Information Sharing: Federal Agencies Are Helping Fusion Centers Build and Sustain Capabilities and Protect Privacy, but Could Better Measure Results
Released: 2010-09-29T00:00:00

Letter

Background

Fusion Centers

Nationwide, states and major urban areas have established fusion centers to coordinate the gathering, analysis, and dissemination of law enforcement, homeland security, public safety, and terrorism information. After centers had begun to be established around the country, Congress passed the 9/11 Commission Act to require the Secretary of Homeland Security to share information with and support fusion centers. The National Strategy identifies fusion centers as vital assets critical to sharing information related to terrorism because they serve as focal points for the two-way exchange of information between federal agencies and state and local governments. According to DHS, fusion centers are the primary way that DHS shares intelligence and analysis with state and local homeland security agencies. For example, fusion centers typically issue analytical products, such as daily or weekly bulletins on general criminal or intelligence information and intelligence assessments which, in general, provide in-depth reporting on an emerging threat, group, or crime. These products are primarily created for law enforcement entities and other community partners, such as members of the critical infrastructure sectors. In recent years, fusion centers have been credited with being influential in disrupting a planned terrorist attack on the New York City subway system, investigating bomb threats against U.S. airlines, and providing intelligence support to several political conventions and summits. Other fusion centers have been instrumental in providing intelligence and analytical support to assist with securing our nation’s borders. For example, the Arizona Counterterrorism Information Center and the New York State Intelligence Center routinely (i.e., either twice a week or quarterly, respectively) issue border-specific intelligence products to enhance the situational awareness of law enforcement agencies in border communities.

While all fusion centers were generally created by state and local governments to improve information sharing across levels of government and to prevent terrorism or other threats, the missions of fusion centers vary based on the environment in which the center operates. Some fusion centers have adopted an “all-crimes” approach, incorporating information on terrorism and other high-risk threats into their jurisdiction’s existing law enforcement framework to ensure that possible precursor crimes, such as counterfeiting or narcotics smuggling, are screened and analyzed for linkages to terrorist planning or other criminal activity. Other fusion centers have adopted an “all-hazards” approach. In addition to collecting, analyzing, and disseminating information on potential terrorist planning and other crimes, these fusion centers identify and prioritize types of major disasters and emergencies, such as hurricanes or earthquakes, which could occur within their jurisdiction. In doing so, they gather, analyze, and disseminate information to assist relevant responsible agencies—law enforcement, fire, public health, emergency management, critical infrastructure—with the prevention, protection, response, or recovery efforts of those incidents.

Fusion centers also vary in their personnel composition and staffing levels. Consistent with the statutory definition of a fusion center, these centers typically bring together in one location representatives from several different state or local agencies, such as state and local law enforcement agencies—state police, county sheriffs, and city police departments— homeland security agencies, emergency management agencies, and the National Guard. In addition, as DHS is required to the maximum extent possible to assign officers and intelligence analysts to fusion centers, many centers have federal personnel working on-site, such as DHS intelligence operations specialists and Customs and Border Protection agents, along with others such as FBI intelligence analysts and Drug Enforcement Administration agents. In terms of staffing levels, a 2009 joint DHS and PM-ISE survey of fusion centers reported that the number of personnel working at these centers ranged from under 10 employees to over 75 per center, as shown in figure 1.

Federal Role in Relation to Fusion Centers

Recognizing that DHS had already begun to provide support to fusion centers but needed to play a stronger, more constructive role in assisting these centers, Congress passed the 9/11 Commission Act, which required the Secretary of Homeland Security to create the State, Local, and Regional Fusion Center Initiative. The Act also required the Secretary, in coordination with representatives from fusion centers and the states, to take certain actions in support of the initiative. Specifically, the Act requires that the Secretary take a number of steps to support the centers, including supporting efforts to integrate fusion centers into the ISE, assigning personnel to centers, incorporating fusion center intelligence information into DHS information, providing training, and facilitating close communication and coordination between the centers and DHS, among others. The law also required the Secretary to issue guidance that includes standards that fusion centers shall undertake certain activities. These include, for example, that centers collaboratively develop a mission statement, identify expectations and goals, measure performance, and determine center effectiveness; create a collaborative environment for the sharing of intelligence and information among federal, state, local, and tribal government agencies, the private sector, and the public, consistent with guidance from the President and the PM-ISE; and offer a variety of intelligence and information services and products.

DHS has taken steps to organize and establish a management structure to coordinate its support of fusion centers. In June 2006, DHS tasked I&A with the responsibility for managing DHS’s support to fusion centers. I&A established a State and Local Program Office (SLPO) as the focal point for supporting fusion center operations and to maximize state and local capabilities to detect, prevent, and respond to terrorist and homeland security threats.

Consistent with the 9/11 Commission Act and Intelligence Reform Act, DHS, in conjunction with DOJ and the PM-ISE, has issued a series of guidance documents to support fusion centers in establishing their operations. In 2006, through the Global Justice Information Sharing Initiative (Global), DHS and DOJ jointly issued the Fusion Center Guidelines, a document that outlines 18 recommended elements for establishing and operating fusion centers consistently across the country, such as establishing and maintaining a center based on funding availability and sustainability; ensuring personnel are properly trained; and developing, publishing, and adhering to a privacy and civil liberties policy.

To supplement the Fusion Center Guidelines, in September 2008, DHS, DOJ, and Global jointly published the Baseline Capabilities, which were developed in collaboration with the PM-ISE and other federal, state, and local officials. The Baseline Capabilities define the capabilities needed to achieve a national, integrated network of fusion centers and detail the standards necessary for a fusion center to be considered capable of performing basic functions by the fusion center community. For example, the Baseline Capabilities include standards for fusion centers related to information gathering, recognition of indicators and warnings, processing information, intelligence analysis and production, and intelligence and information dissemination. In addition, the Baseline Capabilities include standards for the management and administrative functioning of a fusion center. Among these are standards for ensuring information privacy and civil liberties protections, developing a training plan for personnel, and establishing information technology and communications infrastructure to ensure seamless communication between center personnel and partners. The development of these baseline standards is called for in the National Strategy, which identifies their development as a key step to reaching a national integrated network of fusion centers. By achieving this baseline level of capability, it is intended that a fusion center will have the necessary structures, processes, and tools in place to support the gathering, processing, analysis, and dissemination of terrorism, homeland security, and law enforcement information.

In accordance with the 9/11 Commission Act, DHS, DOJ, and the PM-ISE rely on fusion centers as critical nodes in the nation’s homeland security strategy and provide them with a variety of other support.

