The Department of Homeland Security Intelligence Enterprise: Operational Overview and Oversight Challenges for Congress
Released: 2010-03-19T00:00:00

Introduction

A primary mission of the Department of Homeland Security (DHS, Department) is to "prevent terrorist attacks within the United States, reduce the vulnerability of the United States to terrorism, and minimize the damage, and assist in the recovery from terrorist attacks that do occur in the United States. The current organization of the Department is displayed at Figure 1 .

To support this mission, DHS has had an intelligence component since its inception in 2003. The Homeland Security Act of 2002, assigned the original DHS intelligence component—the Directorate of Information Analysis and Infrastructure Protection—with responsibility to receive, analyze, and integrate law enforcement and intelligence information in order to— "(A) identify and assess the nature and scope of terrorist threats to the homeland; (B) detect and identify threats of terrorism against the United States; and (C) understand such threats in light of actual and potential vulnerabilities of the homeland."

Congress also made information sharing a top priority of the new DHS intelligence organization, requiring it "to disseminate, as appropriate, information analyzed by the Department within the Department, to other agencies of the Federal government with responsibilities related to homeland security, and to agencies of State and local government and private sector entities, with such responsibilities in order to assist in the deterrence, prevention, preemption of, or response to, terrorist attacks against the United States."

Following the release of the 9/11 Commission Report in 2004, which identified a breakdown in information sharing as a key factor contributing to the failure to prevent the September 11, 2001 attacks, Congress underscored the importance it attached to information sharing at all levels of government. The Intelligence Reform and Terrorism Prevention Act of 2004 required the President to "create an information sharing environment for the sharing of terrorism information in a manner consistent with national security and with applicable legal standards relating to privacy and civil liberties," and "to designate an individual as the program manager responsible for information sharing across the Federal Government."

In July 2005, following "a systematic evaluation of the Department's operations, policies and structures" (commonly called the Second Stage Review or "2SR"), former Secretary of Homeland Security, Michael Chertoff, initiated a major reorganization of DHS. In his remarks describing the reorganization, he noted that "…intelligence lies at the heart of everything that we do." In an effort to improve how DHS manages its intelligence and information sharing responsibilities, he established a strengthened Office of Intelligence and Analysis (I&A) and made the Assistant Secretary for Information Analysis (now Under Secretary for Intelligence and Analysis) the Chief Intelligence Officer (CINT) for the Department. He also tasked I&A with ensuring that intelligence is coordinated, fused, and analyzed within the Department to provide a common operational picture; provide a primary connection between DHS and the Intelligence Community (IC) as a whole; and to act as a primary source of information for state, local and private sector partners.

In testimony to a House of Representatives hearing shortly after his selection, the first DHS CINT, stated that "[m]y goal and my role as chief intelligence officer is to see that Homeland Security intelligence, a blend of traditional and nontraditional intelligence that produces unique and actionable insights, takes its place along the other kinds of intelligence as an indispensable tool for securing the nation.

He also set five priorities: Improving the quality of intelligence analysis across the department; integrating the DHS IE; strengthening support to state, local, and tribal authorities and the private sector; ensuring that DHS IE takes its place in the IC; and solidifying the relationship with the Congress; and improving transparency and responsiveness.

Since the 2SR reorganization, Congress imposed additional requirements on DHS through the Implementing Recommendations of the 9/11 Commission Act of 2007:

Integrate information and standardize the format of intelligence products produced within DHS and its components. Establish department-wide procedures for review and analysis of information provided by state, local, tribal, and private sector elements; integrate that information into DHS intelligence products, and disseminate to Federal partners within the Intelligence Community. Evaluate how DHS components are utilizing homeland security information and participating in the Information Sharing Environment. Establish a comprehensive information technology network architecture to connect various DHS elements and promote information sharing. Establish a DHS State, Local, and Regional Fusion Center Initiative to establish partnerships with state, local, and regional fusion centers. Coordinate and oversee the creation of an Interagency Threat Assessment and Coordination Group that will bring state, local, and tribal law enforcement and intelligence analysts "to work in the National Counterterrorism Center (NCTC) with Federal intelligence analysts for the purpose of integrating, analyzing and assisting in the dissemination of federally-coordinated information…."

The DHS IE consists of those elements within DHS that have an intelligence mission. These include I&A, the Homeland Infrastructure Threat and Risk Analysis Center, and the Intelligence Division of the Office of Operations Coordination and Planning (all located at the DHS headquarters), and the intelligence elements of six operational components: U.S. Customs and Border Protection (CBP), U.S. Immigration and Customs Enforcement (ICE), U.S. Citizenship and Immigration Services (USCIS), Transportation Security Administration (TSA), U.S. Coast Guard (USCG), and U.S. Secret Service (USSS). The Department and USCG are statutory members of the IC.

On February 11, 2010, the Senate confirmed President Obama's selection of Caryn Wagner to serve as Under Secretary for Intelligence and Analysis. As she assumes responsibility for the DHS IE, Congress will likely be interested in the progress of integration of the Department's intelligence components and the quality and relevance of the intelligence DHS IE produces for front line law enforcement and security officials who are responsible for protecting America and its people.

Also in February, DHS published its first Quadrennial Homeland Security Review (QHSR), a comprehensive assessment outlining its long-term strategy and priorities for homeland security and guidance on the Department's programs, assets, capabilities, budget, policies, and authorities. The next step in the Department's QHSR process is to conduct a "bottom-up review" to systematically link strategy to program to budget. The results of that review will be particularly important as Congress considers an authorization bill for DHS.

Some have argued that there is a broad homeland security intelligence enterprise that encompasses not only the DHS IE, but other organizations at the Federal, state, local, tribal, and private sector levels that collect and analyze homeland security information and disseminate intelligence products. This report will focus on the DHS IE both at headquarters and within the components; how it is organized; and how it supports key departmental activities to include homeland security analysis and threat warning, border security, critical infrastructure protection, and support to and the sharing of information with state, local, tribal, and private sector partners. It will also discuss oversight challenges and options for Congress to consider on these issues.

Office of Intelligence and Analysis (I&A)

The Homeland Security Intelligence Mission

According to its December 2009 Strategy , the mission of I&A is "To strengthen DHS and its partners' ability to perform homeland security functions by accessing, integrating, analyzing, and sharing timely and relevant intelligence and information, while protecting the privacy, civil rights, and civil liberties of the people I&A serves. It accomplishes this by ensuring that information related to homeland security threats is collected, analyzed, and disseminated to the full spectrum of homeland security customers in the Department, at state, local, and tribal levels, in the private sector, and in the IC." The Under Secretary for I&A is the Chief Intelligence Officer for the Department and is responsible to lead I&A and the entire DHS IE. The Under Secretary is also the Department's chief information sharing officer and is responsible for implementing the objectives of the PM-ISE within DHS.

To accomplish its mission, I&A participates in all aspects of the intelligence cycle" – the process by which information is acquired, converted into finished intelligence, and made available to policymakers. Generally the cycle comprises five steps: planning and direction, collection, processing, analysis, and production and dissemination." It is an iterative process in which collection requirements based on national security threats are developed, and intelligence is collected, analyzed, and disseminated to a broad range of consumers.

DHS does not generally engage in traditional foreign intelligence collection activities such as imagery intelligence, signals intelligence, human intelligence, measurement and signatures intelligence, and foreign open source intelligence. But, as former Secretary Chertoff has noted:

Intelligence, as you know, is not only about spies and satellites. Intelligence is about the thousands and thousands of routine, everyday observations and activities. Surveillance, interactions—each of which may be taken in isolation as not a particularly meaningful piece of information, but when fused together, gives us a sense of the patterns and the flow that really is at the core of what intelligence analysis is all about....

I&A combines the unique information collected by DHS components as part of their operational activities (e.g., at airports, seaports, and the border) with foreign intelligence from the IC; law enforcement information from Federal, state, local, and tribal sources; private sector data about critical infrastructure and key resources; and information from domestic open sources to develop homeland security intelligence. This encompasses a broad range of homeland security threats. It includes border security information to counter human smuggling and trafficking, cargo data to prevent the introduction of dangerous items, information to protect critical infrastructure against all hazards, information about infectious diseases, and demographic data and other research about 'violent radicalization.'

I&A Customers

The DHS I&A Strategy identifies its core customers as the President; Secretary of Homeland Security; DHS Components; State, Local, Tribal, and Private Sector Partners (through State and Major Urban Area Fusion Centers); the IC; and Federal Interagency Partners. In short, I&A's customers range from the Chief Executive all the way to individual border patrol agents, Coast Guard seamen, and airport screeners.

According to Under Secretary Wagner, "A primary role of I&A is to share intelligence and information with our partners at the state, local, tribal, and private sector levels. It is our job to meaningfully convert what may appear to be bits of unrelated information into a product that helps protect our communities." State, local, and tribal law enforcement are "first preventers" of terrorism and require timely and actionable intelligence to respond to threats. They also need intelligence about the latest terrorist tactics and techniques so that they know what to look for and what to do when they encounter suspicious behavior or dangerous items. In addition, I&A supports the operators of the nation's publicly and privately-owned critical infrastructure with threat information and other intelligence that supports their risk management decision making.

Former Under Secretary Charles Allen noted that "virtually any terrorist attack on the homeland that one can imagine must exploit a border crossing, a port of entry, a critical infrastructure, or one of the other domains that the department has an obligation to secure. DHS Intelligence must learn and adapt faster than the enemy, so that our department with all its partners in the federal, state, and local levels of government and the private sector have the information edge they need to secure our nation."

I&A is a full partner within the IC and represents DHS on several IC committees. The Under Secretary, for example, is a member of the Director of National Intelligence (DNI) Executive Committee. I&A contributes analytic staff to the National Counterterrorism Center (NCTC). The office also contributes items to the President's Daily Brief providing a unique homeland security perspective on terrorism and other threats to the United States to the nation's leaders.

Integrating the DHS IE

Among the many challenges for DHS since its founding has been the integration of 22 legacy and newly-created agencies. This also includes the integration of intelligence activities of the Department's operational components whose intelligence organizations predate the establishment of DHS. These intelligence elements were created to support the operational missions of their respective components and were tailored accordingly.

One of the objectives of the Department's 2005 2SR reorganization was to enhance integration to include its intelligence effort. The Under Secretary for I&A is also the Chief Intelligence Officer for the entire Department. Congress also made the Under Secretary responsible to "establish the intelligence collection, processing, analysis, and dissemination priorities, policies, processes, standards, guidelines, and procedures for the intelligence components of the Department."

Homeland Security Intelligence Council (HSIC)

The heads of the DHS intelligence components do not report to the Under Secretary, but to their respective component chiefs. However, pursuant to the Implementing Recommendations of the 9/11 Commission Act of 2007, they are required to advise and coordinate closely with the Under Secretary on their activities in support of the intelligence mission of the Department.

The HSIC was established to serve as the mechanism to provide senior-level direction for Department-wide intelligence activities and to promote integration efforts. It is chaired by the Under Secretary and is comprised of the key intelligence officials in applicable DHS components. In March 2010 testimony, Under Secretary Wagner, stated that the HSIC "... now reflects a broader range of DHS activities that require intelligence support" and

... is focused on governance-level, enterprise-wide objectives, such as collaboratively defining intelligence activities for the Department's Bottom Up Review; and developing new tools for conducting DHS Intelligence Enterprise program reviews. The HSIC oversaw the completion of the first coordinated, Enterprise-wide analytic production plan, which builds on the expertise of the operational components to produce products in their areas, deconflicts competing efforts, and helps focus analytic efforts on QHSR priorities.

Budget

I&A is funded through the classified National Intelligence Program (NIP), formerly known as the National Foreign Intelligence Program. For budgetary purposes, intelligence spending is divided between the NIP; and the Military Intelligence Program that supports the Secretary of Defense's intelligence- and counterintelligence-related responsibilities. The DNI does not publicly disclose details about the intelligence budget, but consistent with Section 601 of the Implementing Recommendations of the 9/11 Commission Act of 2007 ( P.L. 110-53 ), the DNI reported that the aggregate amount appropriated to the NIP for FY2009 was $49.8 billion.

As part of its responsibility to integrate Department intelligence activities, the Under Secretary for I&A is responsible for presenting a consolidated intelligence budget to the Secretary. DHS operational component intelligence activities are generally not part of the NIP—therefore they are not classified—with the exception of the activities of the Coast Guard's National Intelligence Element. Those budgets are listed within each component's appropriation, however they are generally co-mingled with other operational activities. Within the FY2009 homeland security appropriation, the total I&A budget figure (classified) is combined with the budget figure for operational activities (unclassified) within the Analysis and Operations category.

