus and further integrating Sub Regional Bureaus into

overall INTERPOL activity, including the development of relevant law

enforcement initiatives in areas such as terrorism, drugs, organized

crime, trafficking in human beings, child abuse images on the Internet,

and financial and high-tech crime. 

Criminal intelligence analysts at INTERPOL are uniquely placed to

recognize and detect patterns and criminal trends from a global

perspective, as well as having the resources to assist with specific

international crime cases.

In the United States, the contact point for INTERPOL is the U.S. National

Central Bureau (USNCB) which operates within the guidelines prescribed

by the Department of Justice, in conjunction with the DHS. The mission of

the USNCB is to facilitate international law enforcement cooperation as the

United States representative to INTERPOL. 

When INTERPOL is seeking specific information or seeking a person, it
139

U.S. Department of Justice

INTERPOL

United States National Central Bureau

Washington, DC 20530

http://www.usdoj.gov/usncb/index.html 

Law Enforcement Information Sharing

Program

The U.S. Department of Justice is developing a new initiative called the

Law Enforcement Information Sharing Program (LEISP). The initiative is

designed not to create a new system, but to integrate systems and

relationships that already exist. Too often both systems and initiatives

operate independently. The result is that system queries and information

dissemination are not comprehensive.

Networks and Systems
140 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

Intelligence Center); it may be a portion of a state (e.g., Upstate New York

Regional Intelligence Center), or it may encompass an entire state (e.g.,

Georgia Information Sharing and Analysis Center). 

Most RICs were started as the product of counterdrug initiatives starting in

the 1980s. Indeed, the High Intensity Drug Trafficking Area (HIDTA)

intelligence centers171 can serve as models for successful structures and

initiatives as well as systemic issues that need to be overcome.172 In the

late 1990s, the Bureau of Alcohol, Tobacco and Firearms (ATF) developed a

number of programmatic activities to reduce gun violence. Emerging from

these initiatives were ATF Regional Crime Gun Centers. The centers, in

some cases collocated with the HIDTA RIC, have a number of intelligencerelated roles including “...analyzing trace data to identify gun traffickers,

disseminate investigative leads, and coordinate with the HIDTA RIC to

identify drug traffickers and their sources of guns.”173 In virtually all cases,

both the HIDTA and ATF intelligence centers had a great deal of interaction

with SLTLE.

content.html

172 The Counterdrug Intelligence

Executive Secretariat (1331 F

Street, NW, Suite 700,

Washington, DC 20530;

Telephone: 202.353.1876/Fax

202.353.1901 has an

insightful unpublished report

on Metropolitan Area

Consolidation/Collocation of

Drug Intelligence Elements

that describes success and

challenges for Regional

Intelligence Centers.

173 http://www.atf.gov/field/

newyork/rcgc/
141

Networks and Systems

The Iowa Law Enforcement Intelligence Network (LEIN) is an awardwinning

program established by the Department of Public Safety in 1984. In August 1994,

coordination and administrative responsibilities for LEIN were assigned to the

newly created Iowa Department of Public Safety Intelligence Bureau. State,

county and local law enforcement agencies from across the state of Iowa

provide support to LEIN operations.

LEIN's membership consists of law enforcement officers who have successfully

completed a 2-week criminal intelligence course conducted by the Department.

LEIN members work together with the department to accomplish two related

objectives:

1. To develop and disseminate knowledge about significant criminal conditions

that affect the state of Iowa.

2. To use this knowledge to identify, investigate, and remove these criminal

conditions. 

To achieve the first objective, LEIN serves as a mechanism for the statewide

collection and exchange of criminal intelligence information. LEIN members

submit information reports to the department's Intelligence Bureau, which in

turn, disseminates the information to participating agencies throughout the state.
142 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

Georgia based on the collection, evaluation, and analysis of information that can

identify criminal activity. This intelligence can be disseminated the form of either

tactical or strategic intelligence.

GISAC is the state's clearinghouse for all terrorism-related intelligence from

which it proactively works with the Georgia Bureau of Investigation and other

agencies involved in any aspect of counterterrorism.

Multiple state agencies work in the GISAC as outlined in a memorandum of

understanding. Federal agencies working in GISAC do so under the provisions of

a Participation Agreement between Georgia's Director of Homeland Security and

an executive officer for each of the participating federal agencies.

Salary, vehicle, equipment, and supply expenses associated with GISAC

personnel are paid for by the employing agency of each GISAC participant. The

facilities and furnishings, including computer and communications equipment,

are funded by grants and contributions from several of the participating

agencies.
143

Networks and Systems

10

Intelligence Requirements and 

Threat Assessment
CHAPTER T
147

Information is needed to make decisions – the higher the

quality and the more comprehensive the information, the more

sound the decision. If an executive is going to make a

decision about implementing a new program, he or she needs

information on the costs, benefits, and risks of the program as

well as the more difficult dimension of what benefits will be

lost if a program is not implemented. Typically, the information

sought is not conclusive, but based on probability, the

experience of others, experimentation, logic or, sometimes, an

educated guess. Not having sufficient reliable information

makes the decision process more difficult (and risky).
148 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

and ensures that the right information needs are being targeted. Too often

in the past a “dragnet” approach was used for collecting information, and

analysts and investigators would examine the information in hopes of

discovering the “pearls” that may emerge. As illustrated in Figure 10-1,

there are a number of differences between the traditional approach and

the requirements-based approach to information collection. In essence,

the requirements-based approach is more scientific; hence, more

objective, more efficacious, and less problematic on matters related to civil

rights.

A desk reference guide for

law enforcement. (Pamphlet

form). (July 2004).
149

illustrations. This is not a template, but a process that each agency needs

to develop to meet its unique characteristics.

1. Understand your intelligence goal

• Arrest terrorists and/or criminals

• Prevent or mitigate terrorists attacks

• Stop a criminal enterprise from operating

2. Build an analytic strategy

• What types of information are needed?

• How can the necessary information be collected?

3. Define the social network

• Who is in the social circle of the target(s)?

• Who is in the regular business circle of the target(s)?

• Who has access to the target(s) for information and observation

• What hobbies, likes, or characteristics of the target's social behavior

are opportunities for information collection, infiltration, and

observation?

Intelligence Requirements and Threat Assessment
150 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

Threat Assessments

Threat assessments are often discussed, but the process remains elusive

to many state, local, and tribal law enforcement (SLTLE) agencies (Figure

10-2). There are four key variables in the process:

1. Threat Inventory.

2. Threat Assessment.

3. Target Assessment.

4. Target Vulnerability.
151

domestic extremists, individuals who have an extreme special interest

ideology, or a criminal enterprise. The type of information sought centers

on identifying answers to certain questions: Who are the people involved?

What is their group affiliation, if any, and what do they believe? To

understand extremists it also is useful to identify their motives, methods,

and targets. With criminal enterprises, the variables are methods,

commodities, and locations. In either case, understanding how the

criminal entity operates and what it seeks to accomplish can provide

significant insight into their ability to act. Care must be taken to collect and

retain the information in a manner that is consistent with 28 CFR Part 23

guidelines.

Threat assessment: Each threat identified in the inventory must be

assessed with respect to the level of the threat posed. Some individuals

make threats, but do not pose a threat. Conversely, some individuals and

groups pose threats without ever making a threat. To fully assess their

Intelligence Requirements and Threat Assessment

State and Local Anti-Terrorism

Training (SLATT) program.

179 Realistically, the threat

assessment must be done on

a regional, rather than

jurisdictional, basis because a

specific threat and/or target

will likely have an impact on

the jurisdiction.
152 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

against an attack.

When information is not available about the factors in this assessment

model, there is an intelligence gap that must be filled by a requirement.

FBI Intelligence Requirements

Templates

When going through this threat assessment process, the SLTLE agency will

need information from the FBI to aid in fully identifying and assessing

threats. As noted by the FBI:

State and local agencies or entities are served by the FBI and

have specific needs for tailored intelligence. ... To appropriately

address the information needs of state and local agencies, certain
153

servicing it.

CONCLUSION

The intent of intelligence requirements and threat assessments is to

provide a comprehensive, consistent model for managing the threats to a

community. These processes are not necessarily easy; however, the

outcomes they provide can be priceless.

Intelligence Requirements and Threat Assessment

IN ORDER TO FACILITATE THIS INFORMATION EXCHANGE,

the FBI Office of Intelligence has developed a template

expressly for SLTLE agencies to be used to log Intelligence

Information Needs or intelligence gaps they identify. 
154 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies
Intelligence Requirements and Threat Assessment 155

- Identity of suspects and their roles in the

local area

- Territorial reach

- Decision-making processes; degree of

subordinate autonomy

- Command-control-communications

techniques, equipment, network

Global, national and local trend reports

regarding capabilities, intentions, MO of

suspect groups in the US

- Types of weapons, explosives, or WMD

- Methods of moving, storing and concealing

weapons, contraband and human traffic

- Special/technical expertise possessed by

groups
156 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

 chain of custody in transport of critical

technology, illegal items/persons

- overseas connections (official, unofficial,

private sources); group sympathizers

- financial dependencies; extent of group's

reliance on external support, funds 

Intelligence/security activities of suspect groups

- surveillance, reconnaissance, concealment,

“cover” activities; safe houses

- counterintelligence and physical security

techniques and tactics

- COMSEC operations; ability to monitor LEC

communications

- informant/mole network available to suspect

groups

- production of, access to false/counterfeit

documents and identification

- deception, disinformation operations and

techniques
Intelligence Requirements and Threat Assessment 157 

 shell companies; charity/humanitarian

sponsors and covers

- financial crime used to generate income;

extortion of vulnerable targets

- cooperative, facilitating financial institutions

or service providers

- financial links between public officials and

criminal organizations or enterprises, hate

groups, or FIS

- criminal control of public, tribal financial

assets or property

Impact of LE or USG efforts to combat suspect

groups' activities

- infiltration; compromise; destruction;

disruption

- which tactics most/least effective; evidence

of shift in suspect groups' tactics,

techniques, or targets

- effectiveness of LE efforts overseas
158 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

organizations 

- incidents of violence or incitement against

individuals, groups, places of worship,

schools, commercial entities identified with

ethnic or political minorities

Capabilities, plans, intentions, MO of suspect

groups to conduct computer intrusion or

criminal assault on computer systems and data

bases.

