/$:(1)25&(0(176(16,7,9( 
 

HSI Effectively Contributes 

to the FBI’s Joint 

Terrorism Task Force, 

But Partnering Agreements 

Could Be Improved 

(REDACTED) 

:DUQLQJ7KLVGRFXPHQWLV/DZ(QIRUFHPHQW6HQVLWLYH/(6'RQRWGLVWULEXWHRU

FRS\WKLVUHSRUWZLWKRXWWKHH[SUHVVHGZULWWHQFRQVHQWRIWKH2IILFHRI,QVSHFWRU

*HQHUDO

August 13, 2020 /$:(1)25&(0(176(16,7,9( OIG-20-59 
 

 

 FOR OFFICIAL USE ONLY//LAW ENFORCEMENT SENSITIVE 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Washington, DC 20528 / www.oig.dhs.gov



$XJXVW

MEMORANDUM FOR: Randolph D. Alles 

Senior Official Performing the Duties of the Under 

Secretary for Management 

Alysa D. Erichs 

Acting Executive Associate Director 

Homeland Security Investigations 

U.S. Immigration and Customs Enforcement 

FROM: Joseph V. Cuffari, Ph.D. Digitally signed by JOSEPH V JOSEPH V CUFFARI Inspector General Date: 2020.08.05 14:00:47 CUFFARI -04'00' 

SUBJECT: HSI Effectively Contributes to the FBI’s Joint Terrorism 

Task Force, But Partnering Agreements Could Be 

Improved)RU2IILFLDO8VH 2QO\/DZ(QIRUFHPHQW

6HQVLWLYH

Attached for your action is our final report, HSI Effectively Contributes to the 

FBI’s Joint Terrorism Task Force, But Partnering Agreements Could Be 

Improved)RU2IILFLDO8VH2QO\/DZ(QIRUFHPHQW6HQVLWLYH. We 

incorporated the formal comments provided by your office. 

The report contains five recommendations aimed at improving counterterrorism 

efforts and information sharing. Your office concurred with two 

recommendations, and did not concur with three recommendations. Based on 

information provided in your response to the draft report, we consider 

recommendations 1 and 3 resolved and open. Once your office has fully 

implemented the recommendations, please submit a formal closeout letter to 

us within 30 days so that we may close the recommendations. The 

memorandum should be accompanied by evidence of completion of agreedupon corrective actions and of the disposition of any monetary amounts. 

We consider recommendations 2, 4, and 5 unresolved and open. As prescribed 

by the Department of Homeland Security Directive 077-01, Follow-Up and 

Resolutions for the Office of Inspector General Report Recommendations, within 

90 days of the date of this memorandum, please provide our office with a 

written response that includes your (1) agreement or disagreement, 

(2) corrective action plan, and (3) target completion date for each 

recommendation. Also, please include responsible parties and any other 

supporting documentation necessary to inform us about the current status of 

the recommendation. Until your response is received and evaluated, the 

recommendations will be considered unresolved and open. 

FOR OFFICIAL USE ONLY//LAW ENFORCEMENT SENSITIVE 
 

 

 FOR OFFICIAL USE ONLY//LAW ENFORCEMENT SENSITIVE 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Please send your response or closure request to 

OIGAuditsFollowup@oig.dhs.gov. 

Consistent with our responsibility under the Inspector General Act, we will 

provide copies of our report to congressional committees with oversight and 

appropriation responsibility over the Department of Homeland Security. We 

will post a redacted version of the report on our website. 

Please call me with any questions, or your staff may contact Sondra McCauley, 

Assistant Inspector General for Audits, or Don Bumgardner, Deputy Assistant 

Inspector General for Audits, at (202) 981-6000. 

2 

FOR OFFICIAL USE ONLY//LAW ENFORCEMENT SENSITIVE 
 

 

 

FOR OFFICIAL USE ONLY//LAW ENFORCEMENT SENSITIVE 

DHS OIG HIGHLIGHTS 

HSI Effectively Contributes to the FBI’s Joint Terrorism

Task Force, But Partnering Agreements Could Be Improved 

August 13, 2020 

Why We Did 

This Audit 

A top priority of DHS is 

to protect America from 

terrorism. However, the 

FBI is the lead law 

enforcement agency in 

combatting terrorism 

and maintaining 

operational oversight of 

the JTTF. As such, 

ICE’s HSI has allied with 

the FBI’s JTTF to carry 

out the counterterrorism 

mission. We conducted 

this audit to determine 

if ICE HSI is effectively 

contributing to the FBI’s 

JTTF. 

What We 

Recommend 

We made five 

recommendations to 

improve 

counterterrorism efforts 

and information 

sharing. 

For Further Information: 

Contact our Office of Public Affairs 

at (202) 981-6000, or email us at 

DHS-OIG.OfficePublicAffairs@oig.dhs.gov 

What We Found 

Immigration and Customs Enforcement’s (ICE) Homeland 

Security Investigations (HSI) is effectively contributing to 

the Federal Bureau of Investigation’s (FBI) Joint Terrorism 

Task Force (JTTF) counterterrorism efforts by leveraging its 

authorities, experience, skills, and staffing. Specifically, 

HSI's investigative expertise and ability to enforce its 

unique customs, criminal, and immigration law 

enforcement authorities successfully contribute to JTTF 

efforts. 

However, existing agreements and guidance for HSI’s 

participation in the JTTF and its terrorism financing 

investigations are outdated. This occurred because 

Department of Homeland Security headquarters and HSI 

have not prioritized updating the documents. Up-to-date 

guidance would help establish a framework for agents to 

perform their assigned duties more effectively to support 

mission priorities. 

Additionally, an existing DHS agreement with the 

Department of State restricts HSI JTTF agents from 

sharing passport information with the FBI or other law 

enforcement partners outside of DHS without prior 

approval. The agreement was enacted without considering 

the JTTF’s unique interagency data sharing needs and 

does not adequately support the investigative activities of 

the JTTF. Further, Transportation Security Administration 

policy delays HSI JTTF agents’ access to Secure Flight 

data. HSI agents on the JTTF work around the clock to 

protect the American public from terrorist attacks. Any 

delays or restrictions obtaining critical information could 

have detrimental consequences, such as loss of life. 

Department Response 

DHS concurred with two recommendations and did not 

concur with three. We have included a copy of DHS’ 

management comments in their entirety in appendix A. 

www.oig.dhs.gov OIG-20-59 

FOR OFFICIAL USE ONLY//LAW ENFORCEMENT SENSITIVE 
FOR OFFICIAL USE ONLY/ /LM\' ENFORCEMENT SENSITWE 


OFFICE OF INSPECTOR GENERAL 


Department of Hom elan d Security 

Background 

Immigration and Customs Enforcement's (ICE) Homeland Security 

Investigations (HSI) plays an important role in combatting terrorism through its 

participation in the Federal Bureau of Investigation's (FBI) Joint Terrorism 

Task Force (JTTF). The FBI is the lead law enforcement agency in combatting 

terrorism and maintainin g operational oversight of the JTTF. Prior to the 

formation of ICE, the Department of Justice (DOJ) established agreements with 

its legacy components, Immigration and Naturalization Services (INS) and U.S. 

Customs Service (Customs), to govern participation in the JTTF. 

In October 2001, Customs began conductin g terrorism financing investigations 

under Operation Green Quest. Subsequently, the FBI established the Terrorist 

Financin g Operations Section (TFOS) in 2002 to also focus on terrorism 

financing cases. See Figure 1 for a timeline of events impacting terrorism 

investigations. 

Figure 1. Events Impacting Terrorism Investigations 

JTTF Established e I

September 11 Attacks­

~ M<mo,.ndum of Ag.e~~ First Heightened focus on OHS and OOJ negotiated an JTTF was established 

terrorism followed the 9/11 agreement to address overlap

attacks. 

in New York City. betw.en ICE and FBI on tarrorism 

financing investigations. 

FBI Lead on Terrorism Creation of ICE 

The Homeland Security Act 

as lead law enforcement 

U.S. Code established FBI 

reorganized the government to 

agency in combatting form agencies such as ICE under 

OHS. terrorism. 

9 

Source: OHS Office of Inspector General (OIG) analysis of ICE and FBI data 

Because of duplicate efforts between Operation Green Quest and the FBI's 

TFOS investigations, the Department of Homeland Securityl and DOJ 

1 OHS was established in response to the September 11 , 200 1 terrorist attack s . As a 

component of OHS, ICE was formed in March 2003, transferring and consolidating some of the 

functions and agents from legacy INS and Customs into ICE. 

www.oig.dhs.gov 1 OIG-20-59 

FOR OFFICIAi. USE ONl.Y//l.AU' ENFORCEMENT SENSITIVE 
FOR OFFICIAL USE ONLY/ /LM\' ENFORCEMENT SENSITWE 


OFFICE OF INSPECTOR GENERAL 


Department of Hom elan d Security 

negotiated a Memorandum of Agreement (MOA) in May 20032 to address 

overlapping functions in conducting terrorism financing investigations. The 

MOA dismantled Operation Green Quest and consolidated terrorism financing 

investigations in the JTTF. The MOA specifically requires deconfliction of HSl's 

money laundering and financial crime leads through the FBI TFOS to 

determine if there is a nexus to terrorism. Ifthe FBI declines the case, HSI 

retains the investigation. Otherwise, the investigation is assigned to the JTTF 

where HSI agents may potentially be tasked to lead or assist. Even in 

situations where HSI is the lead case agent, the FBI maintains operational 

control of all cases. 