I&A Organization

I&A is led by an Under Secretary, a position subject to Senate confirmation. The Under Secretary also serves as the department's Chief Intelligence Officer. Caryn Wagner assumed this position on February 11, 2010. The Under Secretary is supported by a Principal Deputy Under Secretary, currently Mr. Bart R. Johnson, who served as Acting Under Secretary from May 2009-February 2010.

The current I&A organization is at Figure 2 . However to support the strategic goals of its December 2009 Strategy and the homeland security missions described in the Department's QHSR report, I&A intends to realign organizationally in 2010.

The Analysis Mission

I&A is focused on five "analytic thrusts" aligned with the principal threats to the Homeland: border security, including narcotics trafficking, alien and human smuggling, and money laundering; radicalization and extremism; particular groups entering the United States that could be exploited by terrorists or criminals; critical infrastructure and key resources; and weapons of mass destruction (WMD) and health threats.

Following a 2009 comprehensive evaluation of its analytic capabilities and functions, I&A has informed Congress that its analysis and production resources have been prioritized to:

Realign analytic resources to improve and expand support to [the] state, local, and tribal consumer base. Develop an analytic capability and methodology for assessing Suspicious Activity Reporting data. Create a centralized analysis group to meet the intelligence and information needs of the Secretary and Department components, including improved coordination and information sharing. Augment [the] border security analytic capability. Strengthen our collaboration and consultation with other producers of intelligence and information products.

I&A Intelligence Products

I&A produces numerous products for its customers. In 2008, there was a realignment and standardization of the I&A finished intelligence product line which now include:

Homeland Security Threat Assessment (HSTA) . This is an annual threat assessment that represents the analytical judgments of DHS and assesses the major threats to the homeland for which the nation must prepare and respond. This includes the actions, capabilities, and intentions of domestic and foreign terrorists and extremists and the possible occurrence of systemic threats. It focuses on domestic extremists, international terrorists operating in the homeland or directing attacks against it, and systemic threats such as pandemics and transnational criminal organizations. The HSTA is produced in classified and "Unclassified/For Official Use Only" versions. Intelligence Warning. Contains urgent intelligence. Intelligence Note. Contains timely information or analysis on a current topic. Homeland Security Assessment. Consists of in-depth analysis on a topic. Homeland Security Monitors. These are produced monthly in collaboration with the components and may be classified or unclassified. Examples include: Border Security Monitor Cyber Security Monitor Cuba-Gram Reference Aids. These are less analytical and more descriptive. For example, they might describe what an anthrax lab looks like or the latest on improvised explosive devices (IED) and fuses. They contain photos and diagrams and inform law enforcement and first responders what to look for and what actions to take if they are encountered. Perspective. These are longer term analytic pieces. Joint Homeland Security Assessment/FBI Intelligence Bulletin. These are joint reports done in conjunction with the FBI.

I&A also produces Homeland Intelligence Reports (HIR) which contain information that has yet to be fully evaluated. These are similar to the Intelligence Information Report (IIR) produced by other IC agencies. An HIR could contain information related to border encounters, information shared by a state or local fusion center, or other information of homeland security interest. There are also Homeland Security Intelligence Reports (HSIR) that are produced by the DHS component agencies. HSIR's, however, do contain some analysis.

I&A makes the products of its analysis available to state and local officials through classified and unclassified intelligence networks: The Homeland Security Information Network (HSIN) is a secured, web-based platform that facilitates Sensitive But Unclassified information sharing and collaboration between federal, state, local, tribal, private sector, and international partners. It is managed by the DHS Directorate of Operations Coordination and Planning. The HSIN platform was created to interface with existing information sharing networks to support the diverse communities of interest engaged in preventing, protecting from, responding to, and recovering from all threats, hazards and incidents under the jurisdiction of DHS. It provides real-time, interactive connectivity between states and major urban areas and the National Operations Center (NOC).

There are five community of interest portals on HSIN: Emergency Management, Critical Sectors, Law Enforcement, Multi-Mission Agencies, and Intelligence and Analysis (HSIN-Intelligence). The latter portal provides state, local, and tribal authorities access to unclassified intelligence products. The Homeland Security State and Local Intelligence Community of Interest (HS-SLIC) is a nationwide, virtual community of intelligence analysts that operates on a special portal on the HSIN network. The system contains collaborative tools such as discussion thread, chat tool, and secure messaging through which analysts collaborate. HS-SLIC has members from 45 states, the District of Columbia, and seven Federal agencies. The Under Secretary has established a governance board for HS-SLIC with strong participation by state and local officials.

The Homeland Secure Data Network (HSDN) provides access to collateral Secret-level terrorism-related information. This includes NCTC Online, a classified repository that serves as the counterterrorism community's library of terrorism information. I&A has deployed HSDN terminals to 33 state and local fusion centers and intends to install terminals in all of the fusion centers as soon as security requirements are met.

Intelligence Support To State, Local, Tribal Officials, and the Private Sector

A longstanding challenge for the department is the focus of I&A analysis and the relevance of its products to state, local, tribal, and private sector customers. For example, at a homeland security forum in early 2008, some state and local participants expressed unhappiness with the flow of intelligence from DHS. According to the forum's findings, published in the journal Homeland Security Affairs , "[t]he Department had become 'irrelevant' to states and localities as a source of intelligence, because that intelligence lacks timeliness and adds so little value to local terrorism efforts. Another participant noted that 'the stream of intelligence from DHS is useless ... '" Among efforts to address the issue, former Under Secretary Allen established a State and Local Fusion Center (SLFC) Pilot Project Team in 2006 to work with six fusion centers in five states to enhance DHS support.

State and Local Fusion Center Program

In an effort to strengthen intelligence and information sharing and analysis capabilities following the 9/11 attacks, states and major urban areas established intelligence fusion centers. Congress has defined fusion centers as a "collaborative effort of two or more Federal, state, local, or tribal government agencies that combines resources, expertise, or information with the goal of maximizing the ability of such agencies to detect, prevent, investigate, apprehend, and respond to criminal or terrorist activity." At the end of 2009, there were 72 DHS/FBI designated state and Urban Area Security Initiative (UASI) fusion centers.

Congress mandated that DHS support fusion centers in the Implementing Recommendations of the 9/11 Commission Act of 2007 . Through the DHS State, Local, and Regional Fusion Center Initiative, I&A supports these centers by providing operational, analytic, reporting, and management advice and assistance; training; information technology systems and connectivity; and intelligence officers and analysts to participating fusion centers to the maximum extent practicable.

I&A intelligence officers assigned to fusion centers are responsible for providing intelligence support, including briefings to state and local officials; reviewing and analyzing suspicious activity reports and writing HIRs based on state and local information; supporting the development of state and local intelligence products; posting material on the HSDN and the HS-SLIC portal; and reaching back to I&A for intelligence products and IT resources.

As of March 2010, there are 57 officers deployed to fusion centers and Under Secretary Wagner has stated that DHS plans to deploy a total of 76 officers (there would be more than one officer at some fusion centers) by the end of FY2010. In interviews of several fusion center directors for this report, those that had I&A officers assigned to their centers were pleased with the contributions they were making. The directors who did not have an officer assigned were anxious to get one.

Intelligence Threat Assessment and Coordination Group (ITACG)

Another program intended to improve the focus, relevance, and accessibility of federal intelligence products for state, local, and tribal officials is the ITACG. In 2007, Congress amended the Homeland Security Act by directing the establishment of the ITACG at NCTC to "improve information sharing within the scope of the Information Sharing Environment ...with state, local, tribal, and private sector officials." Among the objectives of the ITACG is to provide a formal mechanism to inject a state, local, tribal and private sector perspective about the types of intelligence products they need and how these products should be produced and disseminated in order to be of greatest value for these officials.

The ITACG consists of two elements, an ITACG Advisory Council to set policy and develop processes for the integration, analysis and dissemination of federally-coordinated information; and an ITACG Detail comprised of state, local, and tribal homeland security and law enforcement officers and intelligence analysts detailed to work at NCTC with federal intelligence analysts. The Under Secretary for I&A, as the Secretary's designee, was directed to establish and maintain the ITACG Detail and assign a senior intelligence officer from the department, who would report directly to the Director of NCTC and manage the Detail on a day-to-day basis.

One historical barrier to the sharing of intelligence information with state, local, and tribal officials has been the need to protect the sources and methods used to obtain the intelligence information. The requirement for security clearances and "the need to know" principle have been cited as impediments to access by these officials. But, as one observer has pointed out, "The local deputy or officer is not interested in the sources of the information nor the means that were utilized to obtain it. The deputy or officer does need the tactic, technique, procedure, method, or resource being reported on to ensure he or she recognizes precursors of an attack when encountered on the streets." The ITACG Detail is intended to educate and advise NCTC analysts about state, local, tribal, and private sector requirements, and then assist those analysts in the preparation of versions of the products at the lowest possible level of classification to make them accessible to those customers.

As of November 2009, the Detail consists of five state and local law enforcement officers and a fire services officer. The Detail and the Advisory Council have agreed on the need for increased representation, specifically in the areas of tribal operations; homeland security planning and operations at the State and local level; health and human services; and State and local intelligence analysis. The intent is to grow the ITACG Detail to a full complement of ten SLT representatives.

The ITACG Detail has been operational since late January 2008, so it may be too early to judge how effective it has been in influencing the IC's production and dissemination of intelligence products at a level of classification useful for state, local, tribal, and private sector consumers. In its November 2009 report to Congress on the ITACG, the PM-ISE reported the following achievements of the ITACG detail:

Informs and helps shape IC products for state and local agencies by reviewing, and when appropriate, providing comments during the drafting phase of the process. Since its inception, the Detail has participated in the production of 214 intelligence products. Created the Roll Call Release (RCR), a collaborative For Official Use Only (FOUO) product produced by DHS, FBI, and the Detail. The product is written specifically for state, local, and tribal (SLT) "street-level" first responders and focuses on terrorist tactics, techniques, procedures, terrorism trends, and indicators of suspicious activity. The success of this product can be measured by its incorporation into SLT-created publications and from the interest the product has also drawn from international law enforcement partners. Since the product line was created in December 2008, 26 RCRs have been published. Works closely with NCTC's Operations Center in the preparation of the Terrorism Summary (TERRSUM). The TERRSUM is a daily, SECRET- level digest of intelligence deemed to be of potential interest to SLT entities. Since its inception in June 2008, over 350 TERRSUM products have been published. Approximately 45 percent of the articles included in the TERRSUMs have been suggested by the ITACG Detail. The ITACG Intelligence Guide for First Responders was developed by SLT and federal members of the ITACG to assist SLT first responders in accessing and understanding federal intelligence reporting. The guide helps first responders understand IC jargon and acronyms, provides awareness of what information is available to them, how to access this information, and to help them understand threat reporting. The guide has been posted to several Internet websites and official unclassified portals. In addition, the guide has been mailed to over 16,000 police departments and 32,000 fire departments across the United States, Guam, Puerto Rico, and the Virgin Islands.

A senior police official at a major police department commented that "the ITACG is a good step forward, but the problem is that the IC still has a 'Cold War' mindset. The culture needs to change." He did, however, acknowledge being told by a law enforcement member of the ITACG Detail that "when he [the Detail member] reviews products and highlights things, 'the light bulbs are coming on at NCTC.' It is beginning to manifest itself in how the product is written, focusing on the right priorities."

However, one senior police official is concerned that "the ITACG is limited to editing intelligence and returning those products to originating agencies where the information may or may not reach state and local law enforcement personnel." This police official recommends that the ITACG "be authorized as an approved dissemination point for state and local fusion centers nationwide. ITACG liaison personnel are necessary to maintain a flow of current intelligence and must have authority to release information to state and local agencies."

Mission Integration

This Office of the Deputy Under Secretary for Mission Integration (DU/S-M) is responsible for DHS IE integration activities; policies governing enterprise-wide production and standardization of reports; the I&A Strategic Plan; training, and the implementation of a comprehensive information systems architecture. As part of its integration responsibilities, the DU/S-M is responsible for program review, department-level analysis, and cross-cutting intelligence initiatives. The DU/S-M also chairs the Intelligence Career Management Board that reports to the HSIC and is responsible for developing core competencies for the intelligence cadre of the Department. It does this through a document called the Learning Road Map that describes the tasks intelligence professionals perform, lists the training courses and other opportunities to learn the tasks, and provides measures to assess performance.

The DU/S-M organization also manages I&A responsibilities for the Department's Counterintelligence (CI) Program and the Integrated Border Intelligence Program.

