Terrorism Information Sharing and the Nationwide Suspicious Activity Report Initiative: Background and Issues for Congress
Released: 2011-12-28T00:00:00

Background

The National Commission on Terrorist Attacks Upon the United States (the 9/11 Commission) cited breakdowns in information sharing and the failure to fuse pertinent intelligence (i.e., "connecting the dots") as key factors in the failure to prevent the 9/11 attacks. A bipartisan task force of former policy makers and senior executives described the challenge facing the government in "the new era of national security we have entered," as "the challenge of using information effectively, linking collection with sound and imaginative analysis derived from multiple perspectives, and employing cutting edge technology to support end-users, from emergency responders to Presidents. In other words, we need to mobilize information."

In the 2004 Intelligence Reform and Terrorism Prevention Act (IRTPA), Congress mandated the creation of an Information Sharing Environment (commonly known as the "ISE"). Congress intended the ISE to be a "decentralized, distributed, and coordinated environment ... with 'applicable legal standards relating to privacy and civil liberties.'" The act also directed that the ISE provide and facilitate the means of sharing terrorism information among all appropriate federal, state, local, and tribal entities and the private sector through the use of policy guidelines and technologies.

A Program Manager for the Information Sharing Environment (PM-ISE) was established and placed within the Office of the Director of National Intelligence (ODNI). As required by Section 1016(h) of the IRTPA, the PM-ISE submitted to Congress three annual reports on the extent to which the ISE has been implemented. The Obama Administration reaffirmed effective information sharing as a "top priority" and established within the Executive Office of the President the position of Senior Director for Information Sharing Policy.

Also after 9/11, states and major urban areas established intelligence fusion centers to coordinate the gathering, analysis, and dissemination of law enforcement, homeland security, public safety, and terrorism intelligence and analysis. According to the Department of Homeland Security (DHS), this activity by fusion centers contributes to the ISE. Fusion centers have been defined as a "collaborative effort of two or more Federal, state, local, or tribal government agencies that combines resources, expertise, or information with the goal of maximizing the ability of such agencies to detect, prevent, investigate, apprehend, and respond to criminal or terrorist activity." As of December 2011, DHS notes that 72 centers are operational within the United States and its territories. DHS has supported these centers with grant funding and has assigned intelligence officers to them.

Why Information Sharing?

Information sharing is ... about establishing a collaborative environment with a clear purpose: ensuring that the right people have access to the right information at the right time under the right conditions to enable informed decisions.

The imperative for the exchange of terrorism-related intelligence information among law enforcement and security officials at all levels of government is founded on three propositions.

The first is that any terrorist attack in the homeland will necessarily occur in a community within a state or tribal area, and the initial response to it will be by state, local, and tribal emergency responders and law enforcement officials.

Second, the plotting and preparation for a terrorist attack within the United States (such as surveillance of a target, acquisition and transport of weapons or explosives, and even the recruitment of participants) will also occur within communities. Every day, officers at thousands of state and local law enforcement agencies collect and document information regarding behaviors, incidents, and other suspicious activity associated with crime including terrorism. A joint study by the Departments of Justice and Homeland Security and senior law enforcement officials concluded that "[t]he gathering, processing, reporting, analyzing, and sharing of suspicious activity is critical to preventing crimes, including those associated with domestic and international terrorism."

Third, "[i]nformation acquired for one purpose, or under one set of authorities, might provide unique insights when combined, in accordance with applicable law, with seemingly unrelated information from other sources." This recognizes that "relevant information comes from a much wider range of sources … and it is difficult to know a priori what information will prove relevant to analysts or useful to users. For this reason, it is necessary to create a more horizontal, cooperative, and fluid process for intelligence collection, sharing, and analysis." Or, as the 9/11 Commission concluded, "A 'smart' government would integrate all sources of information to see the enemy as a whole."

