REDACTED FOR PUBLIC RELEASE

Office of the Inspector General

U.S. Department of Justice

OVERSIGHT ★ INTEGRITY ★ GUIDANCE

Audit of the Federal Bureau of 

Investigation’s Efforts to Identify 

Homegrown Violent Extremists

through Counterterrorism Assessments

REDACTED FOR PUBLIC RELEASE

The full version of this report contains information that the Department considered to be classified and therefore

could not be publicly released. To create this public version of the report, the Office of the Inspector General

redacted (blacked out) portions of the full report. 

Audit Division 20-030 March 2020

REDACTED FOR PUBLIC RELEASE
(U) Objectives 

(U) The Office of the Inspector General (OIG) conducted 

an audit of the Federal Bureau of Investigation's (FBI) 

efforts to identify homegrown violent extremists (HVE) 

through counterterrorism assessments. Our objectives 

were to review the FBI's HVE-related casework and 

resource management and evaluate its policies and 

processes to assess HVE threats from October 2012 

through September 2018. 

(U) Results in Brief 

(U) HVEs are the highest priority for the FBI's 

Counterterrorism Division (CTD) because the FBI 

believes HVEs currently present the greatest terrorist 

threat to the United States. Since September 11, 2001, 

HVEs have carried out over 20 attacks in the 

United States, some of which occurred after the FBI 

closed a counterterrorism investigation or assessment 

on the individual. Following these attacks, the FBI 

conducted reviews and determined there were 

weaknesses in its HVE assessment processes. 

However, we found that the FBI has not taken sufficient 

action to address these weaknesses. Additionally, in 

2017, the FBI conducted an enterprise-wide review and 

identified potential terrorist threats that may not have 

been adequately assessed during calendar years (CY) 

2014 through 2016, which amounted to 6 percent of 

the total assessments reviewed. We found that the FBI 

did not take adequate action on nearly 40 percent of 

these assessments for 18 months. After we inquired 

about the lack of action, the FBI reexamined these 

assessments and, in some instances, the reexamination 

resulted in the opening of an investigation. We further 

found that the FBI has experienced a substantial influx 

of reports of suspicious incidents, but has not developed 

comprehensive strategies for addressing t he challenges 

associated with the potential cross-over between 

terrorist threats and other categories of threats, for 

example, those posed by individuals with mental health 

issues and crim inal threats to life. 

(U) Recommendations 

(U) Our report includes seven recommendations to 

assist the FBI in its efforts to identify HVEs through 

cou nterterrorism assessments. 

(U) Audit Results 

(U) The FBI defines HVEs as global jihad-inspired 

individuals who are in the United States, have been 

rad icalized primarily in the United States, and are not 

receiving individualized direction from a foreign terrorist 

organization (FTO). Accordi ng to the FBI, between 

January 2015 and December 2018, it arrested 

65 individuals who allegedly planned to conduct 

terrorist attacks in the United States. This is a 

particularly challenging issue for the FBI because, as 

the FBI has recognized, addressing the HVE 

counterterrorism threat requ ires the FBI to balance 

constitutional protections afforded to U.S. persons with 

its obligation to protect national security. 

(U) Weaknesses in the Assessment Process 

(U) Following attacks conducted by individuals 

previously assessed or investigated by the FBI, such as 

Nida! Hasan, Omar Mateen, and Ahmad Rahami, the FBI 

conducted reviews to identify weaknesses and areas for 

improvement in the FBI's process for assessing 

potential HVEs. The reviews identified shortcomings 

and necessary improvements to the FBI's assessment 

process, but we found that the FBI had not taken all 

appropriate actions to ensure that improvements and 

actions were implemented. For instance, the FBI issued 

a September 2015 policy that required field offices to 

conduct specific database checks and interview 

identified subjects of counterterrorism assessments 

done within the Guardian system, which is the FBI's 

analytical and operational database that tracks and 

manages threats. However, in subsequent reviews, the 

FBI found that field offices had not complied with these 

requirements. In 2016, the FBI issued an internal 

report on the Guardian assessment process that 

contained recommendations and best practices but did 

not ensure that headquarters and field offices 

implemented them. As a result, FBI field offices 

continued to conduct assessments that did not meet FBI 

requirements or standards. 

(U) Inadequate Execution ofan Enterprise-Wide 

Review of Closed Counterterrorism Assessments 

(U) In FY 2017, the FBI conducted an internal review of 

counterterrorism assessments closed between CY 2014 

and CY 2016 (Closed Guardian Review). The intent was 

i 

SECRET// NOFORN 
to ensure that the investigative effort and oversight of 

these assessments were appropriate to identify threats 

and m itigate risks to public safety. The review found 

deficiencies in the quality and completeness of 

6 percent of the total threat assessments that 

warranted additional investigative action. 

(U) However, we found that not all FBI field offices 

performed the necessary additional investigative actions 

on these inadequate assessments. Further, CTD 

program managers did not conduct consistent oversight 

of and did not ensure field offices took appropriate 

action to address investigative deficiencies. As a result, 

nearly 40 percent of these counterterrorism 

assessments went unaddressed for 18 months after 

deficiencies were known. As of February 2019, the FBI 

reported necessary investigative measures were taken 

on these assessments, some of which resulted in 

opening new assessments and investigations. 

(U) As part of this review process, the FBI Office of 

General Counsel (OGC) provided guidance to field 

offices stating that proactively performing database 

checks on all closed Guardian assessments was outside 

the scope of the Closed Guardian Review and could 

implicate the civil liberties of the subjects where an 

appropriate level of work had previously been 

completed. While many field offices followed this OGC 

guidance, we found that some field offices did not and 

instead conducted updated database checks for all 

closed assessments, which in some cases resulted in 

reopening assessments based on new derogatory 

information. Given these results, the FBI should 

determine whether the OGC's guidance was appropriate 

or too limiting under applicable law and FBI policy. If 

the guidance was required by FBI policy, we believe the 

FBI should consider whether it may be appropriate and 

consistent with applicable law to amend FBI policy to 

permit fol low-up inquiries of closed assessments and 

under what circumstances. 

(U) In July 2017, CTD issued a final report on the 

Closed Guardian Review that identified various 

outcomes and areas for improvement in the Guardian 

process. However, given the deficiencies in the 

execution of the review, we concluded that the final 

report may not accurately represent the extent of 

weaknesses in the assessment process and convey 

necessary improvements. 

(U) Field Office Initiatives to Reevaluate Closed 

Guardian Subjects 

(U) According to certain field offices, the FBI's 

assessment of individuals occurs at a particular point in 

time, and HVEs can mobilize to violence after an 

investigation or assessment is closed. Separate from 

the Closed Guardian Review, some FBI field offices have 

implemented initiatives to proactively reassess subjects 

of closed assessments and investigations to determine 

if new derogatory information exists after closure. 

Similar to t he additional database checks conducted by 

some field offices, these initiatives to reassess subjects 

in closed assessments and investigations may implicate 

the civil liberties of these subjects. Given these 

competing interests, the FBI should take steps to 

assess the benefits of these field office initiatives and 

determine the legal, policy, and civil liberties issues 

implicated by t hem so that a decision can be made as 

to whether they should be undertaken by all FBI field 

offices. 

(U) Strategies to Mitigate Emerging Challenges 

(U) Recent high-profile attacks have heightened public 

awareness and resulted in an increase in tips and leads 

sent to FBI field offices. Assessing these tips and leads 

is a priority for the FBI but also poses significant 

challenges in properly deciphering and mitigating 

national security and public safety threats. In 2018, 

the FBI began assessing criminal threats within the 

same Guardian infrastructu re used to assess national 

security threats. The FBI has also recognized the 

prevalence of Guardian assessments of individuals who 

have an identified mental health issue and the difficulty 

in differentiating whether these individuals pose an 

actual threat to national security or public safety. 

However, t he FBI has not developed and implemented 

cross-cutting comprehensive strategies and training to 

effectively address these challenges. 

ii 

SECRET// NOFORN 
SECRET// NOFORN 

{U) AUDIT OF THE 

FEDERAL BUREAU OF INVESTIGATION'S EFFORTS 

TO IDENTIFY HOMEGROWN VIOLENT EXTREMISTS THROUGH 

COUNTERTERRORISM ASSESSMENTS 

TABLE OF CONTENTS 

(U) INTRODUCTION ........... .... .. ... .. .... ... ................ ..... .............. ................. ... .. 1 

(U) FBI Prioritization of the HVE Threat........ .......... ...... .... ...... .. .. ............. 1 

(U) HVE Initiatives, Casework, and Resource Utilization .................... 2 

(U) OIG Audit Approach ....... ....................................................... .......... 6 

(U) OI G Management Advisory Memorandum to FBI Leadership ........ 7 

(U) AUDIT RESULTS ... ... ..... .. ... .......... .. .. .. ............ .... .... ............ .... .. .... .... ........ 8 

(U) The FBI's Reviews and Evaluations Following HVE Attacks in the 

United States .... ... .... .... .. .. ..... ..... .......... ..... ....... ... .. ........... ... ....... 8 

(U) Findings and Weaknesses with Guardian Assessments and 

Processes .. ..... .... .. .... ... .... ........... .... ....... .. ........ .. ... ..... ... .. 10 

(U) Internal FBI Recommendations to Address Identified Weaknesses 

in the Guardian Process .................................................... 11 

(U) The FBI's Enterprise-Wide Evaluation of Closed Guardian Assessments: 

The Deputy Director's Closed Guardian Review .... .. .. .. .. ................. 13 

(U) Field Offices Did Not Timely Address Incomplete Assessments 

Identified During the Deputy Director's 

Closed Guardian Review ............................................... .... 14 

(U) Procedural Weaknesses in Execut ing the Deputy Director's Closed 

Guardian Review ............. .... .. .............. ............................ 15 

(U) Additional Field Office Initiatives to Identify Potential HVEs ................ 20 

(U) Emerging Challenges Related t o Assessing Potential HVEs .................. 21 

(U) Guardian System Expansion to Include Threat-to-Life 

and Criminal Complaints ................................................... 22 

(U) Strategy to Address Terrorism Incidents of 

Mental Health Subjects ..................................................... 24 

(U) CONCLUSION AND RECOMM ENDATIONS ............... .................... .... .. ......... 27 

(U) STATEMENT ON INTERNAL CONTROLS ........... .. ........................................ 30 

(U) STATEMENT ON COMPLIANCE WITH LAWS AND REGULATIONS.................... 31 

SECRET// NOFORN 
SECRET// NOFORN 

(U) APPENDIX 1: OBJECTIVES, SCOPE, AND METHODOLOGY ........................... 32 

(U) APPENDIX 2: FEDERAL BUREAU OF INVESTIGATION 

RESPONSE TO THE DRAFT REPORT ...................................................... 34 

(U) APPENDIX 3: OFFICE OF THE INSPECTOR GENERAL ANALYSIS AND SUMMARY 

OF ACTIONS NECESSARY TO CLOSE THE REPORT .................................. 38 

SECRET// NOFORN 
SECRET// NOFORN 

(U) AUDIT OF THE 

FEDERAL BUREAU OF INVESTIGATION'S EFFORTS 

TO IDENTIFY HOMEGROWN VIOLENT EXTREMISTS THROUGH 

COUNTERTERRORISM ASSESSMENTS 

(U) INTRODUCTION 

(U) The Federal Bureau of Investigation (FBI) defines homegrown violent 

extremists (HVE) as global jihad-inspired individuals who are based in the 

United States, have been radicalized primarily in the United States, and are not 

directly collaborating with a Foreign Terrorist Organization (FTO). Since 9/11, the 

federal government has determined that HVEs have carried out more than 

20 attacks in the United States with many of these attacks committed by 

U.S. citizens or legal permanent residents in the United States who were inspired 

by an FTO, most prominently the Islamic State of Iraq and Syria (ISIS). 

(U) Some of the HVEs who have perpetrated these terrorist attacks in the 

United States had, prior to committing the attacks, been the subjects of FBI 

assessments or investigations that had been closed by the FBI. 1 According to an 

internal FBI document, the FBI has a fundamentally incomplete understanding of 

the HVE threat at the national level - noting that identifying HVEs and deciphering 

whether individuals are simply consuming FTO propaganda or planning to commit 

an attack is extremely complex. Further, the FBI has recognized the challenge of 

balancing constitutional protections afforded to U.S. persons, in particular freedom 

of speech and association, with its obligation to protect national security. The FBI 

has shown a commitment to combatting HVEs by making it a top priority for its 

Counterterrorism Division (CTD), as reflected in its Consolidated Strategy Guide for 

fiscal year (FY) 2017 through FY 2019. 

(U) FBI Prioritization of the HVE Threat 

(U) Over the past 5 years, CTD has instructed field offices to increase 

investigative activity and develop new operational capabilities to effectively mitigate 

the HVE threat. Additionally, CTD has tasked various headquarters sections with 

developing initiatives to identify unknown HVEs and to determine the risk of known 

HVEs mobilizing to violence in the United States. 