Integrated Border Intelligence Program (IBIP)

I&A established the IBIP to enhance its support to border security activities. Under the program, additional personnel and support infrastructure have been committed to support all of the Department's border security operations. The program is designed to link DHS intelligence resources, and those of state and local partners, with the IC in order to deliver actionable intelligence to front-line operators and to fuse national intelligence with law enforcement information.

An important initiative within the IBIP is the Homeland Intelligence Support Team (HIST). The first HIST team was deployed in 2007 to El Paso, Texas. It consists of intelligence officers from I&A whose mission is to coordinate and facilitate the delivery of national intelligence and enhance information fusion to support DHS operational missions at the border. In this regard it serves as a bridge between the national and field levels and between I&A and the component intelligence staffs at the border. It can also push/pull information from state and local law enforcement officials. The HIST also helps provide context to I&A analysts on topics such as border violence. Its focus areas are alien smuggling, border violence, weapons trafficking, illicit finance, drug trafficking, and the nexus between crime and terrorism. Its location at the El Paso Intelligence Center (EPIC) gives the HIST staff immediate access to each of the DHS operational components plus 15 other Federal, state, and local agencies.

I&A has also increased staffing of the "Borders Branch" within I&A's analytic element. One senior I&A official cited this as an example of an evolving focus away from purely terrorism issues to enhanced support for specific departmental concerns. In 2005, there were only three analysts working border issues. By mid-2008, there were 20 on the border team. In the same three years, I&A increased the production of HIR's from 600, of which 3% were related to the border, to 3,563 in FY2008, of which 22% were border related.

National Applications Office (NAO).

For more than 30 years, the Civil Applications Committee (CAC) has facilitated requests by civil agencies to make use of space-based imaging and remote sensing capabilities in support of traditional mapping applications, as well as a broad range of resource management, environmental climate natural disaster, and remote sensing applications. In its September 2005 report, a DNI study group unanimously recommended that the scope of the CAC be expanded beyond civil applications to include homeland security and law enforcement applications. In May 2007, the DNI designated DHS to be executive agent and functional manager of the NAO whose mission is to facilitate the use of IC technological assets for those purposes. I&A placed this office within the DU/S-M organization.

The establishment of this office, however, has been controversial. In 2008, Congress prohibited the use of funds "to commence or continue operations of the NAO until the Secretary of Homeland Security certifies in FY2009 that NAO programs comply with all existing laws, including all applicable privacy and civil liberties standards and that clear definitions of all proposed domains are established and auditable." Congress also required the Government Accountability Office (GAO) to review the certification and report to Congress.

After the Obama Administration took office, DHS revisited the need for an NAO program. On June 23, 2009, after a five-month review, which the department stated was conducted in coordination with its law enforcement, emergency management, and intelligence partners, Secretary Napolitano announced her decision to end the NAO program.

The CAC will continue to foster information sharing for the civil community and will seek to provide CAC members access to the skills and information necessary to protect and maximize the use of assets; facilitate relationships between the Civil and the Intelligence communities to identify and document their requirements; and expand a monthly inter-community forum for technology and information exchange to a much broader audience.

Homeland Infrastructure Threat and Risk Analysis Center (HITRAC)

HITRAC is the Department's infrastructure-intelligence fusion center. It is not a formal part of I&A, but is jointly resourced and managed by I&A and the Office of Infrastructure Protection, an office within the DHS National Protection and Programs Directorate. HITRAC's mission is to produce and disseminate timely and meaningful threat- and risk-informed analytic products that can effectively influence the development of infrastructure protection strategies. Its use of intelligence and infrastructure expertise to support risk management decision making is illustrated at Figure 3 .

HITRAC is organized into two divisions responsible for the Center's principal functions. The Risk Analysis Division performs infrastructure risk analysis and prioritization to support decision making. The division manages Congressionally-mandated and priority initiatives, including the Tier 1 and Tier 2 Program and the Critical Foreign Dependencies Initiative (CFDI). The Threat Analysis Division provides three services: critical infrastructure threat analysis, cyber threat analysis, and regional threat analysis including threat assessments to support the Committee on Foreign Investment in the United States (CFIUS).

HITRAC products include State Threat Assessments that support the State Homeland Security Grant Program; Regional Infrastructure Assessments; Strategic Sector Assessment that provide an overall assessment of potential terrorist threats to critical infrastructure and key resources; Quarterly Suspicious Activity Analysis of suspicious incident reports to identify signs or patterns of activity that might pose a threat; Infrastructure Intelligence Notes that provides the private sector with a timely perspective on events, activities, or information of importance to support their specific sector-level security planning; and Homeland Security Assessments and Joint Homeland Security Assessments that communicate intelligence information that impacts the security of U.S. persons and infrastructure.

Operations Coordination and Planning Directorate (OPS)—Intelligence Division

In an effort "to improve its operations coordination and planning capability for non-routine, multi-Component operations to protect, prevent, respond to, and recover from significant threats and hazards, former Secretary Chertoff in 2008 directed the enhancement of an already extant DHS organization—OPS—which was built on the foundation of the former Office of Operations Coordination. I&A provides staff to the OPS Intelligence Division, including its director.

A persistent challenge for the Department since its founding has been the integration of 22 legacy and newly-created agencies. Although the Homeland Security Act of 2002 transferred most operational responsibilities to DHS, many of these components derive their authorities from earlier legislation. The execution of these authorities and responsibilities provides them with nominal operational independence. The Department has sought to develop a robust, department-wide operations planning and coordination capability to support DHS integration. But, when operational activities involve only one or two components or routine operations, the need and incentive for "department-level" planning and coordination is diminished.

A further imperative for department-wide operational planning and coordination is to support crisis and contingency planning and operations to support the Secretary of Homeland Security in his/her HSPD-5 role as the principal Federal official for domestic incident management. That role not only involves coordinating activities within DHS and its components, but also all "Federal operations within the United States to prepare for, respond to, and recover from terrorist attacks, major disasters, and other emergencies."

The Intelligence Division at OPS is staffed by selected I&A personnel who provide timely, tailored intelligence products and services to support Departmental and interagency plans and operational coordination efforts. The division reaches back to, coordinates with, and leverages I&A parent elements, I&A representatives at state and local fusion centers, component intelligence organizations, and IC agencies as required, for threat-related intelligence, analysis, and other support. How the division is integrated into the OPS structure is shown in Figure 4 .

In short, the key function of the OPS Intelligence Division is the application of intelligence research and analysis to conditions on the ground that must be considered for effective planning and operations and the development of a Common Intelligence Picture (CIP).

Former Secretary Chertoff provided insight into what a Common Intelligence Picture for DHS should look like:

Understanding the enemy's intent and capabilities affects how we operate at our borders, how we assess risk in protecting infrastructure, how we discern the kind of threats for which we must be prepared to respond…. We need to have a common picture across this Department, of the intelligence that we generate and the intelligence that we require. We need to fuse that information and combine it with information from other members of the intelligence community, as well as information from our state and local and international partners.

Contributing to the development of a Common Intelligence Picture for the department as a whole is one of the important roles for the OPS Intelligence Division.

U.S. Customs and Border Protection (CBP) Intelligence Element

CBP is the agency responsible for securing the nation's borders at and between ports of entry (POE). It was established in 2003, as a result of the Homeland Security Act of 2002, consolidating the inspection and patrol functions of the legacy U.S. Customs Service, the Immigration and Naturalization Service (INS), the U.S. Border Patrol (BP), and the Animal and Plant Health Inspection Service (APHIS). CBP's primary mission is to prevent the entry of terrorists and the instruments of terrorism into the United States. But it also has responsibility to prevent illegal immigration; regulate and facilitate international trade; collect import duties; enforce U.S. trade and drug laws; and protect Americans and U.S. agricultural and economic interests by preventing the importation of harmful pests, diseases, and contaminated, diseased, infested, or adulterated agricultural and food products.

CBP accomplishes its various missions by inspecting persons and goods to determine if they are authorized to enter the United States. CBP officers and Border Patrol agents intercept illegal narcotics, firearms, counterfeit merchandise, and other types of contraband. They also interdict unauthorized aliens and enforce more than 400 laws and regulations at the border.

CBP Office of Intelligence and Operations Coordination (OIOC)

In October 2007, CBP reorganized its intelligence and anti-terrorism functions by establishing the OIOC headed by an Assistant Commissioner. It provides intelligence support to CBP's effort to detect, identify, target, and interdict terrorists, terrorist threats, weapons of mass destruction (WMD), illegal aliens and alien smuggling groups, narcotics traffickers, and other criminals attempting to penetrate or use the borders of the United States to facilitate their illegal activities.

The Assistant Commissioner for OIOC is also responsible for managing the coordination of field operations among and beyond CBP elements and for CBP's continuity of operations program. The OIOC also functions as the situational awareness hub for CBP providing timely and relevant information and actionable intelligence to operators and decision-makers. The OIOC is divided into four divisions, Incident Management, Field Coordination, Analysis and Targeting, and Intelligence and Situational Awareness. OIOC analysts are stationed at its headquarters and are posted to other agencies in a liaison capacity, such as NCTC, the NJTTF, and the Human Smuggling and Trafficking Center (HSTC).

CBP Intelligence Support to DHS and CBP Missions.

CBP intelligence operations are designed to support the full range of CBP missions, particularly its primary mission of preventing the entry of terrorists and the instruments of terrorism. To that end, the CBP OIOC is engaged in the entire intelligence cycle, including planning, collection, processing, production, and dissemination of "all source" information and intelligence to support CBP's operational elements, as well as their partners within DHS and other government agencies.

Although CBP does not engage in traditional foreign intelligence collection activities, it receives information from DHS I&A, the IC, and law enforcement agencies. In addition, CBP gathers and analyzes large amounts of data concerning persons and cargo inbound to the U.S. as well as information derived from the apprehensions of illegal aliens, drug seizures, and other border enforcement activities. For example, CBP collects advance passenger information (API) for all air and ship passengers and crew traveling to or from the United States. During its border inspection activities, CBP officers may also examine documents, books, and other printed material, as well as computers disks, hard drives, and other electronic or digital storage devices. All of this data is a unique source of operational intelligence that is potentially very useful to other Federal agencies with national security missions. The border environments in which the CBP offices operate illustrate how intelligence supports DHS and CBP mission activities.

At Ports of Entry

CBP officers conduct screening activities to determine the admissibility of persons and goods and interdict dangerous people, dangerous items, and contraband. Given the volume of people and goods seeking entry into the U.S. every year, it is impractical for CBP to physically inspect every person or shipment that arrives at a U.S. port. Therefore, CBP analyzes trade data and cargo, crew, and passenger manifest information to 'target' its inspection resources towards those persons or cargo shipments that potentially pose the highest risk. Intelligence from other Federal agencies, in the form of 'lookouts,' and other law enforcement and intelligence reporting, is also reviewed.

The targeting mechanism used by CBP is the Automated Targeting System (ATS). ATS is composed of six modules that focus on exports, imports, passengers and crew (airline passenger and crew on international flights, passengers and crew on sea carriers), private vehicles crossing at land borders, and import trends over time. These modules employ weighted rule sets to identify high-risk passengers and cargo shipments.

In the cargo environment, ATS employs these rule sets to assign scores based on factors associated with risk. Above a certain threshold risk score, cargo is subject to further inspection. A variety of data is used within ATS to perform risk analysis. For cargo, ATS uses data from the Automated Commercial System (ACS), Automated Broker Interface (ABI), Automated Manifest System (AMS), and the new Automated Commercial Environment.

The passenger component of ATS (ATS-P) processes traveler information against other information available to ATS, and applies threat-based scenarios comprised of risk-based rules to assist CBP officers in identifying individuals who require additional screening or in determining whether individuals should be allowed or denied entry into the United States. The risk-based rules are derived from discrete data elements, including criteria that pertain to specific operational/tactical objectives or local enforcement efforts.

Unlike in the cargo environment, ATS-P does not use a score to determine an individual's risk level. Instead, it compares Passenger Name Record (PNR) and information in the following databases against lookouts and patterns of suspicious activity identified by analysts based upon past investigations and intelligence.

Treasury Enforcement Communications System (TECS) Advance Passenger Information System (APIS) Non Immigrant Information System (NIIS) Suspect and Violator Indices (SAVI) Department of State visa databases Passenger Name Record (PNR) systems

This risk assessment is an analysis of the threat-based scenario(s) that a traveler matched when traveling on a given flight. These scenarios are drawn from previous and current law enforcement and intelligence information. This analysis is done in advance of a traveler's arrival to or departure from the United States and becomes one tool available to DHS officers in identifying illegal activity.

It was through application of the ATS-P that CBP officers at the National Targeting Center selected Umar Farouk Abdulmutallab, who attempted to detonate an explosive device on board Northwest Flight 253 on December 25, 2009, for further questioning upon his arrival at the Detroit Metropolitan Wayne County Airport POE.