Information-Sharing Systems

In a nationwide survey conducted in 2006, the Justice Research and Statistics Association (JRSA) found that there are currently in place or under development 266 separate systems that share information about crime, including terrorism, at the national, regional, and state levels. The boom in the development of these systems has led to concern that "it is hard to know what information is being shared and who is sharing it. In many cases, multiple systems are being developed to cover overlapping areas." Appendix A provides a brief overview of significant information-sharing systems.

Suspicious Activity Reporting

Suspicious Activity Reports (SAR) contain information about criminal activity that may also reveal terrorist pre-operational planning. These reports could be based on an officer's observation of suspicious behavior, 9-1-1 calls, or other tips and leads provided to police by citizens. Many believe that the sharing of SARs among all levels of government and combining them with other intelligence information will help uncover terrorist plots within the United States. Every day, more than 800,000 police officers collect and document information regarding behaviors, incidents, and other suspicious activity associated with crime, including terrorism.

"On the beat or mobile, cops are sensitive to things that do not look right or do not sound right," says one police chief. "[R]emember, it was a rookie cop on a routine check that resulted in the arrest of Eric Robert Rudolph in North Carolina despite the enormous commitment of federal resources." Oklahoma City bomber Timothy McVeigh was arrested after a traffic stop when Oklahoma State Trooper Charles J. Hanger noticed that McVeigh's yellow 1977 Mercury Marquis had no license plate. Using his home state as an example, a former U.S. Attorney maintains that "evidence of a potential terrorist threat or organized criminal enterprise is far more likely to be found in the incidental contact with the 10,000 police officers in the state of Washington than by the less than 150 FBI agents assigned to the Seattle Field Division."

In addition to the arrests of Rudolph and McVeigh, state and local law enforcement officers, in the normal course of their duties, have uncovered or disrupted the following terrorist plots:

The Japanese Red Army terrorist, Yū Kikumura, was arrested on April 12, 1988, at a rest stop on the New Jersey Turnpike by a state trooper who thought he was acting suspiciously. He was found carrying three 18-inch (46-cm) pipe bombs loaded with gunpowder. Prosecutors said Kikumura had planned to bomb a military recruitment office in New York City. In July 2005, two undercover police officers noticed two men acting suspiciously near a gas station in Torrance, CA. After the men robbed the gas station, they were arrested by the undercover officers. A search of the arrested men's apartment revealed that they were members of the terrorist group Jamiyyat Ul-Islan Is-Saheeh. They were planning to bomb synagogues in Los Angeles and were financing their operation through armed robberies. In August 4, 2007, two Egyptians studying in Florida were stopped by police for a traffic violation near Goose Creek, SC. They were found to have explosives in their vehicle. A subsequent investigation revealed that one of the students had made and placed on the Internet a video demonstrating how to use a doll to conceal an improvised explosive device. The student later plead guilty to "providing material support to terrorism."

One major city police department commander notes that the role of police officers has evolved after 9/11. They are now also "first preventers" of terrorism, and this represents a "dramatic paradigm shift," both for the federal government and for the local and state agencies themselves. The need for intelligence information to support the police in this terrorism prevention role is considered crucial.

A national information-sharing system, says a former U.S. Attorney, should also ensure that "federal agencies have access to information maintained in state and local agencies that may be pertinent to terrorist threats ... the benefit that would accrue to U.S. national security in having police records integrated in a strictly controlled fashion with sensitive federal data would be nothing short of remarkable." He cites the example of Hani Hanjoor, the hijacker who piloted American Airlines Flight 77 that crashed into the Pentagon. Six weeks prior to the 9/11 attacks, Hanjoor had been issued a speeding ticket by a local police department in the Washington, DC, area. Had a system been in place to share this information with the FBI, it may have alerted them that a suspected Al Qaeda operative was present within the National Capital Region. Also prior to September 11, 2001, local police officers made separate traffic stops of two other 9/11 hijackers—Mohammed Atta and Ziad Samir Jarrah. Like Hanjoor, both were in violation of their immigration status. There was even an outstanding arrest warrant on Atta for failing to appear on a previous traffic citation.

