Missing Persons and Unidentified Remains: Opportunities May Exist to Share Information More Efficiently
Released: 2016-06-07T00:00:00


Highlights: section_title: Why GAO Did This Study
paragraphs: Every year, more than 600,000 people are reported missing, and hundreds of human remains go unidentified. Two primary federal databases supported by DOJ—NCIC and NamUs—contain data related to missing and unidentified persons to help solve these cases. NCIC contains criminal justice information accessed by authorized agencies to assist with daily investigations. NamUs information can be used by law enforcement, medical examiners, coroners, and the general public to help with long-term missing and unidentified persons cases.

Senate Report 113-181 (accompanying the Consolidated and Further Continuing Appropriations Act of 2015) includes a provision for GAO to review NCIC and NamUs. This report describes the access to and use of missing and unidentified persons information contained in NCIC and NamUs, and the extent to which there are opportunities to improve the use of this information. GAO reviewed NCIC and NamUs data, and relevant state and federal statutes. GAO also conducted nongeneralizeable interviews with stakeholders in three states, selected in part on state laws.

section_title: What GAO Found
paragraphs: The Federal Bureau of Investigation's (FBI) National Crime Information Center (NCIC) database includes criminal justice agency information and access to such data is restricted to authorized users. In contrast, the Department of Justice's (DOJ) National Institute of Justice (NIJ) funds and oversees the National Missing and Unidentified Persons System (NamUs), a database for which the public may register to access published case information. Because many users of NamUs are not authorized to access NCIC, there are no direct links between the systems. As a result, while both NCIC and NamUs contain information on long-term missing and unidentified persons, they remain separate systems.

DOJ could facilitate more efficient sharing of information on missing persons and unidentified remains (referred to as missing and unidentified persons cases) contained in these systems. GAO found, in part, that the following three key characteristics of NCIC and NamUs are fragmented or overlapping, creating the risk of duplication.

Database Records: NCIC and NamUs contain fragmented information associated with long-term missing and unidentified persons (cases open for more than 30 days). For example, in fiscal year 2015, 3,170 long-term missing persons cases were reported to NamUs while 84,401 missing persons records reported to NCIC became long-term cases. NamUs also accepts and maintains records of missing and unidentified persons cases that may not be found in NCIC because, for example, they have not yet been filed with law enforcement. As a result, users relying on only one system may miss information that could be instrumental in solving these types of cases.

Registered Users: The NCIC user base is significantly larger than the NamUs user base, and the types of users vary, which may contribute to the discrepancies in each system's data. For instance, almost all law enforcement agencies use NCIC, with only a small fraction registered to use NamUs. Additionally, members of the public do not have access to NCIC, but can report missing persons cases to NamUs.

Data Validation Efforts: In part to minimize fragmentation, NamUs uses a case validation process and other ad hoc efforts to help ensure that data on missing and unidentified persons contained in NCIC is captured by NamUs. However, these processes introduce additional inefficiencies because they require officials to manually review and enter case data into both systems, resulting in duplicative data entry.

Inefficiencies exist in the use of information on missing and unidentified persons primarily because there is no mechanism to share information between the systems, such as a notifier to inform NCIC users if related case data were present in NamUs. According to FBI officials, federal law precludes full integration of NCIC and NamUs; however, opportunities to share information may exist within the legal framework to address fragmentation and overlap without full system integration. By evaluating the technical and legal feasibility of options to share information, documenting the results, and implementing feasible options, DOJ could better inform those who are helping solve missing and unidentified persons cases and increase the efficiency of solving such cases.

section_title: What GAO Recommends
paragraphs: To allow for more efficient use of missing and unidentified persons information, GAO recommends that DOJ evaluate options to share information between NCIC and NamUs. DOJ disagreed because it believes it lacks the necessary legal authority. GAO believes DOJ can study options for sharing information within the confines of its legal framework, and therefore believes the recommendation remains valid.

section_title: Letter
paragraphs: Hundreds of thousands of people across the country are reported missing  each year. In fiscal year 2015, approximately 87 percent of these cases  were resolved within 30 days, while the remaining 13 percent—or more  than 84,000 people—became long-term missing persons cases.  Additionally, as 2007 Department of Justice (DOJ) estimates suggest,  there are more than 40,000 sets of unidentified human remains in medical  examiner or coroner offices, with several hundred new cases reported  each year. Multiple federal databases supported by DOJ contain  information related to missing persons and unidentified remains (referred  to in this report as missing and unidentified persons) that can be used to  assist law enforcement in resolving these cases. The two primary  databases are the Federal Bureau of Investigation's (FBI) National Crime  Information Center (NCIC) and the National Missing and Unidentified  Persons System (NamUs), which is funded and overseen by DOJ’s  National Institute of Justice (NIJ).

NCIC is an electronic repository of criminal justice information of  nationwide interest with locator files, including missing and unidentified  persons files, designed to assist the criminal justice community perform  day-to-day duties. Responsibility for entering and managing the data  contained in NCIC is shared between the FBI and federal, state, local,  and tribal criminal justice users. Access to the system is limited to  agencies that have authorization under federal law and have applied for  access. NamUs is managed by NIJ through a cooperative agreement with  the University of North Texas Health Science Center, and contains  information on missing, unidentified, and unclaimed persons—deceased  persons who have been identified by name, but for whom no next of kin  or family member has been identified or located to claim the body. The  system can be used by law enforcement, medical examiners, coroners,  and the general public to enter and search for information on missing and  unidentified persons cases.