Federal Grant Funding: DHS’s HSGP awards funds to states, territories, and urban areas to enhance their ability to prepare for, prevent, protect against, respond to, and recover from terrorist attacks and other major disasters. The fiscal year 2010 HSGP consists of five separate programs, two of which are primarily used by states and local jurisdictions, at their discretion, for fusion-center-related funding. These grant programs are not specifically focused on, or limited to, fusion centers. Thus, fusion centers do not receive direct, dedicated funding from DHS; rather, the amount of grant funding a fusion center receives is determined by a state’s State Administrative Agency (SAA)—the state-level agency responsible for managing all homeland security grants and associated program requirements—or an urban area’s working group, which has similar responsibilities. A fusion center typically contributes to the development of a state’s federal grant application by providing information on how it will use the proposed funding needed, called an investment justification. Personnel: DHS and DOJ have deployed, or assigned, either part-time or full-time personnel to fusion centers to support their operations and serve as liaisons between the fusion center and federal components. For example, DHS personnel are to assist the center in using ISE information; review information provided by state, local, and tribal personnel; create products derived from this information and other DHS homeland security information; and assist in disseminating these products. As of July 2010, DHS’s I&A had deployed 58 intelligence officers and the FBI had deployed 74 special agents and analysts full time to 38 of the 72 fusion centers.

Access to Information and Systems: DHS and DOJ also share classified and unclassified homeland security and terrorism information with fusion centers through several information technology networks and systems. For example, in February 2010, DHS’s I&A reported that it had installed the Homeland Secure Data Network, which supports the sharing of federal secret-level intelligence and information with state, local, and tribal partners, at 33 of 72 fusion centers. DHS also provides an unclassified network, the Homeland Security Information Network, which allows federal, state, and local homeland security and terrorism-related information sharing.

Training and Technical Assistance: DHS has partnered with DOJ, through Global, to offer fusion centers a variety of training and technical assistance programs. These include training on intelligence analysis and privacy and civil liberties protections, as well as technical assistance with technology implementation, security, and the development of liaison programs to coordinate with other state and local agencies.

Privacy Requirements for Fusion Centers

Fusion centers have a number of privacy related requirements. As provided under the 9/11 Commission Act, DHS is required to issue standards that fusion centers are to develop, publish, and adhere to a privacy and civil liberties policy consistent with federal, state, and local law. In addition, the standards must provide that a fusion center give appropriate privacy and civil liberties training to all state, local, tribal, and private sector representatives at the center and have appropriate security measures in place for the facility, data, and personnel. Because fusion centers are within the ISE when they access certain kinds of information, federal law requires they adhere to ISE privacy standards issued by the President or the PM-ISE under the authority of the Intelligence Reform Act, as amended. Other federal requirements found in 28 C.F.R. part 23, Criminal Intelligence Systems Operating Policies, apply to federally funded criminal intelligence systems, and fusion centers receiving criminal intelligence information must follow these procedures, which also include privacy requirements.

In 2006, the PM-ISE issued the ISE Privacy Guidelines, which establish a framework for sharing information in the ISE in a manner that protects privacy and other legal rights. The ISE Privacy Guidelines apply to federal departments and agencies and, therefore, do not directly impose obligations on state and local government entities. However, the ISE Privacy Guidelines do require federal agencies and the PM-ISE to work with nonfederal entities, such as fusion centers, seeking to access protected information to ensure that the entities develop and implement appropriate policies and procedures that are at least as comprehensive as those contained in the ISE Privacy Guidelines. Among the primary components of these guidelines, agencies are required to, for example, ensure that protected information is used only for authorized, specific purposes; properly identify any privacy-protected information to be shared; put in place security, accountability, and audit mechanisms; facilitate the prevention and correction of any errors in protected information; and document privacy and civil liberties protections in a privacy and civil liberties policy.

Federal Efforts Are Under Way to Assess Centers’ Capabilities, Target Funding to Capability Gaps, and Assess Costs, but Measuring Results Achieved Could Help Show Centers’ Value to the ISE

Officials in all 14 fusion centers we contacted cited federal funding as critical to expanding their operations and achieving and maintaining the baseline capabilities needed to sustain the national network of fusion centers. An assessment of fusion centers, led by the PM-ISE, DHS, and DOJ, is under way to obtain data about the current capabilities of centers nationwide, identify the operational gaps that remain, and determine what resources centers may need to close the gaps. DHS is evaluating whether to amend its grant guidance to require fusion centers to use future funding to support efforts to meet and maintain the baseline capabilities. DHS also has plans to assess the costs of the fusion center network to help inform decisions about the extent to which the funding mechanisms in place in support of fusion centers are adequate, or if other funding avenues need to be explored. However, taking steps to implement standard performance measures to track the results of fusion centers’ efforts to support information sharing and assess the impact of their operations could help demonstrate center value to the ISE and enable the federal government to justify and prioritize future resources in support of the national network.

Fusion Center Officials We Interviewed Cited Federal Funding as Critical to Sustaining Operations

Officials in all 14 fusion centers we contacted stated that without continued federal grant funding, in particular DHS grant funding, their centers would not be able to expand, or in some instances even maintain, operations. States have reported to DHS that they have used about $426 million in grant funding from fiscal year 2004 through 2009 to support fusion-related activities nationwide, as shown in table 1.

According to a nationwide survey conducted by DHS and the PM-ISE, of the 52 of 72 fusion centers that responded, on average, over half of their 2010 budgets were supported by federal funding. Specifically, as shown in figure 2, these centers reported that federal grant funding accounted for 61 percent of their total current budgets of about $102 million and state or local funds accounted for 39 percent ($40 million), according to information reported to DHS and the PM-ISE. For the 14 centers we contacted, officials in 6 of the centers reported relying on federal grant funding for more than 50 percent of their annual budgets, which ranged from $600,000 to about $16 million.

Officials in all 14 of the centers we contacted stated that federal funding was critical to long-term sustainability and provided varying examples of the impact that not having federal grant funding would have on their fusion centers. Officials in four fusion centers stated that without federal funding, their centers would not be able to continue operations. For example, an official in one of these centers stated that with the state’s economic recession, the fusion center does not expect to grow operations over the next 5 years and is struggling to maintain the personnel and funding needed to maintain their current operations, which includes fewer than 10 full-time personnel with an estimated budget of a little over $500,000. Officials in another fusion center stated that while they have a comparatively large budget of about $10 million, they could not maintain their level of operations without the federal grant funding, about $5 million per year, they receive.

Fusion Centers See Federal Funding as Necessary to Achieve and Maintain the Baseline Capabilities; a Nationwide Assessment to Gauge Gaps in Centers’ Capabilities Is Under Way

Officials in all 14 fusion centers we contacted stated that without sustained federal funding, centers could not expand operations to close the gaps between their current operations and the baseline capabilities, negatively affecting their ability to function as part of the national network. For example, officials from one fusion center stated that they currently do not have the resources to hire a security officer, which affects the center’s development, implementation, maintenance, and oversight of security measures, including ensuring that security measures are in place to provide the proper information protection in compliance with all applicable laws and the center’s privacy and civil liberties policy. Officials in another fusion center stated that federal grant funding is essential to expanding their outreach and coordination with other state and local entities—a recommended baseline capability and one of the primary ways that centers maintain partnerships with other entities.

