Homeland Security: Efforts to Improve Information Sharing Need to Be Strengthened
Released: 2003-08-27T00:00:00

Letter

Background

A constitutional role of the federal government is to provide for the common defense, which includes preventing terrorist attacks. The government must prevent and deter attacks on our homeland as well as detect impending danger before attacks occur. Although it may be impossible to detect, prevent, or deter every attack, steps can be taken to reduce the risk posed by the threats to homeland security. Traditionally, protecting the homeland against these threats was generally considered a federal responsibility. To meet this responsibility, the federal government gathers intelligence, which is often classified as national security information. This information is protected and safeguarded to prevent unauthorized access by requiring appropriate security clearances and a “need to know.” Generally, the federal government did not share national level intelligence with states and cities, since they were not viewed as having a significant role in preventing terrorism. Therefore, the federal government did not generally grant state and city officials access to classified information. However, as we reported in June 2002, the view that states and cities do not have a significant role in homeland security has changed since September 11, 2001, and the need to coordinate the efforts of federal, state, and local governments for homeland security is now well understood.

Preventing Terrorism Has Traditionally Been Viewed As a Federal Responsibility

Protecting the United States from terrorism has traditionally been a responsibility of the federal government and, typically, the views of states and cities in formulating national policy have not been considered. In the Homeland Security Act of 2002, Congress found that the federal government relies on state and local personnel to protect against terrorist attacks and that homeland security information is needed by state and local personnel to prevent and prepare for such attacks. Congress also found that federal, state, and local governments; and intelligence, law enforcement, and other emergency and response personnel must act in partnership to maximize the benefits of information gathering and analysis to prevent and respond to terrorist attacks. As a result, the act expressed the sense of Congress that federal, state, and local entities should share homeland security information to the maximum extent practicable. Federal, state, and local governments and the private sector were not fully integrated participants before the September 11, 2001, attacks, but the need to integrate them became more widely recognized afterward.

In order to develop national policies and strategies to address terrorism issues, senior policymakers obtain information from the intelligence community. The intelligence community uses a cyclic process for intelligence production. Simplified, the intelligence community (1) receives information requirements from policymakers, (2) collects and analyzes the information from its sources, (3) creates intelligence products from the information, (4) disseminates the products to consumers of intelligence, and (5) receives feedback about the usefulness of the information from consumers. This process can lead to additional information requirements and is ongoing.

Since the late 1940s, the federal government generally separated law enforcement and intelligence functions, although both have a role in combating terrorism. From this separation, law enforcement and intelligence were created and handled differently, depending on which community obtained the information and how it was to be used. The law enforcement community investigates criminal activity and supports prosecutions by providing information related to events that have occurred. In contrast, the intelligence community tries to provide policymakers and military leaders with information so that decisions can be made to protect and advance national interests. Often, the intelligence community collects information from sensitive sources or using special methods and keeps the information classified to protect their sources and methods and ensure a continual flow in the future.

Executive Order no. 12958, Classified National Security Information, as amended, prescribes a uniform system for classifying, safeguarding, and declassifying national security information, including information related to defense against transnational terrorism. Executive Order no. 12968, Access to Classified Information, states that access to classified national security information is generally limited to persons who have been granted a security clearance, been briefed as to their responsibilities for protecting classified national security information, have signed a nondisclosure agreement acknowledging those responsibilities, and have agreed to abide by all appropriate security requirements. In addition, these persons must have a demonstrated “need to know” the information in connection with the performance of their official functions. If these criteria are not met, then the information is not to be shared.

The federal intelligence community has traditionally not always considered states or cities to need access to intelligence that could be used to fight terrorism. As a result, few officials at the state and local levels have the clearances required for access to intelligence products.

Furthermore, the collection and use of intelligence information on individuals for domestic law enforcement purposes is constrained by the application of constitutional protections, statutory controls, and rules of evidence. For example, the Foreign Intelligence Surveillance Act of 1978 had, in effect, been interpreted as requiring some separation that limited coordination between domestic law enforcement and foreign intelligence investigations, particularly with regard to the use of information collected for foreign intelligence purposes in criminal prosecutions.

September 11, 2001, Attacks Redefined Terrorism Responsibilities

Although previous terrorist attacks—such as the 1993 World Trade Center bombing—proved that the United States was not immune to attacks on its homeland, the enormity of the loss of life and impact of the terrorist attacks on September 11, 2001, highlighted the increasing risk of terrorist attacks on U.S. soil. Consequently, federal, state, and city governments recognized an urgent need to effectively unify their efforts to enhance homeland security by employing the unique contribution that each level of government can make on the basis of its capabilities and knowledge of its own environment. After the September 11, 2001, attacks, policymakers questioned the separation between law enforcement and intelligence, noting that the distinctions may limit access to some information needed to effectively execute homeland security duties. In October 2001, Congress passed the USA PATRIOT Act, to improve the sharing of information between the intelligence and law enforcement communities, such as by providing federal investigators with more flexibility in sharing information obtained under the authority of the Foreign Intelligence Surveillance Act. In October 2002, the Senate Select Committee on Intelligence: Joint Investigation inquiry into the attacks found problems in maximizing the flow of relevant information both within the Intelligence Community as well as to and from those outside the community. The review found that the reasons for these information disconnects can be, depending on the case, cultural, organizational, human, or technological. The committee recommended that comprehensive solutions, while perhaps difficult and costly, must be developed and implemented if we are to maximize our potential for success in the war against terrorism.