Terrorist Threats to the Homeland 

In 2011, DHS launched the National Terrorism "The United States is 

Advisory System (NTAS), replacing the Homeland engaged in a generational 

fight against terrnrists who Security Advisory System. The purpose of NTAS 

seek to attack the is to issue timely and detailed information, in the American people, our 

form of Bulletins and Alerts, to inform the country, and our way of 

American Public of terrorist thr eats. The life. An informed, vigilant 

January 18, 2019 NTAS Bulletin emphasizes that and engaged public 

remains one ofour "We continue to face one of the most challenging greatest assets to identify threat environments since 9 / 11, as foreign potential terrnrists and 

terrorist organizations exploit the Internet to prevent attacks." - NTAS 

inspire, enable, or d irect individuals alr eady here January 18, 2019 

in the homeland to commit terrorist acts. 

Homegrown terror suspects increasingly rely on 

technology, such as end-to-end encrypted social media applications, to avoid 

detection." See appendix B for the complete January 18, 2019 NTAS Bulletin. 

Since 9/ 1 1, the DOJ OIG has r eported3 that homegrown violent extremists 

have carried out over 20 attacks in the United States. These attacks include: 

• April 15, 2013 - Boston Marathon Bombings 

• June 12, 2016 - Orlando Pulse Night Club Mass Shooting 

• August 3, 2019 - El Paso Wal-Mart Mass Shooting 

See appendix C for additional terrorist events. 

2 MOA between the Department of Justice and the Department of Homeland Security 

Concerning Terrorist Financing Investigations, dated May 13, 2003. This MOA establishes the 

FBI as the lead agency on terrorism and terrorist financing investigations and emphasized 

information sharing and coordination with HSI. 

3 Audit ofthe Federal Bureau ofInvestigation's Efforts to Identify Homegrown Violent Extremists 

through Counterterrorism Assessments, March 2020. 

www.oig.dhs.gov 2 OIG-20-59 

FOR OFFICIAi. USE ONl.Y//l.AU' ENFORCEMENT SENSITIVE 
FOR OFFICIAL USE ONLY/ /LM\' ENFORCEMENT SENSITWE 


OFFICE OF INSPECTOR GENERAL 


Department of Hom elan d Security 

Prior Related Audits 

DHS OIG collaborated with DOJ OIG to issue a report in 20074 that examined 

coordination between the FBI and HSI on terrorism financing investigations, as 

required by the 2003 MOA. The audit found that terrorism financing cases 

transferred from HSI to the FBI were suitably investigated and HSI agents' 

expertise and experience were fully employed to assist the investigations. No 

recommendations were made to modify the 2003 MOA at the time. However, 

the report identified shortcomings in HSI and FBI implementation and 

management of the MOA that led to problems in cooperation and coordination. 

DHS OIG made four recommendations to overcome the issues. 

In 20 17, the Inspectors General of the Intelligence Community, DOJ, and DHS 

examined counterterrorism information sharing among federal, state, and local 

entities.s Although the report concluded that partners in the counterterrorism 

environment are committed to sharing terrorism information, it identified areas 

for improvement to enhance information exchange. For example, federal, state 

and local partners involved in counterterrorism need to have clearly defined 

roles and responsibilities. 

Additionally, a joint review issued in 20 19 by the DOJ and DHS OIGs examined 

cooperation between the FBI and HSI at the Southwest border. 6 The report 

included five recommendations to improve cooperation. These 

recommendations included "developing written, agency-specific deconfliction 

guidelines; increasing awareness among FBI and HSI agents of each agency's 

mission, statutory authorities, and criminal investigative priorities; instituting 

an interagency MOU for investigative interactions; and resolving unclear 

jurisdictional areas." 

4 Coordination between FBI and ICE on Investigations ofTerrorist Financing (OIG-07-55, July 

2007). 


5 Review ofDomestic Sharing ofCounterterrorism Information (OIG-17-49, March 2017). 
 6 A Joint Review ofLaw Enforcement Cooperation on the Southwest Border between the Federal 


Bureau ofInvestigation and Homeland Security Investigations (OIG-19-57, July 2019). 


www.oig.dhs.gov 3 OIG-20-59 

FOR OFFICIAi. USE ONl.Y//l.AU' ENFORCEMENT SENSITIVE 
• • 

FOR OFFICIAL USE ONLY/ /LM'I ENFORCEMENT SENSITWE 


OFFICE OF INSPECTOR GENERAL 


Department of Hom elan d Security 

Results of Audit 

HSI Provides Significant Contributions to the JTTF 

U.S. Code Titles 8, 18, and 19 are the primary sources authorizing HSI agents 

to investigate criminal activity and immigration violations for: 

• financial crimes, money laundering, and bulk cash smuggling; 

• commercial fraud and intellectual property theft; 

• narcotics and weapons smuggling and trafficking; and 

• immigration, document, and benefit fraud. 

ICE HSI is effectively contributing to the FBI's JTTF counterterrorism efforts by 

leveraging its authorities, experience, skills, and staffing. HSI special agents 

strengthen the JTTF's ability to identify and address threats to ensure the 

safety and security of Americans. Specifically, HSI agents' investigative 

expertise and ability to enforce broad and unique customs, criminal, and 

immigration law enforcement authorities have resulted in successful outcomes, 

as presented in Figure 2. 

Figure 2. FY 2015 - 2019 HSI Performance Metrics for JTTF 

Cases 

• fJ 

927 550 1094 


Criminal Arrests Indictments Convictions Administrative Arrests 

(Immigration Violations) 

Source: DHS OIG analysis of HSI data 

• • HSI ! t : 

www.oig.dhs.gov 4 OIG-20-59 

FOR OFFICIAi. USE ONl.Y/ /LAW ENFORCEMENT SENSITWE 
FOR OFFICIAL USE ONLY/ /LM\' ENFORCEMENT SENSITWE 


OFFICE OF INSPECTOR GENERAL 


Department of Hom elan d Security 

According to HSI officials, existing JTIF staffing allocations were based on 

available resources for competing mission priorities. In October 2019, HSI 

conducted an internal assessment of its JTIF staffing and concluded that an 

additional 97 positions nationwide would provide adequate coverage of HSI's 

JTIF o erational res onsibilities. 

DHS Agreements and Component Guidance Do Not Reflect the 

Operational Needs of HSI Agents Assigned to the JTTF 

DHS Management Directive 0450.1, "Memoranda of Understanding (MOU) and 

Memoranda ofAgreement (MOA)," dated January 24, 2003, requires that every 

DHS MOU and MOA comply with specific requirements. The management 

directive requires basic information, such as clear identification of the parties, 

authorities, points of contact, modification provisions, and termination 

information for every agreement with DHS to ensure the agreements are 

current and accurate. However, we determined existing JTIF agreements are 

outdated and do not comply with these requirements. Figure 4 highlights 

www.oig.dhs.gov 5 OIG-20-59 

FOR OFFICIAi. USE ONl.Y//l.AU' ENFORCEMENT SENSITIVE 
FOR OFFICIAL USE ONLY/ /LM\' ENFORCEMENT SENSITWE 


OFFICE OF INSPECTOR GENERAL 


Department of Hom elan d Security 

issues related to the outdated JTIF agreements and HSI guidance, which are 

discussed in more detail below. 

Source: DHS OIG analysis of JTIF agreements and related HSI guidance 

1999 and 2000 MOUs Governing HSI's Participation in the JTTF 

The FBI established agreements8 with INS and Customs in 1999 and 2000 (no 

longer in existence) that govern HSl's current participation in the JTIF. 

Because the MOUs were executed over 20 years ago and prior to DHS' 

existence, the agreements do not identify termination procedures and points of 

contact information, and do not conform to guidelines in DHS Management 

B MOU between INS and the FBI, dated June 18, 1999, and MOU between Customs and the 

FBI, dated January 6 , 2000. 

www.oig.dhs.gov 6 OIG-20-59 

FOR OFFICIAi. USE ONl.Y//l.AU' ENFORCEMENT SENSITIVE 
FOR OFFICIAL USE ONLY/ /LM\' ENFORCEMENT SENSITWE 


OFFICE OF INSPECTOR GENERAL 


Department of Hom elan d Security 

Directive 0450. l. Additionally, we found no evidence to support whether DHS 

Office of General Counsel r eviewed and approved both MOUs, which is also 

required by DHS Management Directive 0450.1. Since instituting the original 

agreements, HSI has not p rioritized developing a new agreement for its 

continued participation in the JTIF. As a resu lt, HSI does not have up-to-date, 

docu mented arrangements governing its participation in the JTIF, outlining its 

authorities, roles and responsibilities, skill sets, and access to systems within 

the JTIF. 