Federal law requires that law enforcement agencies (LEA) enter required  information about missing children, defined as individuals under the age  of 21, into NCIC within 2 hours of receiving it—called the 2-hour entry  rule. These requirements do not apply to NamUs, though NamUs does  contain information about missing children. Further, there are no federal  requirements associated with reporting information on missing adults to  either database because adults have the legal right to go missing in most  cases. For example, an adult may choose to go missing to seek  protection from a domestic abuser. In addition, there are no federal  requirements to report an unidentified person’s remains (child or adult) to  either database. As a result, not all information on missing and  unidentified persons may necessarily be reported to one or both  databases.

Senate Report 113-181 (accompanying the Consolidated and Further  Continuing Appropriations Act of 2015) includes a provision for us to  review national databases containing information reported on missing  persons and unidentified human remains, including NCIC and NamUs.  NCIC and NamUs both collect data for authorized users to solve long- term missing and unidentified persons cases. This report describes the  access to and use of missing and unidentified persons information  contained in NCIC and NamUs and discusses the extent to which  opportunities exist to improve the use of this information.

To describe the access to and use of missing and unidentified persons  information contained in NCIC and NamUs, we reviewed and compared  NCIC and NamUs operating and policy manuals and data entry guides. In  addition, we observed access to and use of missing and unidentified  persons information in NamUs. To corroborate information above, we  conducted interviews with officials who access and use NCIC and  NamUs, including criminal justice agencies, state and local LEAs, and  medical examiners.

To determine the extent to which opportunities exist to improve the use of  missing and unidentified persons information contained in NCIC and  NamUs, we analyzed summary level case data by state for each system  for fiscal year 2015. We assessed the reliability of the data and found it  to be sufficiently reliable to demonstrate the extent to which information  contained in the two systems is similar or different. To identify details  about the design of each system, we reviewed and compared NCIC and  NamUs operating manuals and data entry guides, including minimum  data requirements for record entry, individual data elements in each  system, and their definitions. We also reviewed laws, policies, and  information associated with reporting and sharing information on missing  and unidentified persons, to include information about the types of users  that can access or enter information into each system within three  categories: (1) LEA, (2) non-LEA criminal justice agency (CJA)—such as  a court; and (3) medicolegal investigator—such as coroners and forensic  analysts. NCIC and NamUs assign user access differently, with NCIC  assigning access at the agency level, while NamUs provides access  directly to individuals. Additional details and limitations related to how we  adjusted for these differences, as well as steps taken to assess NCIC and  NamUs data reliability can be found in appendix I. We assessed this  information against Standards for Internal Control in the Federal  Government and GAO’s evaluation and management guide for  fragmentation, overlap, and duplication.

To corroborate information above, and to obtain more in-depth  perspectives about the extent to which opportunities exist to improve the  collection and use of missing and unidentified persons information, we  also conducted interviews. Specifically, we interviewed DOJ officials,  relevant stakeholders from selected states, and officials from  nongovernmental agencies, in part to learn about past and current efforts  to share information between NCIC and NamUs. We interviewed a  nongeneralizeable sample of stakeholders from state criminal justice  agencies, state and local LEAs, and medical examiner or coroner offices  in three states—Arizona, California, and New York. We selected these  states to include in this review, based in part on their respective state  laws and policies associated with missing and unidentified persons, as  well as the number of cases reported to each database for fiscal year  2015. Specifically, after identifying the 10 states that reported the highest  number of cases to both NCIC and NamUs, we then compared  characteristics of state laws and policies related to reporting missing and  unidentified persons. Although the views expressed from these interviews  cannot be generalized to all states, they provide valuable insights about  the types of experiences different stakeholder groups experience in states  with varied reporting requirements. We also reviewed state documents  associated with the data systems used by each state to report missing  and unidentified persons information to NCIC. For additional detail  regarding the state selection process, see appendix I.

We conducted this performance audit from September 2015 to April 2016  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: NCIC is a law enforcement database maintained by the FBI’s Criminal  Justice Information Services (CJIS) Division and was first established in  1967 to assist LEAs in apprehending fugitives and locating stolen  property. In 1975, NCIC expanded to include the missing persons file to  include law enforcement records associated with missing children and  certain at-risk adults. The missing persons file contains records for  individuals reported missing who: (1) have a proven physical or mental  disability; (2) are missing under circumstances indicating that they may be  in physical danger; (3) are missing after a catastrophe; (4) are missing  under circumstances indicating their disappearance may not have been  voluntary; (5) are under the age of 21 and do not meet the above criteria;  or (6) are 21 and older and do not meet any of the above criteria but for  whom there is a reasonable concern for their safety.

The unidentified persons file was implemented in 1983 to include law  enforcement records associated with unidentified remains and living  individuals who cannot be identified, such as those individuals who  cannot identify themselves, including infants or individuals with  amnesia. When a missing persons record is entered or modified, NCIC  automatically compares the data in that record against all unidentified  persons records in NCIC. These comparisons are performed daily on the  records that were entered or modified on the previous day. If a potential  match is identified through this process, the agency responsible for  entering the record is notified.