Consistent with fusion center views reported at the 2010 National Fusion Center Conference, officials in all 14 fusion centers we contacted stated that achieving and maintaining the baseline capabilities was key to sustaining their centers. By achieving and maintaining these capabilities, fusion centers should have the necessary structures, processes, and tools in place to support the gathering, processing, analysis, and dissemination of terrorism, homeland security, and law enforcement information as part of the national, integrated network. At the 2010 National Fusion Center Conference, fusion center directors reported that achieving the critical operational capabilities at each fusion center was necessary to ensure an effective flow of information throughout the national network of fusion centers. To do so, these directors cited the importance of performing baseline capability self-assessments, identifying gaps between operations and the baseline capabilities, developing plans to address the gaps, and leveraging existing resources more effectively and efficiently to close those gaps. For example, assessing gaps in centers’ current information technology and communication infrastructure and the associated costs of implementing the necessary systems may enable fusion centers to focus resources more efficiently to address these needs and close the identified gaps. Officials in all of the 14 fusion centers we contacted said that, in recognizing the importance of meeting the baseline capabilities, they had taken some steps to review their own operations and identify gaps between their current operations and the recommended baseline capabilities. For example, an official in one center said that he had conducted a systematic gap analysis of the center’s current operations against the baseline capabilities and determined that the center still had to achieve an estimated 80 percent of the capabilities, such as developing performance metrics and an outreach program. Gaps identified by officials at the 14 fusion centers included, for example, the need to develop information technology and related tools for analysis; not having a privacy and civil liberties policy in place; not having identified a privacy/civil liberties officer; and not having identified a security officer.

To provide data about the baseline capabilities of fusion centers nationwide, the PM-ISE, DHS, and DOJ are conducting an ongoing systematic assessment of centers’ capabilities. The goal of the nationwide assessment, according to DHS senior officials, is to help enable both federal and fusion center representatives to (1) obtain more accurate information on the current status of centers’ abilities to meet the baseline capabilities, (2) help identify gaps between centers’ current operations and the capabilities, and (3) use this information to develop strategies and realign resources to support centers’ efforts to close those gaps going forward. Further, according to both DHS senior officials and fusion center representatives, the results of the assessment are also intended to provide centers with the information needed to develop more accurate and specific investment justifications to their SAAs in competing for DHS HSGP funding.

According to DHS and a senior official from the NFCA, personnel from DHS, the PM-ISE, and DOJ coordinated with state and local government representatives and fusion center officials prior to and during the National Fusion Center Conference in February 2010 to jointly identify four critical operational capabilities and four enabling capabilities to be prioritized in developing the national network of fusion centers. Among the four enabling capabilities are those that relate to establishing a sustainment strategy and establishing privacy and civil liberties protections, as shown in table 2.

The nationwide assessment of fusion centers consists of two phases—a self-report survey followed by onsite validation. First, the PM-ISE sent a self-assessment questionnaire, which was to be completed in May 2010, to all 72 designated fusion centers to use to assess their current operations against all baseline capabilities. Second, starting in June 2010, seven validation teams consisting of federal and fusion center personnel began making site visits to fusion centers to validate centers’ responses to the self-assessment. Specifically, the validation teams are to conduct a review of the four critical operational capabilities that were identified collaboratively by federal officials and fusion center directors as being critical to the functioning of the national network. Validation teams are also to review information on the privacy and civil liberties protections established by these fusion centers and to discuss the centers’ sustainment strategies. Senior DHS officials stated that this review is to involve discussions on each fusion centers’ experiences and related issues, challenges, and associated costs of achieving and maintaining the four critical operational capabilities, as well as the privacy and civil rights/civil liberties enabling capability, to provide additional information on why gaps may exist and how to address them.

According to DHS senior officials, the site visits were completed in September 2010. The results of the assessment, which are to include the aggregate of both the self-assessment and on-site validation data, are expected to be analyzed and shared in a report with the participating fusion centers by the end of October 2010. Further, according to DHS senior officials, they are planning to conduct the assessment on a recurring basis. Thus, this initial assessment is expected to serve as a baseline against which to measure the development of the baseline capabilities in individual fusion centers, as well as across the national network.

DHS Has Efforts Under Way to Link DHS Grants to Filling Baseline Capabilities Gaps and Plans to Assess Costs of the Fusion Center Network

DHS has opportunities to better target federal fusion center funding to fill critical baseline capability gaps and is taking steps to do so. Both the National Strategy and DHS emphasize that federal agencies are to play an active role in addressing the challenge of sustaining fusion centers by ensuring that they are able to achieve and maintain the baseline capabilities. Specifically, the National Strategy states that federal agencies are to assist fusion centers in incorporating the baseline capabilities into their operations by amending and modifying grants and grants guidance, and other applicable funding programs, to ensure that centers are able to meet and sustain the baseline capabilities and operational standards. In its fiscal year 2010 HSGP grant guidance, DHS encourages, but does not require, that fusion centers prioritize the allocation of HSGP funding they receive through their SAAs to meet and maintain the baseline capabilities. Further, senior DHS officials stated, generally, that the results of the nationwide assessment will be used to address future fusion center funding and that the office will determine how it may leverage DHS’s HSGP to ensure that centers have access to grant funds and assist with putting these mechanisms in place for the future.

Senior officials from DHS as well as all 14 of the fusion centers we contacted stated that linking, or tying, future HSGP grant funding to achieving and maintaining the baseline capabilities may better enable fusion centers to obtain the resources needed to address the gaps in baseline capabilities by allowing them to more specifically detail how grant funding is to be used in their investment justifications. For example, by tying future grant funding to developing fusion centers’ ability to gather information, aggregate it, analyze it, and share it as appropriate, centers may be more likely to obtain the funding necessary to develop the specific information systems and analytical tools needed to enable them to achieve these capabilities. An Acting Director with FEMA’s Office of Counterterrorism and Security Preparedness stated that, as part of developing the Fiscal Year 2011 HSGP guidance, FEMA is currently working with DHS and fusion center stakeholders to evaluate the potential for amending the guidance to accomplish two goals. Specifically, they are working to (1) require, rather than encourage, that fusion centers use 2011 grant funding allocated from SAAs to achieve and maintain all of the baseline capabilities; and (2) focus funding to specifically address gaps in baseline capabilities identified during the assessment process. For example, the official said that they are exploring options such as requiring centers to include in their investment justifications the results of the nationwide assessment and indicating how the center would use funding to fill any identified gaps. Further, this official added that FEMA has also begun collaborating within DHS and with DOJ to discuss current grant programs and possibilities for future interagency coordination on the support specifically for fusion centers. Directives such as these could help ensure that capabilities are met by enabling fusion centers to provide specific data about operational gaps and needs in their investment justifications.

