The Federal Bureau of Investigation and Terrorism Investigations
Released: 2014-02-19T00:00:00

Introduction

The Federal Bureau of Investigation (FBI, the Bureau) is the lead agency for investigating the federal crime of terrorism, which is defined under law as "an offense that is calculated to influence or affect the conduct of government by intimidation or coercion, or to retaliate against government conduct." This includes terrorist acts committed within and outside U.S. national boundaries. This report provides background on some of the key elements of the FBI terrorism investigative process based on publicly available information.

The September 11, 2001 (9/11) terrorist attacks have been called a major security, law enforcement, and intelligence failure. Prior to 9/11, the FBI was largely a reactive law enforcement agency—pursuing suspects after they had allegedly committed crimes. Since 9/11, the Bureau has arguably taken a much more proactive posture, particularly regarding counterterrorism. It now views its role as both "predicting and preventing" the threats facing the nation, drawing upon enhanced resources. A few basic measures suggest this:

Post-9/11 legislation—notably the USA PATRIOT Act ( P.L. 107-56 )—dismantled "the Wall" between intelligence and criminal investigation and expanded the U.S. government's ability to monitor terrorist suspects, among other changes. Changes in the Attorney General's Guidelines for Domestic FBI Operations and the FBI Domestic Investigations and Operations Guidelines give the FBI more leeway to engage in proactive investigative work that does not depend on criminal predication (i.e., a nexus to past or future criminal activity). Since 9/11, a widening of the Bureau's counterterrorism operations has occurred as well as closer liaison with agencies outside the Department of Justice (DOJ). This is most evident domestically in the increased number of its Joint Terrorism Task Forces (JTTF). These are multi-agency investigative units led by DOJ and the FBI and are designed to combine the resources of federal, state, and local law enforcement. They are locally based and comprised of investigators, analysts, linguists, Special Weapons and Tactics (SWAT) experts, and other specialists from dozens of U.S. law enforcement and intelligence agencies. In 1999, there were 26 JTTFs throughout the United States. As of January 2014, there were over 100. Evidence of growth within the FBI's counterterrorism operations can also be seen in the Bureau's increased allocation of agents to terrorism matters. In April 2011 testimony to Congress, then FBI Director Robert Mueller "estimated that before 9/11, there were 10,000 FBI agents on the streets, with 30 percent engaged in national security issues and the rest focused on criminal activity. Since then, Mueller said, he has gained 4,000 more agents and the FBI's focus is a 50-50 split between terrorism and other criminal activity like mortgage fraud." To further its proactive intelligence-driven counterterrorism mission, the FBI established a National Security Branch (NSB) and a Directorate of Intelligence (DI) within the NSB. Moreover, the FBI has reportedly increased its intelligence analyst workforce from approximately 1,100 in October 2001 to more than 3,000 by September 2011.

Enhanced Investigative Authorities, Tools, and Capabilities

The FBI is an intelligence agency as well as a law enforcement agency. Since 9/11, the Bureau has taken what it describes as a more forward-leaning, intelligence-driven posture in its terrorism investigations in order to prevent or disrupt terrorist acts, not merely investigate them after they have occurred. Shortly after the attacks, the FBI Director wrote a memo to Special Agents in Charge of FBI Field Offices saying, "while every office will have different crime problems that will require varying levels of resources, the FBI has just one set of priorities: Stop the next attack ." Then-Deputy Attorney General Paul McNulty described the DOJ's aggressive, proactive, and preventative approach as

the only acceptable response from a department of government charged with enforcing our laws and protecting the American people. Awaiting an attack is not an option. That is why the Department of Justice is doing everything in its power to identify risks to our Nation's security at the earliest stage possible and to respond with forward-leaning – preventative – prosecutions.

The FBI's post-9/11 transformation is particularly evident in four areas: The USA PATRIOT Act provided the FBI additional authorities and enhanced investigative tools. The FBI and DOJ altered the way the Bureau investigated terrorism with the 2008 revision of The Attorney General's Guidelines for Domestic FBI Operations . The FBI expanded operationally via a proliferation of JTTFs across the United States. In so doing, it also increased its cooperation with state, local, and federal agencies. Finally, watershed changes were made in the Bureau's intelligence program.

USA PATRIOT Act

Shortly after the 9/11 attacks, Congress provided the FBI with several additional investigative tools and expanded its authority to monitor and search suspects in terrorism-related and other investigations. Many of these tools and authorities were contained in the USA PATRIOT Act ( P.L. 107-56 ) signed by President George W. Bush on October 26, 2001. The act amended several existing statutes, such as the Foreign Intelligence Surveillance Act (FISA) of 1978 ( P.L. 95-511 ), the Electronic Communications Privacy Act of 1986 ( P.L. 99-508 ), and the various National Security Letter (NSL) statutes. Additional tools and authorities include

dismantling "the Wall" that inhibited the sharing of information between intelligence and criminal investigators, roving wiretaps, expanded use of devices that record the sources of incoming and outgoing communications, "Sneak and Peek" search warrants, increased access to business records, and expanded use of National Security Letters.

Dismantling "the Wall" Between Intelligence and Criminal Investigations

Historically, there have been differences between electronic surveillance (wiretaps) conducted for intelligence and for law enforcement purposes. Among these is the protection of the constitutional rights of persons under criminal investigation. A former government official describes the differences:

Law enforcement wiretaps are heavily regulated … they can only be carried out for a limited time. They require constant supervision and review…. They are approved for only specific types of crime…. And once a crime begins the defendant can see transcripts of the wiretaps and challenge their legality…. Intelligence wiretaps are different … they aren't triggered by suspected criminal activity. Any representative of a foreign government is fair game for an intelligence tap. The rules that apply to law enforcement taps just aren't appropriate for intelligence wiretaps.

FISA regulates intelligence collection directed at foreign powers and agents of foreign powers in the United States to include those engaged in international terrorism. FISA required the government to certify that "the purpose" of surveillance was to gather foreign intelligence information. Prior to the USA PATRIOT Act, DOJ turned the "primary purpose" standard into written policy that had the effect of limiting the coordination between intelligence and criminal investigators. This came to be known as "the Wall" between intelligence and law enforcement and the "unfortunate consequences" of this barrier to information sharing were noted by the 9/11 Commission in its report on the 9/11 attacks.