Management of NCIC is shared between CJIS and the authorized federal,  state, and local agencies that access the system. CJIS Systems Agencies  (CSA)—criminal justice agencies with overall responsibility for the  administration and usage of NCIC within a district, state, territory, or  federal agency—provide local governance of NCIC use. A CSA  generally operates its own computer systems, determines what agencies  within its jurisdiction may access and enter information into NCIC, and is  responsible for assuring LEA compliance with operating procedures  within its jurisdiction. An Advisory Policy Board, with representatives from  criminal justice and national security agencies throughout the United  States, and working groups are responsible for establishing policy for  NCIC use by federal, state, and local agencies and providing advice and  guidance on all CJIS Division programs, including NCIC.

NamUs became operational in 2009, and was designed to improve  access to database information by people who can help solve long-term  missing and unidentified persons cases—those cases that have been  open for 30 days or more. NamUs is comprised of three internet-based  data repositories that can be used by law enforcement, medical  examiners, coroners, victim advocates or family members, and the  general public to enter and search for information on missing and  unidentified persons cases. These repositories include the missing  person database (NamUs-MP), the unidentified person database  (NamUs-UP), and the unclaimed persons database. NamUs-MP and  NamUs-UP allow automated and manual comparison of the case records  contained in each.

The University of North Texas Health Science Center, Center for Human  Identification (UNTCHI) has managed and administered the NamUs  program under a cooperative agreement with NIJ since October 2011.  Two Directors within UNTCHI’s Forensic and Investigative Services Unit  are responsible for daily management, oversight, and planning associated  with NamUs. Additionally, eight regional system administrators (RSAs)  and eight forensic specialists provide individualized case support.

section_title: Authorizations to Use NCIC and NamUs Differ so the Data in Each Remains Separated
paragraphs: To gain access to NCIC, an agency must have authorization under  federal law and obtain an Originating Agency Identifier (ORI). In  general, to be authorized under federal law for full access to NCIC, an  agency must be a governmental agency that meets the definition of a  CJA. Specifically, data stored in NCIC is “criminal justice agency  information and access to that data is restricted to duly authorized users,”  namely CJAs as defined in regulation. The CJIS Security Policy allows  data associated with the missing and unidentified persons files to be  disclosed to and used by government agencies for official purposes or  private entities granted access by law. For example, there is a specific  provision that allows these files to be disclosed to the National Center for  Missing and Exploited Children, a nongovernmental organization, to  assist in its efforts to operate a nationwide missing children hotline,  among other things. As of February 2016, there were almost 118,000  active ORI numbers that granted authorized agencies at least limited  access to NCIC. Table 1 shows the different types of users granted ORI  numbers to access NCIC and their associated access levels.

Unlike NCIC, any member of the public may register to use NamUs and  access published case information. When cases are entered, the RSA  carries out a validation process by reviewing each case entered within his  or her region to ensure the validity and accuracy of the information  provided and determine whether the case may be published to the public  website. Before any case may be publicly published to the NamUs site,  the RSA must confirm the validity of that case with the LEA or other  responsible official with jurisdiction by obtaining an LEA case number or  an NCIC number. The RSA also vets registration applications for non- public users—professionals affiliated with agencies responsible for  missing or unidentified persons cases. In addition to the published case  information, these non-public registered users may also access  unpublished case information. Table 2 shows the types of individuals that  may register as NamUs users for the missing persons and unidentified  persons files, and their access levels.

NCIC data include criminal justice agency information and access to such  data is restricted by law to only authorized users. Because many users of  NamUs are not authorized to access NCIC, there are no direct links or  data transfers between the systems. In addition, NCIC and NamUs only  contain information manually entered by their respective authorized  users. As a result, while both NCIC and NamUs contain information on  long-term missing and unidentified persons, they remain separate  systems.

section_title: Opportunities Exist to More Efficiently Share Missing and Unidentified Persons Information in NCIC and NamUs
paragraphs: DOJ could facilitate more efficient sharing of information on missing and  unidentified persons cases contained in NCIC and NamUs. The two  systems have overlapping purposes specifically with regard to data  associated with long-term missing and unidentified persons cases—both  systems collect and manage data that officials can use to solve these  cases. Further, three key characteristics of NCIC and NamUs—the  systems’ records, registered users, and data validation efforts—are  fragmented or overlapping, creating the risk of duplication. We found  that, as CJIS and NIJ proceed with planned upgrades to both databases,  opportunities may exist to more efficiently use data related to missing and  unidentified persons cases, in part because no mechanism currently  exists to share information between NCIC and NamUs.

Figure 3 below describes the purpose of each system and explains how  certain characteristics contribute to fragmentation, overlap, or both. See  appendix II for a non-interactive version of figure 3.

Interactive graphic Figure 3: Comparison of Fragmentation and Overlap in Key Characteristics of the  National Crime Information Center (NCIC) and National Missing and Unidentified Persons  System (NamUs)

Move mouse over headers for description. For a noninteractive version, please see appendix II.

Database Records: NCIC and NamUs contain fragmented information  associated with long-term missing and unidentified persons.  Specifically, information about long-term missing or unidentified  persons may be captured in one system, but not the other. As a  result, if users do not have access to or consult the missing and  unidentified persons files in both data systems, they may miss vital  evidence that could help to solve a given case. For example, in fiscal  year 2015, 3,170 missing persons cases were reported to NamUs.  During the same time period, 84,401 of the missing persons records  reported to NCIC remained open after 30 days and became long-term  cases. Conversely, in fiscal year 2015, 1,205 unidentified persons  cases were reported to NamUs, while 830 records were reported to  NCIC.