While DHS could ensure that fusion centers target the federal funding they receive on filling baseline capabilities gaps, fusion centers have called on the federal government to establish a dedicated funding stream for them. DHS’s HSGP is the primary grant program through which fusion centers receive funding, but these grants are not specifically focused on, nor limited to, fusion centers. As such, fusion centers compete with other state homeland security, law enforcement, and emergency management agencies and missions for a portion of the total amount of HSGP funding awarded to the SAA, which decides what portion of the total funding centers will receive. This process has generated long-standing concerns by the fusion center community about the lack of a longer-term, predictable funding source for the centers. For example, we reported in October 2007 that fusion centers reported challenges with funding, that these issues made it difficult to plan for the future, and that fusion centers were concerned about their ability to sustain their capability for the long term. The Congressional Research Service (CRS) similarly reported in January 2008 that the threat of diminished or eliminated federal or state funding, such as a decrease in DHS grant funding programs, poses a risk to the development of fusion centers. The DHS Office of Inspector General subsequently reported in December 2008 that fusion center officials they spoke with remained concerned with sustainability and funding, emphasizing that sustainment planning and funding from the federal government is essential for the success of fusion centers.

Officials from 13 of the 14 centers we contacted cited a number of challenges with obtaining funding and the lack of a dedicated funding source, which affected their ability to plan long term or expand their operations. For example, officials in 9 of these centers stated that uncertainty around the amount of federal grant funding the fusion center will receive from their states each year made it difficult to plan and expand operations. For instance, an official from a fusion center stated that the center relies on federal funding for 80 percent of its annual operating budget, but has to compete with several other state agencies and about 75 counties for a portion of HSGP funding each year. Officials in another fusion center stated that competition for limited federal grant funding has made getting the necessary funding more difficult and, as a result, they have had to scale back part of their outreach efforts to state and local entities, which is one of the four critical enabling capabilities.

In referring to the role fusion centers are to have in the national information sharing network, officials from all 14 fusion centers stated that there should be a federal grant funding stream or program dedicated specifically to support fusion centers. For example, officials from 6 centers stated that, since the National Strategy has identified fusion centers as a key component of the success of the ISE, the federal government should recognize the importance of providing dedicated funding support so that centers with varying missions and resources can continue to close baseline capability gaps and function as key partners in the national network. An official from one of these fusion centers stated that while centers are owned and operated by state and local entities—and should thus be supported by state and local resources—centers are also expected, as members of the ISE, to support a national information sharing, homeland security mission. Moreover, this official said that if fusion centers, as the primary focal points of information sharing between state and local and federal governments, are to support this mission, there should be a targeted federal funding source to support centers’ efforts to meet and achieve the baseline capabilities, which have been identified as being essential for centers to function in the national network.

Senior I&A and FEMA officials said that they understood the fusion centers’ concerns and recognized the challenges centers faced in competing for funding. However, these FEMA officials stated that they do not have the authority to create a fusion-center-specific grant within the HSGP and that doing so would require congressional action. These FEMA officials said that, in addition to the nationwide assessment that is underway to identify gaps in baseline capabilities, within the HSGP, they have broadened the allowable costs for which fusion centers can use HSGP funding and prioritized funding on achieving the baseline capabilities. However, DHS has not directed that a certain percentage of HSGP funding be used for fusion centers out of concern that other state agencies, such as emergency management agencies, would likewise lobby for such specific funding. These officials added that this would not be possible because they are trying to balance ensuring that SAAs have flexibility in administering HSGP funds while ensuring that federal fusion center requirements are supported and met.

Further, senior DHS officials stated that DHS has recognized the need to conduct extensive research on funding options for fusion centers, stating that, after the nationwide assessment is completed, the SLPO is to assess key budgetary processes to determine how support to fusion centers can be affected and determine DHS’s ability to identify additional funding options for centers. In addition, Fiscal Year 2012 implementation guidance for the ISE requires that, by October 29, 2010, DHS should develop and promulgate an annual common reporting process that will document the total operational and sustainment costs of each of the 72 fusion centers in the national network. Senior DHS officials stated that, while not yet completed, the SLPO has begun to develop this reporting process and that it is to be based in part on surveys implemented in previous years at fusion centers. These officials added that the goal of the guidance is to develop annual data on the costs to sustain fusion centers, and that these data are a necessary first step to assessing the adequacy of current funding mechanisms.

Taking Steps to Implement Standard Performance Measures to Track the Results of Fusion Centers’ Efforts to Support Information Sharing Could Help Demonstrate Centers’ Value to the ISE

If fusion centers are to receive continued financial support, it is important that centers are also able to demonstrate that they are providing critical information that is helping the federal government and state and local agencies protect against terrorist and homeland security threats. We have previously emphasized the importance of performance measures as management tools to track an agency’s progress toward achieving goals and to provide information on which to base organizational and management decisions. Performance data allow agencies to share effective approaches, recognize problems, look for solutions, and develop ways to improve results.

The Fusion Center Guidelines recommend that individual fusion centers develop and use performance measures as an ongoing means to measure and track performance and determine and evaluate the effectiveness of their operations to make better decisions and allocate resources. The Baseline Capabilities expand on these guidelines and recommend that fusion centers develop measures that allow them to, among other things, track their performance and results against the centers’ individual goals and objectives. Officials from 5 of the 14 centers we contacted stated that one of the gaps they identified between their current operations and the baseline capabilities was development of methods to monitor and evaluate their fusion center’s performance. Officials from these 5 fusion centers stated that it was a challenge to develop performance measures to monitor their operations and demonstrate results because their mission was to prevent crimes, and it is difficult to know how many crimes were averted due to their efforts. Additionally, officials from 3 of these 5 fusion centers stated that their ability to develop performance measures was also affected by the fact that, due to limited personnel, addressing other operational work responsibilities, such as analyzing intelligence information and developing related reports, was the priority. A senior official from NFCA said that these challenges are similarly experienced across the broader network of fusion centers, and that centers would welcome a collaborative process in developing these measures to involve participation from, among others, federal agencies such as DHS, DOJ, and the PM-ISE.

According to DHS senior officials, the nationwide assessment currently under way is to gauge whether or not each fusion center has developed methods to monitor and evaluate its own performance. For example, the assessment results are to indicate to what extent a center has developed mechanisms to receive feedback on the value of its products or to determine the effectiveness of its operations in achieving identified goals and objectives. DHS senior officials stated that the results will be used to help federal agencies assess to what extent there are gaps in this baseline capability across the national network of fusion centers and to make decisions about where to allocate resources to support centers’ efforts to develop these individual performance measures.