1 (U) The Attorney General's Guidelines for FBI Domestic Operations and the FBI's Domestic 

Investigations and Operations Guide (DIOG) authorize three levels of investigation to address a 

potential threat to national security: ( 1) an assessment, which requires an authorized purpose but 

does not require any particular factual predication; (2) a preliminary investigation, which requires 

information or an allegation of a possible threat to national security; and (3) a full investigation, which 

requires an articulable factual basis of a possible threat to national security. When the term 

"investigation" appears in our report, we are referring to predicated preliminary and full investigations 

as set forth in the DIOG, and we intend the term to be exclusive of assessments. 

1 

SECRET// NOFORN 
SECRET// NOFORN 

(U) HVE Initiatives, Casework, and Resource Utilization 

(U) Since FY 2017, over 90 percent of field offices have designated HVEs as a 

severe terrorist threat and priority. Given the significance of the HVE threat and 

the difficulty in identifying HVEs, the FBI has developed initiatives that encourage 

law enforcement and the public to report suspicious activities and exploit publicly 

available information and FBI intelligence to identify unknown HVEs. I n addition, 

according to the FBI, it has increased liaising efforts with community partners (such 

as religious institutions, non-governmental organizations, and other types of groups 

outlined in the U.S. Government's "Strategic Implementation Plan Empowering 

Local Partners"), along with traditional investigative methods, such as tripwire 

networks human sources. 2 In FY 2018, the FBI observed that examining internet 

activity; evaluating individuals who are in contact with subjects of ongoing FBI 

investigations; and obtaining tips from community and fami ly members, 

confidential human source reporting, local law enforcement, other federal agencies, 

and foreign government partners were the most successful techniques for obtaining 

threat and suspicious activity information and for finding homeland plotters. 

fS-7 FBI policy requires that each threat or suspicious incident be reviewed, 

documented, and assessed. 3 These counterterrorism assessments are the initial 

investigative actions that the FBI takes to evaluate a potential terrorism subject. 

Between FY 2013 and FY 2018, the FBI recorded the receipt of more than 

- threats or suspicious incidents within its counterterrorism program, with 

the number of such incidents by year shown in Figure 1. 4 

2 (U) A tripwire is a mechanism to help build cooperative relationships and educate non-FBI 

entities about suspicious activities or potential threats, as well as encourage the public to contact the 

FBI should they become aware of such suspicious activities or threats. 

3 (U) Appendix 1 provides details on the FBI data obtained and reviewed during the audit, 

including assessment, case, and personnel resource data. Please note that the graphs shown in 

Figures 1 through 4 use different scales. 

4 (U) According to the FBI, the process for entering information into the Guardian system 

resulted in the total number of these matters containing threat information associated with other 

program areas, such as the Weapons of Mass Destruct ion Directorate (WMDD) or Criminal 

Investigative Division. 

2 

SECRET// NOFORN 
SECRET// NOFORN 

fSt Figure 1 

fSt Threats or Suspicious Incidents 

Reported within the Counterterrorism Program 

FY 2013 through FY 2018 

FY 2013 FY 201 4 FY 201 5 FY 201 6 FY 2017 FY 201 8 

(U) Source: FBI Guardian Data 

(S//~JF) If a nexus to terrorism is ident ified during the assessment, the FBI 

may open a preliminary or full investigation. During the audit, the FBI provided us 

with data on the number of HVE investigations initiated during FYs 2013 through 

2018. This data showed that the FBI initiated a total of- preliminary or full 

HVE investigations during this time, with the number of HVE investigations initiated 

each year from FY 2013 through FY 2018 shown in Figure 2. 

fSt Figure 2 

fSt Number of HVE Investigations Initiated 

FY 2013 through FY 2018 

-

FY 2013 FY 2014 FY 2015 FY 2016 FY 2017 FY 2018 

(U) Source: FBI case data 

3 

SECRET// NOFORN 
--

SECRET// NOFORN 

(SI/NF) The FBI also provided us with historical data associated with pending 

HVE cases for FYs 2014 through 2018, which the FBI previously prepared for the 

Attorney General in October 2018. 

4 As depicted in Figure 3, the number of pending 

cases ranged from over that period. 

(S//NF) Figure 3 

(S//NF) Number of Pending HVE Investigations 

Reported by the FBI 

FY 2014 through FY 2018 

FY 2014 FY 2015 FY 2016 FY 2017 FY 2018 

(U) Source: FBI CTD 

(U) Through its counterterrorism investigations, the FBI told us that it has 

disrupted a substantial number of HVE attempts to conduct terrorist attacks and 

travel overseas to join FTOs. According to the FBI, between January 2015 and 

December 2018, it arrested 65 individuals who expressed intent to conduct an 

ideologically motivated attack in the United States and who identified a generalized 

attack method or target. Some examples of these disruptions demonstrate the 

FBI's significant and successful efforts to combat HVEs, as outlined below. 

• (U) In 2015, the FBI thwarted the attempted terrorist attack planned by 

Alexander Ciccolo, aka Ali Al Amriki, a U.S. citizen. Ciccolo was inspired by 

ISIS and planned to attack in a highly populated area, such as a college 

cafeteria, by igniting improvised explosive devices, such as pressure cookers 

filled with black powder, nails, ball bearings, and glass. In 2018, Ciccolo pied 

guilty to multiple charges, including attempting to provide material support 

to an FTO, and was sentenced to 20 years in federal prison and lifetime 

supervision. 

• (U) In 2016, the FBI investigated and stopped the plans of Marlonn Hicks, a 

U.S. citizen, who was distributing manuals on how to manufacture and use 

• (U) This pending case data (Figure 3) represents a count of cases, by fiscal year, that were 

ongoing at any time during the fiscal year. In this data, the same individual investigation can be 

counted in more than 1 year. Pending case data differs from data on case initiations (Figure 2) in that 

case initiation data counts each case only once at the time of its opening. 

4 

SECRET// NOFORN 
SECRET // NOFORN 

explosives and poisons. According to the indictment, through the distribution 

of these manuals, Hicks was attempting to orchestrate an attack in the name 

of ISIS similar to the one carried out by Omar Mateen in Orlando. In 2018, 

Hicks was convicted of distributing information regarding the manufacture 

and use of explosives with the intent that the information be used for and in 

furtherance of a crime of violence and sentenced to 15 years in federal prison 

and 3 years supervision. 

• (U) In 2016, the FBI investigated and disrupted plans by Derrick Thompson, 

a U.S. citizen, to conduct a lone-wolf style terrorist attack. Thompson was 

found to have frequent contact with ISIS websites and posted support for 

lone-wolf attacks inspired by ISIS. In 2018, Thompson pied guilty to state 

charges related to assisting a criminal syndicate and solicitation to commit 

misconduct involving weapons and was sentenced to 1 year in state prison 

and 4 years of probation. 

• (U) In 2016, the FBI investigated and disrupted efforts by Mahin Khan, a 

Tucson, Arizona, resident who was conspiring with an individual whom he 

believed to be an ISIS soldier, to obtain weapons in order to conduct a 

terrorist attack in Arizona. That same year, Khan pied guilty to state charges 

of terrorism, conspiracy to commit terrorism, and conspiracy to commit 

misconduct involving weapons and was sentenced to 8 years in state prison 

and lifetime probation. 

• (U) In 2017, the FBI investigated and disrupted efforts by Everitt Jameson, a 

Modesto, California, resident and former military member, to provide money 

to ISIS and conduct an explosives and mass shooting attack in California. In 

2018, Jameson pied guilty to attempting to provide material support to an 

FTO and was sentenced to 15 years in federal prison and lifetime supervision. 

(U) The FBI has also recognized the importance of continuously reexamining 

its methods and techniques for assessing the national security threat of individuals 

in the United States who espouse the rhetoric of FTOs, whi le respecting those 

individuals' constitutiona l rights. Further, the FBI has noted that because HVEs are 

U.S. citizens or legally reside in the United States and do not have a direct nexus to 

an FTO but can also quickly mobilize to violence, the FBI must use traditional and 

resource intensive investigative techniques to mitigate these threats. For example, 

these techniques may include deploying undercover agents and confidential human 

sources, surveillance and technical coverage, conducting community outreach, and 

liaising with domestic and international government agencies. 

5 

SECRET// NOFORN 
SECRET// NOFORN 

(SI/NF) We analyzed data from the FBI's Time Utilization Record Keeping 

(TURK) System. 5 As shown in Figure 4 the FBI's data indicates that between 

FY 2013 and FY 2017, the number of special agents in field offices working HVE 

activities increased by. special agents, or 63 percent, from FY 2013 to FY 2017. 6 

Similarly, FBI data indicates that it more than doubled the number of intelligence 

analysts handling HVE activities within FBI field offices from ■ in FY 2013 to. in 

FY 2017. 

(S//NF) Figure 4 

- -

(S//NF) Special Agent 

Utilization on HVE Activities 

FY 2013 to FY 2017 

FY 2013 FY 2014 FY 2015 FY 2016 FY 2017 

(U) Source: FBI TURK Data 

(S//NF) Intelligence Analyst 

Utilization on HVE Activities 

FY 2013 to FY 2017 

- • 

FY 2013 FY 2014 FY 2015 FY 2016 FY 2017 

(U) Source: FBI TURK Data 

(U) In addition to the increase in FBI special agents and intelligence analysts 

working the HVE threat, CTD also realigned its headquarters resources to address 

and focus on the HVE threat. According to the Assistant Director of CTD, this 

realignment correlates to the need for the FBI to address the differences and 

challenges posed by the HVE threat, and recognize that terrorist threats that 

originate in the United States are just as significant as terrorist threats that 

originate overseas. 

(U) OIG Audit Approach 

(U) Given the significance of the national security threat posed by HVEs and 

the recognition that the FBI had knowledge of individuals who later committed 

5 (U) The FBI tracks actual time worked by its field personnel in its TURK system. Field special 

agent personnel record the hours worked on different types of investigative cases, which is converted in 

TURK to Average On-Board (AOB) data. One AOB equals one special agent and refers to either: (1) one 

special agent working solely in a single investigative area, or (2) multiple special agents working part-time 

on the same investigation. Non-supervisory field special agents are the employees whose time is 

captured in these categories. FBI headquarters personnel and top level field office management do not 

record time in the TURK system. 

6 (U) We were unable to obtain FY 2018 figures because the FBI is in the midst of integrating 

data from one time reporting management system to another and each system uses a different 

computation for calculating the number of personnel utilized. 

6 

SECRET// NOFORN 
SECRET// NOFORN 

terrorist attacks, the Department of Justice (DOJ) Office of the Inspector General 

(OIG) conducted an audit of the FBI's efforts to identify HVEs through 

counterterrorism assessments from October 2012 through September 2018. We 

evaluated the FBI's strategic and tactical policies and processes for identifying and 

assessing HVE threats. To address our objectives, we focused on the FBI's intake 

and review of counterterrorism incidents and assessments within the Guardian 

System, which is the FBI's analytical and operational database that tracks and 

manages threats. We interviewed over 100 FBI officials, including the Executive 

Assistant Director of the National Security Branch and the Assistant Director of 

CTD. We also conducted audit work associated with seven FBI field offices in 

Austin, Texas; Chicago, Illinois; Denver, Colorado; Milwaukee, Wisconsin; San 

Francisco, California; Phoenix, Arizona; and Washington, D.C. In addition, we 

examined FBI internal reports, guidance, and policies; reviewed approximately 

200 counterterrorism Guardian assessments; and reviewed FBI resource utilization, 

casework, and Guardian data. Appendix 1 contains additional information on our 

objectives, scope, and methodology. 

(U) OIG Management Advisory Memorandum to FBI Leadership 

(U) In June 2018, during the course of our audit, we issued a Management 

Advisory Memorandum (MAM) to the FBI Director to formally convey findings and 

concerns regarding a specific national security threat. This classified document 

provided the FBI, our congressional oversight committees, and other stakeholders 

with detailed information about the circumstances discovered during our audit. 7 

Our MAM included five recommendations and we have coordinated with the FBI 

since June 2018 to assess its efforts to address these recommendations. In June 

2019, we closed all five recommendations. 

7 (U) In addition to the classified MAM, we released an unclassified public summary of our 

concerns. DOJ OIG, Public Summary of a Management Advisory Memorandum for the Director of the 

Federal Bureau of Investigation Regarding Inadequate Actions Take to Mitigate a National Security 

Threat, (June 2018). 