At the same time, recognizing a need to balance the protection of information with the emerging homeland security requirements of those that had a newly recognized need-to-know, Congress passed the Homeland Security Act of 2002 to, among other purposes, specifically facilitate information sharing. In creating the Department of Homeland Security, the act gives the Secretary the responsibility to coordinate with other executive agencies, state and local governments, and the private sector in order to prevent future attacks. Among other responsibilities, the Secretary is to coordinate the distribution of information between federal agencies and state and local governments. Furthermore, the act requires the new department’s Under Secretary for Information Analysis and Infrastructure Protection to disseminate, as appropriate, information analyzed by the department to other federal, state, and local government agencies with homeland security roles; to consult with state and local governments to ensure appropriate exchanges of information (including law-enforcement-related information) relating to threats of terrorism; and to coordinate with elements of the intelligence community and with federal, state, and local law enforcement agencies, and the private sector, as appropriate. Additionally, a subtitle of the Homeland Security Act, titled the Homeland Security Information Sharing Act, requires the President of the United States to prescribe and implement governmentwide procedures for determining the extent of sharing, and for the actual sharing, of homeland security information between federal agencies and state and local personnel, and for the sharing of classified (and sensitive but unclassified) information with state and local personnel. To date, these procedures have not been promulgated, although the President has recently assigned this function to the Secretary of Homeland Security.

Furthermore, several national strategies that have been developed include information sharing as major initiatives. Both the National Strategy for Homeland Security and the National Strategy for the Physical Protection of Critical Infrastructures and Key Assets include, as objectives, improving information sharing between intelligence and law enforcement agencies at all levels of government. In addition, FBI increased the number of its Joint Terrorism Task Forces, from 35, as of September 11, 2001, to 66, as of March 2003. Federal, state, and local law enforcement officials can interact to prevent terrorist attacks and share information in investigations of terrorist events through the task forces. State and city governments have also implemented several initiatives to improve the information-sharing process, both within their jurisdiction as well as with participants from other levels of government.

Information-Sharing Initiatives Are Not Well Coordinated

Congress passed legislation and the President issued strategic plans to improve the sharing of information to fight terrorism. The Department of Homeland Security was given the responsibility to coordinate the distribution of information between federal agencies, and state and local governments, and private industry. However, the department is in the early phases of determining how to execute this responsibility. In the meantime, some federal agencies and state and city governments undertook initiatives on their own to improve sharing. However, these actions are not well coordinated and consequently risk duplicating efforts. In addition, without coordination, these actions may not be mutually reinforcing and may create information-sharing partnerships that do not necessarily include all agencies needing access to the information.

Legislation and Strategies to Improve Information Sharing

After the September 11, 2001, attacks, Congress took legislative action to improve information sharing. Several national strategies, such as the National Strategy for Homeland Security contain actions to improve sharing as well.

The Homeland Security Act directs the President to prescribe and implement procedures for sharing homeland security information between federal agencies and with appropriate state and local government personnel (a function since assigned by the President to the Secretary of Homeland Security). The act also created the Department of Homeland Security, which consolidated 22 federal agencies with homeland security missions into a single department. Within the department, the Office of State and Local Government Coordination and the Office of Private Sector Liaison were created to provide state and local governments and appropriate private-sector representatives with regular information, research, and technical support to assist local efforts at securing the homeland. According to the department, these offices will give these participants one primary federal contact instead of many to meet their homeland security needs.

Since September 11, 2001, the administration has developed several strategies containing actions to improve information sharing and charge DHS, FBI, and other government components with responsibility to perform these actions. For example, the National Strategy for Homeland Security (July 2002), the National Strategy for the Physical Protection of Critical Infrastructures and Key Assets (Feb. 2003), and the National Strategy to Secure Cyberspace (Feb. 2003) have, as one of their priorities, actions to promote information sharing between federal agencies and with state and city governments, law enforcement and intelligence agencies, and the private sector.

The National Strategy for Homeland Security specifies that the federal government will “build a national environment that enables the sharing of essential homeland security information horizontally across each agency of the federal government and vertically among federal, state, and local governments, private industry, and citizens” by integrating all participants and streamlining the sharing process. The strategy contains initiatives to declassify documents to facilitate sharing, integrate databases at all levels of government, and provide for a secure method of sharing information. Similarly, the National Strategy for the Physical Protection of Critical Infrastructures and Key Assets has initiatives to facilitate information sharing by improving processes for domestic threat data collection, analysis, and dissemination to state and local governments as well as with private industry. This strategy calls on DHS to lead the effort to (1) define sharing requirements, (2) establish processes for providing and receiving information, and (3) develop technical systems to share sensitive information with public-private stakeholders. The National Strategy to Secure Cyberspace has initiatives to improve and enhance public-private information sharing involving cyber attacks by establishing, among other things, protocols for ensuring that information voluntarily provided by the private sector is securely stored and maintained.