NamUs also accepts and maintains records of missing and  unidentified persons cases that are not published on its public  website, in part because they may not meet criteria for entry into  NCIC. According to NamUs officials, cases may remain unpublished  for several reasons, including (1) they are undergoing the validation  process, (2) they lack information required to complete the entry, (3)  the responsible agency has requested the report go unpublished for  investigative reasons, (4) a report has not been filed with law  enforcement, or (5) law enforcement does not consider the person  missing. For example, according to NamUs officials, a non-profit  agency entered approximately 800 missing migrant cases that have  remained unpublished on the NamUs public website because they do  not have active law enforcement investigations associated with the  cases. Because they do not have active law enforcement  investigations on file and NCIC only accepts documented criminal  justice information, it is highly unlikely that these approximately 800  cases are present in NCIC. Since access to unpublished cases is  limited to authorized LEA and medicolegal investigators that have  registered as NamUs users, investigators using only NCIC cannot use  information from these NamUs cases to assist in solving unidentified  persons cases.

In addition, the number of NCIC cases that are also recorded in  NamUs varies greatly among states, further contributing to  fragmentation. For example, of the long-term missing persons cases  officials in each state reported to NCIC in fiscal year 2015, the  proportion of these NCIC cases that were also recorded in NamUs  ranged from less than 1 to almost 40 percent. However, in our  nongeneralizeable review of laws in Arizona, California, and New  York, the state laws specifically associated with reporting missing  persons cases to NCIC or NamUs did not contribute to variation in  reporting rates. Specifically, in fiscal year 2015, approximately 2 to 3.5  percent of the long-term cases reported by officials in each state to  NCIC were ultimately reported to NamUs. These reporting rates are  very similar despite the fact that, as discussed previously, we chose  these three states because they had different reporting requirements  associated with reporting missing and unidentified persons.

Registered Users: Fragmentation between the records reported to  NCIC and NamUs also exists because different user groups with  different responsibilities enter data on missing and unidentified  persons. The fact that different user bases report information to each  system means that certain types of cases may be found in one  system but not the other. This creates inefficiencies for officials  seeking to solve long-term missing and unidentified persons cases  who have to enter information and search both systems to get all the  available information.

Further, the NCIC user base is significantly larger than the NamUs  user base, which likely contributes to the discrepancies in the number  of long-term missing persons cases reported to each system. As of  February 2016, almost 118,000 agencies had at least limited access  to NCIC, with approximately 113,000 granted full access to all 21  NCIC files, including the missing and unidentified persons files. As  of November 2015, just over 3,000 individuals were registered as non- public users of NamUs-MP and approximately 2,000 individuals were  registered as non-public users of NamUs-UP. These registered  users represent at least 1,990 agencies, less than 2 percent of the  number of agencies registered to use NCIC.

In 1996, a person was reported missing and  the case was entered into National Crime  Information Center (NCIC). Three days later,  a decomposed body was found a few miles  away; however, no police report was ever  generated for the person’s death nor was an  entry made into NCIC. In 2013, the detective  following up on the missing person case  searched National Missing and Unidentified  Persons System (NamUs) and found that a  medical examiner had entered the  unidentified remains case into NamUs. As a  result, 16 years after the missing persons  case was originally reported, DNA testing  verified a match between the unidentified  remains reported by a medical examiner to  NamUs and the missing person case reported  by law enforcement to NCIC in 1996.

In addition to the difference in the number of agencies registered to  use NCIC or NamUs, there is variation in the types of agencies that  are registered with each system, possibly contributing to differences in  the type of case information reported. For instance, NamUs has a  larger number of registered users in the medicolegal field (either as  medical examiners, coroners, forensic odontologists, or other forensic  personnel), which may explain why a greater number of unidentified  persons cases are reported to NamUs. Specifically, while medical  examiners and coroners represent less than 0.1 percent of NCIC’s  total active ORIs, approximately 18 percent of agencies registered  with NamUs have at least one user registered in the medicolegal  field. Similarly, virtually all LEAs use NCIC, with only a small fraction  registered to use NamUs, likely contributing to the low proportion of  long term missing persons cases reported to both NCIC and NamUs  by LEAs. Additionally, members of the public who do not have access  to NCIC and are not affiliated with any type of agency can report  missing persons cases to NamUs. The variation in the types of users  registered with NCIC or NamUs ultimately limits the usefulness of  either system, as important case information may be missed by  individuals who do not access both systems. According to one LEA  official we spoke with, his unit has had more than a dozen resolutions  of cold cases as a result of information contained in NamUs since  NamUs was established in 2009.

Data Validation Efforts: NamUs uses a validation process to ensure  that all missing and unidentified persons cases include either the local  LEA case number or an NCIC number before they are published to  the public website. NamUs also has some ad hoc processes in place,  beyond routine RSA responsibilities, designed to help ensure that  data in selected states on missing and unidentified persons contained  in NCIC are captured by NamUs. However, while intended in part to  minimize fragmentation, these processes introduce additional  inefficiencies caused by overlapping and potentially duplicative  activities. Specifically, as part of the NamUs validation process, at  least once a year, the RSA requests records from NCIC and manually  reviews the data in both systems to ensure consistency. For  example, from January 2015 through September 2015, RSAs  requested and manually reviewed statewide NCIC records for at least  22,000 missing persons and 4,532 unidentified persons cases to  ensure that if cases entered into NamUs were present in NCIC, the  two systems contained comparable information. According to NIJ  officials, if RSAs identify errors or missing information in an NCIC  record during the course of their work, they will alert the agency  responsible for the case. It is then the responsibility of that agency to  enter or update the NCIC record.