Section 218 of the USA PATRIOT Act amended FISA to replace the phrase "the purpose" with the phrase "a significant purpose." According to Senator Dianne Feinstein, these changes were necessary to make it

easier to collect foreign intelligence information under … FISA. Under current law, authorities can proceed with surveillance under FISA only if the primary purpose of the investigation is to collect foreign intelligence. But in today's world things are not so simple. In many cases, surveillance will have two key goals—the gathering of foreign intelligence, and the gathering of evidence for a criminal prosecution. Determining which purpose is the "primary" purpose of the investigation can be difficult, and will only become more so as we coordinate our intelligence and law enforcement efforts in the war against terror.

As one legal scholar described it, by moving the FISA requirement from the purpose to a significant purpose , the USA PATRIOT Act "knocked out the foundation for 'the Wall.'" This removed impediments to the exchange of information about terrorism or other national security threats between intelligence and law enforcement personnel.

Other provisions of the USA PATRIOT Act also sought to increase intelligence information sharing. Section 504 amended FISA by adding provisions allowing federal officers who conduct electronic surveillance to acquire foreign intelligence information to consult with federal law enforcement officers to coordinate efforts to investigate or protect against (among other issues) sabotage or international terrorism by a foreign power or an agent of a foreign power. And Section 203 amended the Federal Rules of Criminal Procedure to allow disclosure of grand jury information in certain circumstances, including if that information is related to sabotage or international terrorism by a foreign power or an agent of a foreign power.

Roving Wiretaps

Federal law enforcement officers have the authority, subject to court approval, to conduct wiretaps and electronic surveillance on persons suspected of committing federal crimes. A "roving" wiretap allows law enforcement officers to "follow" a subject and lawfully intercept that person's communications with a single court order even if the target attempts to evade surveillance by changing telephones or other communications devices. According to an Assistant U.S. Attorney, "Prior to roving wiretaps, law enforcement agents and federal prosecutors had to invest substantial time and resources in obtaining a separate wiretap order for each additional telephone used by a subject during an investigation … [Q]uite often this resulted in a loss of valuable evidence through missed wiretap conversations relating to the criminal activity being monitored."

Before the USA PATRIOT Act, the concept behind roving wiretaps did not apply to FISA. The USA PATRIOT Act amended the electronic surveillance portion of FISA to allow government agents to continue surveillance when "the target of the surveillance switches from a facility (e.g., a telephone) associated with one service provider (e.g., a telephone company) to a different facility associated with a different provider."

Expanded Use of Devices that Record the Sources of Incoming and Outgoing Communications

A trap and trace device shows all incoming phone numbers to a particular telephone. A pen register shows all outgoing phone numbers a particular telephone has called. Prior to 2001, FISA allowed law enforcement officers to collect incoming and outgoing numbers on a telephone line. The USA PATRIOT Act expanded the law to permit the capture of comparable information related to other forms of communication including the Internet, electronic mail, web surfing, and all other forms of electronic communications.

"Sneak and Peek" Search Warrants

In general, police officers serving a warrant must "knock and announce"—that is, give the subject notice that they are the police and are serving a warrant. They may enter and search even if the subject is not present at the premises to be searched, but they must leave a copy of the warrant and an inventory of what was seized, giving notice that the premises was searched.

The USA PATRIOT Act amended Title 18 to allow federal law enforcement officers to request from the courts a delayed-notice (so-called "sneak and peek") search warrant allowing officers to enter and search a premises without immediately notifying the owner when such notice may have an adverse result (e.g., tipping off a suspect or co-conspirators). This authority has been used rarely in terrorism cases.

Increased Access to Business Records

The USA PATRIOT Act amended FISA to authorize the FBI to seek an order from the FISA Court for the production of any tangible things (including books, records, papers, documents, and other items) in a terrorism or counterintelligence investigation provided that such investigation of a United States person is not conducted solely upon the basis of activities protected by the First Amendment.

National Security Letters

National Security Letters (NSLs) are regularly used in FBI counterterrorism investigations and are roughly comparable to administrative subpoenas. They have been described as "form letters signed by an FBI agent" used to request and collect non-content consumer records and related information from "telephone companies, Internet service providers, consumer credit reporting agencies, banks, and other financial institutions." The FBI has described NSLs as "indispensable investigative tools that serve as building blocks in many counterterrorism and counterintelligence investigations." FBI Director James Comey reiterated the importance of NSLs for FBI investigations in 2014. In 2012, the FBI made 15,299 NSL requests. These requests asked for information related to 6,223 individuals.

NSLs predate the USA PATRIOT Act, but the act increased their use by the FBI. For one thing, the USA PATRIOT Act allowed the FBI to issue NSLs for full consumer credit reports. Additionally, it widened the number of FBI officials who could issue NSLs. It also expanded the circumstances under which the letters could be issued by eliminating requirements that NSLs contain specific and articulable facts demonstrating a nexus to a foreign power or its agents. Currently, the information sought via an NSL "must only be relevant to protecting against international terrorism or clandestine intelligence activities." However, an NSL-related investigation of an American citizen or legal permanent resident cannot be based solely on First Amendment-protected activities.

The implementation of the post-USA PATRIOT Act NSL regimen at the FBI has not been seamless. For example, the unease that some telecommunications companies had with NSLs as well as revelations made by Edward Snowden regarding foreign intelligence gathering by the National Security Agency (NSA) have spurred changes. In March 2013, in a suit involving a telecommunications company, a federal judge ruled that the federal government must stop using NSLs, because, among other things, the indefinite nondisclosure orders that are part of most NSLs "significantly infringe on speech regarding controversial government powers." The judge also mandated that the federal government had to stop enforcing the nondisclosure orders already in place with existing NSLs. The nondisclosure agreements—applied in 97% of NSLs—are "strict secrecy orders, barring the recipient from acknowledging the case to anyone but attorneys." The judge stayed the order for 90 days so the federal government could appeal it.

Snowden's actions have also likely pushed the Obama Administration to alter some NSL procedures. Snowden, a former contractor at the NSA, reportedly illegally accessed and removed from the NSA top secret documents about sensitive U.S. intelligence collection efforts. These documents have been publicly released via a number of press outlets. Disclosure of this information began in June 2013. In January 2014, President Obama delivered a speech focused on U.S. intelligence surveillance programs. Among changes suggested in his comments, the President indicated a loosening of the nondisclosure stipulations, and soon after the speech, communications providers were allowed to publish some information about the volume of FISA court orders they receive. This change may seem incremental when compared to suggestions made in a December 2013 report to President Obama on intelligence and communications technologies, which was developed in response to Snowden's disclosures. While the report did suggest relaxing nondisclosure in the NSL process, among other things, it also recommended prior judicial review of NSL orders.