However, while federal guidance recommends that individual fusion centers develop and use performance measures as a baseline capability, currently there are no standard measures to track performance across fusion centers and demonstrate the impact of centers’ operations in support of national information sharing goals. According to PM-ISE and DHS senior officials, the results of the nationwide assessment are not intended to provide standard measures for fusion centers to demonstrate the results they are achieving in meeting broader information sharing goals as part of the national network. For example, the assessment results are not intended to provide information about how well centers disseminated federal information to local security partners or how useful federal agencies found the information that centers provided them.

The PM-ISE and DHS have recognized the value of implementing standard performance measures across fusion centers. In its 2009 annual report to Congress, the PM-ISE stated that among the activities the office would undertake in 2009 and 2010 would be designing a set of performance measures to demonstrate the value of a national integrated network of fusion centers operating in accordance with the baseline capabilities. Senior PM-ISE officials stated that the PM-ISE had not begun this effort and is no longer planning to develop these performance measures however, because DHS, as the lead agency in coordinating federal support of fusion centers, is now responsible for managing development of these performance measures. Further, in response to a requirement under the 9/11 Commission Act, DHS stated in its 2008 fusion center Concept of Operations that it will develop qualitative and quantitative measures of performance for the overall network of fusion centers and relevant federal entities, such as DHS and DOJ. According to senior DHS officials, the agency recognizes that developing these measures is important to demonstrate the value of agency efforts in support of the ISE. However, these officials stated that, while DHS has started collecting some information that will help in developing such measures, the agency is currently focusing on completing the nationwide assessment to gauge the capabilities and gaps across fusion centers. As such, these officials said that they have not defined next steps or target timeframes for designing and implementing these measures. Standard practices for program and project management state that specific desired outcomes or results should be conceptualized, defined, and documented in the planning process as part of a road map, along with the appropriate steps and time frames needed to achieve those results. By defining the steps it will take to design and implement a set of standard measures to track the results and performance across fusion centers and committing to a target timeframe for completion, DHS could help ensure that centers and federal agencies demonstrate the value of fusion centers’ operations to national information sharing goals and prioritize limited resources needed to achieve and maintain those functions deemed critical to support the national fusion center network.

Federal Agencies Are Providing Technical Assistance and Training to Centers to Help Them Develop Privacy and Civil Liberties Policies and Protections, and DHS Is Assessing the Status of These Protections

DHS and DOJ are providing technical assistance to assist fusion centers in developing privacy and civil liberties policies, and fusion centers nationwide are in varying stages of completing their policies. Additionally, fusion center officials we interviewed reported taking steps to designate privacy/civil liberties officials and conduct outreach about their policies. Further, DHS and DOJ are providing training to fusion centers on implementing privacy and civil liberties policies and protections that officials in the 14 centers we contacted found helpful and wanted to be continued. DHS also has several efforts underway to assess the status of fusion centers’ privacy and civil liberties protections, including updating the privacy and civil liberties impact assessments to help ensure centers’ protections are implemented.

DHS and DOJ Are Providing Technical Assistance to Help Fusion Centers Develop Privacy and Civil Liberties Policies, and Centers Nationwide Are in Varying Stages of Completing Their Policies

Because fusion centers are collecting and sharing information on individuals, federal law establishes requirements and federal agencies have issued guidelines for fusion centers to establish policies that address privacy and civil liberties issues. Consistent with the 9/11 Commission Act, the Fusion Center Guidelines call for fusion centers to develop, publish, and adhere to a privacy and civil liberties policy. Further, the Baseline Capabilities provide more specific guidance on developing such a policy and contain a set of recommended procedures for fusion centers to include in their policies to ensure that their centers’ operations are conducted in a manner that protects the privacy, civil liberties, and other legal rights of individuals according to applicable federal and state law. According to federal guidance, if centers adhere to the Baseline Capabilities, they in turn will be in adherence with the ISE Privacy Guidelines. Further, DHS’s fiscal year 2010 HSGP funding guidance stipulates that federal funds may not be used to support fusion-center- related initiatives unless a fusion center has developed a privacy and civil liberties policy containing protections that are at least as comprehensive as the ISE Privacy Guidelines within 6 months of the grant award. According to senior DHS Privacy officials, the fiscal year 2010 grants were awarded in September 2010, so fusion centers will have until March 2011 to have their policies reviewed and certified by the DHS Privacy Office. If a fusion center does not have a certified privacy and civil liberties policy by March 2011, according to DHS guidance, DHS grants funds may only be used to support the development or completion of the center’s privacy and civil liberties protection requirements.

To facilitate fusion centers meeting federal requirements for their privacy and civil liberties policies, DHS and DOJ have published a template and established a process to review and certify the policies. The template incorporates the primary components of the ISE Privacy Guidelines and provides sample language for the center to use as a starting point when drafting procedures for a privacy and civil liberties policy. To ensure fusion centers comply with the certification requirements in DHS’s grant guidance, DHS and DOJ have established a joint process to review and certify fusion centers’ privacy and civil liberties policies. First, a fusion center sends its draft policy to a team of attorneys contracted by DOJ’s Bureau of Justice Assistance to provide a detailed review of the policy and compare its language and provisions against language in the template. After its review, DOJ submits the center’s completed draft policy to the DHS Privacy Office for a final review. This office reviews the policy specifically to determine whether it contains protections that are at least as comprehensive as the ISE Privacy Guidelines. If the policy satisfies the ISE Privacy Guidelines, the DHS Chief Privacy Officer sends written notification to the fusion center director stating that the policy has been certified.

Using this guidance and technical assistance, fusion centers nationwide are in varying stages of completing their privacy and civil liberties policies. Specifically, 21 centers had certified policies; 33 centers had submitted policies; and 18 centers, while they have not yet submitted their policies, were currently receiving technical assistance, as of August 2010. Senior DHS Privacy officials stated that they expect that all 72 fusion centers will have submitted their policies and the federal agencies will be able to review and certify them by the March 2011 deadline to avoid any limits on grant funding. The 14 centers we contacted were at different stages of the review process and reported that they found the template and technical assistance to be helpful. Specifically, 7 centers had certified policies, 6 had policies in the review process, and 1 center was drafting its policy. Officials from all 14 of the fusion centers stated that they used or were using the template to write their policies, and that the template was a helpful guide to developing their policies. In addition, officials in 13 of these centers that had submitted their policies for review stated that the technical assistance and guidance DHS and DOJ provided was integral in assisting them draft their policies, especially a tracking sheet the DOJ review team used to document comments, feedback, and recommendations.