Locally active hackers.
11

Federal Law Enforcement Intelligence
CHAPTER EL
161

Many federal agencies have reengineered their intelligence

function since 9/11. Intelligence products have been

redesigned or new products developed, dissemination

methods have been revised, greater attention has been given

to providing critical information that is unclassified for wide

consumption by state, local, and tribal law enforcement

(SLTLE), and new offices and initiatives have been developed.

More information is being produced and disseminated more

widely than in the history of law enforcement. Among the

challenges that law enforcement now faces is accessing that

needed information and using it with efficacy.
162 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

There is often a mystique about classified information, leading most people

after seeing a collection of classified documents to ask, “That's it?” For

the most part, the key distinction between classified and unclassified

information is that the former contains “sources and methods.” 

Some definitions: According to Executive Order 12958181 issued on March

23, 2003, information at the federal level may be classified at one of three

levels: 

• “Top Secret” shall be applied to information, the unauthorized disclosure

of which reasonably could be expected to cause exceptionally grave

damage to the national security that the original classification authority

is able to identify or describe. 

• “Secret” shall be applied to information, the unauthorized disclosure of

which reasonably could be expected to cause serious damage to the

national security that the original classification authority is able to

identify or describe. 
163

corroborated, the FBI will initiate a policy response. Policy responses may

include proactive investigations, target hardening, and in the most severe

cases, the Department of Homeland Security (DHS) may increase the threat

level of the Homeland Security Advisory System (HSAS), triggering a

significant string of policy responses at all levels of government. This

admittedly oversimplified illustration demonstrates the need for analysts to

know the sources and methods of information so that they can make the

best judgments in their analysis.

Beyond analysts, it is important for investigators, too, to know sources and

methods to work their leads. Members of the Joint Terrorism Task Forces

(JTTF) need security clearances to conduct their investigations effectively.

Do other members of SLTLE agencies need to have security clearances?

Certainly not, but who receives a clearance depends on a number of

factors. As a rule, SLTLE executives may apply for a clearance for three

reasons:

Federal Law Enforcement Agency
164 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

simply not prudent fiscal management to authorize clearance investigations

in all cases. Third, conducting an excess number of clearance

investigations slows the process, thereby taking longer to process

clearances for those persons who may be in more critical positions. 

In most cases, the FBI will begin consideration of a clearance investigation

for an SLTLE officer by examining local issues on a case-by-case basis.182

For those who seek to apply for a security clearance, the appropriate forms

and fingerprint cards can be obtained from the local FBI Field Office.

Appendix E describes the process for gaining a clearance and provides a

list of frequently asked questions and their answers.183

Sensitive But Unclassified (SBU)

Information184

Since it is not feasible for every law enforcement officer to have a security

clearance, there is a mechanism to get critical information into the hands

usually be accomplished at

the Secret level. Local FBI

Field Offices can help

determine whether or not a

security clearance is needed,

and if so, what level is

appropriate. 

183 The National Security

Clearance Application

(Standard Form SF-86) can

be downloaded from

http://www.usaid.gov/procure

ment_bus_opp/procurement/f

orms/SF-86/sf-86.pdf. 

184 As a means to aid in clarity,

the FBI is moving away from

the SBU label and using/will

use Law Enforcement

Sensitive in all cases, rather

than using both labels.
165

critical information but excludes data that should remain classified. (The

FBI Office of Intelligence is working specifically on this process.) Following

this process, SLTLE officers receive documents that are labeled “Sensitive

But Classified” or “Law Enforcement Sensitive”, thereby raising the

question, “What does this mean?”

Over time some agencies have established procedures to identify and

safeguard SBU information. Generally, this unclassified information is

withheld from the public for a variety of reasons, but has to be accessible

to law enforcement, private security, or other persons who have a

responsibility to safeguard the public. The term SBU has been defined in

various presidential-level directives and agency guidelines, but only

indirectly in statute. Agencies have discretion to define SBU in ways that

serve their particular needs to safeguard information. There is no

uniformity in implementing rules throughout the federal government on the

use of SBU.185 There have been even fewer efforts to define and safeguard

the information at the state, local, and tribal levels. There is an intuitive

Federal Law Enforcement Agency

Technical Information.

Washington, DC:

Congressional Research

Service.
166 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

intelligence products it is useful to know the framework from which they

arise. At a practical level, the rule of thumb for law enforcement officers is

to use good judgment when handling such materials. This does not mean

that SLTLE officers may not disseminate this information further unless

prohibited from doing so as indicated on the report. Rather, the officer

should use the information in a manner that meets community safety

needs, including disseminating portions of the information to those

segments of the community that would benefit from the data contained in

the report.

FEDERAL INTELLIGENCE PRODUCTS187

In light of the perspective regarding classification of federal intelligence

reports, the following discussions will describe federal intelligence

products, virtually all of which will be SBU.

187 Information in this section is

based on interviews with FBI

Office of Intelligence

personnel, reviews of the

Office of Intelligence

Concepts of Operations

(ConOps) and Congressional

testimony of Director Mueller.

See

http://www.fbi.gov/congress/co

ngress04/mueller022404.htm. 
167

collection strategies.

As a means to ensure that FBI-wide collection plans and directives are

incorporated into field activities, every FBI Field Office has established a

Field Intelligence Group (FIG). The FIG is the centralized intelligence

component in each field office that is responsible for the management,

execution, and coordination of intelligence functions. FIG personnel

gather, analyze, and disseminate the intelligence collected in their field

Federal Law Enforcement Agency

In order to maximize the effectiveness of the intelligence

process, the FBI OI has established a formal “INTELLIGENCE

REQUIREMENTS” process for IDENTIFYING intelligence

information (or information) needs and resolving them.
168 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

is Law Enforcement Sensitive.

• Intelligence Bulletin: A finished intelligence product in article format that

describes new developments and evolving trends. The bulletins typically

are SBU and available for distribution to state, local, and tribal law

enforcement.

• Intelligence Information Report: Raw, unevaluated intelligence

concerning “perishable” or time-limited information about criminal or

national security issues. While the full IIR may be classified, state, local,

and tribal law enforcement agencies will have access to SBU

information in the report under the tear line.

An immediate source for FBI intelligence products is the Field Intelligence

Group (FIG).189 In addition, SLTLE agencies are able to gain direct access to

these reports by secure email through Law Enforcement Online (LEO), the

National Law Enforcement Telecommunications System (NLETS), or the

Joint Regional Information Exchange System (JREIS). When

circumstances warrant, the FBI and DHS will produce an intelligence

product jointly and disseminate it to the appropriate agencies. 
169

telephone communications and identifies terrorist associations and

networks 

• The Document Exploitation Unit identifies and disseminates intelligence

gleaned from million of pages of documents or computers seized

overseas by intelligence agencies 

• The Special Technologies and Applications Section provides technical

support for FBI Field Office investigations requiring specialized computer

technology expertise and support 

• The interagency Terrorist Financing Operations Section is devoted

entirely to the financial aspects of terrorism investigations and liaison

with the financial services industry. 

Intelligence gleaned from these special information and analysis resources

is placed in the appropriate format (i.e., Bulletins, Assessments, IIR,

advisories) and distributed to the field through appropriate dissemination

avenues.

Federal Law Enforcement Agency

http://www.fbi.gov/terrorinfo/c

ounterrorism/waronterrorhom

e.htm. 
170 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

between the agencies represented on the NJTTF and other government

agencies. 

• The Office of Law Enforcement Coordination (OLEC). The OLEC was

created to enhance the ability of the FBI to forge cooperation and

substantive relationships with all SLTLE counterparts. The OLEC, which is

managed by FBI Assistant Director Louis Quijas, a former chief of police,

also has liaison responsibilities with the DHS, COPS Office, Office of

Justice Programs, and other federal agencies.

Terrorist Threat Integration Center

(TTIC)191

The mission of TTIC is to enable full integration of terrorist threat-related

information and analysis derived from all information and intelligence

sources in the law enforcement and intelligence communities. The center

is an interagency joint venture where officers will work together to provide

The center will become our

government's central

knowledge bank for

information about known and

suspected terrorists, and will

help ensure effective joint

action across the government

so that our efforts against

terrorists are unified in priority

and purpose. Center

personnel will also prepare

the daily terrorism threat

report that comes to me and

to senior government

officials.” At this writing, no

additional details were

available.

http://www.whitehouse.gov/ne

ws/releases/2004/08/2004082

8.html
171

Security, as well as the broader Intelligence Community, and by creating a

consolidated website for the counterterrorism community. The center is

colocated with counterterrorism elements from the CIA and FBI, further

enhancing coordination efforts.

TTIC is not operational and does not collect intelligence; rather, it receives

collected intelligence from other agencies (FBI, CIA, etc.) and analyzes the

integrated raw information. While not dealing directly with field

components of the FBI or SLTLE, the products disseminated by TTIC serve

as an important source for threat development and prevention.