Nationwide Suspicious Activity Reporting Initiative (NSI)

The NSI is a framework to support the reporting of suspicious activity—from the point of initial observation to the point where the information is available in the information-sharing environment. It supports one of the core principles of the 2007 National Strategy for Information Sharing , that information sharing "be woven into all aspects of the counterterrorism activity, including preventive and protective actions, actionable responses, criminal and counterterrorism investigative activities, event preparedness, and response to and recovery from catastrophic events." The NSI responds to the strategy's mandate that the federal government support the development of a nationwide capacity for a standardized, integrated approach to gathering, documenting, processing, analyzing, and sharing information about suspicious activity that is potentially terrorism-related while protecting the privacy and civil liberties of Americans.

According to the PM-ISE, the NSI is neither a technology nor a single, monolithic program. Rather it is a coordinated effort that integrates all SAR-related activities into a nationwide unified process. The NSI is a framework that defines the data standards, business processes, and policies that facilitate the sharing of terrorism-related SARs. NSI has been described as

a partnership among federal, state, local, tribal, and territorial law enforcement that establishes a national capacity for gathering, documenting, processing, analyzing, and sharing SAR information—also referred to as the SAR process—in a manner that rigorously protects the privacy and civil liberties of Americans.

According to the 2010 Nationwide SAR Initiative Annual Report, 29 fusion centers had implemented the NSI process and achieved operational status, with another 30 fusion centers in progress as of March 2011.

The NSI also differs from data mining programs. Data mining entails the search of numerous commercial or government data sets that contain data—the vast majority of which documents legal activity. Mathematical algorithms are then used to identify data trends that can be examined as predictors of criminal activity. The NSI establishes a federated search capability that requires the articulation of some type of criminal or law enforcement predicate before permitting a search of repositories consisting of documented events that are themselves considered reasonably indicative of criminal activity. Given the controversies surrounding various data mining programs, this difference may be a salient issue in terms of public acceptance of the NSI program.

In December 2008, a concept of operations for the NSI program was published that describes the roles, missions, and responsibilities of NSI participating agencies and the top level NSI governing structure. A comprehensive overview of the operational steps of the nationwide SAR cycle grouped into five business process activities—planning, gathering and processing, analysis and production, dissemination, and reevaluation—is shown in Figure 1 .

The intended operational steps of the cycle can be described simply: When a police officer detects suspicious activity that might be terrorist related, he or she documents that activity in a SAR. That report is reviewed within the officer's chain of command. Once vetted, it is submitted to a state/local fusion center, where it is reviewed by a trained intelligence analyst to determine whether it meets the established SAR criteria. If so, the report is entered into the information-sharing environment, where it becomes accessible to authorized agencies at all levels of government and available for analysis and fusion with other intelligence information.

Privacy and Civil Liberties Implications

According to the commander responsible for the Los Angeles Police Department (LAPD) SAR program, a suspicious activity reporting program should be "built upon behaviors and activities that have been historically linked to preoperational planning and preparation for terrorist attacks." Appropriately managed, a SAR program "takes the emphasis off the racial or ethnic characteristics of individuals and places it on detecting behaviors and activities with potential links to terrorism related criminal activity."

Some observers, however, are concerned that many behaviors that the police observe, and then use to judge whether the behaviors might be precursors to terrorism, are often entirely innocent and perfectly legal. Consider the following behaviors derived from the LAPD list of SAR "suspect actions":

Uses binoculars or cameras. Takes measurements. Takes pictures or video footage. Draws diagrams or takes notes. Pursues specific training or education that indicate suspicious motives (flight training, weapons training, etc). Espouses extremist views.

The American Civil Liberties Union (ACLU) argues that "[m]ost people engage in one or more of these activities on a routine, if not daily, basis." They fear that "overbroad reporting authority gives law enforcement officers justification to harass practically anyone they choose, to collect personal information, and to pass such information along to the intelligence community." The Center for Democracy and Technology (CDT) is concerned that "there is a trend toward the collection of huge quantities of information with little or no predicate through SARs. There seems to us a high risk that this information will be misinterpreted and used to the detriment of innocent persons."