Consistent with Recommended Federal Guidance, Fusion Center Officials We Interviewed Have Taken Steps to Designate Privacy/Civil Liberties Officials and Conduct Outreach

The Baseline Capabilities recommend that fusion centers designate a privacy/civil liberties official or a privacy committee to coordinate the development, implementation, maintenance, and oversight of the fusion center’s privacy and civil liberties policies and procedures. Furthermore, the Baseline Capabilities recommend that if the designated privacy/civil liberties official is not an attorney, fusion centers should have access to legal counsel with the appropriate expertise to help clarify related laws, rules, regulations, and statutes to ensure that centers’ operations are adhering to privacy and civil liberties protections. Officials from all 14 fusion centers we contacted stated that they have taken steps to designate privacy/civil liberties officials or form privacy committees. For example, officials in 12 of these centers said that they designated a single individual to serve as the privacy/civil liberties official; officials in 1 fusion center selected two officials—attorneys from the state’s bureau of investigation and the state’s department of safety; and officials in 1 center created a privacy committee. For more information on the qualifications of privacy/civil liberties officials and the challenges associated with designating them, see appendix I.

In addition to developing a privacy and civil liberties policy and designating a privacy/civil liberties official, the Baseline Capabilities recommend that fusion centers facilitate public awareness of their policy by making it available to the public. Officials in 7 of 14 fusion centers we contacted described taking steps to make the public aware of their fusion center’s privacy and civil liberties protections. For example, officials in 3 centers said that they met with privacy and civil liberties advocacy groups to elicit feedback about the centers’ policies. For instance, one official said that his fusion center shared its policy with a local chapter of the ACLU, which reviewed it and made suggestions for revisions, some of which the center implemented. Additionally, officials from 6 of 14 fusion centers we interviewed said that they posted their policies on their centers’ Web sites or planned to post them once they are certified. To assist centers with their outreach efforts, DHS and DOJ officials stated that they are developing a communications and outreach guidebook that will include information on how fusion centers can communicate their mission, operations, and privacy and civil liberties protections to state and local governments, privacy advocacy groups, and the general population. These officials added that this guidebook will recommend that fusion centers post their privacy and civil liberties policies online to help centers achieve the baseline capability of promoting transparency and public awareness of their privacy and civil liberties protections.

Fusion Center Officials We Interviewed Reported That DHS’s and DOJ’s Training on Privacy and Civil Liberties Protections Was Helpful and Would Like It Continued after Their Policies Are Developed

The 9/11 Commission Act requires DHS to establish guidelines for fusion centers that include standards for fusion centers to provide appropriate privacy training for all state, local, tribal, and private sector representatives at the fusion center, in coordination with DHS’s Privacy Office and CRCL. To support fusion centers in this effort, DHS, in partnership with DOJ and Global, has implemented a three-part training and technical assistance program for fusion center personnel consisting of (1) a “Training the Trainers” Program, where representatives from DHS’s Privacy Office and CRCL provide instruction to fusion center privacy/civil liberties officials with the intent that these officials then implement and teach the material to personnel at their centers; (2) a Web site “Tool Kit” or Web portal, which provides a single point of access to federal resources on privacy training and contains training material and video resources for state and local personnel on privacy topics; and (3) an On-site Training Program, where representatives from DHS’s Privacy Office and CRCL travel to fusion centers, upon request, to provide training on privacy, civil rights, and civil liberties issues. Appendix II discusses this training program in greater detail.

Officials from all 14 fusion centers we contacted stated that DHS’s and DOJ’s three-part training and technical assistance program was helpful and expressed a need for continued training or guidance as they continue to establish their privacy and civil liberties protections. Fusion center officials cited several reasons why they wanted continued training and updated guidance, including evolving privacy laws, and the recognition that some privacy/civil liberties officials may lack privacy-related expertise or backgrounds. In addition to training, six fusion center officials expressed a need for continued privacy guidance, such as briefings on examples of fusion center privacy violations and how they were corrected. For example, an official from one of these centers expressed a need for federal guidance on how centers should deal with certain groups who make threats against state or local governments, as these groups can span across multiple states. Recognizing that fusion centers would like continued federal training and guidance on privacy, senior officials from DHS’s Privacy Office and CRCL stated that they plan to continue the DHS- DOJ joint three-part training and technical assistance program over the next several years and to tailor its privacy, civil rights, and civil liberties instruction to the needs of individual centers. Further, senior DHS Privacy officials stated that a goal of the training program is to develop multiyear relationships with privacy/civil liberties officials in each center, helping to establish a professional cadre of trained privacy/civil liberties officials across the national fusion center network.

DHS Has Efforts Under Way to Assess the Status of Fusion Centers’ Privacy and Civil Liberties Protections

Senior DHS Privacy officials stated that the review of fusion centers’ privacy and civil liberties policies is a first step in providing ongoing federal oversight of the development of privacy and civil liberties protections across fusion centers. These officials stated that continued assessment and oversight—by the federal government and by fusion centers themselves—is necessary to ensure that the protections described in centers’ policies are implemented in accordance with all applicable privacy regulations, laws, and constitutional protections. For example, a Director with DHS’s Privacy Office noted that a fusion center can, in theory, have a model privacy and civil liberties policy but not correctly implement its protections, increasing the risk of potential violations such as the proliferation of inaccurate data. The 9/11 Commission Act requires that the Secretary issue guidelines that contain standards that fusion centers shall not only develop and publish a privacy and civil liberties policy, but also that they adhere to it. Further, the Baseline Capabilities recommend that fusion centers, as part of their privacy and civil liberties protections, identify methods for monitoring the implementation of their privacy and civil liberties policies and procedures to incorporate revisions and updates. While the 9/11 Commission Act does not dictate specific oversight mechanisms for fusion center privacy and civil liberties protections, DHS, in coordination with DOJ and the PM-ISE, has two efforts under way to assess the status of these protections across fusion centers and is taking steps to encourage centers to assess their own protections going forward to identify any existing privacy and civil liberties risks and develop strategies to mitigate them.

First, the nationwide assessment asks fusion centers to provide information on each of the privacy-related baseline capabilities, including information on the centers’ designated privacy/civil liberties officials, components of their privacy and civil liberties policies and related protections, policy outreach efforts, and training. Following that, validation teams are to review the self-reported information in detail with each fusion center. According to senior DHS officials, this information may help to identify any critical gaps in privacy and civil liberties protections across the national network of fusion centers. Senior DHS Privacy officials stated that this information will be an important tool in developing a longer-term oversight and assessment strategy to ensure that resources are aligned to address these gaps.

Second, the 9/11 Commission Act, enacted in August 2007, requires, among other things, that DHS submit (1) a report within 90 days of the enactment of the Act containing a Concept of Operations for the Fusion Center Initiative that includes a privacy impact assessment (PIA) and a civil liberties impact assessment (CLIA) examining the privacy and civil liberties implications of fusion centers, and (2) another PIA and CLIA within 1 year of enactment. In general, these assessments allow agencies to assess privacy and civil liberties risks in their information sharing initiatives and to identify potential corrective actions to address those risks. DHS published a PIA in December 2008 that identified several risks to privacy presented by fusion centers, explained mitigation strategies for those risks, and made recommendations on how DHS and fusion centers can take additional action to further enhance the privacy interests of the citizens in their jurisdictions. CRCL similarly published a CLIA in December 2008 that evaluated fusion centers’ impact on the civil liberties of particular groups or individuals, outlined procedures for filing a civil liberties complaint with DHS, and highlighted the importance of training fusion center personnel on civil rights and civil liberties.