National Targeting Center (NTC)

The operational organization that utilizes the ATS to support CBP officers at POE's is the NTC. It is not an intelligence organization, it is part of the CBP Office of Field Operations. But it is a significant consumer of intelligence information, upon which it conducts analysis and bases recommendations for security actions. It is also a major source of information about passenger and cargo movements that can be exploited for intelligence purposes.

The NTC grew out of efforts by the legacy U.S. Customs Service to develop targeting techniques at the port level to detect drug smuggling and currency violations in both the passenger and cargo environments. Post-9/11, Customs began adapting these targeting practices towards anti-terrorist and other national security concerns. In November of 2001, following the 9/11 attacks, the NTC began operations on a 24/7 basis. In March 2007, the NTC was divided into two elements, NTC–Passenger and NTC–Cargo.

NTC—Passenger (NTCP)

The NTCP works closely with the OIOC and other intelligence and law enforcement organizations to develop targeting rule sets for ATS-P. They then work with analytical units located at POE's to provide targeting information and real-time response to requests from CBP officers in the field for information on potentially high-risk passengers seeking entry into the United States. One of the most important sources of information analyzed by NTCP is API data which commercial carriers are required to submit to CBP on all air and ship passengers and crew traveling to the United States. The data is examined to determine possible matches with various inspection systems and watchlists that include lookouts on known and suspected terrorists or other persons of interest to U.S. law enforcement agencies.

NTC—Cargo (NTCC)

The NTCC supports efforts to detect and prevent dangerous cargo from entering the United States. It examines advance electronic manifest information that CBP requires to be submitted for all modes of transportation. It then uses advanced, computerized risk-assessment techniques within ATS to sort the information according to more than 100 variables. Citing security concerns, federal officials refused to list those variables, but some officials said that the port of origin, the nature of the cargo, and the track records of the exporter and importer were among the criteria. In addition, the NTCC provides significant support to Cargo Security Initiative ports where CBP has stationed targeting teams to identity containers for inspection prior to their being loaded on U.S.-bound vessels.

The NTCC works closely with OIOC to develop targeting rule sets for the cargo component of ATS. They also collaborate with NTCP who notifies NTCC of any passenger matches to terrorist-related or other law enforcement lookouts. NTCC will then run those matches against various databases to determine if those individuals are involved with any cargo businesses or specific cargo shipments.

The NTCC focuses particular attention on types of cargo that could be ingredients for weapons of mass destruction (WMD), weapons of mass effect, chemical precursors of illegal drugs, and conventional weapons and explosives. Sweeps based on specified targeting parameters are conducted daily to target suspect chemical, biological, radiological, conventional weapons, explosives, and ammonium nitrate shipments. In early 2008, working with ICE and DEA, this targeting identified suspicious bills of lading, which led to the seizure of chemicals associated with the manufacture of methamphetamines. In late 2007, targeting and analysis within NTCC led to the intercept and seizure of over $3 million worth of assault rifles and small arms destined for Central America.

Between POE's.

While CBP officers work primarily at POE's, Border Patrol agents patrol vast areas along the northern and southern international land borders of the United States that lie in between the POE's, as well as the coasts of Florida, Puerto Rico, and the U.S. Virgin Islands. The Office of Air and Marine (A&M ) supports this mission through its operations within the air and maritime environments. Two centers that provide intelligence support to these operations are the Border Field Intelligence Center (BORFIC) and the Air and Marine Operations Center (AMOC). In addition, the Border Patrol has placed intelligence units within each of its 20 Border Patrol Sectors.

OIOC supports BP and A&M with real-time intelligence and strategic analyses about the conveyances, routes, and other methods that undocumented aliens, human smugglers, drug traffickers, and other criminals use to enter or smuggle persons or contraband into the United States. An example of this strategic intelligence analysis was an April 2006 report co-produced by CBP and the NCTC. The report, which surveyed the arrest records of "special interest aliens" (SIA) caught at the U.S. southern border, revealed how these individuals entered the U.S. and how terrorists could exploit such vulnerabilities.

In response to this information, DHS developed and implemented a multi-pronged plan to address those vulnerabilities. The plan included targeted training and other efforts to eliminate the proliferation and use of false passports from one African country; and training to build the detection capabilities of several Western Hemisphere countries that were noted to be used by SIA's with false or altered passports in transit to the United States.

Border Field Intelligence Center (BORFIC)

Originally established as the Border Patrol Field Intelligence Center in 2004 in El Paso, Texas, BORFIC conducts all-source intelligence activities to support the border security mission of the BP and other DHS and CBP elements to predict, detect, deter, and interdict terrorists, terrorist weapons, and human traffickers and contraband smugglers entering the United States. In October 2007, the organization was fully integrated into the CBP OIOC and its name changed to the Border Field Intelligence Center.

BORFIC is responsible for supporting security efforts on both the northern and southern borders. It exchanges intelligence and law enforcement information with numerous Federal, state, local, and tribal organizations agencies and actively participates in several interagency and bilateral groups. These include the El Paso Interagency Intelligence Working Group which includes EPIC, DOD's Joint Task Force-North, and the FBI; the Bilateral Interdiction Working Group with Mexico, the Integrated Border Intelligence Teams (IBETS) with Canada, and the Caribbean Border Interagency Group. BORFIC shares law enforcement intelligence information with state and local fusion centers through the HS-SLIC portal. In addition, BORFIC has four personnel assigned to the El Paso Intelligence Center (EPIC) who work in tandem with I&A's Homeland Intelligence Support Team also located there.

Air and Marine Operations Center (AMOC)

Located in Riverside, California, the AMOC is a 24/7, multi-agency coordination center that detects, sorts, and monitors air and marine tracks of interest across the nation's borders and maritime approaches. A subordinate center located in Puerto Rico performs the same mission for the Caribbean region. The AMOC also serves as host activity for the central operations of CBP's long-range unmanned aircraft systems and is the CBP focal point for the coordination of unmanned aircraft system maritime operations with the USCG. The AMOC is staffed with intelligence operations specialists who provide connectivity to the OIOC, DHS, and the IC. It also has liaison officers assigned from the USCG, FAA, DOD National Guard Bureau, and the Government of Mexico.

The AMOC produces a comprehensive air surveillance radar picture through its Air and Marine Operations Surveillance System (AMOSS). Fusing input from up to 450 sensors, including an extensive network of military and civilian radars across the United States and Canada, the AMOSS can process up to 24,000 fused tracks every 12 seconds and input up to 1,000 flight plans per minute. This allows the AMOC to provide real-time data on suspicious or non-cooperative aircraft and marine vessels to A&M, BP, and the USCG to support interdiction operations as well as to other DHS intelligence and operations centers. In addition to aircraft and vessel location data, Detection Systems Specialists at the AMOC have access to numerous law enforcement and other databases that allow them to provide operational units with information regarding the flight plans, history, ownership, and registration of aircraft and vessels and criminal background information on pilots and vessel crew.

In addition to its land and maritime border security mission, the AMOC also supports the multi-agency effort to provide airspace security for the National Capital Region. As a participating agency within the National Capital Region Coordination Center, the AMOC provides its comprehensive radar picture and law enforcement sorting, detection, and investigative capabilities to assist in identifying and determining the threat posed by aircraft that are not compliant with the flight rules in effect for the Washington, D.C. Metropolitan Area Air Defense Identification Zone (DC ADIZ).

Intelligence Driven Special Operations (IDSO)

OIOC collaborates with CBP Office of Field Operations to develop IDSO's based on threat information. IDSO's not only address immediate threat concerns, but also serve to counter predictability in CBP inspection operations. They are enforcement actions that are based upon specific intelligence or current trends and are vetted through the DHS CINT. For example, if an increase in aliens entering the United States illegally from or through a particular country were documented, CBP could develop an IDSO to intensify inspection activity on persons and routes from that country.

An IDSO based on specific intelligence was conducted following the March 2004 Madrid train bombings. CBP analysis revealed an increase in aliens attempting to enter the U.S. illegally using freight and passenger railcars along the northern border. In response, CBP assigned officers and resources to targeted POE's to intensify inspections of railcars; NTC intensified its screening of persons and cargo, the BP assisted in capturing and detaining illegal aliens; and CBP intelligence intensified its checks of foreign nationals through the IC.

Immigration and Customs Enforcement (ICE) Intelligence Element

ICE is the largest investigative organization within DHS. It was established in 2003 and incorporated into DHS by consolidating the investigative elements of the former U.S. Customs Service and Immigration and Naturalization Service (INS) and by transferring the Federal Protective Service from the General Services Administration (GSA).

ICE's mission is to enforce trade and immigration laws through the investigation of activities, persons and events that may pose a threat to the safety or security of the United States and its people. OI also investigates illegal trafficking in weapons (including weapons of mass destruction), the smuggling of narcotics and other contraband, human smuggling and trafficking, money laundering and other financial crimes, fraudulent trade practices, identity and benefit fraud, child pornography, child sex tourism, and health and public safety dangers. It has four operational divisions:

Office of Investigations (OI). OI is responsible for investigating a range of issues that may threaten national security. OI uses its legal authority to investigate issues such as immigration crime, human rights violations, and human smuggling; narcotics, weapons and other types of smuggling; and financial crimes, cybercrime, and export enforcement issues. Of note, ICE Special Agents are the largest non-FBI component of the Joint Terrorism Task Forces (JTTF). Detention and Removal Operations (DRO). DRO is the primary enforcement arm within ICE for the identification, apprehension and removal of illegal aliens from the United States. Office of International Affairs (OIA). With 63 offices in 44 countries, OIA develops partnerships with foreign governments to advance the homeland security mission. Office of Intelligence, discussed below.

Office of Intelligence

ICE's intelligence activities are coordinated and managed within the Office of Intelligence. The office is responsible for collecting, analyzing, and disseminating strategic and tactical intelligence for use by the operational elements of ICE and DHS. ICE intelligence activities focus on information related to the movement of people, money and materials into, within and out of the United States. Its objective is to provide timely, accurate, and useful intelligence to support a range of investigative activities by identifying patterns, trends, routes, and methods of criminal activity; predicting emerging and future threats; and identifying potential systemic vulnerabilities and methods to mitigate those vulnerabilities.

Although ICE is not a member of the IC, the Office of Intelligence participates in all aspects of the intelligence cycle. In support of the agency's mission, the office collects and analyzes information from a variety of sources including the IC, other federal agencies, other components of DHS, state, local, tribal, and foreign agencies. It also analyzes the considerable information derived from ICE operational activity, such as investigations, document exploitation, and interviews of detainees. Information sources include classified intelligence reporting, law enforcement sensitive information, and open source material such as commercial and trade data. Consumers of ICE intelligence products are ICE investigators; DRO and FPS officials; the ICE and DHS leadership; DHS partners, particularly CBP; the Department of State; FBI; the Drug Enforcement Administration; the Bureau of Alcohol, Tobacco, and Firearms, and state and local law enforcement agencies.

The Office of Intelligence is led by a Director and consists of six divisions and 26 Field Intelligence Groups. The Intelligence Operations Division coordinates and provides intelligence support to ICE field components, including the ICE Special Agent-in-Charge (SAC) offices, DRO field offices, and FPS regions. The Intelligence Programs Division analyzes information obtained from intelligence, law enforcement, and open sources and produces finished intelligence products to support ICE, DHS, and other intelligence and law enforcement consumers.

Intelligence Programs Division

The Intelligence Programs Division has the following specialized units: Counter Proliferation Intelligence, Human Smuggling and Public Safety (HSPSU), Contraband, Illicit Finance/Trade Fraud, and International Intelligence, and the Tactical Intelligence Center located in Bay Saint Louis, Mississippi, which works with the National Security Agency and other intelligence units to integrate and analyze signals intelligence, human intelligence, and law enforcement information to identify new criminal organization targets for ICE investigations, assist NSA in SIGINT targeting, and support other Office of Intelligence units in performing strategic level intelligence analysis.

The International and Border Support unit focuses production on two primary areas. The first is support rendered to the ICE Attachés of the Office of International Affairs through the International Intelligence Unit. The second is through another cell that provides support to Southwest Border operations that target criminal organizations operating in that region, especially those that contribute to escalating violence along the border. Southwest Border is focused on four operations: the Border Violence Intelligence Cell, Support the Border Enforcement Security Taskforces, Operation Armas Cruzdas, and Operation Firewall.

Border Violence Intelligence Cell (BVIC)

The BVIC was established in January 2008 in order to provide intelligence support for ICE weapons smuggling investigations and government-wide efforts to combat violence along the United States-Mexico border. It is located at EPIC within the Crime-Terror Nexus Unit. The BVIC works closely with I&A's Homeland Intelligence Support Team, and other partners at EPIC.