Other NSL-related issues have cropped up in the years after 9/11. In 2007 the DOJ Inspector General initially reported that "the FBI used NSLs in violation of applicable NSL statutes, the Attorney General Guidelines, and internal FBI policies," although no evidence was found of criminal misconduct. In a subsequent report in 2008, the Inspector General concluded that DOJ and the FBI "have made significant progress in addressing the need to improve compliance in the FBI's use," but "it is too early to definitively state whether the new systems and controls developed by the FBI and the Department will eliminate fully the problems with NSLs that we identified."

Moreover, between 2003 and 2006 some FBI personnel circumvented the NSL process, using crisis conditions as a justification. Namely, in that time period one FBI headquarters unit issued 722 "exigent letters" to obtain telephone toll records for approximately 4,400 telephone numbers in lieu of NSLs. The unit included representatives from three communications service providers. These representatives typically received the exigent letters from FBI employees working alongside them. None of the 722 exigent letters actually described the specific crises that supposedly made them necessary, and in some cases there were no emergencies. The FBI General Counsel at the time, Valerie E. Caproni, stated in congressional testimony that the exigent letters were

borne out of a misunderstanding of the import of the USA PATRIOT Act's amendments to ECPA [Electronic Communications Privacy Act (18 U.S.C. § 2709)]. For reasons lost in the fog of history—but no doubt partially the result of the intense pace of activity in the months following the 9/11 attacks—the FBI did not adequately educate our workforce that Congress had provided clear mechanisms to obtain records in emergency situations. Although guidance was eventually provided in August 2005, the employees who had been using exigent letters for several years simply did not recognize the applicability of that guidance to their situation.

In March 2007, the FBI ended the use of exigent letters. Regardless, they have played into congressional debate regarding the extension of key provisions within the PATRIOT Act.

Debate over Civil Liberties Issues

When the USA PATRIOT Act was signed into law, then-Attorney General John Ashcroft said

Law enforcement is now empowered with new tools and resources necessary to disrupt, weaken, and eliminate the infrastructure of terrorist organizations, to prevent or thwart terrorist attacks, and to punish the perpetrators of terrorist acts.... The American people can be assured law enforcement will use these new tools to protect our nation while upholding the sacred liberties expressed in the Constitution.

And the FBI Director testified to Congress that "the USA PATRIOT Act has changed the way the FBI operates. Many of our counterterrorism successes are the direct result of the provisions of the Act."

But others were concerned about the constitutional implications of the USA PATRIOT Act. Law Professor Susan Herman notes that four of the provisions described above "exemplify several different ways in which the USA PATRIOT Act allow the executive branch to deviate from the presumptive Fourth Amendment model requiring: (1) some form of individualized suspicion (presumptively probable cause), (2) antecedent judicial review where feasible, and (3) notice of any search."

After passage of the act, the Electronic Freedom Foundation worried that "the civil liberties of ordinary Americans have taken a tremendous blow with this law, especially the right to privacy in our online communications and activities." The Rutherford Institute argued that while the USA PATRIOT Act "may not have been designed to restrict American citizens' civil liberties, its unintended consequences threaten the fundamental constitutional rights of people who have absolutely no involvement with terrorism." And the American Civil Liberties Union (ACLU) charges that "the mammoth USA PATRIOT Act expanded government powers in ways that will diminish liberty for years to come." They specifically note that the wiretapping and intelligence provisions of the act "minimize the role of a judge in ensuring that law enforcement wiretapping is conducted legally and with proper justification, and they permit use of intelligence investigative authority to by-pass normal criminal procedures that protect privacy."

In 2005, debate over the USA PATRIOT Act resumed when Congress deliberated extension of certain provisions of the act that were scheduled to expire (sunset). Eventually, Congress passed, and on March 9, 2006, President George W. Bush signed into law, an extension of several of the USA PATRIOT Act provisions that provided the FBI with additional authorities. In its legislation, Congress added new civil liberties protections. For example, in the case of requests to the FISA Court for an order to obtain business records, government agents are now required to present the court with data proving how the evidence sought will apply to the relevant investigation. The reauthorizing legislation also afforded greater protections for library, medical, and educational records and provides the party forced to disclose the business information the right to seek the advice of an attorney.

In 2011, Congress again considered the extension of three expiring amendments to FISA. Two of these were enacted as part of the USA PATRIOT Act—the "roving wiretap" and "business records" provisions. The third amendment was enacted in 2004 as part of the Intelligence Reform and Terrorism Prevention Act ( P.L. 108-458 ). Known as the "lone wolf" provision, it permits surveillance of non-U.S. persons engaged in, or preparing to engage in, international terrorism without requiring evidence linking those persons to an identifiable foreign power or terrorist organization.

In arguing for extension of these provisions before the House of Representatives, law professor Nathan Sales testified that "they simply let counterintelligence agents use some of the same techniques that ordinary criminal investigators have been using for decades – techniques that federal courts repeatedly have upheld." At the same hearing, then Acting Assistant Attorney General Todd Hinnen added, "Robust substantive standards and procedural protections are in place to ensure that these tools are used responsibly and in a manner that safeguards Americans' privacy and civil liberties."

Congress passed legislation, S. 990 , to extend the provisions until June 1, 2015, and President Barack H. Obama signed the legislation ( P.L. 112-14 ) on May 26, 2011.

Revised Attorney General Guidelines

The FBI and DOJ also emphasized their forward-leaning approach with the September 29, 2008, revision of the Attorney General's Guidelines for Domestic FBI Operations , which they claim "make the FBI's operations in the United States more effective by providing simpler, clearer, and more uniform standards and procedures." Referred to as the "Mukasey Guidelines" after Michael B. Mukasey, who was Attorney General at the time of their release, this is the latest in a series of guidelines stretching back to 1976 that govern the FBI's investigative activities. The Mukasey Guidelines went into effect on December 1, 2008. In large part, these guidelines sprang from the post-9/11 national security context, in which the FBI surmised that it could not simply react to crimes. It had to preemptively search for criminal, counterintelligence, and terrorist threats to the homeland. As the FBI's General Counsel stated in congressional testimony:

We believe that this will allow the FBI to take additional necessary steps to becoming a more proactive organization. One of the key issues that we think the FBI needs to be able to do is assess potential risks and vulnerabilities. Having these additional techniques available at the assessment level, we think, will be key to the FBI's ability to efficiently and effectively answer those questions and assess risks.