DHS has not completed the second PIA or CLIA, which were to be issued by August 2008. However, according to senior DHS Privacy officials, the DHS Privacy Office is currently beginning to develop the updated PIA. These officials said that they identified two key milestones when determining when to begin work on the updated PIA. First, the officials said that they wanted to complete the “training the trainers” program for designated fusion center privacy/civil liberties officials, which they did in July 2010. Second, officials said that they delayed the start of the updated PIA to allow time for fusion centers to develop their privacy and civil liberties policies—which are to be certified by DHS by March 2011. Ensuring that centers had completed, and were beginning to implement, their policies would help in assessing updates to any risks identified in the initial PIA, according to these officials. Senior DHS Privacy officials stated that they have begun planning for the updated PIA, and that the assessment will be published in 2011. These officials stated that the updated PIA will be comprehensive in its scope, and include an assessment of the steps fusion centers have taken to address the recommendations of the 2008 PIA, an analysis of federal and state government involvement in fusion center privacy and civil liberties protections, a description of what federal agencies have done and are doing to assist fusion centers in establishing these protections, and a discussion about related initiatives. These officials added that the updated PIA will be a useful tool in assessing where fusion centers are in implementing protections and addressing the 2008 PIA recommendations, and that the information will be used to inform decisions on where to focus their training and oversight efforts going forward.

Further, senior officials from CRCL stated that they have also begun to develop the updated CLIA, and plan to publish the assessment in 2011. According to these officials, the updated CLIA will address topics such as oversight of fusion centers, common issues and challenges that fusion centers face in establishing civil rights and civil liberties protections, examples of civil rights and civil liberties complaints directed at fusion centers, and key issues brought up during fusion center trainings. Given the assessments’ proposed scope and content, completing the updates to the PIA and CLIA as required will help provide critical information to help ensure that fusion centers are implementing privacy and civil liberties protections and that DHS, and other federal agencies, are supporting them in their efforts.

In addition to the nationwide assessment and updated PIA and CLIA, DHS is also taking steps to encourage fusion centers to conduct their own PIAs once their privacy and civil liberties policies are reviewed and certified by the DHS Privacy Office as a means to oversee their own privacy and civil liberties protections going forward. According to senior DHS Privacy officials, individual PIAs are integral for a fusion center’s development and promote transparency by describing fusion center activities and authorities more fully than the policies can alone. To assist fusion centers in developing their own PIAs, DHS and DOJ jointly published a guide to conducting PIAs specific to state, local, and tribal information sharing initiatives, including a template to lead policy developers through appropriate privacy risk assessment questions. In addition to the template itself, according to senior DHS Privacy officials, the importance of conducting a fusion center PIA is conveyed through the three-part training and technical assistance program where the steps the office took to conduct its own PIA in 2008 are covered.

Conclusions

Fusion centers—as the primary focal points for the two-way exchange of information between federal agencies and state and local governments— play a critical and unique role in national efforts to combat terrorism more effectively. In light of their reliance on fusion centers as critical components in the ISE, DHS, in collaboration with DOJ and the PM-ISE, provide fusion centers with a variety of support, including DHS grant funding, personnel, and technical assistance. However, centers remain concerned about their long-term sustainability and ability to meet and maintain the baseline capabilities given the current federal funding sources and fiscally constrained state and local economic environments. DHS’s efforts to require, rather than encourage, centers to target HSGP funding to achieving and maintaining the baseline capabilities are aimed at enabling fusion centers to close gaps in capabilities and develop more accurate and specific investment justifications in competing for DHS HSGP funding within their respective states. Further, by completing the nationwide assessment and the required cost assessment of the fusion center network, DHS can begin to address long-standing concerns and questions about sustaining the fusion center network. If fusion centers are to receive continued financial support, it is important that centers demonstrate that they are providing critical information that is helping the federal government protect against homeland security and terrorist threats through a set of performance measures. The PM-ISE and DHS have recognized the value of developing such performance measures, but defining the steps it will take to design and implement them and committing to a target time frame for completion could help ensure that fusion centers and federal agencies track fusion center performance in a manner that demonstrates the value of fusion center operations within the ISE.

Recommendation for Executive Action

To enhance the ability to demonstrate the results fusion centers are achieving in support of national information sharing goals and help prioritize how future resources should be allocated, we recommend that the Secretary of Homeland Security direct the State and Local Program Office, in partnership with fusion center officials, to define the steps it will take to design and implement a set of standard performance measures to show the results and value centers are adding to the Information Sharing Environment and commit to a target timeframe for completing them.

Agency Comments and Our Evaluation

We requested comments on a draft of this report from the Secretary of Homeland Security, the Attorney General, and the Program Manager for the ISE on September 13, 2010. DHS, DOJ, and the PM-ISE did not provide official written comments to include in our report. However, in an email received September 23, 2010, a DHS liaison stated that DHS concurred with our recommendation. DHS and DOJ provided written technical comments, which we incorporated into the report, as appropriate. In its technical comments, DHS stated that the agency has recently started to develop a performance management framework to demonstrate the value and impact of the national network of fusion centers and is using the nationwide assessment data to support the development of specific performance measures. With regard to target timeframes, DHS stated that it is planning to (1) collaborate with fusion center directors and interagency partners on the development of these performance measures throughout the remainder of 2010 and (2) provide performance management resources at the next National Fusion Center Conference in March 2011. If properly implemented and monitored, developing these standard performance measures should enhance the ability to demonstrate the results fusion centers are achieving in support of national information sharing goals and help prioritize how future resources should be allocated.

DHS also noted that while the report emphasizes the importance of sustainment funding for fusion centers, it does not recommend that DHS develop a sustainment strategy to assist fusion centers in getting the critical federal support they require. In our 2007 report, we recommended that the federal government articulate such a sustainment strategy for fusion centers—a recommendation with which DHS agreed and that we consider to still be current and applicable. Specifically, we recommended that the federal government define and articulate its role in supporting fusion centers and determine whether it expects to provide resources to centers over the long-term to help ensure their sustainability. During our review, DHS described actions that it plans to take that begin to build this strategy. More specifically, DHS said that it plans to collect and assess cost data from centers—a necessary first step to assessing the adequacy of current funding mechanisms and level of the resources that DHS provides to fusion centers. While a positive start, it will be important for DHS to follow through on these plans and develop a sustainment strategy for fusion centers. This would in turn be responsive to our recommendation.