The potential for duplication also exists when agencies want to utilize  both NCIC and NamUs. For example, if agencies with access wanted  their case data to exist in both systems, the system limitations would  require them to enter the information in one system and then enter the  same data in the second system, resulting in duplicative data entry.  Officials from one state agency we interviewed noted that they have a  full time employee who is solely responsible for entering case data  into NamUs after it has been entered into NCIC. Further, when  attempting to use information from either NCIC or NamUs, users are  required to access and search each system separately, and then  manually compare results.

Fragmentation and overlap between NCIC and NamUs result in  inefficiencies primarily because there is no systematic mechanism for  sharing information between the systems. According to CJIS officials, in  lieu of a systematic sharing of information mechanism, they created a  standard search that state and local agencies can use to request an  extract of all of their missing and unidentified persons data contained in  NCIC. Upon receipt of the resulting data extract, the requesting agency  would then be responsible for entering the provided data into NamUs.  However, this solution to share information does not address the  inefficiencies created by the lack of an automated mechanism, as it  requires additional work on the part of responsible officials and results in  the potential for duplication.

We have previously reported that when fragmentation or overlap exists,  there may be opportunities to increase efficiency. In particular, our prior  work identified management approaches that may improve efficiency,  including implementing process improvement methods and technology  improvements while documenting such efforts to help ensure operations  are carried out as intended. Additionally, we have reported that federal  agencies have hundreds of incompatible information-technology networks  and systems that hinder governmentwide sharing of information and, as a  result, information technology solutions can be identified to help increase  the efficiency and effectiveness of these systems.

According to CJIS officials, the most significant limiting factors to a  systematic sharing of information mechanism between NCIC and NamUs  are that (1) access to NCIC is restricted to authorized users, (2) NamUs  has not been granted specific access to NCIC by law, and (3) NamUs has  a public interface. Because NamUs lacks specific statutory authority to  access NCIC and the public is prohibited from accessing NCIC data, CJIS  officials stated that fully exchanging data with NamUs would constitute an  unauthorized dissemination of NCIC information. As a result, these  officials stated that the CJIS Advisory Policy Board determined that NCIC  could not be fully connected to NamUs. While there are statutory  limitations regarding direct access to NCIC, there may be options to  better share information that are technically and legally feasible. Thus,  opportunities may exist within the current statutory framework to address  fragmentation and overlap between the two systems.

Our review of the data elements required by each system indicates a high  degree of commonality between the data that can be collected by NCIC  and NamUs, which could help facilitate the sharing of information.  Specifically, 12 of the 15 data fields required by NamUs for a missing  persons case and 12 of the 14 data fields required by NamUs for an  unidentified persons case are also present in NCIC. Further, stakeholders  we interviewed from three states offered a variety of solutions to address  the fragmentation and overlap between NCIC and NamUs. For example,

A law enforcement official in one state noted that a notification alert  could be added to NCIC to inform users when related case data was  also present in NamUs.

Another official stated that a query process that allowed authorized  users to search information from both systems simultaneously would  be helpful in minimizing the need to regularly check both systems.  According to CJIS officials, a joint search function would likely require  the systems to be fully integrated; however, CJIS officials noted that  they had not formally evaluated the option because they believe it is  currently precluded by federal law. While full integration of the two  systems may be precluded, a joint search function may not equate to  full integration. Authorized users with access to both systems could  benefit from the efficiencies of such a search function. However, DOJ  will not know whether this type of function could be technically or  legally feasible until it evaluates the option. Implementing  mechanisms to share information without fully integrating the systems  could help improve the efficiency of efforts to solve long-term missing  and unidentified persons cases using NCIC and NamUs.

Officials in another state suggested that a single data entry point  could be used to populate both NCIC and NamUs to minimize  duplicate data entry. This solution to share information has also been  put forward as a requirement in several bills that have been  introduced in Congress since 2009. In 2010, DOJ undertook an  effort in response to the requirement in proposed legislation to  determine whether it would be technically possible for a check box to  be added to NCIC that would allow users to indicate that they would  like the case information to be automatically entered into NamUs as  well. According to CJIS officials, this type of check box is already in  use for other NCIC files, which means it could be technically feasible  for the missing and unidentified persons files. However, according to  CJIS officials, this system change was not pursued for the missing  and unidentified persons files because the proposed legislation did  not pass, and consequently there was no legal requirement that CJIS  implement this mechanism to share information. Nevertheless, without  evaluating this mechanism, DOJ will not know whether it is technically  and legally feasible. As a result, DOJ may be missing an opportunity  to share information between NCIC and NamUs that would better help  users close their missing or unidentified persons cases.

Both NCIC and NamUs are in the early stages of upgrading their  systems; however, neither effort includes plans to improve sharing  information between these systems. These ongoing upgrade processes  provide DOJ with an opportunity to evaluate and document the technical  and legal feasibility of options to improve sharing NCIC and NamUs  missing and unidentified persons information, and to integrate appropriate  changes, if any, into the next versions of the systems.