In support of this contention, both the ACLU and CDT cite a case reported by the Baltimore Sun in July 2008: "Undercover Maryland State Police officers [in 2005 and 2006] ... sent covert agents to infiltrate the Baltimore Pledge of Resistance, a peace group; the Baltimore Coalition Against the Death Penalty; and the Committee to Save Vernon Evans, a death row inmate." The police "also entered the names of some in a law-enforcement database of people thought to be terrorists or drug traffickers." According to files obtained by the ACLU through a Maryland Information Act lawsuit, "none of the 43 pages of summaries and computer logs—some with agents' names and whole paragraphs blacked out—mention criminal or even potentially criminal acts, the legal standard for initiating such surveillance."

A challenge for the NSI is how to achieve law enforcement and intelligence objectives while ensuring privacy and civil liberties protections for American citizens. For example, all of the behaviors listed by the LAPD could be potential indicators of terrorist planning and preparation. But such behaviors could also be innocent and legal activities. Carefully articulating what activity crosses the threshold into reportable suspicious activity is seen as a necessary step to ensuring the protection of privacy and civil liberties.

The NSI has endeavored to address these issues. Agencies participating in the NSI are required to implement a privacy policy that is at least as comprehensive as the policy elaborated within the ISE Privacy Guidelines and that includes a SAR provision. Likewise, all fusion centers have similar protections.

ISE SAR Functional Standard

Also in an effort to address civil liberties issues associated with the NSI, the PM ISE published a ISE SAR Functional Standard , which describes the structure, content, and products associated with processing, integrating, and retrieving SARs by participating agencies. It is specifically intended to establish a structured environment to reduce inappropriate police data gathering and support the training of law enforcement personnel so that they can better distinguish between behavior that is legal or constitutionally protected and that which is potentially associated with criminal activity. It establishes threshold criteria for what suspicious activity will be considered as having a nexus to terrorism and establishes a process to determine whether reports of that activity meet the criteria for being entered into the ISE as a SAR. The 2010 Nationwide SAR Initiative Annual R eport states:

The current ISE-SAR Functional Standard reinforces constitutional standards, including the protection of rights guaranteed by the First Amendment and limitations on the use of certain factors—race, ethnicity, national origin, or religious affiliation—in the gathering, collecting, storing, and sharing of information about individuals. As a result of input from privacy advocates, the standard also includes reliability indicators. Through the use of Information Exchange Package Documentation ... the Functional Standard allows the originating agency to include or not include fields that contain personal information, based upon the agency's rules and policies.

In 2008, the PM ISE completed a report that examined the potential impact of the ISE SAR Functional Standard on the privacy and other legal rights of Americans, how it will be evaluated in a limited operational environment, and articulated the measures that will be established to protect privacy and civil liberties. Subsequently, the Office of the PM-ISE engaged with various stakeholders, including privacy and civil liberties groups such as the ACLU, CDT, and the Freedom and Justice Foundation, as it developed and refined SAR-related operational processes and training. In May 2009, the suggestions of these groups as well as state and local law enforcement agencies were incorporated into a revised version of the ISE SAR Functional Standard . Among the changes in the revision (Version 1.5) were the following:

Refines the definition of "suspicious activity," as "observed behavior reasonably indicative of pre-operational planning related to terrorism or other criminal activity." Further emphasizes a behavior-focused approach to identify suspicious activity and requires that factors such as race, ethnicity, national origin, or religious affiliation should not be considered factors that create suspicion. Refines the guidance to distinguish between Defined Criminal Activity and Potentially Criminal or Non-Criminal Activity requiring additional factual information before investigation. Clarifies those activities that are generally First Amendment-protected and should not be reported in a SAR absent articulable facts and circumstances that support the source agency's suspicion that the behavior observed is reasonably indicative of criminal activity associated with terrorism.