We are sending copies of this report to the Secretary of Homeland Security, the Attorney General, the Program Manager for the ISE, and other interested congressional committees and subcommittees. In addition, this report will be available at no charge on GAO’s Web site at http://www.gao.gov.

If you or your staff have any questions concerning this report or wish to discuss the matter further, please contact me at (202) 512-8777, or larencee@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix III.

Appendix I: Qualifications of Fusion Center Privacy/Civil Liberties Officials and Challenges Associated with Designating Them

According to our interviews with officials in 14 fusion centers, the individuals designated to be privacy/civil liberties officials varied in terms of their position and legal experience. For example, in the 13 fusion centers with privacy/civil liberties officials, 3 of these officials were center directors and 6 were analysts. The remaining 4 fusion centers designated attorneys from other bureaus or agencies within their respective state or local governments, such as state attorneys’ general offices, as their privacy/civil liberties official. These officials stated that because they either did not have the appropriate legal expertise within the fusion center or had an existing working relationship with a state bureau or agency, designating officials outside their center as the privacy/civil liberties official was the best option available in achieving this baseline capability. Among the 9 centers that had designated fusion center personnel as the privacy/civil liberties official, none of these personnel was an attorney; however, officials in 3 of these centers stated that their privacy/civil liberties officials had access to other legal counsel within the state police agency or city police department, for example, to help clarify laws and regulations governing privacy and civil liberties protections and to assist with the development of the centers’ policies.

Fusion center officials we interviewed reported several challenges in designating privacy/civil liberties officials, including concerns that some officials had other operational duties at the fusion center or may not have sufficient legal expertise to ensure implementation of privacy and civil liberties protections. For example, of the nine fusion centers with directors or analysts serving as the privacy/civil liberties official, two had officials whose sole duty was to oversee development of the center’s privacy and civil liberties policy and implementation of privacy and civil liberties protections. The other seven privacy/civil liberties officials had other operational duties at the fusion center. For instance, one fusion center’s privacy/civil liberties official also served as the center’s critical infrastructure and key resources analyst, which according to the center officials, slowed the development of the center’s privacy and civil liberties policy. According to a Director with DHS’s Privacy Office, it is difficult to assess the effect of fusion center privacy/civil liberties officials having responsibilities outside of their privacy-related duties because the position is relatively new and this is common. The official added that, in general, it is better to have the designated privacy/civil liberties official be able to focus exclusively on privacy-related duties. Additionally, officials in two fusion centers were concerned that their privacy/civil liberties officials may not have sufficient legal expertise to effectively monitor privacy and civil liberties protections at the centers. For example, one official stated that it was difficult to identify personnel who, in addition to legal expertise, had experience in both intelligence analysis and standard law enforcement practices which, in his experience, were necessary skills for a center’s privacy/civil liberties official. Senior DHS Privacy officials said that, in recognizing that fusion center privacy/civil liberties officials have multiple duties and vary in terms of their experience and legal expertise, DHS is committed to training and has taken steps to train centers’ designated officials and tailor DHS’s privacy instruction to the needs of individual fusion centers to help centers achieve this baseline capability.

Appendix II: Privacy/Civil Rights and Civil Liberties Training and Technical Assistance Program

DHS, in partnership with DOJ and Global, has implemented a three-part training and technical assistance program in support of fusion centers’ efforts to provide appropriate privacy, civil rights, and civil liberties training for all state, local, tribal, and private sector representatives at the fusion center: A “Training the Trainers” Program: In this 2010 program, representatives from the DHS Privacy Office and CRCL provided instruction to fusion center privacy/civil liberties officials at four regional fusion center conferences that are held annually. These 1 1/2-day classes were intended to provide privacy/civil liberties officials with instruction on the requirements of a fusion center in implementing privacy and civil liberties protections, the general privacy law framework of the ISE, and instruction on how privacy/civil liberties officials can best teach the material to fusion center personnel at their centers. According to senior officials from CRCL, privacy/civil liberties officials from 68 of 72 fusion centers have received the training as of August 2010. According to directors with the DHS Privacy Office and CRCL, the training delivered at the conferences is specialized and tailored based on feedback the offices receive from fusion center staff on key issues they would like covered. Officials added that they obtain feedback at each training session to also identify the privacy, civil rights, and civil liberties-related subject areas in which privacy/civil liberties officials may need more training. Participants in this program are asked to teach the material to other fusion center personnel within their centers within 6 months.

A Web site “Tool Kit:” This tool-kit, or Web portal, provides a single point of access to federal resources on privacy, civil rights, and civil liberties training. The portal contains training material and video resources for state and local personnel on a broad range of privacy, civil rights, and civil liberties topics. The public Web portal can be found at www.it.ojp.gov/PrivacyLiberty. Furthermore, the Web portal provides access to training resources on the requirements in 28 C.F.R. part 23, which contains guidelines for law enforcement agencies operating federally grant-funded criminal intelligence systems. DHS HSGP guidance states that in fiscal year 2010, all fusion center employees are expected to complete the online 28 C.F.R. part 23 certification training. Officials from all 14 fusion centers we contacted stated that fusion center staff have completed the requisite online certification training, and that it was helpful in making their staff aware of the regulations governing their criminal intelligence systems. Furthermore, officials from 5 of these 14 fusion centers stated that they plan to require that fusion center personnel complete the 28 C.F.R. part 23 certification training on an annual basis to ensure that staff are well-versed on privacy requirements.

An On-site Training Program: For this program, representatives from the DHS Privacy Office and CRCL travel to fusion centers, upon request, to provide a full day of training on privacy, civil rights, and civil liberties issues in the following core areas: civil rights and civil liberties basics in the ISE, privacy fundamentals, cultural competency, First Amendment issues in the ISE, and “red flags” when reviewing or creating intelligence products. Additionally, fusion centers have the option of selecting topics from a list of available training modules, such as a civil rights and civil liberties case scenario or an intelligence analysis product review exercise, and receiving customized instruction based on the training needs of their fusion center. Prior to the training, representatives from CRCL conduct interviews with fusion center officials to learn about their specific privacy, civil rights and civil liberties questions or issues, review state constitution and relevant state law, and research local media to identify the types of issues related to the work of the fusion center that have raised concerns among citizens in their jurisdictions. According to senior officials from the DHS Privacy Office and CRCL, as of August 2010, 21 of 72 fusion centers have received this on-site training. Officials we contacted in 3 fusion centers stated that they had requested and received on-site training on privacy, civil rights, and civil liberties protections from DHS personnel at their fusion centers and that the training was helpful.

Appendix III: GAO Contact and Staff Acknowledgments

GAO Contact

Acknowledgments

In addition to the contact named above, Mary Catherine Hult, Assistant Director; Hugh Paquette; Kevin Craw; Katherine Davis; John de Ferrari; Matt Grote; David Plocher; Michael Silver; and Janet Temko made key contributions to this report.