According to NIJ officials, the discovery phase of the NamUs upgrade to  NamUs 2.0 has been completed, and officials have developed a  prioritized list of 793 items that they would like to include in the upgrade.  The feasibility of each item and timelines for implementation will be  determined in an iterative process based on time and funding  considerations. According to the officials, the highest priority items are  related to enhancing the existing capabilities of NamUs to make them  more efficient and user-friendly. Our review of the prioritization document  does not indicate that efforts to improve sharing of information with NCIC  are included in the ongoing upgrade. NIJ officials stated that their goal for  the upgrade is to share data more easily with a variety of state and local  systems.

According to CJIS officials, the upgrade process for NCIC began in 2014,  with a canvas of 500 state, local, tribal, and federal NCIC users to identify  the type of functionality users would like to see included in an updated  system. The officials said that this process yielded more than 5,500  recommendations related to all 21 files contained in NCIC. CJIS officials  did not specify how many recommendations were related to the missing  and unidentified persons files, but did note that they received some  feedback related to improving the ability to share data with NamUs.  Based on the user canvas, CJIS developed a high-level concept paper  that will be discussed at the Advisory Policy Board’s June 2016 meeting.  Following Advisory Policy Board approval, CJIS will begin the  development process, including identifying specific tasks. CJIS officials  explained that because of the uncertainty regarding approval, and the  way in which the upgrade development process will be structured, there  are no specific timeframes available related to the update. The officials  stated it will likely be several years before there are any deliverables  associated with the effort.

While we understand there are statutory restrictions regarding access to  NCIC that must be adhered to, and we recognize that stakeholders may  use NCIC and NamUs in distinct ways, DOJ has opportunities to explore  available options that could potentially allow for more efficient use of  information on missing and unidentified persons by reducing  fragmentation and overlap. Without evaluating the technical and legal  feasibility of options for sharing information, documenting the results of  the evaluation, and, as appropriate, implementing one or more of these  options, potential inefficiencies will persist. As a result, users who do not  have access to information from both systems may continue to miss vital  case information.

section_title: Conclusions
paragraphs: Every year, more than 600,000 people are reported missing, and  hundreds of sets of human remains go unidentified. Solving thousands of  long-term missing and unidentified persons cases requires the  coordinated use of case data contained in national databases, such as  NCIC and NamUs. However, because no mechanism exists to share  information between these systems, the fragmented and overlapping  nature of the systems leads to inefficiencies in solving cases. Although  there are statutory differences between the systems, there are potential  options for sharing information—such as a notification to inform NCIC  users if related case data were present in NamUs —that could reduce  inefficiencies between NCIC and NamUs within the existing legal  framework. The ongoing upgrade processes for both systems provide  DOJ with the opportunity to evaluate the technical and legal feasibility of  various options, document the results, and incorporate feasible options,  as appropriate. Without doing so, and without subsequently implementing  options determined to be appropriate during the next cycle of system  upgrades, potential inefficiencies will persist and users who do not have  access to information from both systems may be missing vital information  that could be used to solve cases.

section_title: Recommendation for Executive Action
paragraphs: To allow for more efficient use of data on missing and unidentified  persons contained in the NCIC’s Missing Persons and Unidentified  Persons files and NamUs, the Directors of the FBI and NIJ should  evaluate the feasibility of sharing certain information among authorized  users, document the results of this evaluation, and incorporate, as  appropriate, legally and technically feasible options for sharing the  information.

section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this product to DOJ for review and comment. On  May 13, 2016, an official with DOJ’s Justice Management Division sent us  an email stating that DOJ disagreed with our recommendation, because  DOJ believes it does not have the legal authority to fulfill the corrective  action as described in the proposed recommendation. Specifically, DOJ  stated that NamUs does not qualify, under federal law, for access to  NCIC and is not an authorized user to receive NCIC data. Therefore, DOJ  does not believe there is value in evaluating the technical feasibility of  integrating NamUs and NCIC.

As stated throughout this report, we understand the legal framework  placed on NCIC and that it may be restricted from fully integrating with a  public database. However, this statutory restriction does not preclude  DOJ from exploring options to more efficiently share information within  the confines of the current legal framework. Moreover, our  recommendation is not about the technical feasibility of integrating NCIC  and NamUs but about studying whether there are both technically and  legally feasible options for better sharing long-term missing and  unidentified persons information. We continue to believe that there may  be mechanisms for better sharing this information—such as a notification  alert in NCIC to inform users when related case data is also present in  NamUs—that would comply with the legal restrictions. However, until  DOJ studies whether such feasible mechanisms exist, it will be unable to  make this determination. Without evaluating the technical and legal  feasibility of options for sharing information, DOJ risks continued  inefficiencies through fragmentation and overlap. Moreover, authorized  users who do not have automated or timesaving access to information  from both systems may continue to miss critical information that would  help solve these cases.

DOJ also provided technical comments, which we incorporated as  appropriate.

We are sending copies of this report to the appropriate congressional  committees, the Attorney General of the United States, and other  interested parties. In addition, the report is available at no charge on the  GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-9627 or maurerd@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix III.

section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: In response to Senate Report 113-181 (accompanying the Consolidated  and Further Continuing Appropriations Act of 2015) this report addresses  the following objectives:  1.  Describe access to and use of missing and unidentified persons  information contained in the National Crime Information Center  (NCIC) and the National Missing and Unidentified Persons System  (NamUs).  2.  To what extent do opportunities exist to improve the use of missing  and unidentified persons information contained in NCIC and NamUs?