Terrorist Screening Center (TSC)192

The TSC was created to ensure that government investigators, screeners,

agents, and state and local law enforcement officers have ready access to

the information and expertise they need to respond quickly when a

suspected terrorist is screened or stopped. The TSC consolidates access

Federal Law Enforcement Agency

ssrel03/tscfactsheet091603.ht

m, and

http://www.odci.gov/cia/public

_affairs/speeches/2003/wiley_

speech_02262003.html. 
172 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

receive a notification that the query resulted in the potential match of a

record within the TSDB and the officer is directed to contact the TSC to

determine if it is an actual match. If it is an actual match, the TSC transfers

the call to the FBI's CT Watch to provide operational guidance to the

officer.

Consolidated Terrorist Screening

Database 

The TSC receives international and domestic terrorist identity records and

maintains them in its consolidated TSDB. The TSC reviews each record to

determine which are eligible for entry into the NCIC's Violent Gang and

Terrorist Organization File (VGTOF) and once the record is entered into

NCIC, it is accessible by state, local, and federal law enforcement officers.

If a query by a law enforcement officer matches a name in NCIC, the

officer will be requested, through the NCIC printout, to contact the TSC.

The printout also provides the officer with instructions to arrest, detain,
173

turned up valuable evidence. This new level of information sharing and

cooperation among state, local, and federal law enforcement agencies

enhances our ability to prevent a terrorist attack within the United States.

Department of Homeland Security193

The DHS, through the Directorate of Information Analysis and

Infrastructure Protection (IAIP), will merge the capability to identify and

assess current and future threats to the homeland, map those threats

against our vulnerabilities, issue timely warnings, and take preventive and

protective action.

Intelligence Analysis and Alerts

Actionable intelligence, that is, information that can lead to stopping or

apprehending terrorists, is essential to the primary mission of DHS. The

timely and thorough analysis and dissemination of information about

terrorists and their activities will improve the government's ability to disrupt

Federal Law Enforcement Agency

and security, see

http://www.dhs.gov/dhspublic/

theme_home6.jsp. 
174 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

road, rail, ports, waterways); information and telecommunications

networks; banking and finance systems; postal services; and other assets

and systems vital to our national security, public health and safety,

economy, and way of life. 

Protecting America's critical infrastructure is the shared responsibility of

federal, state, and local government, in active partnership with the private

sector, which owns approximately 85 percent of our nation's critical

infrastructure. The IAIP Directorate will take the lead in coordinating the

national effort to secure the nation's infrastructure. This will give state,

local, and private entities one primary contact instead of many for

coordinating protection activities within the federal government, including

vulnerability assessments, strategic planning efforts, and exercises. 

Cyber Security

Our nation's information and telecommunications systems are directly

connected to many other critical infrastructure sectors, including banking
175

the following: 

• Coordinated DHS-FBI threat warnings and advisories against the

homeland, including physical and cyber events195

• Processes to develop and issue national and sector-specific threat

advisories through the HSAS 

• Terrorist threat information for release to the public, private industry, or

state and local governments.

Figure 11-1 illustrates DHS and intelligence and threat assessment

processes. DHS-FBI advisories are produced in several forms. Figures 11-

2, 11-3, 11-4, and 11-5 are illustrations of DHS advisory templates. SLTLE

agencies have access to these advisories through the various secure law

Federal Law Enforcement Agency
176 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies
Federal Law Enforcement Agency 177
178 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

Protecting America's CRITICAL INFRASTRUCTURE is the

shared responsibility of FEDERAL, STATE, and LOCAL

government, in active PARTNERSHIP with the private sector...
Federal Law Enforcement Agency 179
180 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

http://www.dea.gov/agency/do

mestic.htm#caribbean. 

 Increase the efficiency in the reporting, analysis, storage, retrieval, and

exchange of such information;

• Undertake a continuing review of the narcotics intelligence effort to

identify and correct deficiencies. 

The DEA's Intelligence Program has grown significantly since its inception.

From only a handful of intelligence analysts (I/A) in the domestic offices

and Headquarters in 1973, the total number of intelligence analysts

worldwide is now more than 680. DEA's intelligence Program consists of

several entities that are staffed by both intelligence analysts and special

agents: Intelligence groups and functions in the domestic field divisions,

district, resident and foreign offices, the El Paso Intelligence Center, and
181

the training. Academic programs, the exchange of federal, state, and local

drug experience, and the sharing of, and exposure to, new ideas will result

in more effective application of drug intelligence resources at all levels.

The DEA divides drug intelligence into three broad categories: tactical,

investigative, and strategic. 

• Tactical intelligence is evaluated information on which immediate

enforcement action – arrests, seizures, and interdictions – can be based. 

• Investigative intelligence provides analytical support to investigations

and prosecutions to dismantle criminal organizations and gain resources. 

• Strategic intelligence focuses on the current picture of drug trafficking

from cultivation to distribution that can be used for management decision

making, resource deployment, and policy planning.

Intelligence Products

Tactical and investigative intelligence is available to SLTLE agencies

through the local DEA field office. In addition, intelligence can be shared

with state, local, and tribal agencies through secure email. Many strategic

Federal Law Enforcement Agency
182 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

15 federal agencies, the Texas Department of Public Safety, and the Texas

Air National Guard. Information-sharing agreements with other federal law

enforcement agencies, the Royal Canadian Mounted Police, and each of

the 50 states ensure that EPIC support is available to those who need it. A

telephone call, fax, or email from any of these agencies provides the

requestor with real-time information from different federal databases, plus

EPIC's own internal database. 

In addition to these services, a number of EPIC programs are dedicated to

post-seizure analysis and the establishment of links between recent

enforcement actions and ongoing investigations. EPIC also coordinates

training for state and local officers in the methods of highway drug and

drug currency interdiction through its Operation Pipeline program. In

addition, EPIC personnel coordinate and conduct training seminars

throughout the United States, covering such topics as indicators of

trafficking and concealment methods used by couriers. 

In a continuing effort to stay abreast of changing trends, EPIC has
183

investigations. The DEA drew from the experience of state and local

agencies to make certain that their concerns were addressed and that they

had extensive input and involvement in the development of the system. 

The National Drug Pointer Index (NDPIX) became operational across the

United States in October 1997. The National Law Enforcement

Telecommunications System (NLETS)–a familiar, fast, and effective network

that reaches into almost every police entity in the United States–is the

backbone of the NDPIX. Participating agencies are required to submit

Federal Law Enforcement Agency

The National Law Enforcement Telecommunications System

(NLETS)-a familiar, fast, and effective network that reaches

into almost every police entity in the United States-is the

backbone of the NDPIX. 
184 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

Characteristics of the NVPS will include the following:

• It will cover all crimes, not just drugs.

• The system will accept only targets of open investigations with assigned

case numbers. 

• Transaction formats will contain an identifying field for the NVPS

Identifier. 

• It will use a secure telecommunications network. 

• It will use the NDPIX “Mandatory” data elements. 

• A single sign-on from any participant will allow access to all

participating pointer databases. 

• Each system will provide a userid and password to its respective users. 

• Each system will maintain its own data. 

• Uniform Crime Reporting (UCR) or the National Incident-Based Reporting

System (NIBRS) codes will be used to identify type of crime. 

• The system will target deconfliction for all crimes.
185

• To support national policymakers and law enforcement decision makers

with strategic domestic drug intelligence

• To support Intelligence Community counterdrug efforts

• To produce national, regional, and state drug threat assessments.

The Intelligence Division consists of six geographic units and four

specialized units. The six geographic units correspond to the regions of

the Department of Justice Organized Crime Drug Enforcement Task Force

(OCDETF)201 program and concentrate on drug trafficking and abuse. The

four specialized units include the Drug Trends Analysis Unit, the Organized

Crime and Violence Unit, the National Drug Threat Assessment Unit, and

the National Interdiction Support Unit.

Within the geographic units, NDIC intelligence analysts cover each state

and various U.S. territories. Intelligence analysts maintain extensive

contacts with federal, state, and local law enforcement and Intelligence

Federal Law Enforcement Agency

information collection. For

more information see

http://www.usdoj.gov/dea/prog

rams/ocdetf.htm. 
186 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

primary drug threat to the nation, monitors fluctuations in consumption

levels, tracks drug availability by geographic market, and analyzes

trafficking and distribution patterns. The report highlights the most

current quantitative and qualitative information on availability, demand,

production and cultivation, transportation, and distribution, as well as the

effects of a particular drug on abusers and society as a whole.

• State Drug Threat Assessment provides a detailed threat assessment of

drug trends within a particular state. Each report identifies the primary

drug threat in the state and gives a detailed overview of the most current

trends by drug type.

• Information Bulletins are developed in response to new trends or highpriority drug issues. They are relayed quickly to the law enforcement and

intelligence communities and are intended to warn law enforcement

officials of emerging trends.

High-Intensity Drug Trafficking Areas
187

assessments and providing event and target deconfliction are also among

the centers' core missions. These core functions are critical to building

trust and breaking down parochialism between and among the local, state,

and federal participating law enforcement agencies.

The plan to connect all HIDTA Intelligence Centers through RISS.net was

initiated by the HIDTA Program Office at ONDCP in 1999 and completed in

mid-2003. The HIDTA Program Office has commissioned interagency and

interdisciplinary working committees to develop a national informationsharing plan, focusing on issues relating to legal, agency policy, privacy,

technical, and logistical information-sharing matters. HIDTA program and

committee personnel are coordinating with, and implementing

recommendations made by, other information-sharing initiatives such as

Global, Matrix, and federally sponsored intelligence programs.204

Bureau of Alcohol, Tobacco, Firearms

Federal Law Enforcement Agency

HIDTA programs and

intelligence centers, see

http://www.ncjrs.org/ondcppub

s/publications/enforce/hidta20

01/ca-fs.html. 