7 

SECRET// NOFORN 
SECRET// NOFORN 

{U) AUDIT RESULTS 

(U//FOUO) FBI policy requires that it must evaluate every potential 

terrorism-related threat or suspicious activity information it receives. The FBI uses 

its counterterrorism assessment process within the Guardian system to determine 

whether an individual has a nexus to terrorism. The FBI has acknowledged that 

various weaknesses related to its assessment process may have impacted its ability 

to fully investigate certain counterterrorism assessment subjects who later 

committed terrorist attacks in the United States. Following these attacks, the FBI 

made various efforts to evaluate and improve its assessment process. However, it 

has not ensured that identified areas for improvement were formalized and 

implemented into enhanced policies and procedures. In 2017, the FBI undertook 

an internal review of all counterterrorism assessments closed between calendar 

year (CY) 2014 and CY 2016 to identify potential terrorist threats that the FBI may 

not have mitigated because of missed investigative actions. The FBI identified 

more than - assessments (or 6 percent) that required additional investigative 

steps. However, because the FBI did not effectively oversee and manage this 

review, over- closed assessments (or nearly 40 percent) identified as 

requiring additional investigative action were not addressed for 18 months, some of 

which have since resulted in the FBI opening preliminary or full counterterrorism 

investigations. In addition, some FBI field offices may not be fully aware of the 

investigative tools and techniques that can be used to thoroughly investigate 

counterterrorism assessment subjects given the inconsistent application of such 

techniques throughout the FBI. Further, the FBI has not developed a 

comprehensive strategy for addressing emerging challenges in mitigating potential 

cross-cutting threats from subjects with mental illnesses or those involving criminal, 

non-terrorist threats to life. 

(U) The FBI's Reviews and Evaluations Following HVE Attacks in the 

United States 

(U) During our audit, we found at least six attacks committed in the United 

States by individuals who the FBI had previously assessed or invest igated and who 

were subsequently categorized as HVEs. The following figure provides an overview 

of these HVEs and the timeframe for FBI actions related to these attackers. 

8 

SECRET// NOFORN 
SECRET// NOFORN 

{U) Figure 5 

{U) Terrorist Attacks by Individuals Assessed or Investigated by the FBI 

Ft. Hood Attack Boston Marathon Attack Garland, Texas Attack 

11/05/ 2009 04/ 15/2013 05/ 30/ 2015 

Nidal Hasan Tamerlan & Dzhokhar Tsarvaev Elton Simpson 

• 01/01/2009: FBI opened a • 03/2011: FBI opened a Guardian • 08/01/ 2006 • 11/07/2014: FBI 

counterterrorism lead on Hasan. assessment on Tamerlan Tsarnaev. investigates and closes case on Elton 

• 06/17/2009: FBI closed its • 06/24/2011: Guardian was closed as Simpson. 

assessment on Hasan as not posing a not posing a threat to national • 02/04/2015 • 02/24/2015: Various 

threat to national security. security. Guardian incidents opened. 

• 03/02/2015: Reopens investigation. 

Orlando Pulse Nightclub Attack New York / New Jersey Attacks Ft. Lauderdale Airport Attack 

06/12/2016 09/ 15/2016-09/17/2016 01/ 06/ 2017 

Omar Mateen Ahmad Rahami Esteban Santiago 

• 08/27/2014: FBI opened a Guardian • 11/08/ 2016: FBI opened a Guardian • 5/20/2013: FBI opens a case on assessment on Rahami. assessment on Santiago. Mateen based on statements 

indicative of radicalized ideology. • 09/19/2014: Guardian assessment • 11/30/2016: Guardian assessment 

was closed as No Nexus to Terrorism closed as not posing a threat to • 03/12/2014: The case closed after could be determined. national security, and Santiago was predicated information determined to taken to a pyschlartric institute for be unfounded. evaluation. 

(U) Source: OIG review of FBI documentation 

(U) Following most of these attacks, the FBI cond ucted or requested va rious 

retrospective reviews to identify and assess its procedures and actions associated 

with its prior involvement with the subjects. While the results of these reviews 

varied, some of the conclusions and recommendations in these reports focused on 

the need for the FBI to update and improve its process for assessing 

counterterrorism threats and suspicious activities in the FBI's Guardian system. 

(U) The FBI's Guardian system is used to record all reports of activities, 

incidents, or observations that may have a nexus to terrorism and may be used to 

detect, obtain information about, or prevent and protect against federal crimes or 

threats to national security. Incidents contained in the FBI's Guardian system may 

be generated by ongoing FBI investigations, leads from FBI analytical entities, 

citizen complaints, law enforcement referrals, and other sources. The majority of 

Guardian incidents are categorized by the FBI as either a "Type I/ II assessment" or 

"information only." A FBI supervisor determines which category to classify the 

incident after reviewing the incident along with any preliminary work conducted by 

an investigator (known as "pre-assessment" work). DOJ and FBI policy states that 

a Type I/II assessment should occur when the FBI has an "authorized purpose and 

clearly defined objective(s)" to conduct a limited investigation to evaluate whether 

individuals or activities may have a nexus to terrorism, as well as to detect and 

protect against federal crimes or threats to the national security. The FBI 

categorizes Guardian entries as "information only" for many reasons, including the 

information contained within the incident does not warrant further investigative 

action (e.g., sufficient detail is missing or there is a lack of federal jurisdiction), 

when the incident correlates to an existing investigation (e.g., a full investigation is 

ongoing into the same subject or there are multiple reports with similar content), 

and when there is a lack of authorized purpose to conduct an assessment (e.g., 

someone calls in a complaint about a protest). The following diagram provides an 

abbreviated overview of the intake and disposition of Guardian entries. 

9 

SECRET// NOFORN 
SECRET// NOFORN 

(U) Exhibit 1 

(U) Abbreviated Overview of the Guardian Assessment Process 

Ongoing FBI 

Investigations 

FBI Analytical 

Entitles 

Citizen 

i Co m plaints 

Law 

Enforcem e nt 

Re ferrals 

Gu ardian System 

T ype 1 & II 

~ 

Yes - N e xus to 

Te rroris m . 

Ope n Investigation 

No or I nconclusive 

Nexus to Te rrorism . 

No Furthe r Action. 

,.-1 Ope n Investiga tion 

Re ta in fo r P.ittc rn 

a nd Tre nd Ana lysis 

(U) Source: OIG illustration based upon FBI documentation 

a. (U) eGuardian allows law enforcement for federal, state, local, tribal, and territorial to 

submit suspicious activity reports to a single information repository accessible to 

thousands of law enforcement personnel and is also migrated to the Guardian system. 

(U) Findings and Weaknesses with Guardian Assessments and Processes 

(U) Following the 2009 attack at a military facility in Fort Hood, Texas, the 

FBI requested an independent review of its actions associated with its assessment 

of Nida I Hasan, the individual who conducted the attack. 8 This review determined 

that shortcomings in the FBI's policies and procedures related to counterterrorism 

assessments contributed to delays and potential missed opportunities to mitigate 

Hasan's actions. One of the recommendations made in this report included 

developing formal policies on the assignment and completion of routine 

counterterrorism assessments to address issues of timeliness and to encourage 

prioritization of counterterrorism assessments. In addition, this review identified 

concerns about the assignment of Task Force Officers as the lead investigators on 

certain assessments and investigations, and the need for increased training for 

counterterrorism Task Force Officers. 

8 (U) The Final Report of the William H. Webster Commission on The Federal Bureau of 

Investigation, Counterterrorism Intelligence, and the Events at Fort Hood, Texas, on 

November 5, 2009 was originally requested by the FBI. Specifically, the FBI requested a full 

investigation of the manner in which the FBI and its Joint Terrorism Task Forces (JTTF) handled and 

acted on counterterrorism intelligence before and after the Fort Hood shootings, as well as a review 

and assessment of the FBI's governing authorities and the FBI's remedial measures after the 

Fort Hood shootings. 

10 

SECRET// NOFORN 
SECRET // NOFORN 

(U) The FBI's processes came under scrutiny again following the 2013 Boston 

Marathon terrorist attack. In April 2014, a multi-agency Inspector General review 

of the FBI's actions in assessing Tamerlan Tsarnaev, one of the HVEs who carried 

out the terrorist attack, found that the FBI counterterrorism agent assigned to the 

Guardian assessment did not take certain available steps to evaluate the subject. 9 

Although the DOJ OIG could not definitively determine if these steps would have 

revealed any additional information, the DOJ OIG concluded that certain available 

investigative steps, including conducting additional database searches, asking 

questions of Tsarnaev and his parents to elicit information about any plans 

Tsarnaev may have had to travel to Russia, and interviewing Tsarnaev's former 

girlfriend and wife, would have resulted in a more thorough assessment. In 

addition, this review found that although the agent closed the Guardian assessment 

and found that the subject had "no nexus to terrorism," the agent created a TECS 

notification, which would alert the FBI if the subject traveled overseas. 10 However, 

the FBI did not take subsequent investigative action when Tsarnaev traveled to 

Russia following the closure of the Guardian assessment. Although the report 

indicated that there was a possibility that the FBI agent may not have received the 

TECS notification, the agent stated that even if he had received the notification he 

would not have taken action because he previously closed the assessment on 

Tsarnaev. In contrast, FBI supervisors stated that Tsarnaev's travel to Russia was 

significant and warranted further investigation. 

(U) Similar lapses in acting on subsequent threat information regarding a 

previous FBI subject were also noted in the FBI Inspection Division's 2015 internal 

after-action report following a terrorist attack in Garland, Texas. This report noted 

that threat information related to Elton Simpson was conveyed through a Guardian 

incident, but not acted upon because field office agents did not interpret the 

information as portraying a significant threat, which resulted in a missed 

opportunity to avert the attack. The report also stated that although the field office 

subsequently received additional information regarding Simpson and opened an 

investigation on him, the field office did not open an assessment on Simpson's 

roommate who also had indications of radical behavior and participated in the 

Garland terrorist attack. In general, this after-action review illustrated the need for 

increased communication and awareness of threat indicators that must be 

evaluated during the counterterrorism assessment process. 

(U) Internal FBI Recommendations to Address Identified Weaknesses in the 

Guardian Process 

(U//FOUO) In September 2015, the FBI issued guidance on mandatory 

baseline collection, which is the standard investigative analysis performed during a 

counterterrorism assessment. This guidance was established to improve and 

9 (U) Inspectors General of the Intelligence Community, Central Intelligence Agency, DOJ, and 

DHS, Unclassified Summary of Information Handling and Sharing Prior to the April 15, 2013, Boston 

Marathon Bombings (April 2014). 

10 (U) DHS's TECS is the principal system used by officers at the border to assist with 

screening and determinations regarding admissibility of arriving persons. 

11 

SECRET// NOFORN 
SECRET // NOFORN 

standardize the consistency and quality of Type I/II assessments. According to this 

policy, investigators are required to 

(U) The FBI identified 

weaknesses in its assessment 

process through multiple 

external and internal reviews 

since 2012. However, identified 

issues continue to persist 

despite the results and 

recommendations of these 

reviews. 

. Although this policy reinforced 

certain requirements and actions for 

counterterrorism assessments, the FBI did not 

conduct a comprehensive evaluation of the 

Guardian system with these revised processes 

until after HVE-perpetrated attacks in Orlando, New York, and New Jersey in 2016. 

(SI/NF) In September 2016, the Assistant Director of CTD directed a study of 

the Guardian program, including an examination of specific areas in which the FBI 

could further assess and mitigate risks associated with the Guardian program and 

ensure continued vigilance with Guardian assessments. In conducting this study, 

the FBI evaluated the Guardian program from the lens of two Guardian 

assessments - one of and the other of Ahmad Rahami.11 In 

October 2016, the FBI summarized the results of this study in an internal report 

entitled "Guardian Review." According to this internal report, the FBI recognized 

several opportunities for improvement and best practices - cu lminating in the 

issuance of 25 recommendations and identification of 11 best practices - some of 

which were repetitive of findings stemming from previous reviews. 

(U) Specifically, this 2016 Guardian review recommended that training be 

provided to reiterate the requirement to interview the subjects of Guardian 

assessments and to provide instruct ion to field office personnel for conducting 

database checks and effective interviews. In addition, the FBI review 

recommended modifications to the Guardian system that would require field office 

personnel to specifically document that all database checks were completed and the 

subject was interviewed prior to being allowed t o close the assessment. 12 It further 

recommended that CTD program managers review and concur with the field offices' 

closure of each Guardian assessment and that FBI agents be an integral part of the 

Guardian assessments that are conducted by Task Force Officers. The report also 

highlighted several best practices, such as conducting fol low-up baseline checks 

before closing the assessment to ensure no new derogatory information is found 

between the opening and the closing dates, as well as informing local partners 

when closing an assessment where the FBI believes the individual may pose a 

future risk to the community. 

12 (U) The recommendation also covered a requirement for field office personnel to include a 

justification for not interviewing the subject if the subject was unavailable. 