In a press release following publication of Version 1.5, the ACLU National Security Policy Counsel noted that

[t]he revised guidelines for suspicious activity reporting establish that a reasonable connection to terrorism or other criminal activity is required before law enforcement may collect Americans' personal information and share it within the ISE. These changes to the standard, which include reiterating that race cannot be used as a factor to create suspicion, give law enforcement the authority it needs without sacrificing the rights of those it seeks to protect.

To bolster these efforts, NSI PMO developed the document "Vetting ISE-SAR Data: A Pathway to Ensure Best Practices." It articulates guidance for fusion center analysts on how to vet SAR information, provides compliance with the ISE-SAR Functional Standard v. 1.5. Also, according to the PM-ISE, for reported activity to make its way into a SAR, the activity "must conform to one or more of the criteria identified in Part B of the ISE-SAR Functional Standard."

Community Outreach

Two projects related to community outreach and associated with the NSI have emerged. These have endeavored to connect private citizens to the SAR process.

Building Communities of Trust Initiative (BCOT)

In recognition that NSI's success depends on partnership with local communities, the Building Communities of Trust Initiative (BCOT) was developed by DOJ and DHS. It resulted in guidance for the development of trust among three sets of actors—fusion centers, law enforcement, and the communities in which they operate. All of these actors have a stake in the production of SARs. These recommendations included items such as

training of fusion center analysts in cultural sensitivity so that they can distinguish behavior that is constitutionally protected from criminal or terrorist activity; encouraging law enforcement to "embrace" community policing by "emphasizing partnerships and problem solving"; and encouraging communities to view information sharing with fusion centers and law enforcement as key to crime prevention and counterterrorism.

"If You See Something, Say Something™" Campaign

In July 2010, DHS launched its national "If You See Something, Say Something™" campaign. It is meant to "raise public awareness of indicators of terrorism and terrorism-related crime and to emphasize the importance of reporting suspicious activity to the proper transportation and law enforcement authorities." DHS has tied the campaign to NSI as a way of emphasizing community awareness regarding terrorism.

NSI Shared Space Architecture

NSI participants can make their SARs available within the NSI federated search via two methods. They can install "an NSI-provided server that leverages an existing legacy computer-aided dispatch … system or records management system…." Alternatively, they can create an eGuardian account to disseminate SARs. Via this architecture, law enforcement agencies can share information without having to open up their own internal databases to outside users. Simultaneously, law enforcement agencies control their own information and determine what they want to share.

This shared space architecture also allows participants to search existing SARs via the NSI Federated Search. NSI participants can access the NSI Federated Search through either the Regional Information Sharing Systems® Secure Intranet (RISSNET™) or Law Enforcement Online (LEO). Eventually, participants will be able to access the search through the Homeland Security Information Network portal geared toward law enforcement. The Federated Search is represented as the "Entry point into ISE Shared Spaces Environment" in Figure 2 .

The FBI's eGuardian system is a node within the ISE Shared Spaces environment. On the surface, it would appear that the existing eGuardian capability duplicates the NSI—or at least NSI's shared spaces concept. But it should be noted that the NSI is an overall framework for a SAR process that includes policies, governance, procedures, training, and information technology (IT) architecture, whereas eGuardian is a specific technology for terrorism-related information sharing.

Under NSI, eGuardian can remain the technology that FBI uses to supply data to and access data from the ISE Shared Spaces environment. Likewise, fusion centers or state and local governments may, if they wish, use eGuardian as a gateway to and from the shared spaces. However, some law enforcement agencies may choose, or are legislatively mandated, to maintain a repository of their own data and to control what data is shared with whom based on statutory criteria. Consistent with the requirement in the IRTPA for a "decentralized, distributed, and coordinated" information-sharing environment, the NSI shared spaces architecture allows state, local, and tribal agencies to maintain control of their own data.