205 Contact your local ATF Field

Office for Intelligence

Products and resources.

Offices and contact

information can be found at

http://www.atf.gov/field/index.

htm.
188 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

Intelligence Group works under the authority of a supervisory special

agent. The intelligence group supervisors are coordinated by, and work in

conjunction with, the Intelligence Division to form a bureau-wide

intelligence infrastructure. The Intelligence Division has provided

indoctrination and training for all Field Intelligence Group supervisors,

intelligence officers, and intelligence research specialists. 

ATF maintains intelligence partnerships with the NDIC, EPIC, FinCEN,

INTERPOL, the Federal Bureau of Investigation Counter Terrorism Center,

(FBI/CTC) and other international intelligence sources. Furthermore, ATF

maintains a memorandum of understanding (MOU) with the six Regional

Information Sharing Systems (RISS) that represent thousands of SLTLE

agencies, pledging to share unique and vital intelligence resources. These

external partners are key components of ATF's Strategic Intelligence Plan

and the means by which ATF ensures a maximum contribution to the

nation's law enforcement and intelligence communities. 
189

inspectors on the use of the N-FOCIS applications. ATF is planning to

expand the N-FOCIS functionality and to integrate N-FOCIS with several

key ATF applications including the National Revenue Center, the National

Tracing Center, National Arson and Explosive Repository, and the

Intelligence Division's Text Management System. This integration plan

establishes N-FOCIS as the bureau's information backbone. 

The Intelligence Division prepares a wide range of strategic intelligence

reports related to the ATF mission that are available to SLTLE. In addition,

intelligence is shared with state and local agencies through RISS and the

JTTFs. In addition, ATF will readily respond to inquiries wherein SBU

information may be shared.

ATF has also created a series of Regional Crime Gun Centers. The intent of

the centers is to integrate gun tracing with ATF intelligence as well as with

the HIDTA Regional Intelligence Centers to suppress gun-related crime .206

Financial Crimes Enforcement

Federal Law Enforcement Agency
190 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

Illicit financial transactions can take many routes – some complex, some

simple, but all increasingly inventive – with the ultimate goal being to

disguise its source. The money can move through banks, check cashers,

money transmitters, businesses, casinos, and is often sent overseas to

become “clean.” The tools of the money launderer can range from

complicated financial transactions, carried out through webs of wire

transfers and networks of shell companies, to old-fashioned currency

smuggling.

Intelligence research specialists and law enforcement support staff

research and analyze this information and other critical forms of

intelligence to support financial criminal investigations. The ability to

network with a variety of databases provides FinCEN with one of the

largest repositories of information available to law enforcement in the

country. Safeguarding the privacy of the data it collects is an overriding

responsibility of the agency and its employees-a responsibility that strongly

imprints all of its data management functions and operations.
191

(IACP), National Association of Attorneys General (NAAG), National White

Collar Crime Center (NW3C), and other organizations to inform law

enforcement about the information that is available at FinCEN and how to

use that information to attack criminal proceeds.

High Risk Money Laundering and

Related Financial Crimes Areas

(HIFCA)208

HIFCAs were first announced in the 1999 National Money Laundering

Strategy and were conceived in the Money Laundering and Financial

Crimes Strategy Act of 1998 as a means of concentrating law enforcement

efforts at the federal, state, and local levels in highintensity money

laundering zones. HIFCAs may be defined geographically or they can also

be created to address money laundering in an industry sector, a financial

institution, or group of financial institutions. 

Federal Law Enforcement Agency
192 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

rather than relying on the resources of an intermediary agency to obtain

financial records. A unique feature of Gateway is the “query alert”

mechanism that automatically signals FinCEN when two or more agencies

have an interest in the same subject. In this way, FinCEN is able to assist

participating agencies in coordinating their investigations.

Virtually every criminal enterprise and terrorist organization is involved in

some dimension of money laundering. The complexities of forensic

accounting, often complicated by jurisdictional barriers, reinforces the

need for intelligence personnel to be aware of the resources and expertise

available through FinCEN.

CONCLUSION

As demonstrated in this chapter, the amount of information and intelligence
193

Federal Law Enforcement Agency
194 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies
12

Summary, Conclusions, and Next Steps
CHAPTER TW
197

Effective law enforcement intelligence operations are

confusing, controversial, difficult, and effective. Intelligence is

confusing because many people do not make the distinction

between law enforcement intelligence and national security

intelligence. Moreover, the term is used generically to

describe a wide body of activities, thereby contributing to the

confusion. One purpose of this guide was to provide

consistent and clear definitions that are accepted by both law

enforcement intelligence professionals and the national

standards of the National Criminal Intelligence Sharing Plan,

Global Justice Information Sharing Initiative, and the Global

Intelligence Working Group.
198 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

Intelligence operations are difficult as well. It requires work to establish

links with different law enforcement organizations and groups to maximize

effective information sharing. It also requires a redistribution of resources

to make the intelligence function perform effectively and to meet

operational and training standards set out in the National Criminal

Intelligence Sharing Plan. A change in culture is required for IntelligenceLed Policing to become a reality and a realignment of priorities may be

needed to accomplish new goals. There is always resistance to change

and always legitimate competing interests that must be weighed. 

Finally, law enforcement intelligence processes can be effective.

Intelligence can help identify suspected criminals, targets of terrorists, and

activities of criminal enterprises that occur in a community. It takes

diverse and often disparate information, integrates it into a cohesive

package, and provides insight that might otherwise be lost. Increasingly,

law enforcement intelligence is more thorough, of higher quality, and

disseminated more broadly as a result of cooperative initiatives such as the

region for training

opportunities. RCPIs can be

found by state at:

http://www.cops.usdoj.gov/def

ault.asp?Item=229. 

210 The COPS Office sponsored

an executive session with the

Police Executive Research

Forum that examined this

topic. The resulting white

paper, Working with Diverse

Communities, is a valuable

resource. It can be found at:

http://www.cops.usdoj.gov/mi

me/open.pdf?Item=1364.
199

Implementing new intelligence initiatives can be difficult. As a road map to

accomplish this, the author recommends a process referred to as “Rcubed”: Reassessing, Refocusing, and Reallocating (R3).

The intent of the R3 exercise is to provide a framework for organizational

change as related to intelligence responsibilities. It requires a critical selfassessment of responsibilities and resources; objectivity absent special

interests; realistic perspectives; both tactical and strategic considerations

of traditional and new policing responsibilities; and methods (including

financing) of how all police responsibilities will be accomplished. This is a

labor-intensive, difficult process that cannot be rushed and should be

inclusive, that is, consideration of the inputs of others–employees,

community members, elected officials, other agencies–should be included

in the process. Final decisions, however, remain with law enforcement

administrators to make changes as best determined by their collective

judgment of responsibilities, priorities, and available resources. 

Summary, Conclusions, and Next Steps

211 Carter, David L. (2000). The

Police and Community. 7th

ed. Upper Saddle River, NJ:

Prentice-Hall.
200 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

investigative capacity for terrorism; obligation to assign personnel to the

Joint Terrorism Task Force

• Resources that can be used to help with police responsibilities of all

forms, e.g., police reserves, volunteers, expertise in other agencies,

community organizations

• Objective assessment of threats and potential targets within the

community and within the region (the latter includes how

multijurisdictional crime and terrorist threats would affect an agency

directly and indirectly, including mutual aid obligations)

• Current intelligence expertise and practices, including information

sharing, and the need to modify these practices, including adding a

private sector component for critical infrastructure.

• Political mandates from elected officials and/or the community that

should not be ignored because expectations and concerns of these

groups must be taken into account in any assessment process.
201

with the addition of intelligence/homeland security and that all

responsibilities will be affected to some degree. Therefore, to determine

this realignment, responsibilities and weights must be stipulated.

Third, these changes are actually implemented through the issuance of

updated (and new when applicable) policies, procedures, and orders.

Implementation also requires communication and, in some cases, inservice training to explain and clarify the changes. 

Reallocating

Once refocusing decisions have been made, the department must

reallocate its resources to meet adjusted priorities. This includes

personnel, operating expenses, equipment (from cars to radios to

computers), and office space, as needed. There is always the possibility

Summary, Conclusions, and Next Steps
202 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

agencies are facing a new challenge. Throughout the history of policing

challenges have been faced, they have been met with resolute

determination, and America has been safer as a result. This new challenge

is no different. The intent of this guide has been to help America's state,

local, and tribal law enforcement agencies make this journey.

Throughout the history of POLICING CHALLENGES have been

faced, they have been met with RESOLUTE DETERMINATION,

and AMERICA has BEEN SAFER as a result. 
Appendices
APPENDIX 
205
206 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

William Mizner

Chief 

Norfolk Police Department

202 N. 7th Street

Norfolk, NE 68701

Theodore Quasula

Chief Law Enforcement Officer

Las Vegas Paiute Tribe Police

1 Paiute Drive

Las Vegas, NV 89106

Bill Young

Sheriff 

Las Vegas Metropolitan Police

Department

400 Stewart Avenue

Las Vegas, NV 89101-2984

William Parrish

Senior Representative

Dept. of Homeland Security, Liaison Office

FBI HQ Room 5885

935 Pennsylvania Avenue, NW

Washington, DC 20535

Darrel Stephens 

Chief

Charlotte-Mecklenburg Police Department

601 East Trade Street

Charlotte, NC 28202

APPENDIX 
209

Guidelines 212
210 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

2. Are suspected of being involved in criminal activities with known

or suspected crime figures.