12 

SECRET// NOFORN 
SECRET// NOFORN 

(U) The FBI developed these best practices and recommendations to address 

weaknesses and improve the Guardian assessment process and system. We found 

that the FBI implemented some of the report's recommendations, such as the 

requirement for CTD program managers to concur within 15 days on all 

counterterrorism Guardian assessments submitted for closure by field offices and 

the inclusion of a performance metric for field office executive management related 

to the quality of counterterrorism Guardian assessments. However, we also found 

that certain recommendations and best practices remained outstanding. In July 

2018, we interviewed a senior CTD official about the status of these 

recommendations and were told that CTD did not specifically follow-up with FBI 

field offices on what actions were taken to address the field office-specific 

recommendations and best practices because the FBI decided, instead, to focus on 

an enterprise-wide review of all Guardian assessments closed between CY 2014 and 

CY 2016. This official told us that this review, which we refer to as the 

Deputy Director's Closed Guardian Review and discuss below, was meant to 

incorporate the results of the October 2016 Guardian Review report. In turn, in 

August 2019, CTD officials stated that the implementation of the recommendations 

from the 2016 Guardian Review report is a long-term process, which has continued 

during and after the Deputy Director's Closed Guardian Review. These officials 

further stated that all of these reviews have resulted in the FBI making efforts to 

improve the Guardian program. 

(U) The FBI's Enterprise-Wide Evaluation of Closed Guardian Assessments: 

The Deputy Director's Closed Guardian Review 

(U) Following the January 2017 Fort Lauderdale, Florida, airport terrorist 

attack by another former Guardian subject, in February 2017, the FBI Deputy 

Director sent an email to field office leadership, which stated that the FBI's 

Guardian system had proven extremely adept at identifying individuals who later 

sought to carry out attacks in the homeland, yet the FBI had never done an 

enterprise-wide review of Guardian assessments. The FBI Deputy Director 

emphasized that the FBI had to ensure that every Guardian assessment was 

conducted with the same baseline level of investigative effort and reviewed 

appropriately by Supervisory Special Agents in the field and CTD to identify 

potential threats to national security and mitigate risks to public safety. As such, 

each field office was instructed to review all of their Type I/II assessments closed 

during CYs 2014 through 2016, and CTD program managers were required to 

examine a sample of these retrospective reviews. 

(U//FOUO) This project was intended to assess the quality of the work done 

on each Guardian assessment and determine if any of the closed Guardian 

assessments warranted further investigative actions because the necessary baseline 

investigative steps were either not taken or not adequately documented when they 

were initially performed. The expectation was that if a determination was made 

that an assessment did not meet the baseline requirements, then that assessment 

would be "flagged" and a new assessment would be opened to conduct the missed 

investigative steps. This review identified - out of-(or 6 percent) 

13 

SECRET// NOFORN 
SECRET// NOFORN 

Guardian assessments that required additional investigative action. Of these -

Guardian assessments,_, or 92 percent, were flagged by FBI field offices; the 

remaining., or 8 percent, were flagged by CTD. 

(U) Field Offices Did Not Timely Address Incomplete Assessments Identified During 

the Deputy Director's Closed Guardian Review 

(U//FOUO) Although the FBI took this important step of reevaluating its 

handling of Guardian assessments, we found that the FBI did not ensure that field 

offices adequately addressed the - flagged Guardian assessments. Specifically, 

approximately 1 year after the Deputy Director's Closed Guardian Review ended, 

we conducted site visits at two FBI field offices and found that these field offices 

either had not taken investigative action until a few weeks prior to our arrival or 

had not taken any action on certain closed Guardian assessments that were flagged 

for missed investigative steps. As a result, potential terrorist threats were not 

mitigated for more than 1 year. 

(U) In July 2018, we alerted senior CTD officials about the lack of timely 

action taken by these two FBI field offices. In response, these individuals told us 

that they did not believe there was a formal process for CTD to ensure FBI field 

offices appropriately addressed the flagged Guardian assessments. While CTD 

program managers may have had some interaction with the FBI field offices they 

were responsible for liaising with, we were told that the onus was on FBI field 

offices to ensure that all flagged Guardian assessments were adequately addressed 

(U) Nearly 40 percent 

of flagged Guardian 

assessments remained 

unaddressed for 

18 months. 

through investigative action or updated documentation. 

However, CTD officials stated that they were unaware 

that field offices had not taken appropriate actions and 

acknowledged that the lack of action was concerning. 

These officials stated that the danger in this additional 

work not being completed was that even one of these 

incomplete or inadequate assessments may involve a 

terrorism threat that has not been mitigated and could put the public's safety at 

risk. 

(U//FOUO) Following this discussion in July 2018, CTD conducted a review of 

the - flagged Guardian assessments to determine if any still needed to be 

addressed. In October 2018, CTD found that field offices had not taken action on 

- of the - Guardian assessments, or nearly 40 percent. After identifying 

those assessments still needing attention, CTD and field offices performed a 

secondary review and determined that. of the- Guardian assessments (or 

66 percent) did, in fact, require additional investigative measures. As of 

February 2019, the FBI informed us that the necessary investigative measures had 

been taken on. of the. assessments (or 78 percent), and that the remaining 

• Guardian assessments (or 22 percent) had been reopened and field offices 

were taking the necessary investigative measures. FBI officials told us that the 

review of some of these assessments resulted in the opening of preliminary and full 

investigations. 

14 

SECRET / / NOFORN 
SECRET// NOFORN 

(U) We found noticeable differences in the required follow-up among various 

offices. In short, some offices appeared to have executed their responsibilities fully 

and in a timely manner, while others failed to conduct follow-up on flagged 

assessments. According to FBI field office personnel, managing both the Deputy 

Director's Closed Guardian Review and ensuring that incoming Guardian 

assessments were appropriately addressed was an onerous and resource-intensive 

process, which may have contributed to field offices not adequately addressing all 

flagged Guardian assessments. When we asked CTD officials if they determined 

why field offices did not fully execute the Deputy Director's Closed Guardian 

Review, we were told that CTD did not know the cause for the lack of execution and 

that conducting an evaluation to determine the cause was not necessary. Given the 

importance of this review and the potential impact of an incomplete or deficient 

counterterrorism assessment, we believe that the FBI should determine why certain 

field offices failed to follow up on flagged Guardian assessments in order to identify 

and document lessons learned from the Deputy Director's Closed Guardian Review. 

(U) Procedural Weaknesses in Executing the Deputy Director's Closed Guardian 

Review 

(U) In addition to the inadequate follow-through on the flagged Guardian 

assessments, we are concerned with inconsistencies and weaknesses in the FBI's 

process for executing the Deputy Director's Closed Guardian Review. 

Consequently, we believe that the FBI-compiled results of this review may not be 

an accurate representation of deficiencies within the Guardian assessment process 

and may not have identified all closed Guardian assessments that required 

additional investigative action. 

(U) Inconsistent Review Protocols 

(U) In connection with the Deputy Director's Closed Guardian Review, CTD 

issued a questionnaire to field offices to use to determine if all appropriate 

investigative steps were taken during the original Guardian assessments. For 

example, this questionnaire instructed field offices to evaluate whether thorough 

database checks were completed and if subject interviews were conducted. 

According to February 2017 guidance issued by CTD, the goal was to review the 

quality of the Guardian assessment and thoroughly investigate the information 

contained within the assessment if the standard was not met. This guidance 

further instructed field offices to not perform additional investigative steps during 

the initial review process. 

(U) Subsequent to CTD's guidance and in response to field office questions, 

the FBI's Office of General Counsel (OGC) sent email guidance to all field offices' 

Chief Division Counsel that, among other items, addressed the topic of proactively 

performing database checks on all closed Guardian assessments to determine if a 

new Guardian assessment should be opened even if the previous one was deemed 

sufficient. The OGC guidance stated that field offices were not to perform 

investigative steps while reviewing the closed Guardian assessments and that doing 

so was outside the scope of the Deputy Director's Closed Guardian Review. 

15 

SECRET // NOFORN 
SECRET// NOFORN 

Further, OGC reiterated that every investigative step must fit within law and policy, 

and that field offices should be diligent to ensure that the authorized criminal 

justice or national security purpose was present before taking any investigative 

step. The OGC guidance also stated "If the field believes, upon review, that 

additional database checks are authorized prior to opening a new assessment, then 

I recommend working with them to ensure that these checks are properly 

documented and reminding everyone that the privacy, civil rights, and civil liberties 

implications and the least intrusive means analysis is especially critical in 

assessments." 

(U//FOUO) We found that while many field offices followed this guidance, 

some FBI field offices conducted new database checks for all closed Guardian 

assessments. For example, we determined that the Chicago and New York field 

offices decided that in executing their responsibilities for this project, the process 

should include updated database checks in order to determine whether new 

derogatory information existed on Guardian subjects involved in all of the 

previously closed Guardian assessments. Once the updated database checks were 

completed, the field offices then conducted an evaluation of the investigative steps 

that were taken during the original assessment. According to an internal FBI 

briefing document, the New York Field Office determined that this process resulted 

in reopening a small percentage of closed Guardian assessments because of new 

information found through re-running database checks. The same briefing 

document indicates that CTD replicated this process for two field offices and had 

not identified any new derogatory information on the. of. closed Guardian 

assessments (or 63 percent) reviewed at that time. 

(U) While we understand that conducting database checks on all closed 

Guardian assessments may have been beneficial, this process was not in line with 

OGC's guidance for conducting the Deputy Director's Closed Guardian Review. 

When discussing the inconsistencies with CTD officials, they stated that it is within 

FBI policy to perform baseline checks on any information in FBI holdings and that 

the examples of certain field offices conducting baseline checks on all of their 

previously closed Guardian assessments is within the scope of the Deputy Director's 

Closed Guardian Review. The CTD Assistant Director, who was appointed 

subsequent to the Deputy Director's Closed Guardian Review, acknowledged that 

some field offices did more work than expected and agreed that these steps may 

have civil liberties implications based upon OGC's guidance. We asked the FBI OGC 

for additional clarification on the legal basis for the FBI OGC's guidance to not 

proactively check databases for all of the closed Guardian assessments reviewed. 

In response, the FBI OGC stated, among other things, that "While it may be clearly 

authorized for the FBI to perform queries within its databases during an open 

Guardian assessment in a particular investigation, it was OGC's opinion that this 

does not automatically extend to permit repeat database checks after the closure of 

the same investigation, especially when the investigation has been deemed 

sufficient." 

(U) As noted, there have been numerous instances where subjects of closed 

assessments subsequently engaged in terrorist acts or were determined to have a 

16 

SECRET // NOFORN 
SECRET// NOFORN 

nexus to terrorism. Additionally, performing proactive database checks resulted in 

reopened assessments. Even if the numbers are small, re-assessments can help to 

ensure that the FBI does not miss an opportunity to identify subjects of closed 

Guardian assessments about whom evidence of a nexus to terrorism may have 

developed since the closure. In light of this, we believe the FBI should determine 

whether the FBI OGC's guidance about proactively updating database checks as 

part of the Deputy Director's Closed Guardian Review was appropriate or too 

limiting, under applicable law and FBI policy. If the guidance was required by FBI 

policy, the FBI should consider whether it may be appropriate and consistent with 

applicable law to amend FBI policy to permit follow-up inquiries of closed 

assessments in particular circumstances. We, therefore, recommend that the FBI 

assess the legal, policy, and civil liberties issues implicated by the OGC guidance, as 

well as CTD and the field offices' execution of the proactive reviews, and determine 

what, if any, follow-up action is necessary. 

(U) In addition, we identified inconsistencies in how field offices handled 

Guardian assessments that had been closed because the subject left the country. 

Some FBI field offices identified the lack of a TECS alert for a subject of a Guardian 

assessment who was overseas as a reason for flagging a closed Guardian 

assessment, while others did not. 13 We also found that while some FBI field offices 

coordinated with DHS and seemed to initiate TECS alerts in Guardian assessments 

that were closed because a subject was overseas, other field offices did not believe 

the FBI was allowed to initiate a TECS alert in these instances. CTD officials said 

that setting up TECS alerts should be used for any subject of a Guardian 

assessment that was closed because the subject was overseas, so that the FBI field 

office is notified when or if that subject returns to the United States. In contrast, 

the IG review of the FBI's actions in assessing Tamerlan Tsarnaev noted that the 

JTTF had initiated a TECS alert on Tsarnaev during the assessment phase while he 

was in the United States. Given the indications of the inconsistent use of TECS on 

Guardian assessments, and that there may be uncertainty about whether it would 

be within FBI's authority and policy to request a TECS alert in a closed Guardian 

assessment, we recommend that the FBI review the use of TECS alerts in Guardian 

assessments and provide clear guidance to CTD and the field offices about when 

such use is appropriate. 