The 2008 revision to the guidelines represents a consolidation of several other previously stand-alone documents that had governed FBI investigations. The 2008 Domestic Investigations and Operations Guide (DIOG)—the FBI's document governing the Bureau's implementation of the Mukasey Guidelines, which the FBI modified in 2011—reflects these changes as well.

The most prominent changes in the Mukasey Guidelines and the DIOG concern "assessments." Agents and analysts may now use assessments outside of the more traditional preliminary and full investigations, which require some level of factual predication. Preliminary investigations can be opened with "any 'allegation or information' indicative of possible criminal activity or threats to the national security." Opening a full investigation requires an "'articulable factual basis' of possible criminal or national threat activity." On the other hand, opening an assessment does not require particular factual predication. Instead, assessments are to follow specifically articulated purposes, of which there are five:

Seek information, proactively or in response to investigative leads, relating to activities—or the involvement or role of individuals, groups, or organizations relating to those activities—constituting violations of federal criminal law or threats to the national security;

Identify, obtain, and utilize information about actual or potential national security threats or federal criminal activities, or the vulnerability to such threats or activities;

Obtain and retain information to inform or facilitate intelligence analysis and planning;

Seek information to identify potential human sources, assess their suitability, credibility, or value of individuals as human sources; and

Seek information, proactively or in response to investigative leads, relating to matters of foreign intelligence interest responsive to foreign intelligence requirements.

Assessments are not to be "pursued for frivolous or improper purposes and are not based solely on First Amendment activity or on the race, ethnicity, national origin, or religion of the subject of the assessment, or a combination of only such factors." Assessments offer terrorism investigators a variety of techniques, including public surveillance and the use of confidential informants to penetrate conspiracies.

The Bureau has incorporated assessments into its investigative processes. According to numbers made publicly available in March 2011, the FBI initiated 11,667 assessments to check leads on individuals, activities, groups, or organizations between December 2008 and March 2009. These, in turn, led to 427 preliminary or full investigations. Officials noted that about one-third of the assessments resulted from vague tips. Reportedly, between March 2009 and March 2011, the Bureau opened 82,325 assessments. About half of the assessments from this time frame focused on determining whether specific groups or individuals were spies or terrorists. This pool of 42,888 assessments produced just under 2,000 full or preliminary investigations.

Critics have voiced broad concerns about the Mukasey Guidelines. One detailed study has noted that they "tip the scales too far in favor of relatively unchecked government power, allowing the FBI to sweep too much information about too many innocent people into the government's view. In so doing, they pose significant threats to Americans' civil liberties and risk undermining the very counterterrorism efforts they are meant to further."

According to media reports, Farhad Khera, executive director of the nonprofit Muslim Advocates, has suggested that the Attorney General Guidelines are invasive and based on "generalized suspicion and fear on the part of law enforcement, not on individualized evidence of criminal activity." The ACLU also criticized the large number of assessments the FBI appears to be initiating. A policy counsel with the civil liberties group noted that the large number of assessments that did not lead to preliminary or full investigations are "against completely innocent people that are now bound up within the FBI's intelligence system forever." The FBI's General Counsel viewed the numbers from a more proactive investigative posture: "Recognize that the FBI's policy—that I think the American people would support—is that any terrorism lead has to be followed up."

As written, the guidelines allow for the collection of information about ethnic or racial communities and justify the gathering of such information for proactive purposes. The DIOG states that it should be done if it "will reasonably aid the analysis of potential threats and vulnerabilities, and, overall, assist domain awareness for the purpose of performing intelligence analysis."

Joint Terrorism Task Forces (JTTFs)

JTTFs are locally based, multi-agency teams of investigators, analysts, linguists, SWAT experts, and other specialists who investigate terrorism and terrorism-related crimes. Seventy-one of the more than 100 JTTFs operated by DOJ and the FBI were created since 9/11. Over 4,400 federal, state, and local law enforcement officers and agents—more than four times the pre-9/11 total—work in them. These officers and agents come from more than 600 state and local agencies and 50 federal agencies.

The FBI considers the JTTFs "the nation's front line on terrorism." They "investigate acts of terrorism that affect the U.S., its interests, property and citizens, including those employed by the U.S. and military personnel overseas." As this suggests, their operations are highly tactical and focus on investigations, developing human sources (informants), and gathering intelligence to thwart terrorist plots.

JTTFs also offer an important conduit for the sharing of intelligence developed from FBI-led counterterrorism investigations with outside agencies and state and local law enforcement. To help facilitate this, especially as the threat of homegrown jihadists has emerged, the number of top-secret security clearances issued to local police working on JTTFs has increased from 125 to 878 between 2007 and 2009.

There is also a National JTTF, which was established in July 2002 to serve as a coordinating mechanism with the FBI's partners. Some 40 agencies are now represented in the National JTTF, which has become a focal point for information sharing and the management of large-scale projects that involve multiple partners.

Intelligence Reform

The 9/11 terrorist attacks have been called a major intelligence failure. In response to criticisms of its intelligence capabilities in the aftermath of 9/11, the FBI has introduced a series of reforms intended to transform the Bureau from a largely reactive law enforcement agency focused on criminal investigations into a more proactive, agile, flexible, and intelligence-driven agency that can prevent acts of terrorism.

Robert Mueller, who became the FBI Director just prior to 9/11 and served until September 2013, vowed to assert headquarters' control over the FBI's historically fragmented and much-criticized intelligence program. He signaled his intention to improve the FBI's intelligence program by consolidating and centralizing control over intelligence capabilities, both at FBI Headquarters and in the FBI's largely autonomous field offices. He contended that intelligence had always been one of the FBI's core competencies, organic to the FBI's investigative mission, and he asserted that the organization's intelligence efforts had been and would continue to be disciplined by the intelligence cycle (i.e., the development and conduct of intelligence collection requirements, collection, analysis, and dissemination).