To describe the access to and use of missing and unidentified persons  information contained in NCIC and NamUs, we reviewed and compared  NCIC and NamUs operating and policy manuals and data entry guides. In  addition, we observed access to and use of missing and unidentified  persons information in NamUs. To corroborate information above, we  conducted interviews with officials who access and use NCIC and  NamUs, including state criminal justice agencies, state and local law  enforcement agencies (LEA), medical examiners, and coroners.

To determine the extent to which opportunities exist to improve the use of  missing and unidentified persons information using NCIC and NamUs, we  analyzed summary level case data by state for each system for fiscal year  2015. Because of statutory limitations on access to criminal justice  information contained in NCIC we did not assess record level case data  from either NCIC or NamUs. However, we compared NCIC summary  level data to NamUs summary level data, and found it sufficient for  demonstrating the extent to which information contained in the two  systems is similar or different. We assessed the reliability of the data  contained in NCIC and NamUs by, among other things, reviewing  database operating manuals and quality assurance protocols, and by  interviewing officials responsible for managing the systems. We found the  data to be reliable for our purposes.

We also reviewed and compared NCIC and NamUs operating manuals  and data entry guides to determine the comparability of minimum data  requirements for record entry, individual data elements in each system,  and their definitions. Our review of these documents allowed us to identify  details about the purpose and design of each system that may support or  preclude data sharing. In addition, we reviewed past and current CJIS  and NIJ plans related to sharing information between NCIC and NamUs.  We reviewed laws, policies, and information associated with reporting and  sharing information on missing and unidentified persons, to include  information about the types of users that can access or enter information  into each system within three categories: (1) LEA, (2) non-LEA criminal  justice agency (CJA)—such as a court; and (3) medicolegal investigator— such as a coroner. We assessed this information against Standards for  Internal Control in the Federal Government and GAO’s evaluation and  management guide for fragmentation, overlap, and duplication.

NCIC and NamUs assign user access differently, with NCIC assigning  access at the agency level, while NamUs provides access directly to  individuals. Because of this, for the purposes of comparing NCIC and  NamUs users, we consolidated information from NamUs for non-public  users into their relevant agencies so as not to overstate the number of  NamUs users as compared to NCIC. However, there are some limitations  associated with this effort. For example, for a city-wide LEA such as the  New York City Police Department, NCIC assigns Originating Agency  Identifiers (ORI) numbers to each office within that particular agency, as  the ORI number is used to indicate the LEA office directly responsible for  a given NCIC record entry. When individuals register for NamUs, they  may or may not provide the same level of detail regarding their specific  office within a greater LEA, which means we may count an agency once  for NamUs, even though that agency likely has multiple ORIs associated  with it for NCIC. Further, because of the way user permissions are  determined in NamUs, some LEAs with DNA or forensic specialists may  also be included in the medicolegal investigator category, whereas they  are likely to use only a single LEA ORI in NCIC. To address these  limitations, this report presents information about both the number and  type of individual users registered with NamUs, as well as the number  and type of agencies that these users represent.

To corroborate information above, and to obtain more in-depth  perspectives about the extent to which opportunities exist to improve the  collection and use of missing and unidentified persons information, we  conducted interviews. Specifically, we interviewed Department of Justice  (DOJ) officials, relevant stakeholders from selected states, and officials  from nongovernmental agencies, in part to learn about past and current  efforts to share information between NCIC and NamUs. In addition, we  selected Arizona, California, and New York to include in this review,  based in part on their respective state laws and policies associated with  missing and unidentified persons, as well as the number of cases  reported to each database for fiscal year 2015. Specifically, after  identifying the 10 states that reported the highest number of cases to both  NCIC and NamUs, we then compared four characteristics of state laws  and policies related to reporting missing and unidentified persons. These  included whether the state law specified (1) required reporting to NCIC,  NamUs, or other federal databases; (2) reporting requirements for  specific populations; (3) a timeframe for reporting missing persons cases;  and (4) a timeframe for reporting unidentified remains. We chose Arizona,  California, and New York to provide illustrative examples of different types  of state laws. Table 1 provides a high-level comparison of the reporting  laws for each state we reviewed.

We then selected a nongeneralizeable sample of relevant stakeholders  from each state to interview. Specifically, we interviewed relevant  stakeholders in 3 state criminal justice agencies, 4 state and local LEAs,  2 medical examiner offices, and 1 coroner office. Although the views  expressed from these interviews cannot be generalized to each state,  they provide valuable insights about the types of experiences different  stakeholder groups experience in states with varied reporting  requirements. We also reviewed state documents associated with the  data systems used by each state to report missing and unidentified  persons information to NCIC.

We conducted this performance audit from September 2015 to April 2016  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

section_title: Appendix II: Comparison of Fragmentation and Overlap in Key Characteristics of the National Crime Information Center (NCIC) and National Missing and Unidentified Persons System (NamUs)
paragraphs: Appendix II: Comparison of Fragmentation and  Overlap in Key Characteristics of the National  Crime Information Center (NCIC) and National  Missing and Unidentified Persons System  (NamUs)

Purpose  Both systems contain  data designed to be  used to solve long- term missing and  unidentified persons  cases.

Registered Users  Registered users of both systems  must populate one system with  missing and unidentified persons  cases and then go through the  process again to enter the same  data in the second system. To  utilize information from either  system, registered users must go  through an inefficient process of  accessing and searching each  system separately, and then  manually comparing results.