Because our audit focused only on HSI, it may be necessary for other DHS 

JTIF participants to also review and update their existing agreements, or 

establish new agreements with the FBI. Without cu rrent agreements d ictating 

oper ational r esponsibilities within the JTIF, DHS risks duplication of effort and 

diminished effectiveness. Furthermore, terms of the MOUs may not be 

enforceable or contain provisions not approved by the Department. 

2003 MOA Between DOJ and DHS Concerning Terrorism Financing 

Investigations 

DHS headquarters and HSI have not taken action to ensur e the 2003 MOA 

between DHS and DOJ aligns with current operational needs and conforms to 

DHS Management Directive 0450. l. The 2003 MOA does not contain a 

statement of authorities, modification provisions, updated points of contact, 

and termination information as the management directive requires. 

Additionally, similar to the 1999 and 2000 MOUs, we found no evidence to 

support whether DHS Office of General Counsel r eviewed and approved the 

MOA. Further, deconfliction procedures described in the 2003 MOA r eference 

the TFOS that no longer exists, rendering the procedures irrelevant and 

inconsistent with HSl's current operational practices. 

HSI Internal Memoranda and Investigative Handbook 

HSl's supplemental memoranda9 and investigative handbook10 include 

outdated deconfliction procedures stemming from the 2003 MOA requirements. 

HSI has not prioritized updating applicable internal memoranda and the 

investigative handbook, which remain outdated and do not address operational 

changes. HSI JTIF officials agreed that the field would benefit from up-to-date 

9 HSI memoranda, Interim Guidance for Reporting Green Quest Cases, dated June 25, 2003; 


Procedures Pertaining to MOA on Terrorist-Finance Investigations, dated August 7 , 2003; Use 


ofJoint Vetting Unit to Coordinate Terrorist Financing Investigations, dated August 24, 2007; 


and OIG Report #07-55: Coordination between the FBI and ICE on Investigations of Terrorist 


Financing, dated September 10, 2007. 
 10 National Security Investigations Handbook, dated April 26, 2013, provides guidance for HSI 


special agents conducting national security investigations to ensure operational consistency. 


www.oig.dhs.gov 7 OIG-20-59 

FOR OFFICIAi. USE ONl.Y//l.AU' ENFORCEMENT SENSITIVE 
FOR OFFICIAL USE ONLY/ /LM\' ENFORCEMENT SENSITWE 


OFFICE OF INSPECTOR GENERAL 


Department of Hom elan d Security 

guidance and sta ted, "ICE/ HSI s h ou ld issue clear, comprehensive, upda ted 

guidance with respect to all aspects ofJTIF investigations, which can impact 

any of ICE's numerous programmatic areas and authorities." Up-to-date 

guidance also helps establish a framework for agents to perform assigned 

duties more effectively in support of mission priorities. 

Current Agreement and Policy Restrict Sharing and Access to 

Critical Investigative Information in the JTTF 

The National Security Strategy, dated December 2017, encourages the Federal 

Government to reduce barriers to information sharing. According to the DHS 

Information Sharing and Safeguarding Strategy, dated January 2013, DHS 

should coordinate with other Federal agencies and update agreements to 

improve the timeliness and quality of information sharing. DHS Policy for 

Internal Information Exchange and Sharing, dated February 2007, promotes a 

department-wide information-sharing environment, free of unnecessary 

limitations and constraints, with emphasis on sharing information related to 

potential terrorism activity. Furthermore, the U.S. Government Accountability 

Office emphasizes the importance of continued efforts to improve the 

information sharing environment in light of "the constant evolution of terrorist 

threats and changing technology." 11 

Despite these guidelines, we determined existing agreements and policy impose 

restrictions that delay and h inder sharing and access to information in the 

JTIF. For example, although DHS and some FBI agents have access to 

passport information through separate agreements with the Department of 

State (State), 12 HSI JTIF agents are prohibited from sharing that information 

with FBI agents or other law enforcement partners outside of DHS without 

prior approval from State. 13 The agreements with State also include provisions 

11 In February 2017, Government Accountability Office removed Establishing Effective 

Mechanisms for Sharing and Managing Terrorism-Related Information to Protect the Homeland 

from its high risk list, but emphasized "while this progress is commendable, it does not mean 

the government has eliminated all risk associated with sharing terrorism-related information. 

It remains imperative that the Program Manager and key departments and agencies continue 

their efforts to advance and sustain the Information Sharing Environment." 

12 MOA between State and DHS Regarding the Sharing of VISA and Passport Records and 

Immigration and Naturalization and Citizenship Records, signed November 18, 2008 and MOU 

between State, Bureau of Consular Affairs and DOJ, Federal Bureau of Investigation 

Washington Field Office for Access to certain Passport Services' Databases, signed August 26, 

2009. 13 Because passport records are subject to the Privacy Act of 1974, State requires prior 

approval for dissemination to third parties/agencies unless there is an agreement or 

arrangement authorizing such sharing. 

www.oig.dhs.gov 8 OIG-20-59 

FOR OFFICIAi. USE ONl.Y//l.AU' ENFORCEMENT SENSITIVE 
FOR OFFICIAL USE ONLY/ /LM\' ENFORCEMENT SENSITWE 


OFFICE OF INSPECTOR GENERAL 


Department of Hom elan d Security 

that may result in termination or 

suspension of access to passport "We are no longer allowed to 

information for unauthorized sharing. share US. Passport information 

Although these agreements address privacy or photos with any agency on the 

JTTF. We are now required to .fill concerns, the provisions were enacted 

out a permission form - or in an based on the specified needs of each agency emergency contact a Department which did not consider the information ofState phone number and 

sharing needs of a JTIF environment. speak to a member oftheir legal 

Consequently, department. This could be critical information exchange detrimental during a terrnrist may be delayed, and the restrictions may attack or imminent threat." 

promote a belief among HSI agents and - HSI JTTF Agent JTIF partners that passport information 

should not be shared, resulting in 

information silos. 

Additionally, HSI JTIF agents do not have immediate access to Secure Flight 

data. 14 In accordance with Transportation Security Administration (TSA) 

policy, 15 HSI JTIF agents must submit formal written requests that are subject 

to a multi-layered approval process. This process requires approval from TSA's 

Office of Chief Counsel, the Privacy Officer, the Office of Intelligence and 

Analysis Assistant Administrator, and potentially the TSA Administrator, 

unless the request pertains to an individual on a watchlist or there is an 

established written arrangement with TSA. Currently, no arrangement is in 

place between TSA and the JTIF, similar to other counterterrorism groups 

such as the National Targeting Center. Although TSA may expedite the process 

for exigent circumstances, HSI JTIF agents 

may still experience delays in obtaining "It is critical to the security ofour 

critical investigative leads. While we focused Nation that we share information 

our review only on HSI's JTIF partnership, in an environment that is free of 

unnecessary limitations or other DHS component policies may also constr-aints." - DHS Information result in delays and restrictions in Sharing Memo 2008 

information sharing that are crucial to JTIF 

investigations. 

14 Secure Flight data consists of passenger data and screening results. Transportation Security 

Administration's Secure Flight program supports the Federal Government's counterterrorism 

efforts by performing risk based screening of passengers in addition to matching carrierprovided traveler information to watchlists, such as No Fly and Terrorism Screening database 

to identify threats to transportation or national security. 1s TSA Management Directive No. 1300.4, Request for Secure Flight Data. 

www.oig.dhs.gov 9 OIG-20-59 

FOR OFFICIAi. USE ONl.Y//l.AU' ENFORCEMENT SENSITIVE 
FOR OFFICIAL USE ONLY/ /LM\' ENFORCEMENT SENSITWE 


OFFICE OF INSPECTOR GENERAL 


Department of Hom elan d Security 

Conclusion 

HSI plays an important role in combatting terrorism through its support of the 

FBI's JTIF. HSI JTIF agents collectively work around the clock to protect the 

American public from terrorist attacks. It is imperative that all DHS 

agreements governing its participation in FBI's JTIF provide clear and current 

guidance to assist agents in effectively performing assigned duties and 

strengthening the Department's counterterrorism efforts. 

Further, the FBI created the JTIF to establish an environment where federal, 

state, and local partners can immediately share information during an evolving 

terrorism event or threat. Information sharing is a crucial aspect of a JTIF 

environment, allowing multi-agency partners to leverage the assets of each 

contributor to reach the JTIF's full potential. In balance with privacy 

protection, the Department must ensure that timely sharing of terrorismrelated information is a top priority to deter or prevent terrorist events. Any 

delays or restrictions of information could have detrimental consequences, 

such as the loss of life. 