(U) Further, we identified differences in how field offices approached the use 

of legal process in Guardian assessments to obtain toll and subscriber records 

associated with social media and other online accounts with reported suspicious 

activity. We found that some closed Guardian assessments were not flagged by 

field offices for additional investigative action where such legal process was not 

pursued. When we asked field office personnel about their decisions to not obtain 

legal process for certain records, we received varying responses. One field office 

supervisor stated that if the Guardian assessment was conducted today, they would 

expect a request for legal process be initiated. Another field office official stated 

13 (U) The use of a TECS alert provides the FBI with a mechanism to be notified if a particular 

indiv idual is entering the United States; for an assessment this could prompt the FBI to return to its 

investigative work that was prematurely ended due to foreign travel of the subject of a closed 

Guardian assessment. 

17 

SECRET// NOFORN 
SECRET// NOFORN 

that obtaining legal process would require opening a preliminary investigation. 

Still, other field office personnel told us that their office did not normally pursue 

legal process for Guardian assessments due to standards imposed by the local 

United States Attorney's Office (USAO). As with TECS alerts, we believe that the 

FBI should ensure field offices are fully aware of when to seek certain forms of legal 

process in connection with Guardian assessments and ensure field offices 

coordinate with CTD to discuss their coordination with USAOs and other options for 

obtaining records. 

(U) Issues with the CTD Review Process 

(U) As part of the Deputy Director's Closed Guardian Review, CTD program 

managers were instructed to review a sample of at least 10 percent of Guardian 

assessments that field offices closed during CYs 2014 through 2016. The written 

guidance given to CTD program managers was that they should not select for 

review closed Guardian assessments that had been identified by the field office as 

deficient during its review of closed Guardian assessments. Program managers 

were otherwise allowed complete discretion for choosing which closed Guardian 

assessments to review and determining if additional investigative steps were 

necessary. We found that this autonomy may have impacted the thoroughness and 

effect of CTD's review. For example, one program manager told us that he chose 

"easy" and "less complex" Guardian assessments to review and did not believe this 

approach meant that riskier Guardian assessments were excluded. Another CTD 

program manager expanded the sample for one field office because of discrepancies 

found during the initial review and identified a variety of deficiencies, some of which 

were not included in the questionnaire, resulting in a greater number of flagged 

Guardian assessments. 

(U//FOUO) In addition, it appeared that CTD program managers did not 

provide sufficient information to field offices on Guardian assessments they flagged 

as deficient. During interviews with FBI field office officials, we were told that CTD 

did not effectively communicate to them why certain closed Guardian assessments 

were flagged and that they, therefore, had to make assumptions as to what 

investigative steps were necessary. Further, we found that CTD program managers 

did not ensure that field offices were taking appropriate actions in response to 

flagged Guardian assessments. For example, we reviewed an August 2017 email in 

which a CTD program manager identified two FBI field offices that lacked 

knowledge and experience for conducting Guardian assessments. Although the 

CTD program manager was aware of these weaknesses, one of the field offices did 

not take appropriate action on ■ of its ■ flagged Guardian assessments (or 

33 percent) for over a year. Given the concerns with the field office's knowledge 

and experience, CTD should have more closely monitored the field office's efforts to 

ensure appropriate attention was given to these Guardian assessments. As noted 

previously, many of the closed Guardian assessments flagged for additional 

investigative action remained unaddressed for 18 months. 

18 

SECRET// NOFORN 
SECRET// NOFORN 

(U) CTD Has Not Effectively Followed-up on Issues Identified during the 

Deputy Director's Closed Guardian Review 

(U) In July 2017, CTD issued its final report on the results of the Deputy 

Director's Closed Guardian review. This report identified four major deficiencies 

during the review: (1) subject interviews were not conducted, (2) insufficient 

database checks were performed, (3) predication was not addressed, and (4) public 

safety notifications were not completed or documented. In its report, CTD noted 

specific actions that it would take or that it directed field offices to take to address 

these deficiencies. An overview of these actions is depicted in the following figure. 

(U) Figure 6 

(U) FBI Updates Following the Deputy Director's Closed Guardian Review 

(U) Areas of Improvement (U) Updates 

(U) Database Checks (U) Field offices should create in-house training and 

issue guidance on database queries as best practices. 

(U) Improper or Incomplete (U) CTD modified the format of Guardian assessments 

Documentation to incorporate text forms and dropdown menus to 

ensure all investigative actions are documented 

properly. 

(U) CTD incorporated updated fields for public 

notifications. 

(U) Field Office Structure (U) CTD reinforced that field offices should tailor their 

Guardian assessment processes to ensure usage of 

appropriate databases, enhance understanding of the 

threat, and balance resource expertise to maximize 

effectiveness. 

(U) Oversight of Investigative (U) CTD formalized a process for relevant program 

Steps management sections to review all Guardian 

assessments within 15 days of field office closure. If 

CTD determines there are further investigative steps 

to be taken, field offices will reopen those specific 

Guardian assessments. 

(U) FBI Inspection Division included Guardian 

assessments as part of its field office inspection 

process. 

(U) Accountability for (U) CTD established a new program measure to 

Guardians evaluate how often a previously closed Guardian 

assessment is reopened and further investigated. 

(U) Source: OIG Review of the FBI's July 2017 Deputy Director's Closed Guardian Review Final Report 

(U) CTD officials stated that the Guardian assessment process has matured 

since the time of the Deputy Director's Closed Guardian Review. Specifically, we 

19 

SECRET // NOFORN 
SECRET// NOFORN 

were told that FBI agents in the field and headquarters believed that the Deputy 

Director's Closed Guardian Review emphasized the importance of conducting 

thorough counterterrorism assessments and ensuring that all investigative steps 

are taken and clearly documented, including CTD program managers now reviewing 

counterterrorism assessments upon closure to ensure adequate investigative 

actions had been taken. We also were advised that after the Deputy Director's 

Closed Guardian Review, certain field offices formalized internal guidance for 

counterterrorism assessments, while other field offices began using additional 

sources and techniques for their counterterrorism assessments. The FBI Inspection 

Division also incorporated into its inspections process an evaluation of Guardian 

assessments to ensure that they were appropriately addressed. 

(U) Overall, we acknowledge the FBI's efforts to improve the quality of its 

Guardian assessments by disseminating guidance that highlights the need for 

thorough documentation and investigative rigor, as well as implementing additional 

layers of review. However, as noted above, while the FBI has historically made 

recommendations and identified best practices to improve its counterterrorism 

assessment process following HVE attacks, these actions have not always been 

implemented sufficiently by field offices. While we recognize the difficulty in finding 

the right balance, the FBI should strive to achieve consistency in field office 

Guardian assessments by identifying the most effective and legally permissible 

approaches, and adopting those practices agency-wide. Consequently, in light of 

the weaknesses that we identified, we recommend that the FBI revisit the results of 

the Deputy Director's Closed Guardian Review to determine if there are other 

lessons learned or other actions that should be taken. Upon completion of this 

evaluation, the FBI should ensure that field offices and CTD take all appropriate 

actions and uniformly adopt best practices to adequately assess all 

counterterrorism threats. 

{U) Additional Field Office Initiatives to Identify Potential HVEs 

(U) We found that some field offices developed initiatives to conduct similar 

reviews on closed investigations and closed assessments, separate from the Deputy 

Director's Closed Guardian Review. According to the FBI, these field offices 

established these initiatives, in part, to address the HVE phenomenon involving 

individuals who turn from consuming radical ideologies to mobilizing to violence in a 

short period of time without extensive planning. These field offices used a Type III 

assessment for their initiatives. According to the DIOG, a Type III assessment is 

opened to identify, obtain, and utilize information about actual or potential national 

security threats of federal criminal activities or the vulnerability to such threats or 

activities. 

(U//LES) One field office explained that because the FBI has found that HVEs' 

mobilization to violence could occur after an assessment is closed, it opened a 

Type III assessment to identify 

20 

SECRET// NOFORN 
SECRET// NOFORN 

(U//LES) Another field office decided to create a Type III assessment to 

review steps taken to mitigate the threat posed by subjects of closed 

counterterrorism investigations and assessments. Specifically, 

(U) These proactive field office initiatives devoted significant attention to 

potentially finding derogatory information on investigative subjects that arose after 

the FBI closed its investigation or Guardian assessment. Although distinct from the 

Deputy Director's Closed Guardian Review, these initiatives have similar 

implications for legal and civil liberties issues resulting from field offices that 

conducted proactive database checks on all closed Guardian assessments. In line 

with our recommendation for the FBI to evaluate the execution of the Deputy 

Director's Closed Guardian Review, we believe the FBI should take steps to both 

assess the benefits of these individual field office initiatives and determine whether 

such proactive steps' are permissible under applicable legal authorities and FBI 

policy so that a decision can be made as to whether they should be undertaken by 

all FBI field offices, and if necessary, whether amending FBI policy, consistent with 

law and mindful of civil liberties, would enable such initiatives to improve the 

qua.lity of Guardian assessments. 

(U) Emerging Challenges Related to Assessing Potential HVEs 

(U) During the FBI's October 2016 Guardian Review, CTD found that field 

offices experienced investigative desensitization when it came to assessing potential 

counterterrorism threats because many of them were hoaxes, unfounded and 

malicious accusations, or involved individuals with mental health issues. Moreover, 

recent high-profile violent attacks, in particular the school shooting that occurred in 

February 2018 in Parkland, Florida, heightened public awareness about potential 

21 

SECRET// NOFORN 
SECRET// NOFORN 

violent or suspicious activity by individuals who are not necessarily HVEs and 

resulted in an increase in tips and leads sent to FBI field offices. 

(U) FBI officials noted that responding to information about threats of 

violence was an important priority regardless of whether the subject met the 

definition of an HVE. They told the OIG that such matters were generally 

investigated through the Guardian counterterrorism assessment process, even 

when a terrorism nexus was not apparent or present. However, FBI 

counterterrorism agents expressed concern that there is an expectation that they 

must handle and mitigate all of these threats, which not only requires a substantial 

amount of attention and resources, but also creates a large repository of 

information on individuals who have come to the attention of the FBI but who may 

not have a nexus to terrorism or other federal criminal activity. While recognizing 

the importance of the FBI receiving threat information from myriad sources to 

mitigate both terrorist threats and threats-to-life, agents conveyed concern about 

what the FBI was doing with the information in Guardian about individuals who may 

present a threat of future violent conduct but for whom the FBI does not have 

predication to open a federal investigation. The concerns of these agents suggest 

that the FBI should ensure that it has a comprehensive strategy to document the 

information it receives about non-terrorist threats to public safety and to coordinate 

the sharing of such information to other assessment programs within the FBI and, 

as importantly, with external partners on the federal, state, and local level, as 

permissible. 

(U) Guardian System Expansion to Include Threat-to-Life and Criminal Complaints 

(U) Following the Parkland, Florida, school shooting, the FBI conducted a 

review of its actions to assess the shooter and found that it received information 

regarding suspicious activity about the shooter on two previous occasions. The 

initial suspicious activity was assessed through the Guardian system and closed 

because no nexus to terrorism was found. Additional information was later 

provided through the FBI's Public Access Line, but was not assessed because it was 

designated as not having value and, therefore, was not disseminated to a field 

office for action. 

(U) After this attack, FBI officials stated that the FBI received an increased 

number of potential threat-to-life leads, which were entered into the Guardian 

system. FBI field agents expressed concern about the expectation that CTD was 

tasked with assessing threats that did not have a nexus to terrorism or other 

federal criminal activity, but rather had a non-federal criminal nexus. 

(U) In April 2018, the FBI decided to formally expand the use of the Guardian 

program to put the same emphasis on handling certain criminal incidents that it had 

on counterterrorism incidents, such as complaints related to threat-to-life incidents. 

FBI officials stated that this decision to expand the Guardian program was made to 

leverage the experience and strength of the FBI's CTD resources and reduce the 

risk of missing potentially dangerous actionable information related to significant 

threats-to-life. In order to alleviate the impact on CTD from the increased volume 

22 

SECRET// NOFORN 
SECRET// NOFORN 

of non-terrorism Guardian incidents, the FBI incorporated the FBI's Criminal 

Investigative Division (CID) into the process so that CTD was not assigned the 

responsibility to triage all incoming threats. The FBI stated that the transition 

would increase consistency within the organization, allow for greater accountability, 

and decrease the possibility that complaints would go unaddressed. The FBI 

acknowledged that the transition raised a number of potential difficulties for field 

offices, and stated that CID has collaborated with various FBI entities to develop a 

threat-to-life decision model and guidance to the field. However, during our audit, 

we found that the FBI had not developed a formalized, consistent, or effective 

process for incorporating CID into the Guardian system. 

(U) In its 2018 change of the Guardian system and processes, the FBI 

initially designated three types of assessments: (1) national security assessments; 

(2) threat-to-life assessments; and (3) all other assessments. However, the FBI 

also noted that it is virtually impossible to categorize accurately every potential lifethreatening situation. The FBI gave field offices discretion for establishing a 

process for making the designation determination and assigning Guardians entries 

to CTD or CID based on the information received . 