B. Organizations, businesses, and groups that:

1. Are suspected of being involved in the actual or attempted

planning, organizing, financing, or commission of criminal acts; or

2. Are suspected of being operated, controlled, financed, or

infiltrated by known or suspected crime figures for use in an

illegal manner.

III. FILE CONTENT

Only information with a criminal predicate and which meets the agency's

criteria for file input should be stored in the criminal intelligence file.

Specifically excluded material includes:
211

State law or local regulations may dictate whether or not public record and

intelligence information should be kept in separate files or commingled.

Some agencies believe that separating their files will prevent the release of

intelligence information in the event a subpoena is issued. This belief is

unfounded, as all information requested in the subpoena (both public and

intelligence) must be turned over to the court. The judge then makes the

determination on what information will be released. 

The decision to commingle or separate public and intelligence documents

is strictly a management decision. In determining this policy, administrators

should consider the following:

A. Records relating to the conduct of the public's business that are

prepared by a state or local agency, regardless of physical form or

characteristics, may be considered public and the public has access

to these records.

Appendices
212 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

IV. FILE CRITERIA

All information retained in the criminal intelligence file should meet file

criteria prescribed by the agency. These criteria should outline the

agency's crime categories and provide specifics for determining whether

subjects involved in these crimes are suitable for file inclusion.

File input criteria will vary among agencies because of differences in size,

functions, resources, geographical location, crime problems, etc. The

categories listed in the suggested model below are not exhaustive.

A. Permanent Status

1. Information that relates an individual, organization, business, or

group is suspected of being involved in the actual or attempted

planning, organizing, financing, or committing of one or more of

the following criminal acts:
213

Identification at the time of file input is necessary to distinguish

the subject/entity from existing file entries and those that may be

entered at a later time. NOTE: The exception to this rule involves

modus operandi (MO) files. MO files describe a unique method of

operation for a specific type of crime (homicide, fraud) and may

not be immediately linked to an identifiable suspect. MO files may

be retained indefinitely while additional identifiers are sought.

B. Temporary Status:

Information that does not meet the criteria for permanent storage but may

be pertinent to an investigation involving one of the categories previously

listed should be given “temporary” status. It is recommended the retention

of temporary information not exceed 1 year unless a compelling reason

exists to extend this time period. (An example of a compelling reason is if

Appendices
214 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

jointly involved in illegal activities.

- Criminal history – individual, organization, business, or group

(not currently reported to be criminally active) that has a

history of criminal conduct, and the circumstances currently

being reported (i.e., new position or ownership in a business)

indicates they may again become criminally active.

3. Reliability/validity unknown – the reliability of the information

sources and/or the validity of the information cannot be

determined at the time of receipt; however, the information

appears to be significant and merits temporary storage while

verification attempts are made.
215

(B) Usually Reliable – The reliability of the source can usually be relied

upon as factual. The majority of information provided in the past has

proven to be reliable.

(C) Unreliable – The reliability of the source has been sporadic in the past.

(D) Unknown –The reliability of the source cannot be judged. Its

authenticity or trustworthiness has not yet been determined by either

experience or investigation.

Content Validity:

(1) Confirmed – The information has been corroborated by an investigator

or another independent, reliable source.

Appendices
216 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

an ongoing basis to ascertain whether a higher or lesser degree of

document security is required to ensure that information is released only

when and if appropriate.

Classification systems may differ among agencies as to the number of

levels of security and release authority. In establishing a classification

system, agencies should define the types of information for each security

level, dissemination criteria, and release authority. The system listed below

classifies data maintained in the Criminal Intelligence File according to one

of the following categories: 

Sensitive

1. Information pertaining to significant law enforcement cases currently

under investigation.
217

2. Nonconfidential information prepared for/by law enforcement

agencies.

Unclassified

1. Civic-related information to which, in its original form, the general public

had direct access (i.e., public record data).

2. News media information – newspaper, magazine, and periodical

clippings dealing with specified criminal categories.

VII. INFORMATION SOURCE

In all cases, source identification should be available in some form. The

true identity of the source should be used unless there is a need to protect

the source. Accordingly, each law enforcement agency should establish

Appendices
218 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

enforcement source of the police department saw a particular event at a

particular time).

VIII. INFORMATION QUALITY CONTROL

Information to be stored in the criminal intelligence file should undergo a

thorough review for compliance with established file input guidelines and

agency policy prior to being filed. The quality control reviewer is

responsible for seeing that all information entered into the criminal

intelligence files conforms with the agency's file criteria and has been

properly evaluated and classified.

IX. FILE DISSEMINATION

Agencies should adopt sound procedures for disseminating stored

information. These procedures will protect the individual's right to privacy

as well as maintain the confidentiality of the sources and the file itself.
219

recommended that stored information be classified according to a system

similar to the following.

The integrity of the criminal intelligence file can be maintained only by

strict adherence to proper dissemination guidelines. To eliminate

unauthorized use and abuses of the system, a department should utilize a

dissemination control form that could be maintained with each stored

document. This control form would record the date of the request, the

name of the agency and individual requesting the information, the need-toknow, the information provided, and the name of the employee handling the

request. Depending upon the needs of the agency, the control form also

may be designed to record other items useful to the agency in the

management of its operations. This control form also may be subject to

discovery.

Appendices
220 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

y 

appropriate.

Law enforcement agencies have an obligation to keep stored information

on subjects current and accurate. Reviewing of criminal intelligence should

be done on a continual basis as agency personnel use the material in

carrying out day-to-day activities. In this manner, information that is no

longer useful or that cannot be validated can immediately be purged or

reclassified where necessary.

To ensure that all files are reviewed and purged systematically, agencies

should develop purge criteria and schedules. Operational procedures for

the purge and the method of destruction for purged materials should be

established.
221

3. Accuracy and Completeness

Is the information still valid?

Is the information adequate for identification purposes?

Can the validity of the data be determined through investigative

techniques?

B. Review and Purge Time Schedule:

Reclassifying and purging information in the intelligence file should be

done on an ongoing basis as documents are reviewed. In addition, a

complete review of the criminal intelligence file for purging purposes

should be undertaken periodically. This review and purge schedule can

vary from once each year for documents with temporary status to once

every 5 years for permanent documents. Agencies should develop a

schedule best suited to their needs and should contact their legal counsel

for guidance.

Appendices
222 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

Public record includes any writing containing information relating to the

conduct of the public's business prepared, owned, used, or retained by any

state or local agency regardless of physical form or characteristics.

“Member of the public” means any person, except a member, agent,

officer, or employee of a federal, state, or local agency acting within the

scope of his or her membership in an agency, office, or employment.

For purposes of these guidelines, public record information includes only

that information to which the general public normally has direct access,

(i.e., birth or death certificates, county recorder's information,

incorporation information, etc.)
223

Appendices
APPENDIX 
225
226 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

International Association of Chiefs of Police (IACP) Model Criminal

Intelligence Policy?218

 Yes  No

6. Does the police department subscribe to the standards of the Law

Enforcement Intelligence Unit (LEIU) Criminal Intelligence File

Guidelines?219 

 Yes  No

7. Does the police department subscribe to the IACP Code of Ethics 220 or

have an articulated Code of Ethics?

 Yes  No

8. Does the police department subscribe to the IACP Code of Conduct 221

or have an articulated Code of Conduct?

 Yes  No

9. Does the police department have an articulated Statement of Values?222

 Yes  No

10. Does the police department adhere to the regulations of 

28 CFR Part 23223 for its Criminal Intelligence Records System?

 Yes  No

links.jsp?link_id=3773

220 http://www.theiacp.org/

documents/index.cfm?

fuseaction=document&

document_type_id=1&

document_id=95

221 http://www.theiacp.org/

documents/index.cfm?

fuseaction=document&

document_type_id=1&

document_id=94

222 As one good example, see

the Santa Clara, CA Police

Department's Value

Statements at

http://www.scpd.org/value_sta

tement.html. 

223 http://www.iir.com/28cfr/
227

/intelsharingreport%2Epdf

227 E.g., collection, analysis,

collation, dissemination,

contact point for other

agencies, clearinghouse, etc.

g

 Yes  No

2. Is the purpose and role of the Unit clearly articulated and related to

the Police Department's Mission Statement?

 Yes  No

3. Have priorities been established for the types of crimes the Unit will

address?

 Yes  No

a. Is any written rationale provided for these priorities?

 Yes  No

4. Are expected activities of the unit articulated?227

 Yes  No

5. Does the mission statement express ethical standards?

 Yes  No

6. Does the mission statement express the importance of protecting

citizens' rights?

 Yes  No

Appendices
228 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

2. Management of Information:

228 Definitional Standards (see chart on next

page)

1. Are there standard terms used in intelligence activities that have been

operationally defined in writing so that all persons in the department

know the explicit meaning and implications of the terms?

 Yes  No

2. What is the source of the definitions? 

 NCISP  Federal Agency

 Mixed  N/A

3. Has the department articulated standards for classifying information in

the Intelligence Unit?

 Yes  No
229

8. Are there standardized definitions of the validity scale?

 Yes  No

9. Does the Intelligence Unit have operational definitions that can be

applied to a person under investigation or a series of related crimes

where the perpetrator is not identifiable in order to classify the case

file as either a “permanent file” or a “temporary file”?

 Yes  No

If Yes...

a. Are the types of identifying information that should be placed in 

the file articulated?

 Yes  No

b. Is there a procedure for requiring the articulation of the criminal 

predicate for the permanent file?

 Yes  No

Appendices
230 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

2. What types of source documents are entered into the Intelligence

Records System?229

Describe:

3. Does the police department have a written directive that the rationale

for each source document entered into the Intelligence Records

System must be articulated in a report or notation?