As the level of violence along the U.S.- Mexican border intensified in the past two years, ICE has partnered with Mexican and other U.S. law enforcement agencies on three initiatives described below to enhance border security, disrupt transnational criminal organizations, and stop the illegal flow of firearms from the United States into Mexico. These are the Border Enforcement Security Task Forces (BEST), Armas Cruzadas, and Operation Firewall. The BVIC supports all three programs. At the BVIC, all-source intelligence is analyzed and operational leads are provided to the BEST task forces and ICE attaché offices. The BVIC also analyzes data from arrests and seizures by the BEST task forces and exchange intelligence with Mexican law enforcement agencies.

In November 2008, the BVIC, in collaboration with CBP and DHS I&A, produced an Intelligence Report, United States Southbound Weapons Smuggling Assessment , which examined U.S. southbound weapon smuggling trends. This report was designed to support the BEST's and other operational components in planning and conducting outbound firearms smuggling operations. In December 2008, the BVIC also co-authored a strategic-level analysis for the ICE and DHS leadership on the same issue.

Border Enforcement Security Task Forces (BEST)

The BEST initiative consists of a series of multi-agency investigative task forces, of which ICE is the lead agency. They seek to identify, disrupt, and dismantle criminal organizations posing significant threats to border security. Other agency participants include CBP, the Drug Enforcement Administration (DEA), Bureau of Alcohol, Tobacco, and Firearms (ATF), FBI, USCG, and the U.S. Attorney's offices, and state and local law enforcement. The Mexican law enforcement agency Secretaria de Seguridad Publica is a partner along the southern border. The Royal Canadian Mounted Police and Canadian Border Services Agency are partners on the northern border.

There are currently BEST task forces on both the northern and southwestern borders with ten on the southwest border. Each BEST concentrates on the prevalent threat in their area. On the southern border, this entails cross-border violence; weapons smuggling and trafficking; illegal drug and other contraband smuggling; money laundering and bulk cash smuggling; and human smuggling and trafficking. The Office of Intelligence maintains 28 analysts within the Southwest Border BESTs to ensure responsive intelligence support and appropriate information sharing with other federal, Government of Mexico, state, tribal and local law enforcement partners.

Armas Cruzadas

Armas Cruzadas is a partnership between U.S. and Mexican law enforcement agencies. Its objective is to synchronize bilateral law enforcement and intelligence sharing operations in order to identify, disrupt, and dismantle trans-border weapons smuggling networks. Among the activities under Armas Cruzadas, ICE Border Liaisons are deployed to the border to strengthen bilateral communication. There is also a Weapons Virtual Task Force, a virtual online community where U.S. and Mexican investigators can share intelligence and communicate in a secure environment. For the United States, ICE is a major participant agency in Armas Cruzadas because of its authority as the Federal agency responsible for investigating cases involving weapons being smuggled out of the United States. ATF participates as a result of its authority over weapons being illegally sold and transported within the United States. CBP is also a participating agency due to its border security responsibilities.

Operation Firewall

Operation Firewall is an initiative to combat bulk cash smuggling, one of the methods that transnational criminal organizations use to move the proceeds from their criminal activities to fund future operations. ICE has found that as successful enforcement has made the transfer of illicit funds between banks and other financial institutions more difficult, criminal organizations are increasing their use of bulk cash smuggling. Operation Firewall is a joint effort with CBP to target the full array of methods used to smuggle bulk cash, including commercial and private passenger vehicles, commercial airline shipments and passengers, and pedestrians crossing U.S. borders with Mexico and Canada.

Collection Management and Requirements Division

The Collection Management and Requirements Division coordinates the intelligence collection and reports efforts within ICE. In this regard, it works closely with other DHS and IC elements to articulate ICE intelligence requirements to collection elements within the IC to ensure the flow of needed information to ICE. This division also manages the ICE Joint Intelligence Operations Center.

The Office of Intelligence also has two divisions which provide support activities, the Business Management Division and the Executive Information and Technology Division. Business Management provides support to daily operations throughout the homeland and overseas through executing procurement, budget, logistics, and training functions.

The Executive Information and Technology Division provides information technology services that support day to day operations, processing large quantities of information, and managing secure communications systems networks. This division also includes the Intelligence Document Exploitation (IDocX). Under this program, captured media, such as hard copy documents, audio recordings, and electronic media are exploited in order to develop intelligence products. Hard copy documents, for example, are converted into digitized data allowing ICE to create a vital resource for analysis, pattern recognition, and information sharing accessible to intelligence analysts and investigators.

Field Intelligence Groups (FIG)

The Office of Intelligence field organization consists of 26 FIGs that are aligned and co-located with ICE SAC offices throughout the United States. They replaced the former Field Intelligence Units in a reorganization of the ICE field intelligence structure intended to improve connectivity and working relationships with ICE operational elements and enhance coordination with other Federal, state, local, and cross border partners.

Each FIG is managed by a Field Intelligence Director or advisor and is staffed by a mix of intelligence and operational personnel. FIG personnel identify and analyze criminal trends, threats, methods and systemic vulnerabilities related to ICE strategic priorities within their office's area of responsibility. FIG intelligence reports, assessments, and other products primarily support the ICE leadership and field managers, but are also disseminated to other DHS, law enforcement, and IC member agencies.

Human Smuggling and Trafficking Center (HSTC)

The HSTC was established in 2004 and serves as the U.S. Government's intelligence fusion center and information clearinghouse for all federal agencies addressing human smuggling, human trafficking, and the facilitation of terrorist mobility. Human smugglers seek to profit from the illegal transportation of persons into a country. Human traffickers seek to profit from transporting a person into a country for the purpose of exploiting them. As a profitable destination for smuggled and trafficked persons, both are major problems for the United States. Numerous transnational organized crime groups are involved in the trade.

Congress formally established the HSTC in the Intelligence Reform Act and Terrorism Prevention Act of 2004. In 2007, Congress strengthened the Center's manning and funding in Section 721 of the Implementing Recommendations of the 9/11 Commission Act of 2007 .

The HSTC focuses on the transnational issues that share one common link – illicit international travel. It brings together federal agency representatives from the policy, law enforcement, intelligence, and diplomatic areas to work together on a full-time basis to convert intelligence into effective law enforcement and diplomatic action. The HSTC prepares strategic reports for U.S. law enforcement and U.S. policy-makers. The HSTC is congressionally mandated to produce an annual report about vulnerabilities in travel systems.

The HSTC also serves as a focal point for international police agencies and provides a mechanism for the exchange of information between the United States and its allies. HSTC is the official point of contact for INTERPOL on trafficking matters for the USG. Members of the HSTC conduct frequent training to law enforcement officials, consular officials, prosecutors and non-governmental organizations, both foreign and domestically.

ICE is a major contributor of personnel to the HSTC. The Center's Director is an ICE employee. The ICE Office of Intelligence provides intelligence support through the Intelligence Program Division's Human Smuggling and Public Safety Unit.

The shortage of staff at the Center has impeded its ability to accomplish its mission. According to the HSTC charter, "[t]he principal determinant of the success of the Center will be its ability to draw on and integrate the diverse experience and perspectives of its full-time staff ... it is critical that key members of the community of interest provide well-qualified personnel to the Center." Various agency members of the community of interest have made commitments to detail personnel to the Center but have been inconsistent in doing so. For example, there are no staff currently detailed to the Center from DOD, FBI, or CIA.

Congress may wish to consider legislatively-mandating minimum staffing by agencies critical to the Center's success. At present, each participating agency provides staff "out of hide," meaning they are not reimbursed for the personnel they detail to HSTC. To alleviate this impact, Congress may also wish to consider dedicated funding for the detailee positions at the Center.

U.S. Citizenship and Immigration Services (USCIS) Intelligence Element

As the agency that oversees lawful immigration to the United States, USCIS establishes immigration services, policies and priorities to preserve America's legacy as a nation of immigrants while ensuring that no one is admitted who is a threat to public safety. The Homeland Security Act of 2002 established USCIS as a component of DHS in 2003 and transferred to the new agency the immigration and citizenship adjudication functions of the former INS. The three principal immigrant service activities of USCIS are the adjudication of petitions for immigration benefits; the adjudication of naturalization petitions from lawful permanent residents desiring to become U.S. citizens; and the consideration of refugee and asylum claims, and related humanitarian and international concerns.

USCIS is not a law enforcement agency nor a member of the IC and the vast majority of its funding is derived from fees collected from immigration benefit applicants and petitioners. Thus its activities are limited to adjudication of immigration benefits, which includes conducting background checks on the individuals and organizations who submit applications and petitions, as well as the intended beneficiaries. As part of that process, USCIS collects biometrics, in the form of digital photographs and fingerprints. On average each day, USCIS processes 30,000 applications for immigration benefits, issues 7,300 Permanent Resident Cards (Green Cards), adjudicates 400 refugee applications, and naturalizes 3,400 new civilian citizens and 30 new citizens who are member of the U.S. Armed Forces.

USCIS also has the authority to detect and combat immigration fraud. In a Conference Report to the FY2005 Department of Homeland Security Appropriations Act, Congress recognized USCIS as the responsible agency for developing, implementing, directing, and overseeing the joint USCIS-ICE anti-fraud initiative and conducting law enforcement/background checks on every applicant, beneficiary, and petitioner prior to granting any immigration benefits. Individuals and organizations intent on harming the United States have become increasingly sophisticated in their methods of gaining entry into the country. The nexus between immigration benefit fraud and threats to national security was illustrated in the 1993 World Trade Center bombing when the plot's mastermind, Mahmud Abouhalima, received a residency visa as an "agricultural worker" despite the fact that he was employed as a New York City cab driver.

In 2004, USCIS established the Office of Fraud Detection and National Security (FDNS). In January 2010, FDNS was promoted to a Directorate to reflect the priority USCIS places on its anti-fraud and national security responsibilities and to place greater emphasis on them. FDNS consists of four branches that collectively are responsible for detecting, pursuing, and deterring fraud; ensuring background checks are conducted on all persons seeking benefits before granting benefits; identifying systemic vulnerabilities and other weaknesses that compromise the integrity of the legal immigration system; and serving as USCIS' primary conduit to and from law enforcement and intelligence agencies.

The USCIS Intelligence Branch

Within FDNS, there is an Intelligence Branch that manages the analysis, reporting, production, and dissemination of immigration-based intelligence products. Those products are designed to focus on the identification of fraud trends or vulnerabilities that are being exploited in the immigration benefits processes while also enhancing national security efforts. The branch manages and directs assets and resources at the headquarters office, five USCIS Service Centers, and within all District Offices. It also establishes liaison with state and local intelligence fusion centers to promote information sharing and collaboration efforts. The branch is also the conduit for information-sharing, coordination, and collaboration with the IC and various law enforcement agencies.

To promote information sharing and provide immigration subject matter expertise, FDNS has placed liaison officers within DHS I&A, the Terrorist Screening Center, NCTC Terrorist Identities Group, the National Joint Terrorism Task Force, DHS Threat Task Force (DTTF), ICE National Security Unit, CBP NTC, State Department's Kentucky Consular Center, FBI National Name Check Program (NNCP), the HSTC, INTERPOL Headquarters in Lyon, France, and the INTERPOL U.S. National Central Bureau.

Intelligence Research Specialists within the branch conduct research and analysis to identify previously unknown links, associations, emerging trends, correlations, anomalies, and indications and warnings with national security or public security threat implications. They produce and disseminate immigration-related intelligence products to a broad audience to include field officers, field and headquarters leadership at USCIS, DHS components, and other Federal, state, and local agencies. For example, there is considerable potential intelligence value in the research and analysis of data within the various USCIS electronic databases as well as the information contained in the more than 90 million immigrant Alien Files (A-Files) in the custody of USCIS (with more than 7 million new A-Files added each year).

An example of the type of intelligence product produced by the FDSN Intelligence Branch was a classified report following the June 2007 failed bombings in London and Glasgow. Police in the United Kingdom (UK) determined that the suspects, who utilized al Qa'ida-like strategies and devices, were immigrants to the UK and working there as medical professionals. This suggested the possibility of similar tactics being used in attacks within the United States. In a response to those events, the FDNS Intelligence Branch queried USCIS databases and records for information on individuals with backgrounds similar to those of the UK plotters. A classified report was produced that identified individuals with exact matches to national security-related hits and individuals under investigation by Federal law enforcement. In addition, over 30 individual intelligence reports were prepared, published, and disseminated to the Intelligence Community.