The Department of Homeland Security has several initiatives to improve the sharing of information that could be used to protect the homeland. In particular, it is developing a homeland security enterprise architecture that, among other actions, will integrate sharing between federal agencies and between the federal government, state and city governments, and the private sector. According to DHS, its enterprise architecture is a business- based framework for cross-agency improvement and will provide DHS with a new way of describing, analyzing, and integrating the data from the agencies, thus enabling DHS to “connect the dots” to better prevent terrorist attacks and protect people and infrastructure from terrorism. Architecture working groups were established to collect, organize, and publish the baseline information-sharing structure for the major components that were transitioned to DHS. According to DHS officials, this effort will be completed by June 2003. The working groups will also be used to integrate the state and city governments, and the private sector. By September of 2003, the department anticipates it will have a plan that provides a phased approach to achieving information sharing between the federal government, states, cities, and the private sector. The department anticipates beginning to implement the plan in November 2003.

Initiatives Risk Duplicating Efforts and May Limit Access for Some Entities

Other federal agencies, and state and city homeland security participants have implemented several initiatives to promote information sharing, yet these initiatives are not well coordinated and may inadvertently limit access to information to those entities that are not part of the initiatives. Nonetheless, the initiatives seek to fulfill a perceived information requirement not yet fully addressed by the federal intelligence community, and include both technological solutions as well as management and communication solutions. However, these initiatives may be duplicating DHS and other federal efforts already under way, and, in some cases, may create information-sharing partnerships that actually limit access to information to only those agencies that are party to the initiatives.

Sensing an urgency to improve their abilities to effectively perform their homeland security duties, other federal agencies, and state and city participants have implemented several initiatives to promote sharing with others from different levels of government. However, it is unclear how these initiatives, while enhancing individual organization sharing, will contribute to national information-sharing efforts. The Departments of Defense and Justice have established initiatives using technology to better gather, analyze, and share information with other homeland security participants. These initiatives include expanding existing mechanisms for sharing; participating in information-sharing centers like FBI’s Joint Terrorism Task Forces; establishing new information-sharing centers; and working with federal, state, and city agencies to integrate databases. Also, the new Terrorist Threat Integration Center, which began operations May 1, 2003, was created to fuse, analyze, and share terrorist-related information collected domestically and abroad. It is an interagency joint venture that reports directly to the Director of Central Intelligence in his capacity as statutory head of the intelligence community. The center will be comprised of elements of DHS, FBI’s Counterterrorism Division, the Director of Central Intelligence Counterterrorist Center, the Department of Defense, and other participating agencies. According to the President, the center is to “close the seam” between the analysis of foreign and domestic intelligence and will have access to all sources of information.

In responding to our survey, 85 percent (or 34 of 40) of the responding states and 70 percent (or 160 of 228) of the responding cities said they were currently participating in information-sharing centers, including FBI’s Joint Terrorism Task Forces. Nonetheless, according to the survey results, many participants expressed a need for still more interaction with other homeland security participants to coordinate planning, develop contacts, and share information and best practices.

In addition to the federal government, several states and cities have implemented their own initiatives to improve sharing. For example, the state of California has established a clearinghouse for all terrorist-related activities and investigations. The clearinghouse collects, analyzes, and disseminates information to its law enforcement officers, other law enforcement agencies, and FBI. The City of New York established a counterterrorism committee comprising FBI, the New York State Office of Public Security, and the New York City Police Department to share information and promote joint training exercises. Officials from the Central Intelligence Agency acknowledged that states’ and cities’ efforts to create their own centers are resulting in duplication and that some cities may be reaching out to foreign intelligence sources independently from the federal government. These officials emphasized that state and local authorities should work through the Joint Terrorism Task Forces to receive the information they require. Appendix II contains examples of other initiatives that various information-sharing participants have expanded and/or implemented to protect the homeland since September 11, 2001.

In written comments to our survey, some respondents indicated that avoiding duplication and redundancy were some of the reasons they were not joining or establishing new information-sharing centers. For example, rather than establishing local or regional databases—as some states and cities have done—some respondents recommended creating a national terrorism intelligence and information network and computer database. However, in order to build a comprehensive national plan that integrates multiple sharing initiatives (including those that integrate databases), the federal government must first be aware of these efforts. In a speech to the National Emergency Managers Association in February 2003, the Secretary of Homeland Security asked states to inform his department of newly created initiatives when they learn of them. However, it is not clear if states and cities have provided DHS with this information and whether DHS has taken actions on the basis of the information. As a result, federal efforts to integrate initiatives may overlook some state or city initiatives that could help to improve information sharing and enhance homeland security.

Another way that information-sharing initiatives may limit access to information for some entities is through partnerships that promote information sharing between the partners but exclude those not participating. Some federal agencies may try to meet their information needs by forming partnerships with other agencies outside the purview of DHS and its ongoing national strategy efforts. Thus, these organizations may concentrate on local threat information and unknowingly have vital information that, when combined with national or regional information, could indicate an impending attack or help prepare for an attack.

Current Information- Sharing Process Not Perceived As Effective

In spite of legislation, strategies, and initiatives to improve information sharing, federal agencies and state and city governments generally do not consider the current information- and intelligence-sharing process to be effective. The documents that we reviewed, and officials from federal agencies, states, and cities we interviewed, indicated that they did not perceive the sharing process as working effectively. And, in our survey, fewer than 60 percent of federal, state, and city respondents rated the current sharing process as “effective” or “very effective.” Respondents identified three systemic problems. First, they believe that needed information is not routinely provided. Second, the information that they do receive is not always timely, accurate, or relevant. Third, they feel that the federal government still perceives the fight against terrorism to be generally a federal responsibility and consequently does not integrate state and city governments into the information-sharing process. An information-sharing process characterized by such systemic problems or shortcomings could contribute to a failure to detect a pending attack or prepare for an attack.