Recommendations 

Recommendation 1: We recommend the Under Secretary, Office of Strategy, 

Policy, and Plans, in consultation with the Under Secretary of Management, 

coordinate with DHS JTIF contributors to: 

• 	 ensure agreements governing participation in the JTIF are binding; 

• 	 evaluate whether new agreements or terms governing JTIF participation 

are required; and 

• 	 develop guidance defining each DHS JTIF contributors' authorities, roles 

and responsibilities, skill sets, and access to systems. 

Recommendation 2: We recommend the HSI Executive Associate Director 

renegotiate and update the existing 2003 MOA with DOJ on terrorism 

financing investigations to ensure: 

• 	 all appropriate action to align guidance on handling of terrorism cases 

with current operations; 

• 	 essential requirements defined in DHS Management Directive 0450.1 

are included; and 

• 	 a review and modification process is established to reflect future 


operational changes. 


www.oig.dhs.gov 10 	 OIG-20-59 

FOR OFFICIAi. USE ONl.Y//l.AU' ENFORCEMENT SENSITIVE 
FOR OFFICIAL USE ONLY/ /LM\' ENFORCEMENT SENSITWE 


OFFICE OF INSPECTOR GENERAL 


Department of Hom elan d Security 

Re commendation 3: We recommend the HSI Executive Associate Director 

revise existing guidance including the 2003 and 2007 terrorism financing 

internal memoranda and its National Security Investigations Handbook to 

reflect changes implemented by departmental or interagency agreements. 

Recommendation 4 : We recommend the Under Secretary, Office of Strategy, 

Policy, and Plans, in consultation with the Under Secretary of Management, 

coordinate with DOJ and State to develop an agreement that facilitates the 

direct sharing of passport information within the JTIF environment through 

State's formal MOU process. 

Recommendation 5: We recommend the Under Secretary of Management 

coordinate with the Information Sharing and Safeguarding Governance Board 

to ensure: 

• 	 ICE and TSA develop an agreement for TSA to d irectly process Secure 

Flight data requested for use by JTIF or HSI JTIF agents investigating 

terrorism activities or performing task force specific m issions, and 

• 	 DHS JTIF contributors mitigate data restrictions or delays pertaining to 

law enforcement and intelligence investigations. 

Management Comments and OIG Analysis 

DHS management provided written comments to address the recommendations 

provided in a draft of this report. Appendix A contains DHS management 

comments in their entirety. We also received technical comments on the draft 

report and revised the report as appropriate. 

DHS Management's General Comments and OIG Response 

In its general comments, DHS management stated our report incorrectly 

concludes partnering agreements and policy hinder JTIF operations. We 

contend the information presented in our report is accurate and fairly presents 

the results of our review. Following is our response to DHS' specific assertions. 

DHS Management Comment: The draft report incorrectly concludes existing 

partnering agreements and policy h inder JTIF operations. As departmental 

program officials and subject matter experts discussed with the audit team on 

multiple occasions, JTIF agents are currently able to obtain needed 

information without undue delay. The current information sharing 

environment has no negative operational or programmatic impacts on the 

JTIF, which functions efficiently and effectively. The OIG's conclusion that 

JTIF operations are negatively impacted is not supported in the draft report. 

www.oig.dhs.gov 11 	 OIG-20-59 

FOR OFFICIAi. USE ONl.Y//l.AU' ENFORCEMENT SENSITIVE 
FOR OFFICIAL USE ONLY/ /LM\' ENFORCEMENT SENSITWE 


OFFICE OF INSPECTOR GENERAL 


Department of Hom elan d Security 

OIG Response: We disagree with DHS' statement that our conclusions are 

incorrect and not supported. We detailed in our report how existing 

agreements and policy impose restrictions that delay and hinder sharing and 

access to information in the JTIF. 

Specifically, we reported that, although DHS and some FBI agents have access 

to passport information through separate agreements with State, HSI JTIF 

agents are prohibited from sharing that information with FBI agents or other 

law enforcement partners outside of DHS without prior approval from State. 

Based on HSI JTIF senior leadership's technical comment, there appears to be 

a misunderstanding regarding State requirements for sharing passport 

information. For example, HSI JTIF senior leadership stated, "While the 

dissemination of Department of State (DOS) information needs to be approved 

through the DOS, as a JTIF partner, we can share information we have access 

to with other members of the JTIF on JTIF investigations. The only time 

approval from the DOS is needed is if the information will be disseminated 

(different than shared) and the original documentation will be used for official 

or court purposes." This clearly contradicts the provisions of the DHS MOA 

with State requiring approval from State prior to sharing passport information 

outside of DHS. 

Additionally, we reported HSI JTIF agents' requests for Secure Flight data are 

not processed directly by TSA. According to TSA's policy, HSI JTIF agents 

must submit formal written requests that are subject to approval from TSA's 

Office of Chief Counsel, the Privacy Officer, the Office of Intelligence and 

Analysis Assistant Administrator, and potentially the TSA Administrator, 

unless the requests pertain to individuals on a watchlist or there is an 

established written arrangement with TSA. 

The Department should strive for immediate passport and Secure Flight 

information sharing for HSI JTIF agents. As described in the 9 / 1 1 

Commission Report, "Agencies uphold a 'need-to-know' culture of information 

protection rather than promoting a 'need-to-share' culture of integration." 

Going forward, DHS should take a proactive stance on sharing information to 

minimize delays experienced by DHS personnel in accomplishing their mission 

of protecting the American public. 

www.oig.dhs.gov 12 OIG-20-59 

FOR OFFICIAi. USE ONl.Y//l.AU' ENFORCEMENT SENSITIVE 
FOR OFFICIAL USE ONLY/ /LM\' ENFORCEMENT SENSITWE 


OFFICE OF INSPECTOR GENERAL 


Department of Hom elan d Security 

DHS Management Response to Recommendations and OIG Analysis 

DHS concurred with recommendations 1 and 3 but did not concur with 

recommendations 2, 4, and 5. A summary of DHS' responses and our analysis 

follows. 

DHS Response to Recommendation 1: Concur. The DHS Office of Strategy, 

Policy, and Plans (PLCY) will coordinate with DHS JTTF contributors to collect 

and review existing agreements governing participation in the JTTF. The PLCY 

Office of Counter Terrorism and Threat Prevention (CTP) will lead the 

development and issuance of guidance that defines the authorities, roles, and 

responsibilities of each DHS JTTF contributor when updating the agreements. 

Upon CTP establishing the guidance, each DHS JTTF contributor will update 

its individual JTTF agreements to reflect its unique law enforcement expertise 

and authorities, as appropriate. The estimated completion date is June 30, 

2021. 

OIG Analysis: We consider these actions responsive to the recommendation, 

which is resolved and open. We will close this recommendation after we verify: 

• 	 PLCY CTP has issued guidance for DHS JTTF contributors to define the 

authorities, roles and responsibilities; and 

• 	 DHS contributors have established or updated existing agreements 


reflecting their scope of involvement and authorities on the JTTF. 


DHS Response to Recommendation 2: Non-concur. Although the "MOA 

Between the Department of Justice (DOJ) and the DHS Concerning Terrorist 

Financing Investigations," dated May 13, 2003, does not currently reflect 

organizational and operational changes within both HSI and the FBI since its 

enactment, activities and subsequent guidance are required to be fluid and 

allow for adjustment to the ever-changing environment in which our law 

enforcement agencies operate. As a result, HSI and the FBI have adapted to 

the various organizational changes within their agencies in the terror finance 

m ission space. In keeping with the intended premise and spirit of the MOA 

between DHS and DOJ on terror finance, HSI continues to fully deconflict 

possible terrorism financial investigations with the FBI. While the MOA 

delineated a process and entities that no longer exist, using the FBI Terrorism 

Finance Operations Section and the Joint Vetting Unit, the process used 

currently is operationally effective and efficient for both agencies in its 

execution and still aligns with the MOA's intended purpose. 

On top of the deconfliction process with the FBI on terror finance cases, 

pursuant to ICE Memorandum entitled, "Capabilities and Mandatory Use of 

ICE Special Operations Unit," dated September 1, 2009, as well as subsequent 

www.oig.dhs.gov 13 	 OIG-20-59 

FOR OFFICIAi. USE ONl.Y//l.AU' ENFORCEMENT SENSITIVE 
FOR OFFICIAL USE ONLY/ /LM\' ENFORCEMENT SENSITWE 


OFFICE OF INSPECTOR GENERAL 


Department of Hom elan d Security 

yearly guidance to HSI field offices, it is mandatory for all HSI field offices to 

forward all communication data identified in any criminal investigation 

targeting narcotics smuggling, narcotics related money laundering, and 

terrorist related activity to the Special Operations Unit (SOU) for deconfliction 

and coordination purposes. 

Senior ICE leadership does not believe renegotiating and updating the 2003 

MOA would represent a prudent expenditure of increasingly scarce and limited 

resources given that the current deconfliction procedures in place are aligned 

with the purpose of the MOA between DHS and DOJ, and only the names of 

the organizational programmatic areas have changed, with no impact to the 

effectiveness of operational deconfliction. 