 Yes  No

bases; field interview reports,

newspaper and open-source

materials, informant

statements, etc.
231

3. Does the department have written procedures for the retention of

records in the Intelligence Records System?

 Yes  No

6. Management of Information: Retention and Purging of Records

1. Does the retention process adhere to the guidelines of 28 CFR Part 23?

 Yes  No

2. Does the retention policy and procedure include written criteria for

purging information?

 Yes  No

Appendices
232 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

8. After information has been purged from a computerized Intelligence

Records System, is free space on the hard drive and/or specific

purged files electronically “wiped”?

 Yes  No

a. Are back-ups wiped?

 Yes  No
233

11. Who is responsible for ensuring compliance of the purge process?

Position/Classification:

7. Management of Information: Personal/Individually-Held Records and

Files

1. Is there an intelligence unit policy and procedures concerning the

retention of individual notes and records that identifies persons

wherein criminality is suspected but is not in either a temporary or

permanent file and is not entered into any formal records system or

database?

 Yes  No

Appendices
234 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

4. Can the computerized records system be accessed through remote

access?

 Yes  No

a. If so, what security controls exist for remote access?

Describe:
235

Describe:

10. What audit process is in place for access to physical records?

Describe:

Appendices
236 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

Describe:

9. Physical Location of the Intelligence Unit and Records

1. Sufficiency: Is the Intelligence Unit in a physical location that has

sufficient space to perform all of its responsibilities?

 Yes  No

2. Security: Is the Intelligence Unit in a physical location wherein the

entire workspace may be completely secured?

 Yes  No
237

 Yes  No

a. Is a background investigation conducted and a comprehensive 

descriptive file completed on each confidential informant?

 Yes  No

b. Are informant files secured separately from intelligence files?

 Yes  No

2. Is there a formally articulated policy and procedures concerning

undercover operations that apply to members of the Intelligence Unit?

 Yes  No

3. Does the police department have a policy on alcohol consumption for

officers working undercover?

 Yes  No

a. Does the police department have a policy requiring designated 

drivers for undercover officers who have consumed alcohol?

 Yes  No

Appendices

the unit for information

collection. Understanding the

management and control of

these activities can be

important for the intelligence

commander for they can

reflect the validity, reliability,

and constitutional

admissibility of the

information collected.
238 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

 Yes [How Often? ]  No

Section C: Personnel

1. Is a position classification plan in place that provides a clear job

description for each position in the unit?

 Yes  No

2. Is a position classification plan in place that articulates Knowledge,

Skills and Abilities (KSAs) for each position?

 Yes  No

3. Is there sufficient hierarchical staff (managers/supervisors) assigned

to the unit to effectively perform supervisory responsibilities?

 Yes  No

4. Is there sufficient functional staff (analysts and/or investigators) to

effectively fulfill defined unit responsibilities?

 Yes  No
239

1. Training

1. What types of training do preservice and newly assigned personnel

receive?

 None  Some–Describe:

a. Are newly assigned sworn employees to the Intelligence Unit

required to attend 28 CFR Part 23 training?

 Yes  No

b. Are newly hired or assigned non-sworn employees required to

attend 28 CFR Part 23 training?

 Yes  No

Appendices
240 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

 Yes  No

e. National White Collar Crime Center Foundations of Intelligence 

Analysis?

 Yes  No

f. Regional Counterdrug Training Academy Intelligence Operations 

Course?

 Yes  No

2. Supervision

1. Does supervision effectively monitor adherence to written procedures?

 Yes  No

2. Does supervision effectively monitor adherence to guidelines adopted

by the department?

 Yes  No
241

 Yes  No

6. Is there effective supervision of the Intelligence Unit throughout the

chain of command external to the Intelligence Unit?

 Yes  No

Section D: Fiscal Management

1. Is the budget sufficient to fulfill the stated mission?

 Yes  No

2. Does the Intelligence Commander have input into the budget planning

process?

 Yes  No

Appendices

component.
242 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

pgpy 

organizational entity?

a. Number and type of analytic products delivered for investigative 

purposes?

 Yes  No  NA

b. Number and type of analytic products that led to arrest?

 Yes  No  NA

c. Assets seized from illegal activities wherein intelligence 

contributed to the arrest and/or seizure?

 Yes  No  NA

d. Number and types of strategic intelligence products delivered to 

the command staff?

 Yes  No  NA

e. Number of intelligence-sharing meetings attended by unit staff?

 Yes  No  NA

f. Number of briefings provided by the intelligence staff?

 Yes  No  NA

easily.
243

state, or federal fiscal or program auditor seeks to audit the

Intelligence Unit?

 Yes  No

If Yes, Describe:

Appendices
244 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

a. An inventory of threats in the region posed by criminal 

enterprises, terrorists, and criminal extremists?

 Yes  No

b. An assessment of the threats with respect to their probability of 

posing a criminal or terrorist threat to the region?

 Yes  No

c. A target or criminal commodity analysis of the region?

 Yes  No

d. A target or criminal commodity vulnerability assessment in the 

region?

 Yes  No

3. For each identified threat, have intelligence requirements been

articulated?

 Yes  No
245

3. Is the police department a member of the Regional Information Sharing

System?235

 Yes  No

4. Is a systematic procedure in place to ensure that advisories and

notifications transmitted via the National Law Enforcement Teletype

System (NLETS) are forwarded to the Intelligence Unit?

 Yes  No

5. Are you connected to any state-operated intelligence or information

networks?

 Yes  No

If Yes, Describe:

Appendices
246 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

Who must approve the MOU?

Section H: Legal Issues

1. Is there a designated person in the police department who reviews

Freedom of Information Act requests directed to the intelligence unit?

 Yes  No

2. Is there a designated person in the police department who responds to

Privacy Act inquiries directed to the intelligence unit?

 Yes  No

entity, they are possibly in

conflict. In order to

“deconflict”, the pointer

system notifies both agencies

of their mutual interest in a

case/person in order to avoid

duplication of effort,

conflicting approaches, and

increasing efficiency and

effectiveness.

237 NVPS integrates HIDTA,

NDPIX, and RISS pointers via

secure web-based

communications.
247

Appendices
APPENDIX 
249
250 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

the privacy and constitutional rights of individuals. 

§ 23.2 Background.

It is recognized that certain criminal activities including but not limited to

loan sharking, drug trafficking, trafficking in stolen property, gambling,

extortion, smuggling, bribery, and corruption of public officials often involve

some degree of regular coordination and permanent organization involving

a large number of participants over a broad geographical area. The

exposure of such ongoing networks of criminal activity can be aided by the

pooling of information about such activities. However, because the

collection and exchange of intelligence data necessary to support control

of serious criminal activity may represent potential threats to the privacy of

individuals to whom such data relates, policy guidelines for Federally

funded projects are required. 

Library of Congress website

by retrieving the regulation

from the Code of Federal

Regulations (CFR) search

engine at:

http://www.gpoaccess.gov/cfr/

index.html. 
251

Federal, or other governmental unit which exercises law enforcement or

criminal investigation authority and which is authorized to submit and

receive criminal intelligence information through an interjurisdictional

intelligence system. A participating agency may be a member or a

nonmember of an interjurisdictional intelligence system; (5) Intelligence

Project or Project means the organizational unit which operates an

intelligence system on behalf of and for the benefit of a single agency or

the organization which operates an interjurisdictional intelligence system

on behalf of a group of participating agencies; and (6) Validation of

Information means the procedures governing the periodic review of

criminal intelligence information to assure its continuing compliance with

system submission criteria established by regulation or program policy.

§ 23.20 Operating principles.

(a) A project shall collect and maintain criminal intelligence information

concerning an individual only if there is reasonable suspicion that the

individual is involved in criminal conduct or activity and the information is

relevant to that criminal conduct or activity.

Appendices
252 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

information which has been obtained in violation of any applicable Federal,

State, or local law or ordinance. In an interjurisdictional intelligence

system, the project is responsible for establishing that no information is

entered in violation of Federal, State, or local laws, either through

examination of supporting information submitted by a participating agency

or by delegation of this responsibility to a properly trained participating

agency which is subject to routine inspection and audit procedures

established by the project. 

(e) A project or authorized recipient shall disseminate criminal intelligence

information only where there is a need to know and a right to know the

information in the performance of a law enforcement activity.

(f) (1) Except as noted in paragraph (f) (2) of this section, a project shall

disseminate criminal intelligence information only to law enforcement
253

inquirers need to know and right to know the information being requested

either through inquiry or by delegation of this responsibility to a properly

trained participating agency which is subject to routine inspection and

audit procedures established by the project. Each intelligence project shall

assure that the following security requirements are implemented:

(1) Where appropriate, projects must adopt effective and

technologically advanced computer software and hardware designs to

prevent unauthorized access to the information contained in the

system;

(2) The project must restrict access to its facilities, operating

environment and documentation to organizations and personnel

authorized by the project;

(3) The project must store information in the system in a manner such

that it cannot be modified, destroyed, accessed, or purged without

authorization;

Appendices
254 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

explanation of decision to retain. Information retained in the system must

be reviewed and validated for continuing compliance with system

submission criteria before the expiration of its retention period, which in no

event shall be longer than five (5) years. 

(i) If funds awarded under the Act are used to support the operation of an

intelligence system, then:

(1) No project shall make direct remote terminal access to intelligence

information available to system participants, except as specifically

approved by the Office of Justice Programs (OJP) based on a

determination that the system has adequate policies and procedures in

place to insure that it is accessible only to authorized systems users;

and

(2) A project shall undertake no major modifications to system design

without prior grantor agency approval.
255

maintain in its agency files information which documents each submission

to the system and supports compliance with project entry criteria.

Participating agency files supporting system submissions must be made

available for reasonable audit and inspection by project representatives.