Further Improvement Is Needed in the Information-Sharing Process

According to recent reports and testimony, further improvement is needed in the information-sharing process to better protect the homeland. Federal officials have stated that information-sharing problems still exist. We have also expressed concerns about information sharing in previous reports and testimonies, as shown in the following examples: Inquiries into the events of September 11, 2001, have highlighted ongoing problems with the existing sharing process and the need for improvement. Both the Senate Select Committee on Intelligence and the House Permanent Select Committee on Intelligence have, in a joint inquiry in 2002, stated that much information exists in the files and databases of many federal, state, and local agencies. However, that information is not always shared or made available in timely and effective ways to decision makers as well as analysts to better accomplish their individual missions. In October 2002, the Staff Director of the Joint Inquiry Staff that investigated the September 11, 2001, intelligence issues testified that information sharing was inconsistent and haphazard.

On December 15, 2002, the Gilmore Commission concluded that information sharing had only marginally improved since the September 11, 2001, attacks, and that despite organizational reforms, more attention, and better oversight, the ability to gather, analyze, and disseminate critical information effectively remained problematic. Additionally, the commission reported that current information-sharing practices neither transfer to local authorities the information they need, nor adequately assesses the information collected by local authorities.

We have also expressed concerns about homeland security in previous reports and testimonies that documented the lack of standard protocols for sharing information and intelligence; the lack of partnerships between the federal, state, and local governments; and the lack of a unified national effort to improve the sharing process. In those reports, we concluded that more effort is needed to integrate the state and local governments into the national sharing process. In our report on the integration of watch list databases that contain information on known terrorists, we found that sharing is more likely to occur between federal agencies than between federal agencies and state or local government agencies because of overlapping sets of data and different policies and procedures.

Participants Do Not Perceive Current Information-Sharing Process as “Effective” or “Very Effective”

Our work involving the interviewing of cognizant officials, reviewing information-sharing documents, and analyzing the results of our survey indicated that information-sharing participants do not perceive the current process as “effective” or “very effective.” Without an effective sharing process, it is not clear how important information obtained by federal, state, or city agencies could be connected to relevant information held by other agencies and potentially pointing to an imminent attack.

In a position paper, the Major Cities Chiefs Association stated that the federal government needed to better integrate the thousands of local police officers into the sharing process and by not doing so, the federal government is not taking advantage of their capabilities. In March 2002, the National Governors Association stated that law enforcement and public safety officers do not have access to complete, accurate, and timely information. As a result, critical information is not always shared at key decision points, sometimes with tragic consequences. The International Association of Chiefs of Police testified in June 2002 that the current sharing process is not effective because state and city governments are not fully integrated into a national sharing process.

We conducted our survey nearly a year later and found little change. Our survey results indicate that participants do not perceive the current sharing of information to fight terrorism to be “effective” or “very effective,” regardless of the level of government with whom they shared information. In our survey we asked all respondents to indicate the extent of effectiveness when they shared information with the other government levels. For example, we asked the federal respondents to rate their responses from “not effective” to “very effective” when they shared information with other state and city governments. Table 2 shows the different perceived levels of effectiveness within the three levels of government.

As shown in table 2, generally fewer that 60 percent of the respondents felt that the information-sharing process was “effective” or “very effective.”

In particular, only 13 percent of the federal agencies that completed our survey reported that when sharing information with the states and cities, the current process was “effective” or “very effective.” One reason for this low percentage may be due to the historic reluctance of the federal government to share terrorism information with states and cities. On the other hand, 51 percent of large-city respondents reported that their sharing relationships with states was “effective” or “very effective,” reflecting a closer historic relationship that cites have with their states.

Systemic Problems Account for Perception That Process Is Ineffective

Federal, state, and city authorities do not perceive the current sharing process as “effective” or “very effective” because they believe (1) that they are not routinely receiving the information they believe they need to protect the homeland; (2) that when information is received, it is not very useful, timely, accurate, or relevant; and (3) that the federal government still perceives the fight against terrorism to be generally a federal responsibility. Consequently, comprehensive policies and procedures to effectively integrate state and city governments into the process of determining requirements, analyzing and disseminating information, and providing feedback have not been established. As a result, opportunities may be routinely missed to engage state and city officials in obtaining information from the federal government and providing the federal government with information that could be important in the war against terrorism.

Participants Are Not Routinely Receiving Needed Information

The federal, state, and city officials that completed our survey indicated that certain information was perceived to be extremely important to execute their homeland security duties, but they reported that they were not routinely receiving it. In the survey, we listed different types of homeland-security-related information and asked all respondents to indicate the extent to which they needed and received the information. With few exceptions, the federal, state, and city agencies that completed our survey indicated that they are typically receiving less than 50 percent of the categories of information they seek. While our survey results found that state and local agencies were generally dissatisfied with the results of information sharing with the federal government, federal agencies were just as dissatisfied with the flow of information from state and city agencies.

As shown in table 3, the majority of the states and cities reported that they needed many of the types of information listed in our survey question. For example, 90 to 98 percent of the states and large and small cities that completed our survey reported that they needed specific and actionable threat information; yet only 21 to 33 percent of them reported that they received this information. However, more than 50 percent of all respondents reported that they were receiving needed broad threat information.