OIG Analysis: We agree that the FBI and HSI have adapted its operational 

deconfliction procedures over time. However, the 2003 MOA does not reflect 

these changes and the agreement does not conform to the requirements 

identified in DHS Management Directive 0450. l. Specifically, the agreement is 

missing required basic information and evidence demonstrating that the Office 

of General Counsel conducted the required legal review and approval prior to 

the Department official signing the agreement. 

Additionally, throughout the course of our audit, HSI officials agreed that the 

2003 MOA is outdated and needs to be updated. HSI officials also informed 

our team they were in the process of drafting a new agreement with the FBI 

which would collectively address counterintelligence and their engagement on 

the JTIF. Until HSI takes the appropriate action on the 2003 MOA and 

provides documentation as appropriate, we consider this recommendation 

unresolved and open. 

DHS Response to Recommendation 3: Concur. HSl's National Security 

Investigations Division, National Security Unit is coordinating the drafting of an 

updated handbook (which will now be titled the Counterterrorism 

Investigations Handbook) through all required parties for clearance and review. 

The draft handbook will specifically highlight the changes that occurred within 

the FBI, including the removal of the Terrorist Financing Operations Section 

and the Joint Vetting Unit. This handbook will comply with the 2003 MOA 

with DOJ to include standard operating procedures and the current 

deconfliction process that has evolved over time. The new handbook will 

supersede all relevant outdated HSI directives and memoranda. The estimated 

completion date is August 30, 2021. 

OIG Analysis: We consider these actions responsive to the recommendation, 

which is resolved and open. We will close the recommendation after HSI 

www.oig.dhs.gov 14 OIG-20-59 

FOR OFFICIAi. USE ONl.Y//l.AU' ENFORCEMENT SENSITIVE 
FOR OFFICIAL USE ONLY/ /LM\' ENFORCEMENT SENSITWE 


OFFICE OF INSPECTOR GENERAL 


Department of Hom elan d Security 

provides the updated Counterterrorism Investigations Handbook and we verify 

it has been updated accordingly. 

DHS Response to Recommendation 4: Non-concur. DHS stated the existing 

access to passport information has no negative operational or programmatic 

impacts on the JTTF. The disclosure of passport information is outside the 

scope of DHS responsibility or authority. Any JTTF personnel seeking more 

access to passport information than they can obtain within their responsibility 

and authority directly negotiate that access with the Department of State. HSI 

agents assigned to the JTTFs are not the appropriate authorities for 

determining when to disclose passport information, as HSI agents assigned to 

JTTFs must follow the rules and process of the agencies responsible for nonHSI data to which they have access. Not doing so would be a violation of 

longstanding practice and properly scoped interagency agreements. 

Consequently, DHS defers to the determinations made by the Department of 

State regarding when it is appropriate to disclose this data. 

OIG Analysis: DHS asserted that disclosure of passport information is outside 

its scope of responsibility or authority. However, as stewards with the mission 

of protecting the Homeland, the Department needs to develop a proactive, not a 

reactive, stance to sharing information. DHS also stated that HSI JTTF agents 

are not the appropriate authorities for determining disclosure of passport 

information as they must follow the processes of the agency that originated the 

data. DHS deferred to State for determinations on disclosing passport data. 

However, according to State, it facilitates critical record and information access 

by approving data sharing agreements for U.S. passport records based on the 

needs identified by the external agency requestor and consistent with 

established laws, rules, and policies on information sharing. Additionally, 

State pointed out, "As outlined in all of State's MOUs, external agencies can 

initiate modifications to their agreements when new needs and unique 

circumstances arise." 

DHS' passport sharing agreement with State was enacted without considering 

the JTTF's unique interagency data sharing needs and does not adequately 

support the investigative activities of the JTTF. The FBI created the JTTF to 

establish an environment for immediate information sharing amongst multiagency partners, leveraging the assets of each contributor to reach the JTTF's 

full potential. Given this, we strongly recommend DHS take the lead to 

coordinate with DOJ and State on developing an agreement that facilitates the 

direct sharing of passport information within the JTTF environment through 

State's formal MOU process. We consider this recommendation unresolved and 

open until DHS provides evidence that it coordinated with State and DOJ to 

update the passport sharing agreement. 

www.oig.dhs.gov 15 OIG-20-59 

FOR OFFICIAi. USE ONl.Y//l.AU' ENFORCEMENT SENSITIVE 
FOR OFFICIAL USE ONLY/ /LM\' ENFORCEMENT SENSITWE 


OFFICE OF INSPECTOR GENERAL 


Department of Hom elan d Security 

DHS Response to Recommendation 5: Non-concur. TSA currently has a 

process with ICE for requesting information, including Secure Flight data for 

use by JTTF or HSI JTTF agents to investigate terrorism activities or perform 

task force specific missions. Although the OIG's draft report suggests that this 

process may pose delays in TSA providing this information to ICE, this concern 

is not substantiated by the data TSA provided to the OIG, and the OIG also 

provided no evidence that this is a problem. TSA records show that a 

significant majority of requests are addressed within 30 minutes. For any 

exigent circumstances, TSA's process allows for information to be provided 

immediately. Without a potential operational or programmatic benefit, DHS is 

unwilling to dedicate limited resources to developing the recommended 

agreement. 

OIG Analysis: Although TSA has a process in place for HSI JTTF agents to 

request Secure Flight data in support of terrorism investigations, potential 

delays still exist as there is no arrangement in place between TSA and the JTTF 

to directly process these requests. TSA currently has arrangements with other 

counterterrorism groups, such as the National Targeting Center and the 

Terrorist Screening Center. The current process inherently creates lead time 

because TSA policy requires HSI JTTF agents submit formal written requests 

that are subject to approvals unless the requests pertain to an individual on a 

watchlist. 

Although DHS management comments cite a 30-minute turnaround time for 

Secure Flight data requests, TSA did not provide evidence supporting this 

timeframe. Further, TSA's official response obtained during field work stated: 

"TSA will usually return results between 1-12 hours; the timing may vary 

based upon the time needed for review by counsel, privacy, and Secure Flight 

leadership to ensure compliance with MD 1300.4. For exigent circumstances, 

the approval process is expedited and returned ASAP, including after normal 

working hours; Secure Flight operations has 24/7 contact information for the 

reviewing offices." The statement that requests can be expedited implies there 

is a delay in obtaining this information. 

Based on this information, we strongly encourage TSA to develop an agreement 

for directly processing Secure Flight data requested by JTTF or HSI JTTF 

agents investigating terrorism activities or performing task force specific 

missions. We consider this recommendation unresolved and open until DHS 

provides evidence that this agreement has been established and DHS JTTF 

contributors have mitigated data restrictions or delays pertaining to JTTF 

investigations. 

www.oig.dhs.gov 16 OIG-20-59 

FOR OFFICIAi. USE ONl.Y//l.AU' ENFORCEMENT SENSITIVE 
FOR OFFICIAL USE ONLY/ /LM\' ENFORCEMENT SENSITWE 


OFFICE OF INSPECTOR GENERAL 


Department of Hom elan d Security 

Objective, Scope, and Methodology 

The Department of Homeland Security Office of Inspector Gener al was 

established by the Homeland Security Act of2002 (Public Law 107- 296) by 

amendment to the Inspector General Act of 1978. 

The objective of this review was to determine if ICE HSI was effectively 

contributing to the JTTF. To achieve our objective, we obtained, reviewed, and 

analyzed: 

• 	 public law, department and component directives, policies, and 


guidance; 


• 	 agreements governing JTTF participation; 

• 	 ICE's Investigative Case Management system information; 

• 	 HSI's performance metrics and risk assessments; 

• 	 TSA policy and related information on Secure Flight; 

• 	 DOJ's agreements, memoranda, and other J TTF related information; and 

• 	 State's information sharing agreements and other related information. 

We conducted interviews with officials from ICE's Office of Budget and Program 

Performance, and from various HSI divisions and units as follows: 

• 	 Strategic Planning and Analysis Requirements Unit 

• 	 Budget Formulation and Reporting Unit 

• 	 National Security Investigations Division 

• 	 Illicit Finance and Proceeds to Crime Unit 

• 	 Special Operations Unit 

• 	 National Targeting Center - Investigations 

• 	 Office of Intelligence 

• 	 Joint Vetting Unit 

• 	 Domestic Operations 

Additionally, we interviewed HSI agents and supervisors assigned to the JTTF 

field offices in Boston, Chicago, Miami, New York, and Houston. We also 

conducted interviews with officials from State and DOJ. 