Project representatives will conduct participating agency inspection and

audit in such a manner so as to protect the confidentiality and sensitivity of

participating agency intelligence records.

(o) The Attorney General or designee may waive, in whole or in part, the

applicability of a particular requirement or requirements contained in this

part with respect to a criminal intelligence system, or for a class of

submitters or users of such system, upon a clear and convincing showing

that such waiver would enhance the collection, maintenance or

dissemination of information in the criminal intelligence system, while

ensuring that such system would not be utilized in violation of the privacy

and constitutional rights of individuals or any applicable state or federal

law. 

Appendices
256 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

(3) Are not limited to one jurisdiction.

(c) The head of a government agency or an individual with general policy

making authority who has been expressly delegated such control and

supervision by the head of the agency will retain control and supervision of

information collection and dissemination for the criminal intelligence

system. This official shall certify in writing that he or she takes full

responsibility and will be accountable for the information maintained by

and disseminated from the system and that the operation of the system will

be in compliance with the principles set forth in § 23.20.

(d) Where the system is an interjurisdictional criminal intelligence system,

the governmental agency which exercises control and supervision over the

operation of the system shall require that the head of that agency or an

individual with general policymaking authority who has been expressly

delegated such control and supervision by the head of the agency: 
257

(a) Awards for the funding of intelligence systems will receive specialized

monitoring and audit in accordance with a plan designed to insure

compliance with operating principles as set forth in § 23.20. The plan shall

be approved prior to award of funds. 

(b) All such awards shall be subject to a special condition requiring

compliance with the principles set forth in § 23.20. 

(c) An annual notice will be published by OJP which will indicate the

existence and the objective of all systems for the continuing

interjurisdictional exchange of criminal intelligence information which are

subject to the 28 CFR Part 23 Criminal Intelligence Systems Policies.

Appendices
258 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

SUPPLEMENTARY INFORMATION: The rule which this rule supersedes had

been in effect and unchanged since September 17, 1980. A notice of

proposed rulemaking for 28 CFR part 23, was published in the Federal

Register on February 27, 1992, (57 FR 6691). 

The statutory authorities for this regulation are section 801(a) and section

812(c) of title I of the Omnibus Crime Control and Safe Streets Act of 1968,

as amended, (the Act), 42 U.S.C. 3782(a) and 3789g(c). 42 U.S.C. 3789g (c)

and (d) provide as follows:

CONFIDENTIALITY OF INFORMATION

Sec. 812.... 

(c) All criminal intelligence systems operating through support under this

title shall collect, maintain, and disseminate criminal intelligence

information in conformance with policy standards which are prescribed by

the Office of Justice Programs and which are written to assure that the
259

CRIMINAL INTELLIGENCE SHARING SYSTEMS; POLICY CLARIFICATION

AGENCY: Bureau of Justice Assistance (BJA), Office of Justice Programs

(OJP), Justice.

ACTION: Clarification of policy.

SUMMARY: The current policy governing the entry of identifying

information into criminal intelligence sharing systems requires clarification.

This policy clarification is to make clear that the entry of individuals,

entities and organizations, and locations that do not otherwise meet the

requirements of reasonable suspicion is appropriate when it is done solely

for the purposes of criminal identification or is germane to the criminal

subject's criminal activity. Further, the definition of “criminal intelligence

system” is clarified.

Appendices
260 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

received, but was not addressed to the subject of this clarification.

Use of Identifying Information

28 CFR 23.3(b)(3) states that criminal intelligence information that can be

put into a criminal intelligence sharing system is “information relevant to

the identification of and the criminal activity engaged in by an individual

who or organization which is reasonably suspected of involvement in

criminal activity, and *** [m]eets criminal intelligence system submission

criteria.” Further, 28 CFR 23.20(a) states that a system shall only collect

information on an individual if “there is reasonable suspicion that the

individual is involved in criminal conduct or activity and the information is

relevant to that criminal conduct or activity.” 28 CFR 23.20(b) extends that

limitation to collecting information on groups and corporate entities.

In an effort to protect individuals and organizations from the possible taint

of having their names in intelligence systems (as defined at 28 C.F.R. Sec.
261

use of identifying information. Information that is relevant to the

identification of a criminal suspect or to the criminal activity in which the

suspect is engaged may be placed in a criminal intelligence database,

provided that (1) appropriate disclaimers accompany the information noting

that is strictly identifying information, carrying no criminal connotations; (2)

identifying information may not be used as an independent basis to meet

the requirement of reasonable suspicion of involvement in criminal activity

necessary to create a record or file in a criminal intelligence system; and

(3) the individual who is the criminal suspect identified by this information

otherwise meets all requirements of 28 CFR Part 23. This information may

be a searchable field in the intelligence system.

For example: A person reasonably suspected of being a drug dealer is

known to conduct his criminal activities at the fictional “Northwest

Market.” An agency may wish to note this information in a criminal

intelligence database, as it may be important to future identification of the

suspect. Under the previous interpretation of the regulation, the entry of

Appendices
262 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

The definition of a “criminal intelligence system” is given in 28 CFR

23.3(b)(1) as the “arrangements, equipment, facilities, and procedures used

for the receipt, storage, interagency exchange or dissemination, and

analysis of criminal intelligence information ***.” Given the fact that crossdatabase searching techniques are now common-place, and given the fact

that multiple databases may be contained on the same computer system,

BJA has determined that this definition needs clarification, specifically to

differentiate between criminal intelligence systems and non-intelligence

systems. 

The comments to the 1993 revision of 28 CFR Part 23 noted that “[t]he term

'intelligence system' is redefined to clarify the fact that historical telephone

toll files, analytical information, and work products that are not either

retained, stored, or exchanged and criminal history record information or

identification (fingerprint) systems are excluded from the definition, and
263

Such precautions should be consistent with the above clarification of the

rule governing the use of identifying information. This could be

accomplished, for example, through the use of multiple windows, differing

colors of data or clear labeling of the nature of information displayed.

Appendices
APPENDIX 
265
266 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

apply for a security clearance through their local FBI Field Office. The

candidate should obtain from their local FBI Field Office a Standard Form 86

(SF 86), Questionnaire for National Security Positions; and two FD-258 (FBI

applicant fingerprint cards). One of two levels of security clearance, Secret

or Top Secret, may be appropriate.

The background investigation and records checks for Secret and Top

Secret security clearance are mandated by Presidential Executive Order

(EO). The EO requires these procedures in order for a security clearance to

be granted; the FBI does not have the ability to waive them.

Secret Clearances

A Secret security clearance may be granted to those persons that have a

“need-to-know” national security information, classified at the Confidential

or Secret level. It is generally the most appropriate security clearance for
267

g

In addition to all the requirements at the Secret level, a background

investigation, covering a 10-year time period, is required. Once favorably

adjudicated for a Top Secret security clearance, the candidate will be

required to sign a Non-Disclosure Agreement.

Questions and Answers (Q&A)

Q: Who should apply for a security clearance?

A: State or local officials whose duties require that they have access to

classified information, and who are willing to undergo a mandatory

background investigation.

Q: What is the purpose of a background investigation?

A: The scope of the investigation varies with the level of the clearance

being sought. It is designed to allow the government to assess

whether a candidate is sufficiently trustworthy to be granted access to

Appendices
268 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

security clearances within 6 to 9 months, once a completed

application is submitted. The processing time for each individual case

will vary depending upon its complexity

Q: What kind of inquiries will the FBI make into my background?

A: Credit and criminal history checks will be conducted on all applicants.

For a Top Secret security clearance, the background investigation

includes additional record checks which can verify citizenship for the

applicant and family members, verification of birth, education,

employment history, and military history. Additionally, interviews will be

conducted of persons who know the candidate, and of any spouse

divorced within the past ten years. Additional interviews will be

conducted, as needed, to resolve any inconsistencies. Residences will

be confirmed, neighbors interviewed, and public records queried for

information about bankruptcies, divorces, and criminal or civil

litigation. The background investigation may be expanded if an

applicant has resided abroad, or has a history of mental disorders, or

drug or alcohol abuse. A personal interview will be conducted of the
269

may only be disseminated to other cleared persons, who also have a

need-to-know.

Q: What is the difference between an interim and a full security

clearance?

A: Interim clearances are granted in exceptional circumstances where

official functions must be performed before completion of the

investigative and adjudicative processes associated with the security

clearance procedure. There is no difference between an interim and a

full security clearance as it relates to access to classified information.

However, when such access is granted, the background investigation

must be expedited, and, if unfavorable information is developed at

anytime, the interim security clearance may be withdrawn.

If you have any additional questions, and/or wish to apply for a security

clearance, please contact your local FBI field office. (See

http://www.fbi.gov/contact/fo/fo.htm to locate the nearest field office.)

Appendices
APPENDIX 
271
272 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

Homeland Security. He is a fellowship recipient from the Foundation for

Defending Democracies where he studied terrorism in Israel. In addition to

teaching graduate and undergraduate courses at Michigan State, Dr.

Carter is director of the Criminal Justice Overseas Study Program to

England. He is the author or co-author of five books and numerous articles

and monographs on policing issues and is a member of the editorial boards

of various professional publications. His most recent book is the seventh

edition of the widely-used community relations textbook, The Police and

Community, (published by Prentice-Hall). He has another book forthcoming

from Prentice-Hall entitled Homeland Security for State and Local Police.

APPENDIX 
275

International Association of Chiefs of Police (IACP) Model Criminal

Intelligence Policy?

 Yes  No

6. Does the police department subscribe to the standards of the Law

Enforcement Intelligence Unit (LEIU) Criminal Intelligence File

Guidelines?