Mueller instituted a number of reforms. He created a new Directorate of Intelligence (DI) at headquarters. He also acted on a recommendation by the Weapons of Mass Destruction Commission and established a National Security Branch at headquarters which integrated the FBI's Counterterrorism and Counterintelligence Divisions with the DI, the Weapons of Mass Destruction Directorate, and the Terrorist Screening Center.

More fundamentally, perhaps, Mueller established Field Intelligence Groups (FIGs), which could be viewed as a cornerstone of his reforms, at each of the FBI's 56 field offices in an effort to improve the Bureau's intelligence capacity by combining its intelligence and investigative capabilities. FIGs are comprised of agents, analysts, linguists, and surveillance specialists. A FIG's principal mission is to identify intelligence gaps, obtain and analyze raw intelligence from FBI investigations and sources, and generate intelligence products and disseminate them to the intelligence and law enforcement communities in order to help guide investigations, programs, and policy. Arguably, the mission of the FIGs is nothing less than to "drive," or inform the direction of, the FBI's counterterrorism effort by identifying, assessing, and attacking emerging threats "before they flourish."

Intelligence Information Reports (IIRs) are a primary component of the FBI's post-9/11 transformation. FIGs disseminate IIRs. These reports are formatted as teletype messages and shared electronically with the law enforcement and intelligence communities. They contain "raw" intelligence—"unevaluated intelligence information, generally from a single source, that has not fully been evaluated, integrated with other information, or interpreted and analyzed." These reports include information "extracted" from FBI case files. The Bureau emphasizes that the information in IIRs must not be "based solely on the exercise of First Amendment protected activities, or on the race, ethnicity, national origin, or religion of the subject." In 2010, the FBI produced over 25,000 IIRs, which included counterintelligence, counterterrorism, and criminal information as well as information related to cyber issues and weapons of mass destruction.

In making intelligence a priority, Mueller also adopted a Strategy Management System, establishing a Strategic Execution Team (SET) to execute organizational changes and to build support and momentum for institutional change across the Bureau. Mueller testified in 2008, "we established Strategic Execution Teams to help us assess our intelligence program, evaluate best practices, decide what works and what does not work, and to standardize it throughout the FBI. The purpose of the SET is to accelerate improvements to our intelligence capabilities, to ensure we are an intelligence-driven organization and to drive a change in mindsets throughout the FBI."

More specifically, the FBI acted on SET recommendations and restructured the FIGs in each of its field offices to conform to one model, based on best practices from the field, and adapted to the size and complexity of each office. As a result, according to Mueller, FIG-Headquarter coordination has improved. In 2008, Mueller told Congress that another result of the single-model standardized FIG approach is that special agents and analysts are now able to transition more easily and quickly from one field office FIG to another.

Reform Initiatives, Still a Work in Progress

According to one expert, as of 2013, the transformation of the FBI into an intelligence-driven agency is still a work in progress:

The FBI still hasn't fully made the transition to an intelligence analytic entity. The Bureau has a long history primarily focused on law enforcement, and the transition to a more intelligence-based organization has been difficult and is still incomplete. A structural, organizational, and cultural shift is needed, and is still underway.

Post-9/11 intelligence reform at the FBI has also been critiqued by the Senate Committee on Homeland Security and Governmental Affairs (HSGAC). Its bipartisan February 2011 report, A Ticking Time Bomb: Counterterrorism Lessons from the U.S. Government's Failure to Prevent the Fort Hood Attack , paints a mixed picture regarding FBI efforts to integrate intelligence with investigative operations. According to the committee's report, which focuses on the counterterrorism lessons derived from the U.S. government's failure to prevent the November 2009 shootings at Fort Hood, there is no question that the FBI has made substantial progress since 9/11 and has achieved many successes in countering terrorism as a result of Mueller's leadership. However, it remains unclear whether the FBI has truly transformed into an "intelligence-driven" organization, meaning that the analysis, production, and exploitation of intelligence is not simply yoked to the process of investigating cases en route to prosecution. In essence, in an intelligence-driven organization, "intelligence is a preeminent objective separate from whether a prosecution occurs."

Perhaps a Question of Culture

Questions persist regarding the place of intelligence in the Bureau's institutional culture. Namely, has the Bureau—particularly its population of agents—embraced the intelligence aspects of its mission? Some observers have doubted this. In 2012, one noted that arrests and criminal convictions remain the standard of success at the FBI, "not the value of intelligence collected and disseminated to its customers." This same commentator has suggested that a fundamental gulf may exist between agents and analysts. Agents favor investigation and arrest over writing and analysis, "a petty chore, best left to others." And FBI agents far outnumber analysts (about 4.5 to 1). In 2013, the FBI employed almost 13,600 agents and likely just above 3,000 analysts. In 2013, another critic argued that a "silent killer" imperils intelligence innovation at the Bureau. This killer is

a century-old law enforcement culture that glorifies catching perps on a street rather than connecting dots behind a desk, that prizes agents above intelligence analysts, and that views job number one as gathering evidence of a past or ongoing crime for a day in court instead of preventing the next attack.

Others have echoed A Ticking Time Bomb's bipartisan assessment. In an April 2011 letter to Attorney General Eric H. Holder and Director of National Intelligence James R. Clapper, Jr., the FBI Intelligence Analysts Association (FBI IAA) criticized the efforts the Bureau has made toward becoming "intelligence-driven." The letter stated that

the Bureau has not yet fully established intelligence analysis as a core mission of the organization. Rather than being a driver of operational activity, intelligence is still typically seen as an enabler to the law enforcement mission. Intelligence is often viewed as an operational asset, an additional tool that can be used much in the same way that technology can be used to help investigate cases. But to be "intelligence-driven" in the FBI cannot mean intelligence should be a surrogate or a component of the law enforcement mission. America's security requires that FBI operations be guided by the best possible assessment of the threat. Intelligence must drive operations by identifying threats and vulnerabilities based on our nation's criminal and national security concerns.

As late as 2010, the FBI IAA stated that analysts at the FBI continued to be relegated to "support" roles (i.e., they react to direction from special agents rather than being full partners in an intelligence-driven investigative operation). They argued that intelligence analysts should have professional parity with special agents to rapidly reform the FBI's institutional culture. The FBI IAA's indictments of the Bureau's efforts came from insiders working on intelligence matters within the FBI. However, it must be kept in mind that these same individuals publicly lobby on behalf of FBI intelligence analysts.