The Intelligence Branch also administers the USCIS Request for Information (RFI) program, coordinating the preparation of agency responses to requests for immigration information from agencies and organizations outside of DHS, as well as other components and offices within DHS.

Transportation Security Administration (TSA) Intelligence Element

In November 2001, Congress established TSA through the Aviation and Transportation Security Act of 2001 (ATSA) . The agency was originally made part of the Department of Transportation, but was transferred to DHS pursuant to the Homeland Security Act when the Department was established in March 2003.

TSA is most commonly known for its aviation security role, particularly the security screening of airline passengers and their baggage. However, ATSA assigned the Assistant Secretary for TSA responsibility for security in all modes of transportation – aviation, maritime, mass transit, highway and motor carrier, freight rail, and pipeline. These modes form a transportation network that is central to the American economy. That network connects cities, towns, and farms, and moves millions of people and millions of tons of goods. The majority of transportation infrastructure in the United States is privately-owned. The remainder is owned and operated by state, local, or regional entities.

The size of the transportation sector in the United States makes it impossible for the Federal government to provide security for all modes. The exception is the commercial aviation sector. But, TSA does provide threat and other intelligence information to support security programs for each sector. In addition, TSA collaborates with industry and government operators and other stakeholders to develop strategies, policies, and programs to reduce security risks and vulnerabilities within each mode. Finally, it seeks to enhance capabilities to detect, deter, and prevent terrorist attacks and respond to and recover from attacks and security incidents, should they occur.

TSA uses a threat-based, risk management approach to the security task. According to former TSA Administrator Kip Hawley: "It begins with intelligence gathered by multiple U.S. agencies that is analyzed, shared, and applied." Intelligence is a key driver in determining the level of security appropriate for the threat environment.

TSA Office of Intelligence (TSA-OI)

The Assistant Secretary for TSA is responsible "to receive, assess, and distribute intelligence information related to transportation security and to assess threats specifically related to transportation. The TSA intelligence function is centered in its Office of Intelligence (TSA-OI) and led by an Assistant Administrator for Intelligence. The office consists of six divisions and an intelligence cell at the Transportation Security Operations Center (TSOC) (also known as the "Freedom Center") in Herndon, Virginia.

TSA-OI Analysis

OI is the only organization that analyzes threats specifically related to transportation. Although it is not an intelligence collector, the office works closely with IC agencies. It participates in NCTC's Daily Intelligence Secure Video Teleconference (SVTS) and receives and analyzes intelligence from the IC to determine its relevant to transportation security. Sources of information outside the IC include other DHS components, law enforcement agencies, and owners and operators of transportation systems. OI also reviews and analyzes the suspicious activity reporting by Transportation Security Officers, Behavior Detection Officers, and the Federal Air Marshal Service (FAMS). The office also works on intelligence issues with its counterparts in the United Kingdom and Canada.

An extensive two-way exchange of information is a unique aspect of OI's relationship with its stakeholders. OI has received funding associated with the Implementing Recommendations of the 9/11 Commission Act of 2007, to establish and implement an information sharing and analysis center (ISAC) for transportation security. OI is in the process of developing both the concept for the TS-ISAC and a milestone plan to establish this capability by early FY2011. Once operational, TSA envisions that the TS-ISAC will provide enhanced solutions for collaboration and information sharing with its stakeholders in the transportation industry.

OI analysts review and analyze information from its many sources in order to produce intelligence on current and emerging threats to U.S. transportation modes, provide tactical support to Federal Air Marshal missions, and support security for other special events. The Intelligence Watch and Outreach Division provides 24/7 indications and warning of threats to the transportation network. The Transportation Intelligence Analysis Division is responsible for in-depth threat analyses. Products are disseminated at appropriate classification levels to OI's principal stakeholders – the TSA leadership, the Office of Security Operations (which performs day-to-day management of the TSA aviation security program), the Office of Global Strategies, Transportation Security Network Management, the FAMS, and public and private transportation industry elements. Intelligence products are also shared with IC members and other DHS organizations.

OI analytic products include the Administrator's Daily Intelligence Brief, Information Bulletins and Circulars, the Transportation Suspicious Incident Reports (TSIR), and the Transportation Intelligence Note (TIN). The TSIR and the TIN products contain information on the latest potential threats, intelligence estimations and trends, and situations observed in transportation systems around the nation and the world. They are produced at the Unclassified/For Official Use Only level for TSA employees and transportation security professionals to enhance situational awareness.

Field Intelligence Officer Program

TSA-OI has deployed field intelligence officers to major airports throughout the United States. They work directly for OI through the respective Eastern or Western Regional Field Intelligence Coordinator. The field intelligence officers are responsible for providing intelligence support and threat briefings to the TSA Federal Security Directors, their staffs, and security workforce in their area of responsibility. In addition, they conduct liaison with the JTTF's and state, local, and tribal law enforcement officials and intelligence fusion centers.

TSA-OI Support to TSA Security Activities

Airline Passenger Pre-Screening

Former TSA Administrator, Kip Hawley has described TSA's aviation security strategy as an interlocking system of multiple layers of security. But, he says, "[w]e cannot focus on a 'catch them in the act" strategy that waits until a person tries to board an aircraft with a weapon ... our success is greatly improved with our ability to anticipate the terrorist act and thwart it well before it gets off the ground." He goes on to say "[a]s important as it is to detect threat objects, it is imperative that we use intelligence to aid in the identification and interception of the people who would do us harm."

Intelligence supports several elements of the airline passenger prescreening systems in use or proposed by TSA, such as the No Fly and Selectee Lists and Secure Flight. OI's specific role in each of these is described below.

No Fly and Selectee Lists

In addition to uncovering terrorist plots, U.S. intelligence and law enforcement agencies focus considerable effort on identifying individuals who are believed to be or are suspected of being terrorists. Agencies in possession of such intelligence nominate such persons for inclusion in the U.S. Government's consolidated terrorist watchlist, the TSDB. The "No Fly" and "Selectee" lists are subsets of the TSDB that are used to screen air travelers.

The "No Fly" list contains the names of individuals who are prohibited from boarding an aircraft "based on the totality of information, as representing a threat to commit an act of 'international terrorism' or 'domestic terrorism (as defined in 18 U.S.C. 2331) to an aircraft (including threat or air piracy, or a threat to airline, passenger, or civil aviation security), or representing a threat to commit an act of "domestic terrorism" with respect to the homeland."

The "Selectee" List is a list of individuals who "do not meet the criteria to be placed on…the "No Fly" list…and who meet the selectee criteria as members of a foreign or domestic terrorist organization (including foreign terrorist organization designated pursuant to 8 U.S.C. 1189); or associated with terrorist activity (as defined in Section 212(a)(3)(B) of the Immigration and Nationality Act)…" Individuals on the Selectee List may fly only after they and their checked and carry-on baggage have been subjected to additional screening

Originally maintained by TSA (and the FAA prior to 9/11), the No Fly and Selectee lists were transferred to the Terrorist Screening Center (TSC) in 2004. The TSC was established under the auspices of the FBI in an initiative under Homeland Security Presidential Directive (HSPD)-6. These lists are distributed to TSA, which is responsible for screening domestic airline passengers, and CBP which screens international passengers for admittance to the United States. At present, for domestic flights, the matching of passenger names against No Fly and Selectee lists is performed by the airlines on the basis of unclassified versions of watch lists sent to them by TSA.

There has been controversy about the No Fly list—its size and the names of those reported to have been on the list. The American Civil Liberties Union (ACLU) claimed in 2008 that the list contained over 1 million names. Individuals who have been reported at some point to be on the list—and were either refused travel or allowed to travel only after some delay—include politicians, musicians, and figures from other professions. It was even reported that some Federal Air Marshals were denied boarding on flights they were assigned to protect because their names matched those on the No Fly list.

The U.S. Government maintains that it has scrubbed these lists. At an October 22, 2008 press conference, then-DHS Secretary Michael Chertoff said there are 2,500 on the No Fly list, fewer than ten percent of whom are U.S. persons. He also said that there are less than 16,000 individuals on the Selectee lists. However, following the attempted bombing of Northwest Flight 253, on December 25, 2009, the No Fly List has nearly doubled to approximately 6,000 according to a senior intelligence official. "The list expanded, in part, to add people associated with al-Qa'ida's Yemen branch and others from Nigeria and Yemen with potential ties to [Umar Farouk] Abdullmuttalab ... " who is alleged to have attempted the bombing of the flight.

DHS has also established a redress mechanism where individuals, who believe their names are on one of the lists in error, may appeal. The program is called DHS Traveler Redress Inquiry Program (DHS TRIP ).

The No Fly and Selectee Lists are an integral part of TSA's airline passenger pre-screening system and one of the biggest tools, the agency argues, for keeping dangerous people off aircraft. OI, however, plays a limited role in who is added to these lists since the preponderance of individuals are nominated for inclusion by other core intelligence and law enforcement agencies. However, according to Acting TSA Administrator Gale Rossides, following the attempted bombing of Northwest Flight 253, "DHS is working with our interagency partners to re-evaluate and modify the criteria and process used to build the Terrorist Screening Database (TSDB), including adjusting the process by which names are added to the No-Fly and Selectee Lists."

Secure Flight

After abandoning an effort to establish a follow-on system to the Computerized Passenger Prescreening System (CAPPS), TSA began development of a new system of passenger pre-screening called Secure Flight. In October 2008, TSA announced the issuance of the Secure Flight Final Rule. This would shift pre-departure watch list matching responsibilities from individual aircraft operators to TSA, thus carrying out a recommendation of the 9/11 Commission.

Secure Flight is intended to alleviate the biggest challenge in the application of the No Fly and Selectee list in the passenger prescreening process—the incorrect matching of names on these watchlists with non-threatening passengers whose names are similar. Under Secure Flight, airlines will be required to collect a passenger's full name, date of birth, and gender when making an airline reservation. This additional information is expected to prevent most inconveniences at the airport, and will be particularly important for those individuals with names similar to those on the watch list. Then-TSA Administrator Kip Hawley asserts that "Secure Flight will improve security by maintaining the confidentiality of the government's watch list information while fully protecting passengers' privacy and civil liberties."

Under the Secure Flight program, DHS began transferring responsibility for watch list matching to TSA in 2009, and the transition is targeted for completion by the end of 2010.

Support to the Federal Air Marshal Service (FAMS)

The primary mission of the FAMS is to deter, detect, and defeat hostile acts targeting U.S. air carriers, airports, passengers and crews. The United States first established such a capability in 1968 with the FAA Sky Marshal program. That program was enlarged in 1985 and renamed the Federal Air Marshal Service. After 9/11, the program was greatly expanded and, pursuant to ATSA, was transferred from FAA to TSA. After DHS was established, the FAMS were briefly part of ICE, but were returned to TSA in 2005 where they remain today.

In addition to their anti-hijacking duties, the FAMS provide support during national emergencies and contingencies, such as Hurricane Katrina and the evacuation of American citizens from Lebanon during the 2006 conflict between Israel and Hezbollah. They also participate in Visible Intermodal Prevention and Response (VIPR) teams which augment security at key transportation facilities in urban areas around the country.

However, the predominant activity for the FAMS is to provide in-flight security for commercial airline flights. Some have questioned the extent of air marshal coverage of such flights. In a March 2008 investigative report, CNN claimed that "of the 28,000 commercial airline flights that take to the skies on an average day in the United States, fewer than 1 percent are protected by on-board, armed federal air marshals." TSA insists that the size of the federal air marshal cadre should be classified, as well as the number and itinerary of flights on which they fly, arguing that "we should not tip our hand to terrorists and let them know the mathematical probability of air marshals being on flights they may be interested in taking over or otherwise disrupting." However, TSA has publicly stated that the number is in "the thousands."

In order to determine which flights should be covered by air marshals, TSA uses an intelligence-driven, risk-based approach. This informs FAM deployments during "steady state" threat conditions and in cases of heightened threat, such as in August 2006 after discovery of the Transatlantic Airline Bombing Plot and in December 2009, following the attempted bombing of Northwest Flight 253. OI provides intelligence to support FAMS mission planning and has an intelligence unit, manned 24/7, at the TSOC.

The U.S. Coast Guard (USCG) Intelligence Element

As a nation of travelers and traders, America has a strategic interest in the maritime domain. The oceans bordering North America are both a barrier and a highway, separating the United States from potential enemies, connecting it to allies, and providing a venue for commerce and trade. Due to its complex nature and immense size, the maritime domain is recognized as particularly susceptible to exploitation and disruption by individuals, organizations, and States.