One reason that states and cities may not receive needed threat information is that the information may not be available. For example, actionable threat information is rarely available according to federal intelligence officials we interviewed; however, if available, these officials told us that they would not hesitate to provide those who needed it with the information. Nonetheless, if the information is classified, Executive Order no. 12968 specifies that the information is not to be shared unless the would-be recipients have the proper security clearances and a need-to-know. Thus, the issue arises of how actionable threat information can be shared with state and local personnel without unauthorized disclosure of classified information by federal officials. Longstanding agency practices may also account for poor information sharing and may include the institutional reluctance of federal officials to routinely share information with local law enforcement officials.

Without the information that they feel they need, states and cities, as well as the federal government, may not be adequately prepared to deter future attacks. Consequently, the nation’s ability to effectively manage the risk of future attacks may be undermined. For example, the National Governors Association, the National League of Cities, and the National Emergency Management Association have all stated that they need timely, critical, and relevant classified and nonclassified information about terrorist threats so that they can adequately prepare for terrorist attacks. And the Major Cities Chiefs Association stated that law enforcement officers need background information on terrorism, the methods and techniques of terrorists, and the likelihood of an imminent attack. With this information, the association believes that law enforcement would have the background from which it could take seemingly random or unconnected events—such as minor traffic violations—and place them into a larger context, thereby being able to perceive a bigger picture of potential attack or recognize the need to pass the information to an appropriate homeland security partner agency.

Information Received Not Very Timely, Accurate, or Relevant

Our survey results confirm the perception that the information that respondents do receive is not often seen as timely, accurate, or relevant. And, of the three aspects, respondents reported that timeliness was more of a problem than accuracy or relevancy. This supports a common complaint we heard from police chiefs—that they wanted timely information but would often receive information from national news sources at the same time that the public received it. This lack of timeliness was often attributed to the federal government’s historic reluctance to share this type of information with local law enforcement officials. In the survey, we asked all respondents to indicate the extent to which the information they received from each other was timely, accurate, and relevant. Generally no level of government, including the federal government, was satisfied with the information received from the federal government, as shown in table 4.

In particular, table 4 highlights these problems for large cities. Only 23 percent of the large cities reported that the information they received from the federal government was timely, and only 39 percent reported that it was accurate. Only 40 percent reported that the information received was relevant.

When state agencies were the source of information, federal and city agencies were also dissatisfied, as shown in table 5.

Table 5 shows that in general, large and small cities view the information they receive from their state as more timely, accurate, and relevant than when compared with the view of federal agencies when they receive information from the states. Few of the federal agencies that responded view state information received as timely, accurate, or relevant.

Similarly, few federal or state agencies that responded to our survey viewed information received from the cities as timely, accurate, or relevant, as shown in table 6.

Table 6 also shows that states view the information they receive from cities more favorably than the federal agencies that responded to our survey.

Fighting Terrorism Still Seen as Generally a Federal Responsibility

The nation’s fight against terrorism is still generally perceived to be a federal responsibility, at least in terms of preventing (in contrast to responding to) a terrorist attack. Even though states and cities develop important information on potential terrorist threats to the homeland, the federal government still has not established comprehensive policies or procedures to effectively integrate state and city governments into the process of determining requirements; gathering, analyzing, and disseminating information; and providing feedback. Nor has the federal government routinely recognized states and cities as customers in the information-sharing process.

Our survey results support the view that preventing terrorism is still perceived generally as a federal responsibility. We asked respondents to indicate the extent to which the elements of a sharing framework for receiving information from the federal government—such as clear guidance and access to needed databases—were in place at the various governmental levels. The existence of these elements would indicate to some extent the level that state and city governments were integrated into the sharing process. Specifically, we found that more elements of a sharing framework, such as clear guidance for providing and receiving information, are in place at the federal level than at the state or city level, indicating that terrorism-related information is managed more at the federal level. Moreover, the lack of such elements at the state and city level nearly 2 years after the September 11, 2001, attacks may perpetuate the perception that the fight against terrorism remains generally a federal responsibility. State and city governments that completed our survey also indicated that they do not participate in national policy making regarding information sharing, which also helps maintain the perception. For example, 77 percent of the responding states, 92 percent of large cities, and 93 percent of small cities reported that they did not participate in this policy-making process. By involving states and cities, this process would help ensure a more unified and consolidated effort to protect the homeland, and provide opportunities to improve information sharing at the state and city levels.

The view that preventing terrorism is generally a federal responsibility is also reflected in the perception of the existence of barriers to providing information upwards or downwards. For example, according to the December 2002 report of the Gilmore Commission, the prevailing view continues to be that the federal government likes to receive information but is reluctant to share information with other homeland security partners. Furthermore, the commission stated that the federal government must do a better job of designating “trusted agents” at the state and local levels and in the private sector, and move forward with clearing those trusted agents. In our survey, we listed a number of barriers and asked all respondents to indicate the extent to which these barriers hindered sharing with each other. Table 7 identifies the barriers that federal, state, and city agencies that responded to our survey believe exist in the current information-sharing process.

As shown in table 7, federal officials cited several barriers that they perceive prevent them from sharing information, including concerns over state and local officials’ ability to secure, maintain, and destroy classified information; their lack of security clearances; and the absence of integrated databases. However, these perceived barriers were seen to exist by only a few respondents and could be overcome. For example, state and local police routinely handle and protect law-enforcement-sensitive information to support ongoing criminal investigations, which suggests that—with proper training and equipment—officials of these governments could handle other types of sensitive information as well.