Data Validation  Efforts  NamUs Regional  System Administrators  (RSA) check NCIC as  part of the NamUs  validation process. In  fiscal year 2015,  RSAs requested and  manually reviewed  NCIC records for at  least 22,000 missing  persons and 4,532  unidentified persons  cases.

NCIC contains  significantly more missing  persons cases than  NamUs, while NamUs  contains more  unidentified persons  cases, limiting the  usefulness of either  system. Specifically, in  fiscal year 2015, 3,170  missing persons cases  were reported to NamUs,  while 84,401 long-term  cases were reported to  NCIC during the same  time period. In contrast,  1,205 unidentified  persons cases were  reported to NamUs in  fiscal year 2015, while  830 cases were reported  to NCIC.

Less than 0.1 percent of  registered NCIC users are medical  examiner or coroner offices, while  approximately 18 percent of the  agencies with at least one  registered NamUs user are  considered part of the medicolegal  field. Additionally, many missing  persons cases are initially  reported in NamUs by members of  the public who do not have access  to NCIC. Consequently, potentially  valuable information on missing  persons cases may not be getting  to all those who need it.

section_title: Appendix III: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
paragraphs: Diana C. Maurer, (202) 512-9627 or maurerd@gao.gov.

section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Dawn Locke (Assistant Director),  Elizabeth Kowalewski, Susanna Kuebler, Amanda Miller, Jan  Montgomery, Heidi Nielson, Janay Sam, Monica Savoy, and Michelle  Serfass made key contributions to this report.


Question-summary annotations: questions: question: What is the difference between the NamUs database and the NCIC database?
answer: The Federal Bureau of Investigation's (FBI) National Crime Information Center (NCIC) database includes criminal justice agency information and access to such data is restricted to authorized users. In contrast, the Department of Justice's (DOJ) National Institute of Justice (NIJ) funds and oversees the National Missing and Unidentified Persons System (NamUs), a database for which the public may register to access published case information.
child_questions: question: What is the implication of this difference?
answer: Because many users of NamUs are not authorized to access NCIC, there are no direct links between the systems. As a result, while both NCIC and NamUs contain information on long-term missing and unidentified persons, they remain separate systems.

questions: question: What do the NCIC and NamUs databases concern?
answer: Database Records: NCIC and NamUs contain fragmented information associated with long-term missing and unidentified persons (cases open for more than 30 days).
child_questions: question: How do case numbers differ across the two databases?
answer: For example, in fiscal year 2015, 3,170 long-term missing persons cases were reported to NamUs while 84,401 missing persons records reported to NCIC became long-term cases.

question: How else do the two databases differ?
answer: NamUs also accepts and maintains records of missing and unidentified persons cases that may not be found in NCIC because, for example, they have not yet been filed with law enforcement.
child_questions: question: What are the implications of this difference?
answer: As a result, users relying on only one system may miss information that could be instrumental in solving these types of cases.

questions: question: How does the NCIC user base compare to NamUs's?
answer: Registered Users: The NCIC user base is significantly larger than the NamUs user base, and the types of users vary, which may contribute to the discrepancies in each system's data.
child_questions: question: What system do law enforcement agencies use?
answer: For instance, almost all law enforcement agencies use NCIC, with only a small fraction registered to use NamUs.

question: What system does the general public use?
answer: Additionally, members of the public do not have access to NCIC, but can report missing persons cases to NamUs.

questions: question: To what extent can NCIC and NamUs integrate?
answer: According to FBI officials, federal law precludes full integration of NCIC and NamUs; however, opportunities to share information may exist within the legal framework to address fragmentation and overlap without full system integration.
child_questions: question: Although full integration is an impossibility, what options remain for the systems to complement each other?
answer: By evaluating the technical and legal feasibility of options to share information, documenting the results, and implementing feasible options, DOJ could better inform those who are helping solve missing and unidentified persons cases and increase the efficiency of solving such cases.

question: What is the effect of this lack of information sharing?
answer: Inefficiencies exist in the use of information on missing and unidentified persons primarily because there is no mechanism to share information between the systems, such as a notifier to inform NCIC users if related case data were present in NamUs.

questions: question: Why are NCIC and NamUs necessary?
answer: Every year, more than 600,000 people are reported missing, and hundreds of human remains go unidentified. Two primary federal databases supported by DOJ—NCIC and NamUs—contain data related to missing and unidentified persons to help solve these cases.
child_questions: question: What information does NCIC contain?
answer: NCIC contains criminal justice information accessed by authorized agencies to assist with daily investigations.

question: What groups generally use NamUs?
answer: NamUs information can be used by law enforcement, medical examiners, coroners, and the general public to help with long-term missing and unidentified persons cases.

questions: question: What does Senate Report 113-181 allow GAO to do?
answer: Senate Report 113-181 (accompanying the Consolidated and Further Continuing Appropriations Act of 2015) includes a provision for GAO to review NCIC and NamUs.
child_questions: question: What does the GAO's report describe?
answer: This report describes the access to and use of missing and unidentified persons information contained in NCIC and NamUs, and the extent to which there are opportunities to improve the use of this information.
child_questions: question: How did GAO collect relevant information in the making of the report?
answer: GAO reviewed NCIC and NamUs data, and relevant state and federal statutes. GAO also conducted nongeneralizeable interviews with stakeholders in three states, selected in part on state laws.