A Ticking Time Bomb also emphasized that the necessary transformation of the FBI is incomplete, and "we must be impatient for progress." Specifically, the committee cited the Fort Hood shootings as a warning that the FBI's transformation remains a work in progress and that the FBI must accelerate efforts—especially given the growing complexity and diversity of the homegrown terrorist threat. Among its findings, the committee said that the FBI's Hassan inquiry was impeded by division among the Bureau's field offices, insufficient use of intelligence analysis, outdated tradecraft, and poor coordination within the JTTFs and between the JTTFs and headquarters. As a counterpoint, the HSGAC report cited the case of the terrorist plot by Najibullah Zazi to attack the New York City subway system in September 2009 as an FBI success, noting that the coordination across federal, state, and local departments, led by two JTTFs, was excellent and unprecedented.

In the wake of the Fort Hood shooting, the Bureau developed its "Fusion Cell Concept," to combine intelligence and investigative activities. In the Bureau's Counterterrorism Division, the concept appears to feature intelligence as a component of the law enforcement mission by blending interagency information sharing with targeting. As described by a senior FBI counterterrorism official, the Fusion Cell Concept "take[s] a target-centric [emphasis added] approach to the threat by combining FBI and Intelligence Community tactical analysis, strategic analysis, and operational capabilities to identify and mitigate the priority threats." The FBI uses "intelligence generated from these Fusion Cells to strategically select targets posing the greatest threat." The FBI's public rhetoric about "Fusion Cells" stresses proactivity, but it remains unclear how this substantially differs from the type of work that is supposed to occur in task force settings such as JTTFs. It is also unclear whether this effort at "fusion" involves a true blending of intelligence and investigative efforts. In the processes involved, does intelligence drive investigations or vice versa?

It appears that these recent changes as well as the overall culture of the Bureau may receive high-level scrutiny. In P.L. 113-6 and P.L. 113-76 , Congress required a review of "the implementation of the recommendations related to the Federal Bureau of Investigation that were proposed in the report issued by the National Commission on Terrorist Attacks upon the United States [the 9/11 commission]." In January 2014, three members of the commission charged with conducting the review were named. This review will likely examine the state of intelligence analysis and its place in the Bureau's culture, particularly because of one of the 9/11 Commission's recommendations:

A specialized and integrated national security workforce should be established at the FBI consisting of agents, analysts, linguists, and surveillance specialists who are recruited, trained, rewarded, and retained to ensure the development of an institutional culture imbued with a deep expertise in intelligence and national security.

Terrorism Prevention and Proactive Investigations

One observer has described intelligence gathering by the FBI in the post-9/11 context as "driven by a theory of preventive policing: in order to anticipate the next terror attack, authorities need to track legal activities…. It focuses not on crime, but on the possibility that a crime might be committed at some future date." This preventative stance can be seen in a domestic intelligence-gathering operation related to events in Libya leading to the fall of Muammar al Qadhafi. In 2011, the FBI interviewed more than 800 Libyans residing in the United States to determine if there was any threat of terror attacks against American targets because of U.S. military action in Libya.

This proactive posture also involves challenges for the Bureau—especially in determining when individuals move from radical activity involving First Amendment-protected behavior to violent extremism. Because not all terrorist suspects follow a single radicalization roadmap on their way to executing plots, U.S. law enforcement also faces the task of discerning exactly when radicalized individuals become real threats.

As suggested, timing is everything. To preemptively stop terrorists, law enforcement requires accurate and timely intelligence. The FBI generates terrorism cases from a number of sources. Information about terrorist threats or suspicious incidents is brought to the attention of the FBI by the public; other government agencies (particularly those in the intelligence community); state and local law enforcement; ongoing FBI investigations (including sources, surveillance, financial analysis, and tactical analysis); and FBI Legal Attachés stationed abroad. Most FBI investigations develop from information or leads generated by pre-existing FBI investigations, or casework and liaison with other federal agencies or international counterparts. A handful of leads stem from information generated by local or state law enforcement and filtered up to the FBI via intelligence fusion centers.

To counter violent plots, U.S. law enforcement has employed two tactics that have been described by one scholar as the "Al Capone" approach and the use of "agent provocateurs." The Capone approach involves apprehending individuals linked to terrorist plots on lesser, non-terrorism-related offenses such as immigration violations. In agent provocateur cases—often called sting operations—government undercover operatives befriend suspects and offer to facilitate their activities. As the "Al Capone" moniker suggests, historically these tactics have been employed against many types of targets such as mafia bosses, white-collar criminals, and corrupt public servants. While these techniques combined with the cultivation of informants as well as surveillance (especially in and around mosques) may be effective in stymieing rapidly developing terrorist plots, their use has fostered concern within U.S. Muslim communities.

The Capone Approach

As mentioned, the Capone approach involves apprehending individuals linked to terrorist plots on lesser, non-terrorism-related offenses such as immigration violations. This approach fits within a preventative mode of counterterrorism prosecution. Experts have noted that immediately after 9/11, DOJ often leveled lesser charges against terrorist suspects to preemptively squelch potential attacks. The author of a 2011 book about the FBI and counterterrorism reported, "of the 417 terrorism indictments in the five years after 9/11 … only 143 of the individuals were actually indicted on specific terrorism charges; the rest were the result of what then-Attorney General Ashcroft called the 'spitting-on-the-sidewalks' approach: driver's license fraud, marriage fraud, wire fraud, immigration violations, and the myriad of other lesser charges that served to disrupt potential plots and get suspects off the streets."

However, according to the Center on Law and Security at New York University School of Law, DOJ has moved toward trying suspected terrorists as terrorists instead of leaning heavily on lesser charges: "77% of cases [between September 11, 2009, and September 11, 2010] carried terrorism or national security charges, an increase of nearly 50% compared to the average over the previous eight years." Regardless, the Capone approach is still used in terrorism cases.