Although this was not a joint audit, both State and DOJ provided us 

information during the course of our audit. State and DOJ also provided 

feedback on draft report content pertinent to their respective department. We 

updated the draft report, addressing each Department's comments as 

appropriate. In addition, we redacted the report as needed for any sensitivity 

concerns based on input from each department. 

www.oig.dhs.gov 17 	 OIG-20-59 

FOR OFFICIAi. USE ONl.Y//l.AU' ENFORCEMENT SENSITIVE 
FOR OFFICIAL USE ONLY/ /LM\' ENFORCEMENT SENSITWE 


OFFICE OF INSPECTOR GENERAL 


Department of Hom elan d Security 

We reviewed and verified the HSI JTIF resources and the investigative case 

information, including performance data (i.e. arrests, indictments, etc., 

reported under performance metrics) and supporting system reports. We 

determined the data were sufficiently reliable to support our conclusions. We 

did not validate HSI's internal staffing assessment to evaluate the adequacy of 

the allocations determined by HSI since we received this information after the 

completion of our fieldwork. 

We did not validate the JTIF staffing data received from the FBI. The FBI's 

JTIF information is mainly classified, which prevented us from reporting on 

some items in explicit details. For example, we were unable to present the 

breakdown of all contributors to the JTIF as this information is classified. 

However, the FBI was able to provide unclassified information at a summary 

level for reporting purposes. 

We conducted this performance audit between April 2019 and March 2020 

pursuant to the Inspector General Act of 1978, as amended, and according to 

generally accepted government auditing standards. Those standards require 

that we plan and perform the audit to obtain sufficient, appropriate evidence to 

provide a reasonable basis for our findings and conclusions based upon our 

audit objectives. We believe that the evidence obtained provides a reasonable 

basis for our findings and conclusions based upon our audit objectives. 

The Office ofAudits major contributors to this report are Shelley Howes, 

Director; Bradley Mosher, Audit Manager; Hope Wright, Auditor-In-Charge; 

Michael Brunelle, Program Analyst; Jacklyn Pham, Auditor; Deborah MoutonMiller, Communications Analyst; and Brandon Landry, Independent 

Referencer. 

www.oig.dhs.gov 18 OIG-20-59 

FOR OFFICIAi. USE ONl.Y//l.AU' ENFORCEMENT SENSITIVE 
FOR OFFICIAL USE ONLY/ /LM\' ENFORCEMENT SENSITWE 


OFFICE OF INSPECTOR GENERAL 


Department of Hom elan d Security 

Appendix A 

DHS Comments to the Draft Report 

U.S. Department of Homeland Security 

\Vashii\gton, DC 20528 

Homeland 

Security 

July 6. 2020 

MEMORANDUM FOR: 	 Joseph V. Cuffari. Ph.D. 


Inspector General 
 Digitally signed by 

JIM H JIM H CRUMPACKER 

FROM: 	 Jim H. Crumpacker. CIA. CFE CRUMPACKER oate:2020.01.06 

13:49:46 --04'00' 

Di.rector 

Depaitmental GAO-OIG Liaison Office 

SUBJECT: 	 Management Response to Draft Repott: ·'HSI EffectiYely 

Contributes to the FBI's Joint TetTotism Task Force, But 

Pattnering Agreements Could Be Impro\'ed" 

(Project No. 19-049-AUD-ICE) 

Thatlk you for the oppormnity to comment on this draft repo11. The U.S. Department of 

Homelai1d Security (DHS or the Depaiiment) appreciates the "vork of the Office of 

Inspector General (OIG) in plam1ing and conducting its re"·iew and issuing this report. 

DHS is pleased to note OIG's recognition that U.S. Immigration and Custom's (ICE's) 

Homeland Secmity ltffestigations (HSI) effecti.\·ely contributes to the Federal Bm-eau of 

Itlvestigation' s (FBI) Joint Te1rnrism Task Force (JTTF) by le,·eraging its authorities. 

experience. skills. ai1d staffing. We also appreciate that the OIG acknowledges the success 

of this partnership. ICE's HSI is committed to strengthening the JTTF's capability by 

utilizing HSI's investigatiw expertise and its unique customs and immigration law 

enforcement authorities to protect the safety and secu1ity of the American people. 

Senior DHS leadership is concemed: however, that the draft repo1t incotTectly concludes 

existing paitnering agreements and policy hinder JTTF operations. As Depa1tmental 

program officials and subject matter experts discussed with the audit teain on multiple 

occasions. JTTF agents ai·e ctmently able to obtain needed infonnation ·without undue 

delay. The ctment info1matio11 shating em·ironment has no negative operational or 

progranunatic impacts on the JTTF. which ftmctions efficiently and effectively. The 

orG·s conclusion that JTTF operations are negatively impacted is not suppo1ted in the 

draft repo1t. 

The draft report contained five recommendations. DHS concurs with tvrn 

(Recommendations 1 and 3). and non-concurs with three (Recommendations 2. 4. and 5). 

www.oig.dhs.gov 19 	 OIG-20-59 

FOR OFFICIAi. USE ONl.Y//l.AU' ENFORCEMENT SENSITIVE 
FOR OFFICIAL USE ONLY/ /LM\' ENFORCEMENT SENSITWE 


OFFICE OF INSPECTOR GENERAL 

Department of Hom elan d Security 

Attached find om· detailed response to each recommendation. ICE previously submitted 

consolidated Departmental technical comments under a separnte co\'er for OIG's 

consideration. 

Again. thank you for the opportunity to review and comment on this draft report. Please 

feel free to contact me ifyou haYe any questions. We look fotward to working with you 

again in the future. 

Attachment 

2 

www.oig.dhs.gov 20 OIG-20-59 

FOR OFFICIAi. USE ONl.Y//l.AU' ENFORCEMENT SENSITIVE 
FOR OFFICIAL USE ONLY/ /LM\' ENFORCEMENT SENSITWE 


OFFICE OF INSPECTOR GENERAL 


Department of Hom elan d Security 

Attachment: ::Vfanagement Response to Recommendations 


Contained in Project 1\"o. 19-049-AUD-ICE 


OIG recommended that the: 

Recommend:ttion 1: Under Secreta1y. Office of Strategy. Policy. and Plans [PLCY]. in 

consultation with the Under Secreta1y for Management. coordinate with DHS JTTF 

contributors to: 

• 	 ensure agreements governing pa1iicipation in the JTTF are binding: 

• 	 evaluate whether new agreements or terms goYerning JTTF pa1iicipation are 

required: and 

• 	 de\·elop guidance defining each DHS JTIF conn·ibutors' authorities. roles and 

responsibilities. skill sets. and access to systems. 

Response: Concur. The DHS Office of Strategy. Policy. and Plans (PLCY). v..-ill 

coordinate with DHS JTTF contributors to collect and re\"iew existing agreements 

governing participation in the JTTF. Specifically. the PLCY Office ofCmmter TeITorism 

and Tlu-eat Pre\·ention (CTP) and others, as appropriate. will oversee an e\·aluation to 

detennine whether the agreements are binding. and whether new agreements or tenns are 

required. Fmihennore. CTP will lead the development and issuance ofguidance that 

defines the authorities, roles, and responsibilities ofeach DHS JTTF contributors when 

updating the agreements. Upon completion of each of these coITecti\·e actions. CTP will 

also provide a copy of the updated guidance to the OIG. 

Following completion ofthe guidance to define the roles and responsibilities of each DHS 

JTTF contributor, the Depa1tment's eight operational Components, such as ICE. will 

update individual JTTF agreements to reflect their unique law enforcement expertise and 

authorities. as appropriate. PLCY believes that operational Components are best able to 

efficiently update JTTF agreements and ensure that they will optimize their JTTF 

pa1iicipation. as appropriate. DHS Management Directive 0450.1. "Memoranda of 

Understanding (MOU) and Memoranda of Agreement (MOA)." dated Januruy 24. 2003. 

governs these agreements and proYides guidance to Components about coordinating the 

drafting and approval of such agreements. PLCY will assist the operational Components 

in this process to ensure the consistency of JTTF agreement updates. as well to ensure that 

coordination and clearance are consistent witl1 DHS's internal review process. 

Estimated Completion Date (ECD): June 30. 2021. 

Recommendation 2: HSI Executive Associate Director renegotiate and update the 

existing 2003 MOA with DOJ on tenorism financing iin-estigations to ensure : 

• 	 all appropriate action to align guidance on handling ofteITorism cases witl1 ctUTent 

operations: 

3 

www.oig.dhs.gov 2 1 	 OIG-20-59 

FOR OFFICIAi. USE ONl.Y//l.AU' ENFORCEMENT SENSITIVE 
FOR OFFICIAL USE ONLY/ /LM\' ENFORCEMENT SENSITWE 


OFFICE OF INSPECTOR GENERAL 


Department of Hom elan d Security 

• 	 essential requirements defined in DHS Management Di.rectiYe 0450.1 are included: 

and 

• 	 a review and modification process is established to reflect future operational 

changes. 