As mentioned earlier, the Homeland Security Act requires the President, in establishing information-sharing procedures, to address the sharing of classified and sensitive information with state and local personnel. Congress suggested in the Homeland Security Act that the procedures could include the means for granting security clearances to certain state and local personnel, entering into nondisclosure agreements (for sensitive but unclassified information), and the increased use of information-sharing partnerships that include state and local personnel. For example, Congress found that granting security clearances to certain state and local personnel is one way to facilitate the sharing of information regarding specific terrorist threats between federal, state, and local levels of government. We found that the federal government has issued security clearances to state or local officials in limited circumstances and is increasing the number of such clearances. The Federal Emergency Management Agency has provided certain state emergency management personnel with security clearances for emergency response purposes, but other federal agencies, including FBI, have not recognized the validity of these security clearances. For FBI, this lack of recognition could prevent it from providing state emergency management personnel with information. At the same time, FBI has undertaken some initiatives to provide certain state officials with clearances and could clearly expand this program at the state and city levels, if officials believe that doing so will address a perceived impediment to information sharing. And DHS is also developing a new homeland security level classification for information to improve sharing.

For their part, states and cities reported few barriers in their ability to provide the federal government with information, while federal agencies cited a number of barriers to sharing. As shown in table 7, state and city agencies perceived that the federal government faces few barriers in sharing information. Appendix V details the barriers that states and cities perceive to providing federal authorities with information.

All categories of survey respondents identified the lack of integrated information systems as the single most common barrier to information sharing across all levels of government. The Markle Foundation stated in its report that federal agencies have seen the information and homeland security problem as one of acquiring new technology. For example, for fiscal year 2003, FBI budgeted $300 million for new technology, the Transportation Security Administration has budgeted $1 billion over several years, and the former Immigration and Naturalization Service (whose function is now within DHS) has a 5-year plan for $550 million. However, the foundation reports that almost none of this money is being spent to solve the problem of how to share this information between federal agencies and with the states and cities. The foundations’ report states that when it comes to homeland security and using integrated information systems, adequate efforts and investments are not yet in sight. And in recent testimony, we stated that DHS must integrate the many existing systems and processes within government entities and between them and the private sector required to support its mission.

Conclusions

With the current decentralized information-sharing process in which actions to improve sharing are not organized, and participants at all levels of government and the private sector are not well integrated into the scheme, the nation may be hampered in its ability to detect potential terrorist attacks and effectively secure the homeland. Additionally, the lack of coordination of the various information-sharing initiatives continues to hamper the overall national effort to effectively share information that could be used to prevent an attack.

DHS has initiated an enterprise architecture to provide a road map to address information-sharing issues with all levels of government and the private sector. It is important that this be done in such a way as to effectively integrate all levels of government and the private sector into an information-sharing process. Until then, it is not clear how the department will coordinate the various information-sharing initiatives to eliminate possible confusion and duplication of effort. Participants risk duplicating each other’s efforts and creating partnerships that limit access to information by other participants, thus increasing the risk that decision makers do not receive useful information; developing initiatives that are not mutually reinforcing; and potentially unnecessarily increasing the cost of providing homeland security.

The failure to fully integrate state and city governments into the information-sharing policy-making process deprives the federal government of the opportunity to (1) obtain a complete picture of the threat environment and (2) exploit state and city governments’ information expertise for their own areas, with which they are uniquely familiar.

Finally, the effectiveness of the information-sharing process to provide timely, accurate, and relevant information is also in question, creating a risk that urgent information will not get to the recipient best positioned to act on it in a timely manner. Until the perceived barriers to federal information sharing are addressed, the federal government may unnecessarily, and perhaps inadvertently, be hampering the state and city governments from carrying out their own homeland security responsibilities.

States, cities, and the private sector look to the federal government—in particular the Department of Homeland Security—for guidance and support regarding information-sharing issues. If DHS does not effectively strengthen efforts to improve the information-sharing process, the nation’s ability to detect or prepare for attacks may be undermined.

Recommendations for Executive Action

We recommend that, in developing its enterprise architecture, the Secretary of Homeland Security work with the Attorney General of the United States; the Secretary of Defense; the Director, Office of Management and Budget; the Director, Central Intelligence; and other appropriate federal, state, and city authorities and the private sector to ensure that the enterprise architecture efforts incorporate the existing information-sharing guidance that is contained in the various national strategies and the information-sharing procedures required by the Homeland Security Act to be established by the President; establish a clearinghouse to coordinate the various information-sharing initiatives to eliminate possible confusion and duplication of effort; fully integrate states and cities in the national policy-making process for information sharing and take steps to provide greater assurance that actions at all levels of government are mutually reinforcing; identify and address the perceived barriers to federal information sharing; and include the use of survey methods or related data collection approaches to determine, over time, the needs of private and public organizations for information related to homeland security and to measure progress in improving information sharing at all levels of government.

As you know, 31 U.S.C. 720 requires the head of a federal agency to submit a written statement of the actions taken on our recommendations to the Senate Committee on Governmental Affairs and the House Committee on Government Reform not later than 60 days after the date of this report. A written statement must also be sent to the House and Senate Committees on Appropriations with the agency’s first request for appropriations made more than 60 days after the date of this report.