Lying to an FBI Special Agent is a charge reminiscent of the Capone approach. An example from 2010 stands out. On July 21, 2010, Paul Rockwood, Jr., a U.S. citizen and Muslim convert, pled guilty to making false statements to the FBI. Rockwood's wife, Nadia Rockwood, also pled guilty to making false statements related to her husband's case. By early 2010, while living in King Salmon, AK, Paul Rockwood had developed a list of 15 people he planned to kill, believing that they had desecrated Islam. He had also researched explosives and shared with others ideas about mail bombs or using firearms to kill his targets. It appears that prosecutors did not pursue a case based on more substantive terrorism charges and opted to neutralize a threat—someone apparently preparing to kill people—by using a false statement charge.

Lesser charges against a suspect in a terrorism case may also act as a placeholder until evidence to support a more serious charge is gathered. The utility of this preventative technique coupled with actual terrorism charges was exhibited by the FBI in its case against Najibullah Zazi. He arrived in New York on September 10, 2009, with explosive material and plans to detonate bombs in New York's subway system. Zazi feared authorities had caught up with him and returned to Denver on September 12. Between September 10 and 19, the FBI monitored his activities and bolstered its case with searches of a vehicle and locations linked to him in New York and Denver. Zazi also agreed to interviews with the FBI in Denver. Then, on September 19 FBI special agents arrested Zazi in Aurora, CO, for knowingly and willfully lying to the FBI. Presumably this was done because he might flee. Four days later, a grand jury returned a more substantive one-count indictment against him on weapons of mass destruction charges.

Agent Provocateur Cases

Agent provocateur cases—sting operations—rely on expert determination by law enforcement that a specific individual or group is likely to move beyond radicalized talk and engage in violence or terrorist plotting. The ultimate goal is to catch a suspect committing an overt criminal act such as pulling the proverbial trigger but on a dud weapon. By engaging in such strategy, investigators hope to obtain ironclad evidence against suspects. Although an official count of terrorist sting operations is not publicly available, the FBI has said that of all the terrorist plots disrupted between 9/11 and the September 2009 Zazi plot to bomb the New York City subway, only two plotters were "prepared to move ahead with their plots without the benefit or knowledge of government informants or U.S. officials." From 2009 through early 2011, according to the Center for Law and Security at the New York University School of Law, the FBI had arrested 41 people on terrorism charges through sting operations.

An FBI investigation exemplifies this approach. On November 26, 2010, Mohamed Osman Mohamud was arrested after he attempted to set off what he believed was a vehicle bomb at an annual Christmas tree lighting ceremony in Portland, OR. Mohamud thought he had plotted with terrorists to detonate the bomb. In actuality, the device was a dud assembled by his co-conspirators, who were FBI undercover operatives. Mohamud offered the target for the strike, provided components for assembly of the device, gave instructions for the operation, and mailed passport photographs for his getaway plan to FBI undercover operatives. What specifically caused the FBI to begin its sting operation against Mohamud is unclear from publicly available sources. At some point, someone from the local Muslim community alerted the FBI to Mohamud, a 19-year-old Somali-born naturalized U.S. citizen. Media reports have suggested that a family member, perhaps Mohamud's father, relayed concerns about the young man to officials.

In a number of FBI terrorism sting operations, defense attorneys have alleged that the FBI had entrapped defendants. Ten defendants charged with terrorism-related crimes formally argued the entrapment defense in six trials between 9/11 and early December 2011. However, since 9/11 this defense has been unsuccessful in federal courts. Former FBI Director Mueller and Attorney General Holder have described the use of sting operations as "essential" to terrorism prevention. Mueller emphasized that the FBI is careful in its undercover investigative work, arguing that the Bureau performs "substantial oversight" of the techniques used in these cases.

In at least some investigations, FBI undercover employees test suspects to ascertain the depth of their intent to do harm. For example, the FBI evaluated Mohamud's resolve on a number of occasions. Two stand out. Mohamud's first meeting with an undercover FBI operative entailed a discussion in which the would-be violent jihadist was told that he could help "the cause" in "a number of ways … ranging from simply praying five times a day to becoming a martyr." The young man responded, saying that he wanted to become "operational" and needed help in staging an attack. When Mohamud suggested the Christmas tree lighting ceremony as his intended target in a following meeting, an FBI undercover employee noted that children attend such events. Mohamud responded by saying that he wanted a large crowd "that will … be attacked in their own element with their families celebrating the holidays."

Balancing Civil Liberties against Terrorism Prevention

As discussed, the FBI's DIOG articulates a need to proactively gather intelligence in counterterrorism investigations and establishes the assessment as a technique to do so. Balancing civil liberties against the need for preventative policing to combat terrorism is a key policy challenge. The notion of balancing civil liberties against security requirements is not new. In 1976, the United States Senate Select Committee to Study Governmental Operations with Respect to Intelligence Activities (commonly referred to as the Church Committee after its chair, Senator Frank Church) noted as much in its investigation of domestic intelligence abuses:

A tension between order and liberty is inevitable in any society. A Government must protect its citizens from those bent on engaging in violence and criminal behavior, or in espionage and other hostile foreign intelligence activity.… Intelligence work has, at times, successfully prevented dangerous and abhorrent acts, such as bombings and foreign spying, and aided in the prosecution of those responsible for such acts.

But intelligence activity in the past decades has, all too often, exceeded the restraints on the exercise of governmental power that are imposed by our country's Constitution, laws, and traditions.

Figure 1 suggests how competing elements influence the balance between civil liberties and security—largely defined today in terms of terrorism prevention efforts. As a historical example, the FBI had developed intrusive domestic intelligence collection measures and counter-radical operations stretching from the late 1930s through the 1960s. Of course, the focus of the FBI's efforts in this period was not counterterrorism. These decades featured domestic security concerns during World War II and fears of espionage and communist infiltration of American institutions during the Cold War. The FBI worked to prevent this activity. For much of this period, a national consensus suggested that serious threats were posed by foreign agents, revolutionaries, or outside agitators operating in the United States. Within this context, the FBI had broad authority for investigation of and intelligence collection regarding domestic subversive activity from Presidents Harry S. Truman and Dwight D. Eisenhower and Attorney General Robert F. Kennedy. The Bureau developed a number of programs to combat what it saw as internal threats.

During this period, the FBI engaged in what can be described as preventive, covert, intelligence-based efforts to target and contain people, groups, or movements suspected by the Bureau to be '"rabble rousers,' 'agitators,' 'key activists,' or 'key black extremists.'" A hallmark was the FBI's Counterintelligence Program (COINTELPRO), which lasted from 1956 to 1971. Subjects investigated by the FBI under its domestic intelligence programs did not have to be suspected of criminal activity. Instead of bringing criminal cases to court, the Bureau acted outside of legal processes and relied on illegal means to curb constitutionally protected activity it deemed threatening to national security.