Training

The training regimen that has been established for the NSI has three levels. At one level, the SAR process training involves briefings for law enforcement executives regarding "executive leadership, policy development, privacy and civil liberties protections, agency training, and community outreach." Another level—the SAR Analytic Role Training—is directed at those involved in analyzing SAR information, "ensuring that SARs are properly reviewed and vetted is critical to promoting the integrity of information submitted; protecting citizens' privacy, civil rights, and civil liberties; and successfully implementing the SAR process." The analytic training revolves around teaching analysts and investigators "to recognize terrorism-related pre-incident indicators and to validate—based on a combination of knowledge, experience, and available information—whether the behavior has a potential nexus to terrorism and meets criteria for submission." The final level—Line Officer Training―focuses on frontline law enforcement personnel. They are trained to "recognize behavior and incidents that may indicate criminal activity associated with terrorism." As of October 2011, more than 160,000 law enforcement officers received SAR training. According to the 2010 Nationwide SAR Initiative Annual Report , training for two additional groups is also necessary. The first of these groups includes public safety/justice professionals involved in fire service, emergency medical service, emergency management, and corrections, as well as probation and parole officers. The second group consists of private-sector owners, operators, and protectors of critical infrastructure.

The NSI Pilot Project

In 2007, the Office of the PM-ISE funded a pilot effort called the "ISE-SAR Evaluation Environment" (ISE-SAR EE) to evaluate the feasibility of the NSI for the sharing of terrorism-related SARs. Program management services for the project were provided by DOJ's Bureau of Justice Assistance (BJA) with the support of the Global Justice Information Sharing Initiative.

The ISE-SAR EE sought to develop and implement consistent national policies, processes, and best practices among the federal, state, local, and tribal partners in the NSI initiative. System evaluations and training activities were conducted at three state and nine urban fusion center pilot sites. That evaluation program concluded on September 30, 2009. There were two specific activities of note within the ISE-SAR EE. First, the project team furnished and tested the "shared spaces" concept. Second, a pilot training program was developed for the thousands of state and local law enforcement officers to assist them in the detection, identification, and reporting of suspicious activity in a way that supports the analysis and fusion of such reports into actionable intelligence while protecting privacy and civil liberties.

ISE-SAR EE Final Report Key Recommendations

In January 2010, the final report of the ISE-SAR EE provided a number of key recommendations. These include securing the support of executive leadership within agencies involved in the SAR process. According to the final report, agencies should form their own unique policies and procedures regarding SARs while folding in a common set of processes across participating agencies. Agencies should maintain privacy frameworks consistent with the ISE Privacy Guidelines. The final report also emphasizes the importance of effectively deploying technology, of offering training, and of outreach to build public, private sector, and law enforcement awareness of the SAR process.

Formation of a Program Management Office

In March 2010, a Program Management Office (PMO) was established within the BJA "to facilitate the implementation of the NSI across all levels of government." The PMO's purpose is largely to "assist agencies with adopting compatible processes, policies, and standards that foster broader sharing of SARs, while ensuring that privacy, civil rights, and civil liberties are protected." The PMO plays an advocacy role for the NSI. It guides participating agencies at all levels and also coordinates NSI efforts. The PMO has also highlighted the importance of privacy and civil liberties issues by working with the DOJ Privacy and Civil Liberties Office.

Issues for Congress

Too Many "Dots"

The NSI is designed to increase the amount of information—the intelligence "dots"—that will flow from state, local, and tribal law enforcement agencies to the federal government. The goal of "connecting the dots" becomes more difficult when there is an increasingly large volume of "dots" to sift through and analyze. Because the NSI would establish mechanisms for—and indeed promote—the widespread reporting and sharing of data by numerous federal, state, and local agencies, some have expressed concerns about the risk of "'pipe clogging' as huge amounts of information are ... gathered without apparent focus."

In an October 2007 report, the Government Accountability Office (GAO) identified a related challenge. When "identical or similar types of information are collected by or submitted to multiple agencies, integrating or sharing this information can lead to redundancies." The GAO found "that in intelligence fusion centers, multiple information systems created redundancies of information that made it difficult to discern what was relevant. As a result, end users were overwhelmed with duplicative information from multiple sources."