 Yes  No

7. Does the police department subscribe to the IACP Code of Ethics or

have an articulated Code of Ethics?

 Yes  No

8. Does the police department subscribe to the IACP Code of Conduct or

have an articulated Code of Conduct?

 Yes  No

9. Does the police department have an articulated Statement of Values?

 Yes  No

David L. Carter, Ph.D.

School of Criminal Justice

Michigan State University
Section B: Management Issues

1. Has a mission statement been written for the Intelligence Unit?

 Yes  No

2. Is the purpose and role of the Unit clearly articulated and related to

the Police Department's Mission Statement?

 Yes  No

3. Have priorities been established for the types of crimes the Unit will

address?

 Yes  No

a. Is any written rationale provided for these priorities?

 Yes  No

4. Are expected activities of the unit articulated? 

 Yes  No

5. Does the mission statement express ethical standards?

 Yes  No

David L. Carter, Ph.D.

School of Criminal Justice

Michigan State University
 Yes  No

If Yes, Describe:

2. Management of Information: Definitional Standards

1. Are there standard terms used in intelligence activities that have been

operationally defined in writing so that all persons in the department

know the explicit meaning and implications of the terms?

 Yes  No

2. What is the source of the definitions? 

 NCISP  Federal Agency

 Mixed  N/A

David L. Carter, Ph.D.

School of Criminal Justice

Michigan State University
information that will be retained in the Intelligence Records System?

 Yes  No

8. Are there standardized definitions of the validity scale?

 Yes  No

9. Does the Intelligence Unit have operational definitions that can be

applied to a person under investigation or a series of related crimes

where the perpetrator is not identifiable in order to classify the case

file as either a “permanent file” or a “temporary file”?

 Yes  No

If Yes...

a. Are the types of identifying information that should be placed in 

the file articulated?

 Yes  No

b. Is there a procedure for requiring the articulation of the criminal 

predicate for the permanent file?

 Yes  No

David L. Carter, Ph.D.

School of Criminal Justice

Michigan State University
2. What types of source documents are entered into the Intelligence

Records System?

Describe:

3. Does the police department have a written directive that the rationale

for each source document entered into the Intelligence Records

System must be articulated in a report or notation?

 Yes  No

David L. Carter, Ph.D.

School of Criminal Justice

Michigan State University
 Yes  No

If Yes, Position/Classification):

3. Does the department have written procedures for the retention of

records in the Intelligence Records System?

 Yes  No

6. Management of Information: Retention and Purging of Records

1. Does the retention process adhere to the guidelines of 28 CFR Part 23?

 Yes  No

2. Does the retention policy and procedure include written criteria for

purging information?

 Yes  No

David L. Carter, Ph.D.

School of Criminal Justice

Michigan State University
7. What is the destruction process for purged hard copy records?

Describe:

8. After information has been purged from a computerized Intelligence

Records System, is free space on the hard drive and/or specific

purged files electronically “wiped”?

 Yes  No

a. Are back-ups wiped?

 Yes  No

David L. Carter, Ph.D.

School of Criminal Justice

Michigan State University
11. Who is responsible for ensuring compliance of the purge process?

Position/Classification:

7. Management of Information: Personal/Individually-Held Records and

Files

1. Is there an intelligence unit policy and procedures concerning the

retention of individual notes and records that identifies persons

wherein criminality is suspected but is not in either a temporary or

permanent file and is not entered into any formal records system or

database?

 Yes  No

David L. Carter, Ph.D.

School of Criminal Justice

Michigan State University
4. Can the computerized records system be accessed through remote

access?

 Yes  No

a. If so, what security controls exist for remote access?

Describe:

David L. Carter, Ph.D.

School of Criminal Justice

Michigan State University
286 Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies

9. What audit process is in place for access to computerized records?

Describe:

10. What audit process is in place for access to physical records?

Describe:

David L. Carter, Ph.D.

School of Criminal Justice

Michigan State University
Chapter Title 287

9. Physical Location of the Intelligence Unit and Records

1. Sufficiency: Is the Intelligence Unit in a physical location that has

sufficient space to perform all of its responsibilities?

 Yes  No

2. Security: Is the Intelligence Unit in a physical location wherein the

entire workspace may be completely secured?

 Yes  No

a. Is there adequate secured storage cabinets (or a vault) for (1) 

documents classified by the Intelligence Unit and (2) sensitive 

records storage within the intelligence unit's physical location?

 Yes  No

David L. Carter, Ph.D.

School of Criminal Justice

Michigan State University
b. Are informant files secured separately from intelligence files?

 Yes  No

2. Is there a formally articulated policy and procedures concerning

undercover operations that apply to members of the Intelligence Unit?

 Yes  No

3. Does the police department have a policy on alcohol consumption for

officers working undercover?

 Yes  No

a. Does the police department have a policy requiring designated 

drivers for undercover officers who have consumed alcohol?

 Yes  No

4. Does the police department have a “narcotics simulation” policy and

training for undercover officers?

 Yes  No

5. Does the police department have a policy for the issuance of fictitious

identification for undercover officers and the proper use of such

fictitious identification?

 Yes  No

David L. Carter, Ph.D.

School of Criminal Justice

Michigan State University
pppg

Skills and Abilities (KSAs) for each position?

 Yes  No

3. Is there sufficient hierarchical staff (managers/supervisors) assigned

to the unit to effectively perform supervisory responsibilities?

 Yes  No

4. Is there sufficient functional staff (analysts and/or investigators) to

effectively fulfill defined unit responsibilities?

 Yes  No

5. Is there sufficient support staff (secretaries, clerks) to effectively

support the unit's activities?

 Yes  No

6. Does the screening process for nonsworn employees of the

intelligence unit require:

a. Fingerprint check?

 Yes  No

b. Background investigation

 Yes  No

David L. Carter, Ph.D.

School of Criminal Justice

Michigan State University
a. Are newly assigned sworn employees to the Intelligence Unit

required to attend 28 CFR Part 23 training?

 Yes  No

b. Are newly hired or assigned non-sworn employees required to

attend 28 CFR Part 23 training?

 Yes  No

2. What types of training do in-service personnel receive?

 None  Some

Describe:

David L. Carter, Ph.D.

School of Criminal Justice

Michigan State University
2. Supervision

1. Does supervision effectively monitor adherence to written procedures?

 Yes  No

2. Does supervision effectively monitor adherence to guidelines adopted

by the department?

 Yes  No

3. Are performance evaluations tied directly to the job descriptions? 

 Yes  No

4. Does supervision effectively monitor the performance of required

duties (Including the quality of performance)?

 Yes  No

5. Is supervision effectively monitoring personnel to ensure civil rights

allegations cannot be made with respect to negligent:

a. Failure to train?

 Yes  No

David L. Carter, Ph.D.

School of Criminal Justice

Michigan State University
gpgpg

process?

 Yes  No

3. Is there over-reliance on “soft money” to operate the unit?

 Yes  No

4. Are equipment and personnel line items assigned directly to the

Intelligence Unit?235

 Yes  No

5. Is there an established process for reliably monitoring credit cards

assigned to personnel?

 Yes  No  NA

Section E: Unit Evaluation

1. As a whole, is the unit effective with respect to:

a. Providing information to prevent crime?

 Yes  No

David L. Carter, Ph.D.

School of Criminal Justice

Michigan State University
 Yes  No  NA

f. Number of briefings provided by the intelligence staff?

 Yes  No  NA

g. Total number of queries into the intelligence data base?

 Yes  No  NA

h. Number of permanent files opened?

 Yes  No  NA

i. Number of temporary files investigated?

 Yes  No  NA

j. Number of requests for information to the unit from outside 

agencies?

 Yes  No  NA

3. Are products produced by the Intelligence Unit:

a. In a consistent format?

 Yes  No

b. Easily consumed and used (i.e., understandable and actionable)?

 Yes  No

David L. Carter, Ph.D.

School of Criminal Justice

Michigan State University
2. Have the following activities been performed by the Intelligence Unit:

a. An inventory of threats in the region posed by criminal 

enterprises, terrorists, and criminal extremists?

 Yes  No

b. An assessment of the threats with respect to their probability of 

posing a criminal or terrorist threat to the region?

 Yes  No

c. A target or criminal commodity analysis of the region?

 Yes  No

d. A target or criminal commodity vulnerability assessment in the 

region?

 Yes  No

3. For each identified threat, have intelligence requirements been

articulated?

 Yes  No

David L. Carter, Ph.D.

School of Criminal Justice

Michigan State University
3. Is the police department a member of the Regional Information Sharing

System?

 Yes  No

4. Is a systematic procedure in place to ensure that advisories and

notifications transmitted via the National Law Enforcement Teletype

System (NLETS) are forwarded to the Intelligence Unit?

 Yes  No

5. Are you connected to any state-operated intelligence or information

networks?

 Yes  No

If Yes, Describe:

David L. Carter, Ph.D.

School of Criminal Justice

Michigan State University
Who must approve the MOU?

Section H: Legal Issues

1. Is there a designated person in the police department who reviews

Freedom of Information Act requests directed to the intelligence unit?

 Yes  No

2. Is there a designated person in the police department who responds to

Privacy Act inquiries directed to the intelligence unit?

 Yes  No

David L. Carter, Ph.D.

School of Criminal Justice

Michigan State University
David L. Carter, Ph.D.

School of Criminal Justice

Michigan State University
Law Enforcement Intelligence:

A Guide for State, Local, and Tribal Law Enforcement Agencies

To obtain details on COPS programs, call the 

COPS Office Response Center at 800.421.6770

Visit COPS Online at www.cops.usdoj.gov

e09042536 March 29, 2006

ISBN: 1-932582-44-4