By the 1970s, as Cold War fears ebbed, the balance between civil liberties and prevention tipped in the other direction—favoring concerns over civil liberties. This is highlighted by the development of the original set of Attorney General guidelines. Issued in 1976 and known as the Domestic Security Investigation Guidelines , these responded to FBI abuses embodied in programs such as COINTELPRO. These first guidelines were intended to prevent the FBI's monitoring of groups that had unpopular or controversial public views and greatly circumscribed the Bureau's domestic intelligence gathering capabilities and investigations related to national security-related issues.

Since the 1976 guidelines, and especially after 9/11, the balance has shifted in favor of security and terrorism prevention efforts. As suggested, the Mukasey Guidelines and FBI DIOG offer more investigative flexibility to proactively counter terrorist actors. Critics have stated that subsequent guidelines have excessively loosened the constraints on FBI intelligence collection and investigation. In essence, these critics suggest that concerns over terrorism and security have outweighed fears of systemic abuse by investigators.

Philadelphia Inquirer reporter and author Stephan Salisbury describes post 9/11 efforts at striking this balance as the "bind" the FBI finds itself in. "On one hand it is being charged by the Justice Department to go out and stop this stuff [terrorism] before it happens. But on the other, it is getting criticized for the techniques it is using to do that." The Mukasey Guidelines and FBI DIOG address the same competing forces, and, as mentioned, their implementation has spurred concerns among civil liberties groups.

Considerations for Congress

Since 9/11, the FBI has been given substantially greater resources to enhance its counterterrorism activities—particularly its intelligence operations. The Bureau over the last decade has also introduced a series of reforms intended to transform it from a largely reactive law enforcement agency focused on criminal investigations into a more proactive, agile, flexible, and intelligence-driven organization.

In its oversight role, Congress may wish to examine the extent to which intelligence has been integrated into FBI operations and culture to support its counterterrorism mission and the progress the Bureau has made on its intelligence reform initiatives. Congress may also wish to explore the extent to which the FBI has enhanced its collaboration with the Department of Homeland Security, other federal partners, and state and local law enforcement elements. This is not just an issue of information sharing, but of how the Bureau has institutionalized its collaboration in order to tackle complex threats. Finally, Congress might ask how the FBI uses strategic intelligence to develop a true understanding of security threats and how they are evolving. In other words, has the Bureau developed effective predictive capacity?

FBI intelligence reforms since 9/11 have met with a mixed response. Among its intelligence initiatives since 9/11, the FBI has increased its intelligence focus by creating a Directorate of Intelligence and hiring thousands of new and better-qualified analysts. Another innovation was the establishment of Field Intelligence Groups (FIGs) that are embedded into each of the FBI's 56 field offices. The FBI says that the FIGs are responsible for coordinating, managing, and executing all the functions of the intelligence cycle. In April 2011, then FBI Director Mueller testified that "the FBI recently restructured its FIGs, where each group now has clearly defined requirements for intelligence collection, use, and production. With this new structure, each office can better identify, assess, and attack emerging threats."

Yet, as the bipartisan Senate Homeland Security and Governmental Affairs Committee (HSGAC) investigation into the Fort Hood shootings highlighted, questions remain about the extent to which intelligence has been effectively integrated into FBI investigative operations. According to the Senate HSGAC's report, A Ticking Time Bomb:

In the Hasan case, the FBI did not effectively utilize intelligence analysts who could have provided a different perspective given the evidence that it had. The FBI 's inquiry focused narrowly on whether Hasan was engaged in terrorist activity - as opposed to whether he was radicalizing to violent Islamist extremism and whether this radicalization might pose counterintelligence or other threats (e.g., Hasan might spy for the Taliban if he was deployed to Afghanistan). This critical mistake may have been avoided if intelligence analysts were appropriately engaged in the inquiry.

Congress may wish to examine the extent to which analysts at the FIGs have access to case information about specific Joint Terrorism Task Force (JTTF) investigations and the opportunity to provide relevant intelligence to help steer those investigations. In 2010, the FBI Intelligence Analysts Association stated that analysts at the FBI continues to be relegated to "support" roles (i.e., they react to direction from special agents rather than being full partners in an intelligence-driven investigative operation). They argued that intelligence analysts should have professional parity with special agents to rapidly reform the FBI's institutional culture. The FBI publicly asserts that "intelligence is an integral part of the FBI's investigative mission. It is embedded in the day-to-day work of the FBI, from the initiation of preliminary investigations to the development of FBI-wide investigative strategies." Has the FBI developed a concept of operations that institutionalizes when and how intelligence analysts and intelligence analysis directly influence investigations?

Congress may also wish to explore the extent to which intelligence analysts outside the FIGs, such as those at FBI headquarters, impact specific JTTF investigations and have the opportunity to provide relevant intelligence for those investigations. Uncovering the impact of the Bureau's recent adoption of the "fusion cell" concept for its headquarters intelligence elements may be of interest. According to the Senate HSGAC report:

In the Hasan case, two JTTFs (each located in a different field office) disputed the significance of Hasan's communications with the Suspected Terrorist and how vigorously he should be investigated. The JTTF that was less concerned about Hasan controlled the inquiry and ended it prematurely after an insufficient examination. Two key headquarters units - the Counterterrorism Division, the "National JTTF" (which was created specifically to be the hub among JTTFs), and the Directorate of Intelligence were not made aware of the dispute. This unresolved conflict raises concerns that, despite the more assertive role that FBI headquarters now plays, especially since 9/11 in what historically has been a decentralized organization, field offices still prize and protect their autonomy from headquarters. FBI headquarters also does not have a written plan that articulates the division of labor and hierarchy of command-and-control authorities among its headquarters units, field offices, and the JTTFs.

Finally, the FBI has greatly increased its production of intelligence products. As noted earlier, in 2010 the Bureau produced over 25,000 intelligence reports on counterintelligence, counterterrorism, and criminal topics as well as information related to cyber issues and weapons of mass destruction. It may be of oversight interest to Congress to examine the value of these reports, their accessibility within the intelligence and law enforcement communities, and the views of various consumers about them.