(U) We found, however, that field offices had a different perspective on how 

to incorporate CID into the Guardian assessment process. For instance, some field 

offices required the counterterrorism Guardian Coordinator to review each incoming 

lead, determine if there was a national security nexus, and then assign it 

accordingly. Other field offices had assigned the responsibility of designating 

Guardian incidents to both criminal and counterterrorism Supervisory Special 

Agents . We believe that these inconsistent methodologies could increase certain 

risks, including misidentifying terrorist threats during the intake and review process 

or utilizing improper investigative techniques to assess the threat. 

(U) Counterterrorism agents told us that CID agents and Task Force Officers 

approach allegations differently than CTD agents and Task Force Officers, and 

emphasized the need for cross-training and formalized guidance on conducting 

Guardian assessments. This was evident in the Inspection Division report 

conducted after the Orlando Nightclub Shooting, which stated that the case agent 

assigned to work counterterrorism matters was also assigned to work criminal 

matters and had little formal counterterrorism training. A senior CID official agreed 

that cross-training would be beneficial and should be implemented. However, we 

found that the FBI has not effectively addressed the need for cross-training and 

guidance for CID agents and Task Force Officers who will conduct these 

assessments. We believe that without proper training and guidance, there is an 

increased risk that if a counterterrorism threat or suspicious activity incident is 

categorized incorrectly in the Guardian system, the FBI may m iss the opportunity to 

adequately assess a potential HVE. 

(U) In January 2019, the FBI issued guidance concerning threat-to-life 

incidents, which applies to all FBI Divisions and the former Public Access Line, 

which is now the National Threat Operations Center (NTOC). Specifically, t his 

guidance discusses NTOC's responsibilities, which include determining whether a 

23 

SECRET// NOFORN 
SECRET// NOFORN 

reported threat or suspicious activity incident meets the threat-to-life definition, 

deciding what program area will address the threat, and assigning the incident to a 

field office. In addition, this guidance requires field offices to concur with the 

threat-to-life designation and to take all necessary steps to assess and mitigate the 

threat within a 24-hour period. However, this guidance does not include instruction 

for how to designate a threat-to-life incident as either a national security or criminal 

matter. Moreover, as of March 2019, a senior CID official stated that the FBI had 

not developed oversight protocols for routine criminal-related threats or suspicious 

incidents that do not meet the threshold for a threat-to-life designation. In 

August 2019, FBI officials stated that field office supervisors and Guardian 

Administrators have utilized the Guardian system to process and resolve routine 

Guardian incidents in a timely manner. 

(U) Regardless of whether CTD or CID conducts the Guardian assessment, 

the FBI must ensure all Guardian subjects are thoroughly assessed to identify those 

who have a nexus to terrorism or may mobilize to violence. We recommend that 

the FBI, in particular CTD, review existing guidance for processing and 

systematically categorizing, assigning, and assessing threats and suspicious 

activities in the Guardian system that are related to counterterrorism threat-to-life 

incidents, and develop any additional policies and procedures required. Once 

completed, the FBI should ensure that this information is disseminated to CID for 

review and deploy cross-training between CTD and CID for appropriately conducting 

threat-to-life assessments. 

(U) Strategy to Address Terrorism Incidents of Mental Health Subjects 

(U) FBI officials stated that they have seen an increase in the prevalence of 

incidents in the Guardian system associated with individuals who have an identified 

mental health issue. These types of incidents present various challenges for the 

FBI during the Guardian assessment process because while the subjects may have 

acted suspiciously and have indications of radical ideas associated with terrorism, 

these behaviors may be associated with a mental disorder and not pose an actual 

threat to national security. The FBI has recognized that foreign terrorist 

organizations use social media and online propaganda to target and lure vulnerable 

individuals to accept a violent extremist ideology. According to a 2018 FBI 

presentation, the FBI estimated that 31 percent of lone actor terrorists, which 

includes HVEs, have a documented history of mental illness. 

(U) During our review of Guardian assessments, we found various examples 

where field offices opened multiple assessments on the same individual who had a 

documented mental health issue because they had received successive information 

about the individual's erratic behavior or troubling statements related to terrorist 

activities or organizations. However, we observed that the field offices handled 

these situations differently. For example, some field offices had established 

partnerships with mental health facilities and referred the individuals to those 

organizations for evaluation. Other field offices referred the individuals to their 

family members or guardians for monitoring. When we spoke with FBI officials 

about the process for managing these situations, they noted that the FBI is 

24 

SECRET // NOFORN 
SECRET // NOFORN 

restricted in what it can do in the absence of legal grounds to predicate a federal 

investigation. These agents further said that while assessments involving subjects 

with mental health issues have merit,· most do not turn into terrorism cases, even 

though the subjects continue to pose a risk to the community. 

(U) The FBI has acknowledged the impact and effectiveness of Crisis 

Intervention Teams and partnerships with both state and local law enforcement 

entities and local mental health professionals when mitigating mental health 

situations. 14 In July 2017 congressional testimony, an FBI Assistant Director 

recognized the need for the FBI to develop a coordinated strategy to identify 

individuals needing mental health intervention. In turn, the FBI must also 

determine and delineate whether an individual with a mental illness poses an actual 

threat to national security, which has been a noted risk with HVEs who committed 

terrorist attacks. For example, the FBI assessed Esteban Santiago in 

November 2016 and identified him as an individual with severe mental health 

issues. The FBI referred Santiago to local law enforcement that brought him to a 

psychiatric hospital. In January 2017, Santiago conducted a terrorist attack in 

Fort Lauderdale, Florida, that killed five people. Similarly, during its investigation of 

Omar Mateen, the FBI found that Mateen had a documented history of mental 

health issues, but according to the FBI Inspection Division, the investigation did not 

properly address the underlying risk of his mental health condition. After the FBI 

closed the investigation, Mateen committed a terrorist attack in Orlando, Florida, 

and killed 49 people. Therefore, it is imperative that the FBI field offices have a 

comprehensive strategy to be aware of tools and techniques to assess individuals 

with a mental health issue to ensure that they properly mitigate the risk that these 

individuals pose to national security and their communities. 

(U) In 2018, the FBI's National Joint Terrorism Task Force (NJTTF) 

established the Mental Health Partner Engagement Initiative (MHPEI) to provide 

guidance and facilitate information sharing between CTD and FBI JTTFs regarding 

investigative responses to counterterrorism subjects suffering from mental health 

disabilities. Through this initiative, CTD's Assistant Director canvassed FBI field 

offices to identify and evaluate existing partnerships and best practices with local 

mental health resources and Crisis Intervention Teams in order to disseminate the 

results throughout the FBI's JTTFs. In addition, the FBI's Office of Partner 

Engagement and OGC are currently working in conjunction with the Office of the 

Deputy Attorney General to standardize investigative policies and procedures 

related to subjects with mental health issues. These FBI entities planned to 

establish and deploy a training module in FY 2019 to increase awareness of mental 

health disabilities and provide subject mitigation techniques when dealing with 

individuals suffering from mental health problems. 

(U) The FBI has also emphasized the importance of making public safety 

notifications to appropriate entities, especial ly in situations involving an individual 

10 (U) Crisis Intervention Teams are groups comprised of law enforcement officials, mental 

health staff, and community leaders that support and promote specialized responses to individuals 

exhibiting signs of emotional disturbance who do not pose an immediate risk of violence, but may 

pose such a risk in the future if lelt untreated. 

25 

SECRET// NOFORN 
SECRET // NOFORN 

with suspected or known mental health concerns. For instance, the FBI has stated 

that if an investigator believes a subject of a closed Guardian assessment may pose 

a future risk to the community, such as if the individual has a mental illness, then 

the risk should be addressed to local partners through JTTF briefings. Moreover, 

the FBI has acknowledged that field agents should be aware of the importance of 

coordinating with their partners to employ mental health holds, which require a 

professional mental health expert to evaluate the subjects and potentially assist in 

identifying these individuals' propensity towards violent actions. In February 2019, 

the FBI updated the Guardian system to include a section in the assessment 

process to better document notifications and referrals to non-FBI entities. 

(U) While the FBI has taken important steps to address this challenge, we 

believe that CTD must ensure field offices are engaged with local Crisis Intervention 

Teams and that field offices fully understand and implement processes to assess 

and mitigate subjects who have mental health disabilities. The FBI should also 

ensure that the training module to provide subject mitigation techniques when 

dealing with individuals suffering from mental health problems is developed and 

deployed. 

26 

SECRET// NOFORN 
SECRET// NOFORN 

(U) CONCLUSION AND RECOMMENDATIONS 

(U) The FBI faces an emerging HVE threat that poses unique challenges 

related to both national security and the privacy rights of U.S. citizens and legal 

permanent residents. The FBI has undertaken efforts to prioritize the HVE threat to 

ensure its processes identify and mitigate HVEs and has successfully disrupted 

plans by individuals to conduct attacks in the United States. However, the FBI has 

also identified weaknesses in its process to assess and mitigate counterterrorism 

threats through its Guardian system. Since 2012, these have included inadequate 

investigative steps associated with counterterrorism assessments, yet 5 years later 

the FBI found that weaknesses continued to exist. Given the longstanding issues 

related to counterterrorism assessments, we are concerned that the FBI has not 

taken a comprehensive approach to resolving the underlying deficiencies in the 

execution of its Guardian program. 

(U) Although the FBI undertook an internal review of all counterterrorism 

assessments closed between CY 2014 and CY 2016 to identify potential unmitigated 

terrorist threats, it did not effectively oversee and manage this review. 

Consequently, nearly 40 percent of the closed assessments identified as requiring 

additional investigative action were not addressed for 18 months, some of which 

have since resulted in the FBI opening preliminary or full counterterrorism 

investigations. 

(U) In addition to the inadequate and untimely action taken by some field 

offices to address these deficient assessments, we found inconsistencies in the 

execution of this internal review. During the review, the FBI's OGC disseminated 

guidance that field offices were only to perform limited investigative steps while 

reviewing the closed Guardian assessments and only on those assessments that 

were determined to be deficient. The FBI's OGC cautioned that additional 

investigative effort on other closed assessments was outside the scope of the 

Deputy Director's Closed Guardian Review. Yet, not all field offices complied with 

this guidance and some conducted database checks on all closed Guardian 

assessments. These field offices found the process of proactively conducting 

database checks on all closed Guardian assessments beneficial, including at least 

one field office that identified new derogatory information and incidents during the 

process. Moreover, CTD also replicated this process by rerunning database checks 

of two field offices' closed Guardian assessments. In light of this, the FBI should 

assess whether the FBI's OGC guidance during the review was too limiting under 

applicable law and FBI policy,· and determine whether updated database checks are 

permissible to ensure that the FBI has current and accurate information about 

potential HVEs. While we acknowledge the difficulty in finding the right balance 

between national security and civil liberties, the FBI should determine what steps 

are permissible under applicable law and FBI policy, and if necessary, amend FBI 

policy consistent with legal requirements to ensure that the FBI is able to identify 

and mitigate potential terrorism threats during Guardian assessments and 

reassessments. 

27 

SECRET// NOFORN 
SECRET// NOFORN 

(U) Further, the FBI needs to ensure that field offices are provided adequate 

guidance and training to appropriately handle emerging challenges affecting its HVE 

strategy, including criminally-based threats to life and challenges presented by 

persons with identified mental health issues making threats of violence. 

(U) We recommend that the FBI: 

1. (U) Identify and document lessons learned from the Deputy Director's Closed 

Guardian Review and disseminate the results to senior headquarters and field 

office leadership to help ensure the underlying problems related to 

procedures, implementation, and oversight of this endeavor do not occur in 

future large-scale internal reviews and initiatives. 

2. (U) Assess the legal, policy, and civil liberties issues implicated by the FBI's 

OGC guidance related to database checks during the Deputy Director's 

Closed Guardian Review, as well as CTD and field offices' execution of the 

review in contrast to this guidance, and determine what, if any, follow-up 

action is necessary. If the FBI's OGC guidance was required by policy, 

determine whether it may be appropriate and consistent with applicable law 

to amend FBI policy to permit follow-up inquiries of closed assessments in 

certain circumstances. 

3. (U) Review the use of TECS alerts in Guardian assessments and provide clear 

guidance to CTD and field offices about when such use is appropriate. 

4. (U) Ensure field offices are fully aware of when to seek certain forms of legal 

process in connection with Guardian assessments and collaborate with CTD 

to discuss their coordination with USAOs and other options for obtaining 

records. 

5. (U) In conjunction with the efforts to address Recommendation Number 2, 

examine current field office initiatives that provide an ongoing mechanism to 

revisit subjects of closed assessments and investigations. This examination 

should identify any legal, pol icy, and civil liberties implications so that a 

decision can be made as to whether all FBI field offices should undertake 

similar initiatives. 