Agency Comments and Our Evaluation

We presented a draft of this report to the Departments of Homeland Security, Defense, and Justice; and to the Director of Central Intelligence. The Departments of Homeland Security, Defense, and Justice provided written comments. The Central Intelligence Agency provided technical comments. All the departments, except the Department of Justice, concurred with our report.

The Department of Homeland Security concurred with our report and recommendations. The department added that it has made significant strides to improve information sharing. For example, the department pointed out that it is in the process of providing secure telephones to the governors and security clearances to the Homeland Security Advisors in every state so that relevant classified information can be shared. The department also pointed out that further progress will require a thoughtful, prudent, and deliberate approach. However, it cautioned that issuing the first draft of the national homeland security enterprise architecture could go beyond the September 2003 target because of the time it may take to obtain appropriate interagency coordination. The department’s comments are reprinted in their entirety in appendix VI.

DOD concurred with our recommendations. DOD’s comments are reprinted in their entirety in appendix VII.

The Central Intelligence Agency provided technical comments that we incorporated into our draft as appropriate.

On the other hand, the Department of Justice did not concur with our report and raised several concerns. The department stated that our draft report reaches sweeping and extraordinarily negative conclusions about the adequacy of the governmental sharing of information to prevent terrorism and that (1) our conclusions are fundamentally incorrect and unsupportable by reliable evidence; (2) our review was beyond our purview; and (3) an evaluation of information sharing requires a review of intelligence sharing which by long standing practice the executive branch provides to Congress but not us, thus we may not be able to provide useful information to Congress. We disagree.

First, we used reliable evidence from a variety of sources, including the Central Intelligence Agency; the Anser Institute of Homeland Security; the Joint Inquiry into the Terrorist Attacks of September 11, 2001; reports of the RAND Institute and the Markle Task Force on National Security in the Information Age; testimony before congressional committees by federal, state, and local officials; interviews that we conducted with federal, state, and local agency officials and associations representing the International Association of Chiefs of Police, the U.S. Conference of Mayors, the National League of Cities, and the National Sheriffs Association; and our survey results. Moreover, over 100 cities with populations in excess of 100,000, over 120 cities with populations of under 100,000, and 40 states responded to our survey, representing a substantial number of governmental entities providing us with evidence of information-sharing shortcomings. These organizations are involved in information collection and analysis, have conducted well respected studies on information- sharing issues, or have significant experience in providing for homeland security through law enforcement or emergency management at the state and the local level, and are recognized as authorities in their fields of endeavor. Our conclusions are based on this body of evidence. Our complete scope and methodology is shown in appendix I.

Second, the Department of Justice stated that “our review of intelligence activities is an arena that is beyond GAO’s purview” and that providing GAO with information on intelligence sharing “would represent a departure from the long-standing practice of Congress and the executive branch regarding the oversight of intelligence activities.” The Department of Justice’s impression that our review was a review of intelligence activities is incorrect. As our report clearly indicates, the oversight of intelligence activities was not an objective or focus of our review, which did not require our access to intelligence information or involve our evaluation of the conduct of actual intelligence activities. Rather, our review considered the use of intelligence information in general in the context of the broader information-sharing roles and responsibilities of various homeland security stakeholders (including the intelligence community). However, even if our review could be construed as involving intelligence activities, we disagree that such a review is outside GAO’s purview. We have broad statutory authority to evaluate agency programs and activities and to investigate matters related to the receipt, disbursement, and use of public money. To carry out our audit responsibilities, we have a statutory right of access to agency records applicable to all federal agencies. Although our reviews in the intelligence area are subject to certain limited restrictions, we regard such reviews as fundamentally within the scope of our authority.

Third, as to the department’s assertion that providing GAO with information on intelligence sharing practices would represent “a departure from long-standing practice,” we believe our review in this area furthers congressional oversight but does not require reviewing intelligence sharing practices. For example, we are not aware that the views of state and local government officials on information sharing contained in our report have previously been provided to Congress in a comprehensive manner, their views are not dependent on whether we do or do not have access to intelligence sharing practices, and the department did not indicate that this is the case in asserting that Congress is already receiving sufficient information from the executive branch. Moreover, we did not review the extent to which the executive branch provides useful information to Congress so we cannot comment on the department’s assertion. Nonetheless, as our report clearly discusses, numerous state and local government officials believe that they had not received the information that they need from federal agencies. It would have also been useful, had the department shared with us its views on information sharing for homeland security. We believe Congress should have available such information in making informed decisions in this area. The department’s comments are reprinted in appendix VIII.

We are sending copies of this report to appropriate congressional committees. In addition, we are sending copies of the report to the Secretaries of Homeland Security, Defense, Commerce, Agriculture, Transportation, and the Treasury; the Attorney General; the Director of Central Intelligence; and the Director, Office of Management and Budget. We will make copies available to others upon request. In addition, the report will be available at no charge on the GAO Web site at http://www.gao.gov.

If you or your staff have any questions about matters discussed in this report, please contact me at (202) 512-6020 or by E-mail at deckerrj@gao.gov. GAO contacts and staff acknowledgements are listed in appendix IX.

Appendix I: Scope and Methodology

Our objectives were to determine (1) what initiatives have been undertaken to improve the sharing of information that could be used to protect the homeland and (2) whether federal, state, and city officials believe that the current information-sharing process is effective.