The USCG is a military, multi-mission, maritime service that is the "principal Federal agency responsible for safety, security, and stewardship within the maritime domain. These missions are performed in any maritime region where those interests may be at risk, including international waters and America's coasts, ports, and inland waterways. In March 2003, pursuant to the Homeland Security Act , the USCG was transferred from the Department of Transportation to DHS.

The USCG has several diverse missions—national defense, homeland security, maritime safety, and environmental and natural resources stewardship. To accomplish these missions, the USCG has authorities unique within the Federal government. It is both an armed service and the nation's primary maritime law enforcement agency.

Maritime Domain Awareness

One of the Administration's maritime security planning assumptions is that today's complex and ambiguous threats place an even greater premium on knowledge and shared understanding of the maritime domain. This knowledge and shared understanding is termed "maritime domain awareness" and is defined as "the effective understanding of anything associated with the global maritime domain that could impact the security, safety, economy, or environment of the United States." Since it grants time and distance to detect, deter, interdict, and defeat adversaries, maritime domain awareness has been enshrined as a principal objective of the National Strategy for Maritime Security .

The achievement of maritime domain awareness is, therefore, the principal objective of the USCG intelligence program. It is a collaborative effort—especially between the USCG and U.S. Navy —and also with DHS components, such as CBP and ICE, other Federal agencies, and the broader maritime community. Coast Guard intelligence collection begins at the port level and encompasses the entire maritime domain and features maritime surveillance activities by patrol aircraft, unmanned aerial vehicles, shore-based radar, and shipboard sensors including radar and passive electronic surveillance systems.

Coast Guard Intelligence and Criminal Investigations

The mission of the Coast Guard Intelligence and Criminal Investigations is to direct, coordinate, and oversee intelligence and investigative operations and activities that support all USCG objectives. It is a binary organization consisting of two closely linked parts:

The National Intelligence Element conducts "intelligence activities" as defined in Executive Order 12333 and the National Security Act of 1947 , including the collection, retention, and dissemination of national intelligence (foreign intelligence and counterintelligence) under those authorities. The National Intelligence Element of the USCG became a statutory member of the IC in December 2001 when Congress amended the National Security Act of 1947 . The USCG Cryptologic Program is part of the National Intelligence Element. The Law Enforcement Intelligence Program describes the collection, retention, and dissemination of information pursuant to USCG law enforcement and regulatory authorities. Persons and components that collect, process, and report law enforcement intelligence, or other information, including those persons performing intelligence functions as a collateral duty, are conducting functions under the Law Enforcement Intelligence Program and are not part of the National Intelligence Element.

Assistant Commandant for Intelligence and Criminal Investigations

The Assistant Commandant for Intelligence and Criminal Investigations oversees the entire USCG intelligence and criminal investigations enterprise, is the senior advisor on intelligence matters to the Commandant of the Coast Guard, and is the Intelligence Community Element Head, previously referred to as the Senior Official of the Intelligence Community for the Coast Guard National Intelligence Element. In this role, the Assistant Commandant is responsible for providing intelligence support to USCG operations.

USCG Cryptologic Program

The Cryptologic Program leverages the USCG's unique access, expertise and capabilities in the maritime environment where other U.S. Government agencies are not often present. This provides opportunities to collect intelligence that supports not only USCG missions, but other national security objectives as well. The USCG describes the mission of its Cryptologic Program as: "inform, warn, and protect Coast Guard, joint, combined, and coalition forces defending national and homeland security interests with timely, focused, and actionable signals intelligence (SIGINT) on adversary disposition, plans, and intent to facilitate tactical, operational, and strategic maritime domain dominance."

Through the Service Cryptologic Component, the USCG provides personnel to the National Security Agency/Central Security Service (NSA/CSS) funded through NSA's Consolidated Cryptologic Program. As part of the USCG's Integrated Deepwater System, tactical cryptologic capability will be installed on the new National Security Cutter and select legacy cutters. This capability should become fully operational in early 2011. The cryptologic systems integrated into the cutters are the same systems used by the U.S. Navy giving the cutters full interoperability with the Navy and, the USCG believes, decrease training and development costs. The USCG sees this capability as the cornerstone of the Global Maritime Intelligence Integration effort.

Coast Guard Counterintelligence Service (CGCIS)

The Coast Guard Counterintelligence Service (CGCIS) helps preserve the operational integrity of the Coast Guard by shielding its operations, personnel, systems, facilities, and information from the intelligence activities of foreign powers, terrorist groups and criminal organizations. CGCIS performs this role through counterintelligence investigations, operations, collection, analysis and production, and Counterintelligence (CI) functional services. CI uses these various aspects to also provide support to anti-terrorism/force protection; research and technology protection; and infrastructure protection/information operations. CGCIS works with the DHS CI program to ensure interoperability and to provide unique capabilities throughout DHS.

Coast Guard Investigative Service (CGIS)

The mission of the CGIS is to conduct professional criminal investigations, engage in law enforcement information and intelligence collection, provide protective services and establish and maintain law enforcement liaison directed at preserving the integrity of the Coast Guard, protecting the welfare of Coast Guard personnel, and supporting Coast Guard and DHS maritime law enforcement and counter-terrorism missions worldwide. CGIS is a federal law enforcement agency whose authority is derived from 14 U.S.C. §95. This authority provides for USCG special agents to conduct investigations of actual, alleged, or suspected criminal activity; carry firearms; execute and serve warrants; and make arrests within their jurisdiction as defined in the statute.

Other Key USCG Intelligence Organizations

The Coast Guard is divided operationally into two geographic areas, the Atlantic and Pacific. These, in turn, are divided into districts; each of which is responsible for a portion of the nation's coastline. The intelligence elements that support the operational organizations are overseen by the Assistant Commandant. They are the Intelligence Coordination Center, the Atlantic and Pacific Area Intelligence staffs, the Maritime Intelligence Fusion Centers, and the District and Sector Intelligence staffs.

The Coast Guard Intelligence Coordination Center (ICC)

The ICC is the national-level coordinator for collection, analysis, production, and dissemination of Coast Guard intelligence. It is the focal point of interaction with the intelligence components of other government entities such as the Department of Defense and Federal law enforcement agencies at the national level. The ICC is co-located with the U.S. Navy's Office of Naval Intelligence at the National Maritime Intelligence Center in Suitland, Maryland, and supports all Coast Guard missions. The ICC conducts the following activities:

Manages, analyzes, and produces intelligence that satisfies the unique maritime intelligence requirements of the USCG that include the areas of law enforcement, military readiness, counterterrorism, force protection, marine environmental protection, and port and maritime security. Analyzes, produces, and disseminates maritime intelligence in support of senior officials of the USCG, DHS, and other national decision makers. Manages the USCG intelligence collection requirements and collections management processes. Maintains a 24-hour Indications and Warning Center and current intelligence watch which includes the COASTWATCH Branch.

COASTWATCH

The ICC, in conjunction with the Office of Naval Intelligence and CBP, systematically screens arriving commercial vessels for potential security and criminal threats in the form of suspect ships and people. Current regulations require commercial vessels greater than 300 gross tons to submit advanced notice of arrival (NOA) information to the National Vessel Movement Center 96 hours prior to expected arrival in the U.S. ICC Coastwatch checks notice of arrival information against federal databases to identify potential security and criminal threats. Coastwatch's goal is to provide Coast Guard and interagency decision makers as much advance warning as possible, permitting time to coordinate appropriate operational responses and risk mitigation actions. Coastwatch has provided thousands of advanced warnings about arriving individuals identified in Federal counterterrorism, law enforcement, and immigration databases as national security or criminal threats. 27

Maritime Intelligence Fusion Centers (MIFC)

These centers are analysis and production centers that provide intelligence analysis to USCG operational commanders, the DOD, and IC and other law enforcement partners on geopolitical issues, terrorism, vessel movements and vessels of interest, transnational crimes (drugs, piracy, human smuggling), port security, and living marine resources. The Atlantic MIFC is located in Virginia Beach, Virginia and covers the North and South Atlantic, Gulf of Mexico, Caribbean, Western Mediterranean, and the Great Lakes and all navigable waterways east of the Rocky Mountains. The Pacific MIFC is located in Alameda, California and covers the North, Central, and South Pacific including the Pacific Rim and the west coast of South America.

Area and District Intelligence Staffs

These staffs provide intelligence support to their respective commanders and the International Ship and Port Facility Code (ISPS) Program. District intelligence staffs are also responsible for coordinating human intelligence (HUMINT) collection, conducting regional law enforcement and intelligence liaison, and overseeing the Sector Intelligence Officers.

Sector Intelligence Staffs (SIS).

The SIS is the key intelligence support element for all operations within a Coast Guard Sector. The SIS is led by a Sector Intelligence Office (SIO). The SIO is the primary intelligence advisor to the Sector Commander. Having successfully integrated the Field Intelligence Support Teams (FISTs) into the Sector Intelligence Staff, each Coast Guard Sector now has a full time dedicated maritime intelligence component to provide port-level threat assessments as well as conduct collection and reporting for all Sector wide maritime-related threats. As part of these efforts, they conduct liaison with Federal, state, local, tribal, and industry partners. The SIS' also report on activities in foreign ports by debriefing ship crews that have returned to the United States from overseas. These interviews are used at the ICC and the MIFC's to identify vessels or individuals of interest arriving at U.S. ports, or potential threats to maritime security.

U.S. Secret Service (USSS) Protective Intelligence and Assessment Division

Although the USSS is best known for its responsibility to protect the President and Vice President of the United States and visiting foreign heads of state and government, it was first established in 1865 as a law enforcement agency with a mandate to investigate the counterfeiting of U.S. currency. Its protective responsibilities began in 1901 following the assassination of President McKinley and were codified by Congress in 1906. The USSS remained a distinct organization within the Department of the Treasury until its transfer to DHS effective March 1, 2003, pursuant to the Homeland Security Act of 2002.

Today, in addition to its protective service mission, the USSS is responsible for maintaining the integrity of the nation's financial infrastructure and payment systems. This was historically accomplished through the enforcement of counterfeiting statutes, but since 1984, its investigative responsibilities have expanded to include crimes that involve financial institution fraud, computer and telecommunications fraud, false identification documents, access device fraud, advance fee fraud, electronic funds transfers, and certain money laundering crimes.

USSS Organizational Structure

The USSS employs approximately 3,500 special agents, 1,350 Uniformed Division officers, and more than 1,800 other technical, professional, and administrative support personnel. They work at the headquarters in Washington, D.C. and in 142 field offices and units within the United States and its territories and 22 offices in 18 foreign countries. The USSS is organized into seven offices, Investigations, Protective Operations, Protective Research, Professional Responsibility, Government and Public Affairs, Human Resources and Training, and Administration. The two principal operational offices are Investigations and Protective Operations. The principal support office from an intelligence perspective is the Office of Protective Research.

Investigations. This office investigates counterfeiting and other crimes against the integrity of the nation's financial infrastructure and payment systems. Protective Operations. This office performs the protective service mission of the USSS. Protectees include the President and Vice-President and their families, visiting heads of state and government, major Presidential candidates, and former President and Vice Presidents. It also has a uniformed division that is responsible for security at the White House Complex; the Vice President's residence; the Department of the Treasury (as part of the White House Complex); and foreign diplomatic missions in the Washington, D.C., area. In addition, the Office of Protective Operations executes the USSS's responsibility as the U.S. Government lead agency for planning, coordinating, and implementing the operational security plans for National Special Security Events (NSSE). Protective Research. This office is responsible for protective intelligence and analysis. It also evaluates and implements technology-based protective countermeasures. Within its Protective Intelligence and Assessment Division, intelligence, law enforcement, and other information is reviewed and threat and vulnerability assessments are produced.

Protective Intelligence and Assessment Division (PID)

The PID supports the USSS protective service mission through three primary means: (a) receive, evaluate, disseminate, and maintain information concerning subjects (individuals and groups) and activities that pose a known, potential, or perceived threat to persons, property, and events protected by the USSS; (b) investigate those subjects and activities; and (c) conduct protective intelligence 'advances' preceding protectee travel. The division is organized into foreign and domestic branches, a 24-hour duty desk to collect and process threat information, and the National Threat Assessment Center.

Unlike other DHS components that collect as well as analyze and disseminate intelligence information, the USSS is principally a consumer of intelligence which it analyzes to mitigate threats to those it is charged to protect. Because of its unique statutory authorities to use intelligence to prevent attacks on the nation's leaders and visiting foreign dignitaries, the USSS maintains that comparisons with intelligence gathering organizations within the IC are difficult, if not impossible.