Response: Non-concur. While the '·MOA Betv.·een the Department of Justice (DOJ) and 

the DHS Concerning Tetrnrist Financing Im:estigations." dated May 13. 2003. does not 

CUITently reflect organizational and operational changes within both HSI and the FBI since 

its enactment. activities and subsequent guidance are required to be fluid and allow for 

adjustment to the everchanging environment in which our law enforcement agencies 

operate. As a result. HSI and the FBI have adapted to the various organizational changes 

within their agencies in the teffor finance mission space. In keeping with the intended 

premise and spirit of the MOA betv.•een DHS and DOJ on te1rnr finance. HSI continues to 

fully deconflict possible tefforism financial inYestigations with the FBI. While the MOA 

delineated a process and entities that no longer exist. using the FBI Te1rnrism Finance 

Operations Section and the Joint Vetted Unit. the process used CUITently is operationally 

effectiYe and efficient for both agencies in its execution and still aligns with the MOA's 

intended purpose. 

On top ofthe deconfliction process with the FBI on teffor finance cas es, pursuant to ICE 

Memorandum entitled. "Capabilities and Mandatory Use ofICE Special Operations Unit." 

dated September 1. 2009. as well as subsequent yearly guidance to HSI field offices. it is 

mandatory for all HSI field offices to forward all conununication data identified in any 

criminal investigation targeting narcotics smuggling. narcotics related money laundering. 

and te1rnrist related activity to the Special Operations Unit (SOU) for deconfliction and 

coordination purposes. 

As background. the SOU is HSl's financial. narcotics. and special operations component 

operating within the Special Operations DiYision (SOD). SOD is a multi-agency 

coordination center consisting ofrepresentatiYes from a significant number of agencies. 

including HSI. the FBI. ,-arious other DOJ agencies and many more. 

SOU also perfonns a valuable deconfliction se1v ice by identifying and coordinating 

investigati\·e commonalities between HSI and other domestic and foreign law enforcement 

agencies on transnational criminal organizations (including tefforist organizations) who 

strive to disguise their illicit proceeds. 

Senior ICE leadership does not believe renegotiating and updating the 2003 MOA would 

represent a pmdent expendimre of increasingly scarce and limited resources gi,·en that the 

ctment deconfliction procedures in place are aligned with the pUipose of the MOA 

between DHS and DOJ. and only the names of the organizational progranuuatic areas have 

changed. having no impact to the effectiYeness ofoperational deconfliction. 

We request the OIG consider this recommendation resolved and closed. 

www.oig.dhs.gov 22 	 OIG-20-59 

FOR OFFICIAi. USE ONl.Y//l.AU' ENFORCEMENT SENSITIVE 

4 
FOR OFFICIAL USE ONLY/ /LM\' ENFORCEMENT SENSITWE 


OFFICE OF INSPECTOR GENERAL 


Department of Hom elan d Security 

Recommendation 3: HSI Executive Associate Director re,·ise existing guidance 

including the 2003 and 2007 ten-orism financing intemal memoranda and its National 

Secmity Investigations Handbook to refle·ct changes implemented by departmental or 

interagency agreements. 

Response: Concur. The existing internal memoranda and guidance provided to HSI 

employees in 2003 and 2007. including multiple intemal memoranda. should be updated. 

Regarding the National Security Investigations Handbook. dated April 26. 2013. HSI 

National Security Investigations Division National Security Unit (NSU) coordinated over 

the past year with HSI field agents and super\'isors assigned to the JTTFs nationwide. as 

well as v;ith ICE's Office of the Principal Legal Advisor to update this handbook. NSU is 

coordinating the drafting ofan updated handbook (which will now be titled the 

Com1terte1rnrism Investigations Handbook) tlu-ough all required parties for clearance and 

review. The draft handbook •vill specifically highlight the changes that occuned within 

the FBI, including the removal of the Ten-orist Financing Operations Section and the Joint 

Vetted Unit. This handbook will comply with the 2003 MOA with DOJ to include 

standard operating procedures and the cun·ent deconfliction process that has evoh·ed over 

time. The new handbook will supersede all relevant outdated HSI directives and 

memoranda. 

ECD: August 30. 2021. 

Recommendation 4: Under Secretary. Office of Strategy. Policy. and Plans, in 

consultation with the Under Secretaiy for Maiiagement. coordinate with DOJ and State to 

develop an agreement that facilitates the direct sharing ofpasspo1t infonnation within the 

JTTF environment. 

Response: Non-concur. DHS is committed to operational collaboration while combatting 

terrorism and the existing access to passport information has no negative operational or 

programmatic impacts on the JTTF. The disclosure ofpassport info1111ation is outside the 

scope ofDHS responsibility or authority. Any JTTF personnel seeking more access to 

passport information than they can obtain within their responsibility and authority directly 

negotiate that access with the Depa1tment of StMe. HSI agents assigned to the JTTFs are 

not the appropriate authorities for detennining when to disclose passpo1i information. as 

HSI Agents assigned to JTTFs must follow the ml es and process of the agencies 

responsible for non-HSI data to which they have access. Not doing so would be a 

violation of longstanding practice and properly scoped interagency agreements. 

Consequently. DHS defers to the detenuinations made by the Deprutment of State 

regarding when it is appropriate to disclose this data. 

We request the OIG consider this recommendation resolved and closed. 

Recommendation 5: Under Secretruy for Mru1agement coordinate with the Infom1ation 

Sharing and Safeguarding Governance Board to ensure: 

www.oig.dhs.gov 23 OIG-20-59 

FOR OFFICIAi. USE ONl.Y//l.AU' ENFORCEMENT SENSITIVE 

5 
FOR OFFICIAL USE ONLY/ /LM\' ENFORCEMENT SENSITWE 


OFFICE OF INSPECTOR GENERAL 


Department of Hom elan d Security 

• 	 ICE and TSA deYelop an agreement for TSA to directly process Secure Flight data 

requested for use by JTTF or HSI JTTF agents investigating ten-orism activities or 

perfonning task force specific missions. and 

• 	 DHS JTTF contributors mitigate data restrictions or delays pertaining to law 

enforcement and intelligence investigations. 

Response: Non-concur. TSA cun-ently has a process with ICE for information requests. 

including Secure Flight data requested for use by JTTF or HSI JTTF agents investigating 

te1rnrism actiYities or perfonning task force specific missions. Although the OIG's draft 

report suggests that this process may create delays with providing this infonnation to ICE. 

this concem is not substantiated with the data TSA provided to the OIG and the OIG has 

provided no evidence that this is a problem. TSA records show that a significant majority 

ofrequests are addressed within 30 minutes ofrequest. For any exigent circumstances. 

TSA's process allows that infom1ation to be provided i111111ediate~1 . Without a potential 

operational or programmatic benefit. DHS is unwilling to dedicate limited resources to 

developing the reconunended agreement. 

We request the OIG consider this recommendation resolved and closed. 

6 

www.oig.dhs.gov 24 	 OIG-20-59 

FOR OFFICIAi. USE ONl.Y//l.AU' ENFORCEMENT SENSITIVE 
FOR OFFICIAL USE ONLY/ /LM\' ENFORCEMENT SENSITWE 

OFFICE OF INSPECTOR GENERAL 

Department of Hom elan d Security 

Appendix B 

NTAS Bulletin, dated January 18, 2019 

- - National Terrorism Advisory System 

Bulletin 

January 18, 2019 2-00PM EST 

• www d.hs.gov/advuones NarE: Posting ofth" l>ld:"nsion d<>lay<>d du" to the laps<> in f<>der al funding

SUMMARY OF TERRORISM THREAT TO THE U.S. HOMELAND 

Since 20:15, the Department Of Homeland security (OHS) has used this Bulletin to highlight the continuing 

terror threat to the u.s. Homeland. The unned states IS engaged In a generat1ona1 ngnt against terronsts 

who seek to attaek the American people. our country, and our way Of llfe. An Informed, vigilant and engaged 

pul>llC remains one of our greatest assets to ldentJty potential terronsts ancl prevent attacl<S. 

ADDITIONAL DETAILS We continue to face one of the most challenging threat environments since 9/ 11. as foreign terrorist 

organizationsexploit the Internet to inspire, enable, or direct individuals already here in the homeland to commit 

terrorist acts. Homegrown terror suspects increasingly relY on technology_ sueh as en d-to-end encrypted social 

med ia applications, to avoid detection. 

Terrorist groups are urging recruits to adopt easy-tCHJse tools to target public places and events. Specific attack 

tactics have included the use of vehicle ramming. to include the use of rental vehicles. small arms. straightedged blades or knives, homemade explosives. and poisons or toxins. 

some terrorist groups overseas are using oan1er1e1a expen ences to pursue new tecnno1og1es ana tactics. sucn 

as unmanned aerial systems and chemieal agents that could be used outside the conflict tones. Many ofthese 

tochnolog:ios aro readily available. Add itionally,. torrorists continue to target commorcial a viation and air cargo, 

mc1uamg w1m concea1ea explosives. 


Violent extremist media encourages individuals worldwide to launch attacks using all means POSsible. 


Cont inued U.S. and partner successes in disrupting: and defeating terrorists on the battlefield m ay encourage 

nomegrown lerrorists to carry out acts or violence in tne nomelana lnsteaa or anemptlng lo travel overseas to 

fight or in retaliation for apparent losses. 