6. (U) Review existing guidance for processing and systematically categorizing, 

assigning, and assessing threats and suspicious activities in the Guardian 

system that are related to counterterrorism threat-to-life incidents, and 

develop any additional policies and procedures required. Once completed, 

ensure that this information is disseminated to CID for review, and deploy 

cross-training between CTD and CID for appropriately conducting 

assessments of threats-to-life. 

7. (U) Develop and implement a comprehensive strategy for assessing and 

mitigating threats with subjects who have mental health concerns, which 

incorporates a requirement for field offices to establish a plan to utilize the 

28 

SECRET // NOFORN 
SECRET// NOFORN 

resources and legal techniques specific to their area of responsibility to 

address this emerging threat, and deploy a training module to provide 

subject mitigation techniques when dealing with individuals suffering from 

mental health problems. 

29 

SECRET // NOFORN 
SECRET// NOFORN 

{U) STATEMENT ON INTERNAL CONTROLS 

(U) As required by the Government Auditing Standards, we tested, as 

appropriate, internal controls significant within the context of our audit objectives. 

A deficiency in an internal control exists when the design or operation of a control 

does not allow management or employees, in the normal course of performing their 

assigned functions, to timely prevent or detect: (1) impairments to the 

effectiveness and efficiency of operations, (2) misstatement in financial or 

performance information, or (3) violations of laws and regulations. Our evaluation 

of the FBI's internal controls was not made for the purpose of providing assurance 

on its internal control structure as a whole. FBI management is responsible for the 

establishment and maintenance of internal controls. 

(U) As noted in the Audit Results section of this report, we identified 

deficiencies in the FBI's internal controls that are significant within the context of 

the audit objectives and based upon the audit work performed that we believe 

adversely affect the FBI's ability to ensure potential threats have been fully 

addressed and mitigated. Specifically, the FBI has not resolved underlying 

deficiencies in the execution of its Guardian Program that have continued to persist, 

all FBI field offices may not be aware of all tools and techniques that can be used 

during the assessment of Guardian subjects, and the FBI has not developed 

comprehensive strategies and guidance for countering emerging challenges posed 

by the HVE threat. 

(U) Because we are not expressing an opinion on the FBI's internal control 

structure as a whole, this statement is intended solely for the information and use 

of the FBI. This restriction is not intended to limit the distribution of this report, 

which is a matter of public record. However, we are limiting the distribution of this 

report because it contains sensitive information that must be appropriately 

controlled. 15 

15 (U) A redacted copy of this report with sensitive information removed will be made 

available publicly. 

30 

SECRET// NOFORN 
SECRET// NOFORN 

(U} STATEMENT ON COMPLIANCE WITH LAWS AND 

REGULATIONS 

(U) As required by the Government Auditing Standards, we tested, as 

appropriate given our audit scope and objectives, selected records, procedures, and 

practices, to obtain reasonable assurance that FBI management complied with 

federal laws and regulations for which noncompliance, in our judgment, could have 

a material effect on the results of our audit. FBI management is responsible for 

ensuring compliance with applicable federal laws and regulations. In planning our 

audit, we identified the following laws and regulations that concerned the 

operations of the auditee and that were significant within the context of the audit 

objectives: 

• The Attorney General's Guidelines for Domestic FBI Operations 

• The FBI's Domestic Investigations and Operations Guide (DIOG) 

• 18 U.S. Code§ 2339A - Providing Material Support to Terrorists 

• 18 U.S. Code§ 2339B - Providing Material Support or Resources to 

Designated Foreign Terrorist Organizations 

(U) Our audit included examining, on a test basis, that FBI's compliance with 

the aforementioned laws and regulations that could have a material effect on the 

FBI's operations, through interviewing FBI personnel, reviewing internal control 

procedures, and reviewing FBI documentation, including counterterrorism 

assessment data. Nothing came to our attention that caused us to believe that the 

FBI was not in compliance with the aforementioned laws and regulations. 

31 

SECRET// NOFORN 
SECRET// NOFORN 

(U) APPENDIX 1 

(U) OBJECTIVES, SCOPE, AND METHODOLOGY 

(U) Objectives 

(U) The objectives of our audit were to: (1) review the FBI's HVE casework 

and resource management; (2) evaluate the FBI's strategic and tactical policies and 

processes to identify and assess HVE threats; and (3) evaluate the FBI's 

coordination with relevant components and its strategic and tactical policies and 

processes to identify and assess HVE threats. 

(U) Scope and Methodology 

(U) We conducted this performance audit in accordance wit h generally 

accepted government auditing standards. Those standards require that we plan 

and perform the audit to obtain sufficient, appropriate evidence to provide a 

reasonable basis for our findings and conclusions based on our audit objectives. 

We believe that the evidence obtained provides a reasonable basis for our findings 

and conclusions based on our audit objectives. 

(U) Our review focused on the FBI's efforts in this area between 

October 2012 and September 2018. During the course of our audit, we interviewed 

officials within the FBI's Counterterrorism Division, including the Assistant Director 

and Deputy Assistant Directors. The audit also required us to interview the 

Executive Assistant Director of the National Security Branch. We interviewed and 

conducted audit work with field offices in Austin, Texas; Chicago, Illinois; Denver, 

Colorado; Milwaukee, Wisconsin; Phoenix, Arizona; San Francisco, California; and 

Washington, D.C. To more fully understand the legality of processes, we 

interviewed individuals within the FBI's Office of the General Counsel. These 

interviews, as well as documentation obtained during t hese discussions, provided 

perspective on the challenges with addressing HVEs. In total, we conducted more 

than 100 interviews with FBI personnel. 

(U) To accomplish our audit objectives, we obtained and reviewed personnel 

resource utilization data from the FBI's Time Utilization Recordkeeping (TURK) 

system. We used this data to perform a review of the FBI's resource management 

of special agents and intelligence analysts with regards to the HVE threat. 

However, we did not test the reliability of t his system as a whole because this data 

was used for information purposes only. 

(U) We additionally obtained and reviewed casework data from the FBI's 

Sentinel system. This data was used in our review of HVE cases opened between 

FYs 2013 and 2018. We did not test the reliability of this system as a whole 

because this data was used for information purposes only. To provide additional 

context for our audit results, this report includes FBI-provided data on the number 

of pending HVE cases. These pending case figures are unaudited by the OIG and 

32 

SECRET// NOFORN 
SECRET// NOFORN 

are figures that the FBI previously prepared for the Attorney General in 

October 2018. 

(U) We also obtained data from the FBI's Guardian system. We did not test 

the reliability of the entire Guardian system as a whole; therefore, any findings 

identified involving information from that system were verified with documentation 

from other sources. However, we assessed reliability of the Guardian data by: 

(1) performing electronic testing of required data elements, (2) reviewing existing 

information about the data and the system that produced it, and (3) interviewing 

FBI officials knowledgeable about the data. We determined that the data was 

sufficiently reliable for the purposes of this report. We examined counterterrorism 

Guardians assessments from the following five FBI field office locations: Chicago, 

Illinois; Denver, Colorado; Milwaukee, Wisconsin; San Francisco, California; and 

Washington, D.C. We judgmentally selected approximately 200 Guardian 

assessments for further review to determine whether appropriate steps were taken 

to address the information reported. As part of this sample, we reviewed Guardian 

assessments that were flagged by either the field office or the CTD during the 

Deputy Director's Closed Guardian Review. Our sample selection methodologies 

were not designed with the intent of projecting our results to the population from 

which the samples were selected. 

(U) Further, we reviewed various FBI policy and guidance documents, 

including the Domestic Investigations Operations Guide and Counterterrorism Policy 

Guide. 

(U) Management Advisory Memorandum 

(U) During the audit, we became aware of an HVE-related threat posed by 

the activities of an HVE who is incarcerated at a federal facility outside of DOJ's 

authority. We provided the FBI, our congressional oversight committees, and the 

non-DOJ entity with more detailed information about the circumstances discovered 

during our audit in a classified Management Advisory Memorandum (MAM). We 

made five recommendations in our MAM and have coordinated with the FBI since 

June 2018 to assess its efforts to address these recommendations. In June 2019, 

we closed all five recommendations. 

33 

SECRET// NOFORN 
SECRET// NOFORN 

(U) APPENDIX 2 

(U) FEDERAL BUREAU OF INVESTIGATION RESPONSE TO THE 

DRAFT REPORT 

0 U.S. Department orJustice 

Federal Bureau oflnvestigation 

Washington, D. C. 20535-0001 

October 17, 2019 

The Honorable Michael E. Horowitz 

Inspector General 

Office ofthe Inspector General 

U.S. Department of Justice 

950 Pennsylvania Avenue, N.W. 

Washington, DC 20530 

Dear Mr. Horowitz: 

The Federal Bureau of Investigation (FBI) appreciates the opportunity to review and 

respond to your office's report entitled. Audit ofthe Federal Bureau ofInvestigation 's Efforts to 

Identify Homegrown Violent Extremists through Counterterrorism Assessments. 

The FBJ has conducted reviews ofthe assessment process and has made changes to 

implement best practices and make recommended changes. Some ofthe changes made include 

the requirement for CTD program managers to concur within 15 days on all counterterrorism 

Guardian assessments subnutted for closure. In addition, a performance metric was implemented 

for field office executive management related to the quality of counterterrorism Guardian 

assessments. 

We agree it is important to continue to improve the assessment process, provide adequate 

guidance, training, and program management for all GWU'dians and those specifically addressing 

HVEs. In that regard, we concur w:ith the seven recommendations for the FBI. 

Should you have any questions, feel free to contact me. We greatly appreciate the 

professionalism of your audit staffthroughout this matter. 

·

Suzanne 

~ 

Turner 

Section Chief 

External Audit and CompliBl!ce Section 

Inspection Division 

Enclosure 

34 

SECRET// NOFORN 
SECRET// NOFORN 

Audit ot'thc Federal Bm·cau ol' Investigation's Efforts to ldcntil'y Homcg1·own Violent 

Extremists thl'Ough Cow1terte1..-01ism Assessments 

Recommendation 1: (U) Identify ,u1d document lessons leamed from the l)eputy l)irector·s 

Closed Guardian Review and disseminate the results to senior headquarters and field office 

leadership to help ensure the underlying problems related to procedures. implementation, and 

oversight ofthis endeavor do not occur in futur.: large-scale intemal reviews and initiativ.:s. 

FBI Response to Recommendation 1: 

(U) The Counte11eITorism l)ivision (CTI)) concurs with this recommendation and will review 

lessons teamed. best practices. and areas for improvement highlighted during this audit and draft 

an after-action repo11 (AAR). 'l11is AAR wi ll highlight lessons teamed, hest practices, and 

procedures when conducting large-scale intemal reviews ofCounterten-orism Guardian 

assessments, assigning clear roles, responsibilities. oversight. and deadlines, and set fo11h 

guidelines to improve accountability and ensure follow-up investigative actions are pursued 

where appropriate. 

Recommendation 2: (U) Assess the legal, policy, and civil lihe11ies issues implicated by the 

FBI"s OGC guidance related to database checks during the Deputy Director·s Closed Guardian 

Review. as well as CTI) and field offices· execution ofthe review in contrast to this guidance. 

and detennine what, if any, follow-up action is necessary. If"the FnI's OGC guidance was 

required by policy, determine whether it may be appropriate and consistent with applicable law 

to amend FBI policy to pennit follow-up inquiri.:s of closed assessments in certain 

circumstanct!s. 

FBI Response to Recommendation 2: 

(U) r:rn Office ofthe General Counsel (OGC), in coordination with CTD concurs with this 

rccommcndation and will assess the applicahlc lcgal, policy, and civil liberties issucs implicat.:d 

hy the ir guidance rdatt!d to the Deputy Director's Closed Guardian Review as well ,L~ CTD and 

field oflices· execution ofthe review·s guidance. If, upon review, guidance may be amended, 

corrective action is needed, or policy modification is warranted and pcnnittcd by law, OGC will 

engage with the relevant stakeholders to propose amendments. pursue corrective action, and 

modifkation. 

Recommendation 3: (U) Review the use of' TECS ahirts in Guardian assessmt!nL~ and provide 

clear guidance lo CTD and field oflices about when such use is appropriate. 

FBI Response to Recommendation 3: 

(U) CTD concurs wilh this rccommcn<lalion. CTD will rcvicw TECS akrts and, more broadly. 

watch listing criteri a for Type 1/2 A~scssmcnls including whether and when these may tools 

apply to closed Type 1/2 Assessments. 

35 

SECRET// NOFORN 
SECRET// NOFORN 

Recommendation 4: (lJ) Ensure field offices are rully aware or when lo seek certain fonns or 

legal process in co1mcction with Guardian assessments and collaborate with CTD to discuss its 

coordination with lJSAOs and other options for ohtaining records. 