National Threat Assessment Center (NTAC)238

NTAC uses historical information, investigative records, interviews, and other primary source material to produce long-term behavioral research studies that leverage USSS expertise in the protection of persons for homeland security or public safety purposes. The premise for NTAC was developed in the wake of an original assassination research study, the Exceptional Case Study Project (ECSP), conducted in collaboration with the Department of Justice. The ECSP was a study of individuals who had assassinated, attacked, or approached with lethal means, public officials or public figures from 1949-1996 in the United States. One major product from this study was a guidebook on protective intelligence and threat assessment investigations.

The NTAC was then established in 1998 as an effort to dedicate resources to better understand, and find ways to prevent, targeted violence; to share this knowledge with others; and to continue to provide leadership in the field of threat assessment. Through the Presidential Threat Protection Act of 2000, Congress formally authorized NTAC to provide assistance to Federal, state, and local law enforcement, and others with protective responsibilities, on training in the area of threat assessment; consultation on complex threat assessment cases or plans; and research on threat assessment and the prevention of targeted violence.

Notable NTAC Research Projects include

Safe School Initiative (1999-2001). In collaboration with the Department of Education, NTAC studied 37 school shootings, involving 41 attackers that occurred in the United States between January 1974-May 2000. The study examined the thinking, behaviors, and communications of the students who planned and carried out these incidents. The Insider Threat Study (2002-08). With financial support from DHS, NTAC partnered with CERT at Carnegie Mellon University, to examine organizational employees who perpetrated harm to their organizations via a computer or system or network to include intellectual property theft, fraud, and acts of sabotage. Four reports were published based on this study. Bystander Study (2004-08). In collaboration with the Department of Education and McLean Hospital, NTAC explored how students with prior knowledge of targeted school-based violence made decisions regarding whether and with whom to share the information. A report, Prior Knowledge of Potential School-based Violence: Information Students Learn May Prevent a Targeted Attack, was published in May 2008. Institutions of Higher Education Targeted Violence Study (ongoing): Pursuant to a recommendation in a report to the President following the April 2007 shootings at Virginia Tech, the NTAC is in the initial stages of a collaborative project with the Department of Education and the FBI Behavioral Analysis Unit to research targeted violence at institutions of higher education.

Oversight Challenges and Options for Congress

Managing competing claims for intelligence support is one of the biggest challenge facing the DHS IE. Former Under Secretary Allen stressed the importance of supporting the Department itself—both headquarters and operational components—noting that "... keeping dangerous people and dangerous items from crossing our air, land, and sea borders and protecting our critical infrastructures ... requires having reliable, real-time information and intelligence to allow the Department to identify and characterize threats uniformly, support security countermeasures, and achieve unity of effort in the response."

But, the DHS IE also has responsibilities to support the President, the Secretary, and other national leaders with a strategic perspective on a range of "all hazards" homeland security issues including terrorism threats. State, local, and tribal, law enforcement and security officials, as well as the operators of the nation's critical infrastructure, are also important customers. They require timely and actionable intelligence through usable products in order to prepare for and respond to a variety of threats.

Helping the Department achieve the right balance among these competing claims on its intelligence resources and capabilities is a challenging task for Congress. The following are options the Congress may wish to consider in exercising its oversight responsibility.

Support to State and Local Fusion Centers

Joint Fusion Center Program Management Office (JFC PMO)

In 2009, Secretary Napolitano directed I&A to outline a Department-wide initiative to strengthen the baseline capabilities and analytic capacity of state and major urban area fusion centers. As a result, a new program office for the fusion center program, the JFC PMO, will be established. DHS intends for the office to be managed on a day-to-day basis by I&A, but all relevant DHS components will be involved to include staff from those components. Among the intended responsibilities of the new JFC PMO are:

Lead a unified Department-wide effort to develop and implement survey tools to ensure state, local and tribal customers are provided the opportunities to define and identify the types of homeland security-related information they need, and the format in which they need it. Develop mechanisms, in coordination with federal, state, local, tribal, and territorial authorities, to improve the capability of fusion centers to gather, assess, analyze, and share locally generated and national information and intelligence, in order to provide complete pictures of regional and national threats and trends.

The Secretary requested a recommendation by March 2010 on the feasibility and optimal structure and resources of the JFC-PMO. Under Secretary Wagner has testified that the Department is also considering how a pending JFC-PMO will align with the White House's direction that DHS, in coordination with the PM-ISE, be the lead agency in establishing a National Fusion Center Program Office. The establishment and operation of these offices will be of interest to Congress.

Sustainment Funding

Law enforcement officers have praised fusion centers as a vital resource for information sharing and coordination while at the same time expressing great concern about the sustainment of these centers through consistent funding. Currently, funds from the State Homeland Security Grant Program (SHSGP) and Urban Area Security Initiative (UASI) are used to support state and local fusion centers. These grant programs are managed within DHS by the Federal Emergency Management Agency (FEMA) Grant Programs Directorate (GPD). However, the intelligence and information sharing activities that these funds support are operationally managed by DHS I&A. Some contend this disconnect between fund administration and implementation is problematic.

Congress may wish to consider alternative funding arrangements for fusion centers. One option is to designate a percentage of SHSGP and UASI funds for fusion centers. Another is to authorize and appropriate funding for a new grant program for fusion centers.

Information Technology Infrastructure

The success of the fusion center program is dependent on the infrastructure that enables state and local fusion centers to have access to each other's information as well as to the appropriate federal databases. The fusion center program and the Nationwide Suspicious Activity Report Initiative (NSI) rely on the concept of shared space architecture, where the fusion centers replicate data from their systems to an external server under their control, making the decision on what to share totally under their control. A secure portal is then created that allows simultaneous searching of all such databases so that fusion centers will be able to aggregate any relevant information that exists throughout the national fusion center network. The NSI project team has arranged for secure access to this portal on one of three existing networks—Law Enforcement Online, Regional Information Sharing Services, or HSIN. Each fusion center will require a server and software to translate data from whatever case management or intelligence system is in place to a separate database on the server.

Achieving information sharing objectives also requires that partners establish wide-scale electronic trust between the caretakers of sensitive information and those who need and are authorized to use that information. Fusion Centers must, therefore, acquire a federated capability for identity and privilege management that securely communicates a user's roles, rights, and privileges to ensure network security and privacy protections. The two elements of this are identification/authentication—the identity of end users and how they were authenticated; and privilege management—the certifications, clearances, job functions, and organizational affiliations associated with end users that serve as the basis for authorization decisions.

Congress may wish to consider providing funding and leadership to provide this infrastructure capability to all 72 fusion centers.

Quadrennial Homeland Security Review (QHSR)

In February 2010, DHS produced its first Quadrennial Homeland Security Review (QHSR), a comprehensive assessment outlining its long-term strategy and priorities for homeland security and guidance on the Department's programs, assets, capabilities, budget, policies, and authorities. The QHSR report outlines the Nation's homeland security missions, which it describes as enterprise-wide (i.e., not limited to DHS):

Mission 1. Preventing Terrorism and Enhancing Security Mission 2: Securing and Managing our Borders Mission 3, Enforcing and Administering Our Immigration Laws Mission 4: Safeguarding and Securing Cyberspace Mission 5: Ensuring Resilience to Disasters

The report also calls for the maturing and s trengthening of the homeland security enterprise by:

Establishing a comprehensive system for building and sharing awareness of risks and threats. Developing and implementing a methodology to conduct national-level homeland security risk assessments. Enhancing critical tools and institutionalizing arrangements for timely access and effective sharing of information and analysis. Establishing a robust approach to identify verification that safeguards individual privacy and civil rights. Ensuring shared situational awareness in the air, land and maritime domains. Using and integrating counterintelligence in all aspects of homeland security to thwart attacks against the homeland. Promoting a common understanding of security as a shared responsibility. Fostering communities that have information, capabilities, and resources to prevent threats, respond to disruptions, and ensure their own well-being. Fostering a broad national culture of cooperation and mutual aid. Ensuring scientifically informed analysis and decisions are coupled to innovative and effective technological solutions.

A review of the QHSR report and the forthcoming "bottom-up review" will give Congress an opportunity to review the department's latest judgments about the homeland security-related risks facing the country and what resources should be committed to address those risks. The results of that review will be particularly important as Congress considers an authorization bill for DHS.

Evolving Risks

Former Secretary Chertoff has said that "DHS must base its work on priorities that are driven by risk." DHS has defined "risk" as the product of three variables, threat (the likelihood of an attack occurring), vulnerability (the relative exposure to an attack), and consequence (the expected impact of an attack). The DHS IE identifies, measures, and monitors the threat variable in the DHS risk equation.

The role of the DHS IE in risk management decision making at the Department is another area Congress may wish to explore. A recent study by the Homeland Security Institute noted that DHS risk assessments require threat inputs but generating useful threat judgments is challenging. It suggested ways to improve risk and intelligence analyst collaboration to better support DHS decision making.

Terrorism remains the paramount concern to the Department. The latest National Intelligence Estimate on the terrorist threat to the United States, concludes that "Al Qa'ida is and will remain the most serious terrorist threat to the Homeland ... has protected or regenerated key elements of its Homeland attack capability ... and that in its Homeland plotting is likely to continue to focus on prominent political, economic, and infrastructure targets with the goal of producing mass casualties, visually dramatic destruction, significant economic aftershocks, and/or fear among the U.S. population."

Following the hijacking of aircraft, that were then flown into the World Trade Center and the Pentagon with devastating effects, a significant portion of homeland security resources in the United States were understandably devoted to aviation security—an amount proportionally larger than that of other transportation modes or critical infrastructure. The 2006 Transatlantic Airlines Plot and the Christmas Day 2010 attempted bombing of Northwest Flight 253, demonstrate that the threat to commercial aviation remains but that the tactics employed have evolved.

Since 9/11, al-Qa'ida and other terrorist groups with anti-Western and anti-American ideologies have committed several other deadly terrorist attacks, including:

Bali, 2002. The Islamist group Jemaah Islamiyah bombed nightclubs killing 202. Madrid, 2004. A Muslim, al-Qa'ida-inspired terrorist cell bombed commuter trains killing 190 and injuring over 1,000. London, 2005. British Islamist extremists bombed city buses killing 52 and injuring over 700. Mumbai, 2008. A team from the militant group Lashkar-e-Taiba conducted a shooting and bombing rampage at two hotels, a railway station, hospital, Jewish Center, cafe, and cinema. 164 were killed.

All of these attacks involved mass casualties. All resulted in visually dramatic destruction. But, none of them were committed against civil aviation. Recognizing that some elements of the nation's critical infrastructure are defended in depth against attack, while others are not, a question of abiding interest is whether terrorists might adapt by choosing to attack softer targets in the Homeland, such as nightclubs, commuter trains, buses, or other places where large numbers of Americans congregate.

In addition, in a period of less than one year (May 2009-March 2010), there were 12 "homegrown" jihadist-inspired terrorist attacks and plots (two attacks and 10 plots) by American citizens or lawful permanent residents of the United States. By comparison, in over seven years from the 9/11 attacks through May 2009, there was an annual average of only two such plots, none of which resulted in attacks. This has not gone unnoticed by many who are concerned that domestic radicalization, previously viewed as a problem largely confined to Europe, is a bigger threat in the United States than originally believed.

And what about methods of attack not yet imagined? The Australian scholar Mervyn Bendle asks us to consider one such scenario. The recent catastrophic bushfires in his own country "alert us to the extreme danger posed by pyroterrorism, especially as global terrorist organizations continue to modify their strategies in the face of increasingly effective counterterrorism measures employed against them. Pyroterrorism can do great harm to valuable natural resources and infrastructure; destabilise and degrade regional economies; kill, maim, terrorise, and radically reduce the quality of life of large populations of people; and even destabilise social and political systems."

Bendle argues that this is not an "alarmist, eccentric, or "Islamophobic" notion." His study documents that pyroterrorism involvement has been suspected or established in Greece, Israel, Spain, and Estonia. Moreover, in the late 1990's, the Earth Liberation Front set fire to various forests, commercial and industrial buildings in the United States including the U.S. Forest Service Headquarters in Oregon.

Pyroterrorism is just one example of many alternative hypotheses that homeland security risk managers may wish to consider in order to avoid what was famously described in the 9/11 Commission Report as "a failure of imagination." Threat assessment is a critical component of the risk equation. Risk, in turn, is an important element of the QHSR which will ultimately inform how the department proposes to allocate resources in the future based on the evolving threat environment.

Therefore, Congress may wish to explore:

How I&A will support the next step in the Department's QHSR process, the top-to-bottom review that is intended to link strategy to program to budget. How intelligence analysis and assessments are used within the Department to determine priorities for funding of new or existing homeland security programs. How intelligence analyses and assessments have led to increased or decreased funding for existing programs. The framework that DHS will establish for enhanced collaboration among risk and intelligence analysts.