Additio nally, f oreign terrorist f ightGrs who h a ve a cquired training and battle-tested terro rism experiGnco may 

flee rrom terronst~ont onea terrnones w1tn a aesire to conauct attacks eisewnere. 1nc1uamgtne u nnea States. 

U .S . GOVERNMENT COUNTERTERRORISM EFFORTS OHS and the Federal B ureau of Inves tigation (FBI) continue to provid e guidance to state. local, tribal a nd 

territorial partners related to the current threat environment. OHS continues to support the private sector to 

provide risk assessm ents and to coordinating securitY measures with busin ess owners and operators. The 

public may continue to observe law enforcement a nd se<:urity a ctivity in and around public places and events. 

OHS works closely with the FBI and other intelligence partners to detect and disrupt terror suspects, enhance 

screening and vetting measures to identify suspicious t ravelers and cargo. combating violent radicalization and 

terrorist recruitment in our communities, monitoring emerging threats,. and engaging with foreign partners. 

More broaaly, OHS remains committed to preventing violence and threats meant to intimidate or coerce specific 

POPUiations on the basis of their religion. ethnicity or ident itY. 

OHS is enhancing its program to s ecure potential soft targets and crowd ed places includingschools. 

DURATION This Bull~n will 

expire on or before 

Jury :18, 20:19 

at 1:00 PM EDT 

TYPES OF 


ADVISORIES 


B ulletin 

Describes current 

aeve1oμmen1S or 

general tren<ls 

regarding threats 

or terronsm. 

Elevated Alert warns of a credible 

terronsm threat 

against the llnited 

States. 

Immine n t 


Alert 


wamsota 

erodible, specific 

and 1mpenamg 

terrorism threat 

against me unnea 

States. 

HOW YOU CAN HELP • 	 Repo rt suspicious activity to local law 

enrorcement wtlo are oesl to orrer 

specific details on terroristic indicators. 

• 	 Repo rt suspicious activity or info rm atiOn 

abOut a threat, including Online a ctivity. 

to fusion centers and the FBl's Field 

OfficQs - part of thQ Na tionwidQ 

Suspicious ACtivity RepOrting Initiative. 

• 	 Learn how to recognize signs of preoperat iona 1 planning associated with 

terrorism or other criminal activity. 

BE PREPARED • 	 BQ prQparQd for SE!Curity and pla n ah Qad. 

Anticipate delays and restrictions on 

Items arouna popu1atea p1aces ana at 

public events. 

• 	 Be responsible for your personal safety. 

Know where emergency exits and 

security personnel are located. carry 

emergency contact and special needs 

inrormauon witn you. 

• 	 El.an.!rain. and .BfillQrt to 

prepare businessos & 

emp1oyees. security lOOIS/resources can 

be accessed through the DHS's 

STAY INFORMED • 	 ThQ U.S . Gov~mmQnt will providQ additional 

inform ation about any emerging threat as 

aaa1t1ona1 1nrormat1on 1s 1aenm1ea. Tne 

public is encouraged to listen to tocal law 

Gnforcement a nd public safety officials. 

• 	 we urge Amencans to continue to travel, 

attend public events. and freely associate 

with othors but rema in vigilant and aware of 

surrouncllngs. 

• 	 The Department of State issues 

international travel ak)rts a nd warnings. 

• 	 For additional information visit Ready. 

Source:www.DHS.gov/advisories 

www.oig.dhs.gov 25 	 OIG-20-59 

FOR OFFICIAi. USE ONl.Y//l.AU' ENFORCEMENT SENSITIVE 
FOR OFFICIAL USE ONLY/ /LM\' ENFORCEMENT SENSITWE 


OFFICE OF INSPECTOR GENERAL 


Department of Hom elan d Security 


Appendix C 

Significant Terrorist Attacks on U.S. Soil 

Since 9/11, there have been over 20 terrorist attacks In the United States. Here's a snapshot of some of the 

~i ca nt events: 

r····· August 3, 201 ~ -····· : ~u : ·····················

September 11, 2001 

Nineteen al Qaeda members 

hijack four US passenger 

airliners. At the World Trade 

Center site 2,753 people are 

killed; 184 at the Pentagon; 

and 40 in Shanksville, 

Pennsylvania. A total of 

2,977 people are killed. 

April 15, 201 3 

Boston Marathon, killing 

least 264. 

July 16, 2015 December 2, 2015 

Twin bomb blasts explode 

near the finish line of the 

three and wounding at 

A man opens fire on a 

military recruiting center 

and a Naval reserve facility 

in Chattanooga, 

Tennessee, killing four US 

Marines and a Navy sailor. 

A married couple open fire 

on a holiday party in San 

Bernardino, California, 

kill ing 14 people. 

u~ 12, 2016 

One person is killed and 19 A domestic terrorism Eight people are killed and An American-born man are injured when a speeding ,t, 

case involving a mass almost a cloien i nju reel pledged allegiance to ISIS 

shooting at a Wal-Mart when a 29-year-Olcl man in and kills 49 people and car slams into a crowd of 

store in El Paso, Texas a rented vehicle drives wounds others in a shooting counter-protesters in 

kills twenty-two people. clown a busy bicycle path Charlottesv spree in Orlando, the seconcl­ ille, Virginia. 

near the World Trade deadliest mass shooting in 

Center in New York. recent US history. 

December 6, 2019 December 10, 2019 CURRENT 

A gunman opens fire on a Two gunmen kills three The United States continues 

Navy air station in people inside a kosher to face an evolving threat 

Pensacola, Florida, killing grocery store in Jersey City, environment where terrorists 

three US sailors. Attorney New Jersey. The case is are increasingly relying on 

General William Barr says being investigated as technology such as social 

the shooting was an act of domestic terrorism. media applications to avoid 

terrorism motivated by detection and utilizing any 

"jihadist ideology." means possible to launch 

terrorist attacks. 

Source: Events from 2001 to 2019 are from the CNN Article, US Terrorist Attacks Fast Facts, 

CNN Editorial Research. Updated Wednesday, January 15, 2020. 16 Current information is 

from the NTAS Bulletin, dated January 18, 2019. 

16 The original CNN article also includes incidents pre-9 / 11 . 

www.oig.dhs.gov 26 OIG-20-59 

FOR OFFICIAi. USE ONl.Y//l.AU' ENFORCEMENT SENSITIVE 
FOR OFFICIAL USE ONLY/ /LM\' ENFORCEMENT SENSITWE 

OFFICE OF INSPECTOR GENERAL 

Department of Hom elan d Security 

Appendix D 

Process and Requirements for HSI Agents Assigned to the JTTF 

HSI agents are first assigned to a field office and subsequently may be 

consider ed for opportunities to serve the JTIF fu ll-time, part-time, or as 

liaisons. 

• 

• 

• 

• 

• 

www.oig.dhs.gov 27 OIG-20-59 

FOR OFFICIAi. USE ONl.Y//l.AU' ENFORCEMENT SENSITIVE 
FOR OFFICIAL USE ONLY/ /LM\' ENFORCEMENT SENSITWE 

OFFICE OF INSPECTOR GENERAL 

Department of Hom elan d Security 

Appendix E 

Report Distribution 

Department of Homeland Security 

Secretary 

Deputy Secretary 

Chief of Staff 

Deputy Chiefs of Staff 

General Counsel 

Executive Secretary 

Director, GAO/OIG Liaison Office 

Under Secretary, Office of Strategy, Policy, and Plans 

Assistant Secretary for Office of Public Affairs 

Assistant Secretary for Office of Legislative Affairs 

Under Secretary, Office of Strategy, Policy, and Plans 

Information Sharing and Safeguarding Governance Board 

Acting Director, ICE 

ICE Liaison 

TSA Liaison 

Office ofManagement and Budget 

Chief, Homeland Security Branch 

DHS OIG Budget Examiner 

Congress 

Congressional Oversight and Appropriations Committee 

www.oig.dhs.gov 28 OIG-20-59 

FOR OFFICIAi. USE ONl.Y//l.AU' ENFORCEMENT SENSITIVE 
 LAW ENFORCEMENT SENSITIVE 

ADDITIONAL INFORMATION AND COPIES 

To view this and any of our other reports, please visit our website at: 

www.oig.dhs.gov. 

For further information or questions, please contact Office of Inspector General 

Public Affairs at: DHS-OIG.OfficePublicAffairs@oig.dhs.gov. 

Follow us on Twitter at: @dhsoig. 

OIG HOTLINE 

To report fraud, waste, or abuse, visit our website at www.oig.dhs.gov and click 

on the red "Hotline" tab. If you cannot access our website, call our hotline at 

(800) 323-8603, fax our hotline at (202) 254-4297, or write to us at: 

Department of Homeland Security 

Office of Inspector General, Mail Stop 0305 

Attention: Hotline 

245 Murray Drive, SW 

Washington, DC 20528-0305

 LAW ENFORCEMENT SENSITIVE