FBI Response to Recommendation 4: 

(U) CTD concurs with this recommendation. CTD will continue to provide oversight and 

guidance regarding legal process for Type 1/2 Assessments through the program management of 

all CID Type 1/2 Assessments. In addition. we will continue lo pursue additional training 

opportunities to ensure that guidance, which is necessarily specific in nature in order to account 

for the specific circumstances, tempos, and nuances or ca-;cs, relationships with service 

providers, relationships with lJSAOs, and expeded results from legal process, is availahle lo 

applicahle field office squads. cm will review availahle online training for this topic and will 

propose modification to this training if improvements arc needed. 

Recommendation 5: (lJ) In conjunction with the effort.~ to address Recommendation um her 2, 

examine cutTent field oflice initiatives that provide an ongoing mechanism to revisit subjects of 

closed assessments and investigations. This examination should identify any legal, policy, and 

civil libe11ies implications so that a decision can be made as to whether all .FHl field offices 

should undertake similar initiatives. 

FBI Response to Recommendation 5: 

(U) cm concurs with this recommendation. OGC in conjunction with its review or the 

applicable legal, policy, and liberties implications, will examine cutTent field office iniliatiws 

and identify any further such implications in order to evaluate whether additional offices may 

undertake similar initiatives. 

Recommendation 6: (U) Review existing guidance for processing and systematically 

categorizing, assigning, and assessing threats and suspicious activities in the Guardian system 

that an: related to counterterrorism threat-to-lifo incidents, and develop any additional policies 

and procedures required. Once completed, ensure that this infonnation is disseminated to CID 

for review and deploy cross-training between CTD and CID for appropriately conducting 

assessmenL-; o f threaL-;-to-lire. 

FBI Response to Recommendation 6: 

(lJ) CTI) concurs with this recommendation. The recommendation is partially complete as the 

FHI hac: reviewed existing guidance and developed a protocol for processing, categorizing, 

assigning, tracking, and overseeing incidents involving tlu·eats to life. This process has been 

adopted by both CID and CTU and has been coordinated with the National "llu·eat Operations 

Center. J\11field offices were required to attend training in early 2019 on the newly established 

protocols. Revisions and improvements to the protocols are underway. 

36 

SECRET// NOFORN 
SECRET// NOFORN 

Recommendation 7: (U) Develop and implement a comprehensive strategy for assessing and 

mitigating threats with subj ects who have mental health concerns, which incorporates a 

requirement for field offices to establish a plan to utilize the resources and legal techniques 

specific to their area ofresponsibility to address this emerging threat, and deploy a training 

module to provide subject mitigation techniques when dealing with individuals suffering from 

mental health problems. 

FBI Response to Recommendation 7: 

(U) CTD concurs with this recommendation. CTD in coordination with CID, Office of Partner 

Engagement (OPE), and Behavioral Analysis Unit (BAU) are currently engaged with DOJ on 

developing a comprehensive strategy to assess and mitigate threats where a law-enforcement 

intervention may not be the singular most effective or appropriate strategy. This strategy, of 

which CTD is a component, would include threats involving mental health dynamics. A canvass 

offield office efforts to address these U1reats has already identified model programs and practices 

throughout the U.S. FBI will also evaluate training requirements and ftmding for Bureau 

personnel to develop expertise in managing complex tlu·eats. The goal is to ensure that field 

offices are aware oftl1e myriad tl1reat mitigation resources in their AORs, have active 

relationships with those resources, and have firn1ly established a system for collaboration on 

qualifying threats. 

37 

SECRET// NOFORN 
SECRET // NOFORN 

(U) APPENDIX 3 

(U) OFFICE OF THE INSPECTOR GENERAL ANALYSIS AND 

SUMMARY OF ACTIONS NECESSARY TO CLOSE THE REPORT 

(U) The Office of the Inspector General (OIG) provided a draft of this audit 

report to the Federal Bureau of Investigation (FBI). The FBI's response is 

incorporated in Appendix 2 of this final report. In response to our audit report, the 

FBI concurred with our recommendations and discussed the actions it will 

implement in response to our findings. The following provides the OIG analysis of 

the response and summary of actions necessary to close the report. 

Recommendations for the FBI: 

1. {U) Identify and document lessons learned from the Deputy Director's 

Closed Guardian Review and disseminate the results to senior 

headquarters and field office leadership to help ensure the underlying 

problems related to procedures, implementation, and oversight of this 

endeavor do not occur in future large-scale internal reviews and 

initiatives. 

(U) Resolved. The FBI concurred with our recommendation. In its response to 

our dra~ report, the FBI stated that it will work to address the recommendation 

by conducting a review and documenting the results in an after-action report 

(AAR). The FBI stated that the AAR will highlight areas of improvement when 

conducting large-scale internal reviews of Counterterrorism Guardian 

assessments, set forth guidelines to improve accountability, and ensure followup investigative actions are pursued where appropriate. 

(U) This recommendation can be closed when we receive evidence that the FBI 

identified and documented lessons learned, best practices, and areas of 

improvement from the Deputy Director's Closed Guardian Review and other 

large-scale Guardian reviews. Please also provide the OIG with evidence that 

the information gleaned from this review is disseminated to senior headquarters 

and field office leadership. 

2. (U) Assess the legal, policy, and civil liberties issues implicated by the 

FBI's Office of General Counsel (OGC) guidance related to database 

checks during the Deputy Director's Closed Guardian Review, as well as 

Counterterrorism Division {CTD) and field offices' execution of the 

review in contrast to this guidance, and determine what, if any, followup action is necessary. Ifthe FBI's OGC guidance was required by 

policy, determine whether it may be appropriate and consistent with 

applicable law to amend FBI policy to permit follow-up inquiries of 

closed assessments in certain circumstances. 

(U) Resolved. The FBI concurred with the recommendation. The FBI stated that 

its OGC will coordinate with CTD to assess the applicable legal, policy, and civil 

38 

SECRET// NOFORN 
SECRET// NOFORN 

liberties issues implicated by OGC guidance related to the Deputy Director's 

Closed Guardian Review, as well as CTD and field offices' execution of this 

guidance. The FBI also stated that if, upon review, the FBI determines that 

guidance needs to be amended, corrective action is needed, or policy 

modification is warranted and permitted by law, then OGC will engage with the 

relevant stakeholders to propose amendments, pursue corrective action, and 

effect policy modification. 

(U) This recommendation can be closed when we receive evidence that the FBI's 

OGC, in coordination with CTD, assessed the legal, policy, and civil liberties 

issues implicated by OGC guidance during the Deputy Director's Closed Guardian 

Review, as well as CTD and field offices' execution of the review in contrast to 

this guidance, determined if follow-up action was necessary, and implemented 

necessary corrective actions or modifications. In addition, the FBI should 

provide documentation of OGC's determination of whether it may be appropriate 

or consistent with applicable law to amend FBI policy to permit follow-up 

inquires of closed assessments in certain circumstances. 

3. {U) Review the use of TECS alerts in Guardian assessments and provide 

clear guidance to CTD and field offices about when such use is 

appropriate. 

(U) Resolved. The FBI concurred with the recommendation. In its response, the 

FBI stated that CTD will review the use of TECS alerts - and, more broadly, 

watchlisting criteria - related to Type 1/11 Assessments, including whether and 

when such tools may apply to closed Type 1/11 Assessments. 

(U) This recommendation can be closed when the FBI provides evidence of its 

review of the use of TECS alerts (as well as watchlisting criteria) and has taken 

steps, including issuing guidance, to ensure personnel are made aware of when 

the use of such tools is appropriate. 

4. {U) Ensure field offices are fully aware of when to seek certain forms of 

legal process in connection with Guardian assessments and collaborate 

with CTD to discuss their coordination with USAOs and other options for 

obtaining records. 

(U) Resolved. The FBI concurred with this recommendation. The FBI stated 

that CTD will continue to provide oversight and guidance regarding legal process 

for Type 1/11 Assessments through the program management of all CTD Type 

1/11 Assessments. In addition, the FBI stated that it will continue to pursue 

additional training opportunities to ensure that guidance is available to 

applicable field office squads. Further, the FBI stated that CTD will review 

available online training for this topic and will propose modification to this 

training if improvements are needed. 

(U) This recommendation can be closed when the FBI provides evidence that 

that field offices, whether it be through training or another mechanism, are fully 

aware of when to seek certain forms of legal process in connection with 

39 

SECRET// NOFORN 
SECRET// NOFORN 

Guardian assessments. In addition, please provide evidence that field offices 

have been reminded to collaborate with CTD to discuss their coordination with 

USAOs and other options for obtaining records. 

5. {U) In conjunction with the efforts to address Recommendation Number 

2, examine current field office initiatives that provide an ongoing 

mechanism to revisit subjects of closed assessments and investigations. 

This examination should identify any legal, policy, and civil liberties 

implications so that a decision can be made as to whether all FBI field 

offices should undertake similar initiatives. 

(U) Resolved . The FBI concurred with this recommendation. In its response, 

the FBI stated that its OGC will examine current field office initiatives, in 

conjunction with its review of applicable legal, policy, and liberties implications, 

in order to evaluate whether additional offices may undertake similar initiatives. 

(U) This recommendation can be closed when the OIG receives evidence that 

the FBI examined field office initiatives that provide an ongoing mechanism to 

revisit subjects of closed assessments and investigations. The evidence should 

also include the identification of any legal, policy, and civi l liberties implications 

and whether all field offices should undertake similar initiatives. 

6. {U) Review existing guidance for processing and systematically 

categorizing, assigning, and assessing threats and suspicious activities 

in the Guardian system that are related to counterterrorism threat-tolife incidents, and develop any additional policies and procedures 

required. Once completed, ensure that this information is disseminated 

to the Criminal Investigative Division {CID) for review and deploy crosstraining between CTD and CID for appropriately conducting 

assessments of threats-to-life. 

(U) Resolved . The FBI concurred with this recommendation. The FBI stated 

that it reviewed existing guidance and developed a protocol for processing, 

categorizing, assigning, tracking, and overseeing incidents involving threats to 

life that both CID and CTD have adopted. The FBI also stated that it required all 

field offices to attend training on the newly established protocols in early 2019. 

The FBI stated, however, that it is in the process of making revisions and 

improvements to the protocols. 

(U) This recommendation can be closed when the OIG receives evidence that 

the FBI reviewed existing guidance related to counterterrorism threat-to-life 

incidents and made necessary revisions and improvements to the policies and 

procedures. In addition, the FBI should provide evidence that CID received the 

updated protocols for threat-to-life incidents and that the FBI also deployed 

cross-training between CTD and CID for appropriately conducting assessments 

of threats-to-life. 

40 

SECRET // NOFORN 
SECRET// NOFORN 

7. (U) Develop and implement a comprehensive strategy for assessing and 

mitigating threats with subjects who have mental health concerns, 

which incorporates a requirement for field offices to establish a plan to 

utilize the resources and legal techniques specific to their area of 

responsibility to address this emerging threat, and deploy a training 

module to provide subject mitigation techniques when dealing with 

individuals suffering from mental health problems. 

(U) Resolved . The FBI concurred with this recommendation . The FBI stated 

that it is currently engaged with DOJ to develop a comprehensive strategy to 

assess and mitigate threats where a law enforcement intervention may not be 

the singular most effective or appropriate strategy. The FBI stated that this 

strategy, of which CTD is a component, would include threats involving mental 

health dynamics. Further, the FBI stated that it will evaluate training 

requirements and funding for FBI personnel to develop expertise in managing 

complex threats. 

(U) This recommendation can be closed when we receive evidence that the FBI 

developed and implemented a comprehensive strategy for assessing and 

mitigating threats with subjects who have mental health concerns, which 

incorporates field offices' utilization of resources and legal techniques specific to 

their area of responsibility. In addition, please provide evidence that the FBI 

has deployed necessary and appropriate training that provides mitigation 

techniques for individuals suffering from mental health problems. 

41 

SECRET// NOFORN 
 

 

 

-

REDACTED FOR PUBLIC RELEASE

The Department of Justice Office of the Inspector General (DOJ OIG) is a 

statutorily created independent entity whose mission is to detect and deter 

waste, fraud, abuse, and misconduct in the Department of Justice, and to

promote economy and efficiency in the Department’s operations.

To report allegations of waste, fraud, abuse, or misconduct regarding DOJ 

programs, employees, contractors, grants, or contracts please visit or call the

DOJ OIG Hotline at oig.justice.gov/hotline or (800) 869-4499.

U.S. DEPARTMENT OF JUSTICE OFFICE OF THE INSPECTOR GENERAL

950 Pennsylvania Avenue, NW

Washington, DC 20530 0001

Website Twitter YouTube

oig.justice.gov @JusticeOIG JusticeOIG

Also at Oversight.gov

REDACTED FOR PUBLIC RELEASE