A challenge for the NSI is the extent to which the program will result in an avalanche of largely irrelevant or duplicative data while diverting the police from more productive law enforcement activities. For example, in a 40-month period before the ISE-SAR EE pilot program, the FBI documented approximately 108,000 potential terrorism-related threats, reports of suspicious incidents, and terrorist watchlist encounters.

Congress may be interested in how a future SAR Program Management Office intends to address this problem—specifically, which agency or agencies will be responsible for quality control of SARs to prevent system overload from irrelevant or redundant ones and to ensure that the SARs that are entered into the shared space environment adhere to privacy and civil liberties standards.

Data Privacy and Access

To achieve information-sharing objectives, government agency partners need to establish wide-scale electronic trust between the caretakers of sensitive information and those who need and are authorized to use that information. The Markle Task Force on National Security in the Information Age, maintains that

[i]n an effective information sharing framework, information is not simply shared without restraint ... information sharing will succeed only if accompanied by government-wide policy guidelines and oversight to provide robust protections for privacy and civil liberties ... [i]ts governance should require a user to provide a predicate in order to access data under an authorized use standard. To establish a predicate, an analyst seeking information would need to state a mission- or threat-based need to access the information for a particular purpose."

To accomplish this, proponents say that fusion centers must acquire a federated capability for identity and privilege management that securely communicates a user's roles, rights, and privileges to ensure network security and privacy protections. The two elements of this are identification/authentication—the identity of end users and how they were authenticated—and privilege management—the certifications, clearances, job functions, and organizational affiliations associated with end users that serve as the basis for authorization decisions.

In order to protect sensitive data and the privacy of Americans, Congress may wish to examine the NSI policies that will govern data privacy and access to data within the ISE Shared Spaces environment.

Information Technology (IT) Infrastructure

The success of the NSI is dependent on an IT infrastructure that enables state and local fusion centers to have access to each other's information as well as to the appropriate federal databases. Under the "shared space architecture" concept, fusion centers replicate data from their systems to an external server under their control. A secure portal is then created that allows simultaneous searching of all such databases so that fusion centers will be able to aggregate any relevant information that exists throughout the network. To connect into the system, a fusion center requires a server and software to translate data from whatever case management or intelligence system it uses to a separate database on the server.

Expenses for this IT infrastructure may exceed the funds that states and cities will allocate for their fusion centers from the State Homeland Security Program (SHSP) or Urban Area Security Initiative (UASI). Congress may wish to consider ways to provide funding to fusion centers for this purpose.

Metrics

One of the biggest challenges facing policy makers is how to determine whether the NSI program is successful:

Are the number of SARs produced or the number of SARs shared relevant metrics? How does one know if the SARs that are produced and shared under the program are actually meaningful intelligence "dots?" How does one determine if the right "dots" are being connected?

Congress may wish to ask the NSI PMO about metrics to measure the success of the NSI program.

Appendix A. Significant Information-Sharing Systems

Law Enforcement Online (LEO)

Established prior to the 9/11 attacks, LEO is a secure, Internet-based communications portal for law enforcement, first responders, criminal justice professionals, and anti-terrorism and intelligence agencies around the globe. Managed by the FBI's Criminal Justice Information Services Division, LEO catalyzes and strengthens collaboration and information-sharing by providing access to sensitive but unclassified information and various state-of-the-art communications services and tools. It is available around the clock and is offered free of charge to members of the criminal justice and intelligence communities, as well as military and government agencies associated with infrastructure protection in the United States.

Regional Information Sharing Systems Program (RISS)

Also established prior to the 9/11 attacks, RISS is a national network of six multistate centers designed to operate on a regional basis. It is federally funded and administered by DOJ's Bureau of Justice Assistance (BJA). RISS supports law enforcement efforts nationwide to combat illegal drug trafficking, identity theft, human trafficking, violent crime, and terrorist activity, and to promote officer safety. The regional centers provide member law enforcement agencies with a broad range of intelligence exchange and related investigative support services. RISS operates a secure intranet, known as RISSNET™, to facilitate law enforcement communications and information sharing nationwide.

Homeland Security Information Network (HSIN)

After the 9/11 attacks, DHS established the HSIN, a secured, Web-based platform for sensitive but unclassified information sharing and collaboration between federal, state, local, tribal, private sector, and international partners. The HSIN platform was created to interface with existing information-sharing networks to support the diverse communities of interest engaged in preventing, protecting from, responding to, and recovering from all threats, hazards, and incidents under the jurisdiction of DHS. There are five community of interest portals on HSIN: Emergency Management, Critical Sectors, Law Enforcement, Multi-Mission Agencies, and Intelligence and Analysis. HSIN provides real-time, interactive connectivity between states and major urban areas and the 24/7 DHS operations center—the National Operations Center (NOC).

The HSIN-Intelligence portal provides state, local, and tribal officials with access to unclassified intelligence products. Classified intelligence products are provided to state and local fusion centers that have the appropriate security infrastructure through the Homeland Security Data Network (HSDN). Through HSDN, users can access collateral Secret-level terrorism-related information including products from the National Counterterrorism Center's (NCTC) NCTC Online .

Law Enforcement Information Sharing Program (LEISP)

After 9/11, DOJ initiated the LEISP to foster the sharing of information across jurisdictional boundaries to prevent terrorism and to systematically improve the investigation and prosecution of criminal activity. Two significant systems under the LEISP are described below:

OneDOJ System

This system is a repository of data from DOJ law enforcement components (Bureau of Alcohol, Tobacco, Firearms, and Explosives; Bureau of Prisons; Drug Enforcement Administration; FBI; and the U.S. Marshals Service) that enables the sharing of investigative information within the department. It is hosted at the FBI's Criminal Justice Information Services (CJIS) data center. External sharing is accomplished through bilateral partnerships with designated regional, state, or federal sharing initiatives. These partnerships allow non-DOJ users to access OneDOJ data from within their own systems and vice-versa. However, data are not contributed by external partners to the OneDOJ system.

Law Enforcement National Data Exchange (N-DEx)

N-DEx is intended to facilitate the sharing of information across jurisdictional boundaries and to provide new investigative tools that enhance the nation's ability to fight crime and terrorism. Its proposed services and capabilities would allow participating agencies to detect relationships between people, places, things, and crime characteristics; to link information across jurisdictions; and to "connect the dots" between apparently unrelated data without causing information overload.

FBI Terrorist Threat Information Tracking Systems

After 9/11, the FBI established two programs for the tracking, analysis, and sharing of information about terrorism threats:

Guardian

Guardian is described as a classified information technology system that allows the FBI to collect and review reports of suspicious activity in an organized way to determine which ones warrant additional investigative follow-up. The primary purpose is not to manage cases, but to facilitate the reporting, tracking, and management of threats to determine within a short time span whether a particular matter should be closed or referred for an investigation. Guardian's database can be searched by FBI employees and certain other government agency partners thus providing a capability to analyze threat information for trends and patterns.

eGuardian

A companion system to Guardian is eGuardian . It is an unclassified system designed to enable near real-time sharing and tracking of terrorist information and suspicious activity with federal, state, local, and tribal agencies. Unclassified information from the Guardian system that appears to have a potential nexus to terrorism is to be passed down to eGuardian , where it will be available for viewing by those members of state, local, and tribal law enforcement and representatives of other federal law enforcement agencies that have been given permission to access the system. It is also intended to serve as the mechanism for the electronic transmittal of leads by state, local, and tribal agencies to the JTTF's. FBI has made eGuardian available on its secure LEO Internet portal, allowing more than 18,000 agencies to run searches and input their own reports.

Appendix B. Acronyms Used in This Report