To achieve the first objective, we reviewed documents to determine legislative initiatives and other initiatives detailed in national strategies to include the National Strategy for Homeland Security, the National Strategy for Combating Terrorism, the National Military Strategic Plan of the United States of America, the National Strategy for the Physical Protection of Critical Infrastructures and Key Assets, the National Strategy to Secure Cyberspace, and the National Security Strategy of the United States of America. We also reviewed federal, state, and city initiatives to share information. We interviewed officials from the Department of Justice, the Federal Bureau of Investigation (FBI), and the Defense Intelligence Agency on their initiatives to share information with state and city entities, and discussed information or intelligence-sharing policies and procedures with officials from the Central Intelligence Agency; the Department of Defense (DOD), Departments of Commerce, Agriculture, the Treasury, and Transportation; the U.S. Coast Guard; and DOD’s new U.S. Northern Command. We also surveyed a select group of federal, state, and city organizations to obtain information on whether they were involved in information-sharing initiatives.

To determine whether the current information-sharing process is perceived as effective by federal, state, and city governments, we interviewed officials from DOD’s Office of the Inspector General and the Defense Intelligence Agency; FBI and the Office of Intelligence Policy and Review within the Department of Justice; the U.S. Coast Guard; the Treasury Department and the U.S. Customs Service; the Department of Commerce; and the U.S. Department of Agriculture. We also interviewed representatives from the California Department of Justice, city and county of Los Angeles law enforcement authorities; the Director of Emergency Management for the District of Columbia; and the chiefs of police of Baltimore, Maryland; and Dallas, Fort Worth, and Arlington, Texas. We also interviewed representatives of professional organizations and research organizations, including the International Association of Chiefs of Police, the National Sheriffs Association, Police Executive Research Forum, the U.S. Conference of Mayors, the National League of Cities, the RAND Institute, the Center for Strategic and International Studies, and ANSER Institute for Homeland Security. To supplement our interviews, we reviewed studies and testimonies before Congress. Among the documents we reviewed are the testimonies of the President of the International Chiefs of Police before the Senate Committee on Governmental Affairs, June 26, 2002; the former Central Intelligence Agency General Counsel before the aforementioned committee, February 14, 2003; and the Chairman of the Advisory Panel to Assess the Capabilities for Domestic Response to Terrorism Involving Weapons of Mass Destruction before the aforementioned committee, February 14, 2003, and also the U.S. Select Committee on Intelligence and the House Permanent Select Committee on Intelligence, October 1, 2002. We also reviewed the position papers of the RAND Institute, International Association of Chiefs of Police, Markle Task Force on National Security in the Information Age, and others.

Use of a Survey to Supplement Interviews and Review of Documents

To achieve both objectives, we conducted a survey to augment our interviews and review of testimonies, documents, and position papers. We surveyed all 29 federal intelligence and law enforcement agencies; 50 state homeland security offices; and 485 cities, including all cities with a population of 100,000 or greater, and 242 representing a random sample of cities with a population of between 50,000 and 100,000. The city surveys were directed to the mayors; however, the mayors frequently delegated the task of completing the survey to career employees such as chiefs of police, city managers, directors of emergency management offices, assistants to the mayors, and others. The survey was not sent to the private sector, although we recognize that it has a sizeable role in homeland security by virtue of owning about 80 percent of the critical infrastructure in the United States. The survey collected information on the types of information needed by participants, the extent that this information was received and provided, the sources and usefulness of the information, and the barriers that prevent participants from sharing. However, the survey did not attempt to validate the information needs of any level of government. To ensure the validity of the questions on the survey, we pretested it with officials from the Office of the Secretary of Defense, the Defense Intelligence Agency; the homeland security directors for the states of North Dakota and Florida; the police chiefs from the cities of Dallas, Fort Worth, and Arlington, Texas; and the Director of Emergency Management for the District of Columbia. We subsequently followed up the surveys with several phone calls and E-mail messages to all federal and state agencies surveyed, and a large number of cities to increase our response rate.

Of the 485 surveys sent to the cities, 228, or 47 percent, responded. The 257 cities that did not respond might have answered the survey differently from those that did; however, we could not determine this. Therefore, we present the results of those cities that did complete the surveys knowing that the nonresponders could have answered differently. Where applicable in the report, we present the results of large and small cities separately, unless noted otherwise. Also, when presenting survey results, we judgmentally benchmarked the response level we believed would be acceptable for an information-sharing process that is so vital to homeland security. For example, for a process of this importance, we believe that respondents should perceive that the overall sharing process is “effective” or “very effective” and not “moderately effective” or lower.

The scope of this review did not include the federal government’s critical infrastructure protection efforts, for which we have made numerous recommendations over the last several years. We also did not include the private sector, although we recognize the importance of this sector in that it owns about 80 percent of the nation’s infrastructure. Critical infrastructure protection efforts are focused on improving the sharing of information on incidents, threats, and vulnerabilities, and the providing of warnings related to critical infrastructures both within the federal government and between the federal government and state and local governments, and the private sector.

We conducted our review from June 2002 through May 2003 in accordance with generally accepted government auditing standards.

Appendix II: Selected Initiatives to Promote Information Sharing

In order to judge the extent of initiatives, judge efforts to share more information, and identify possible duplication of efforts, we gathered documents that outlined these efforts. Also, in our survey, respondents identified initiatives and efforts they were involved with. The following table is not exhaustive, since all respondents did not complete this survey question; however, it illustrates potential duplication of efforts between the federal, state, and city governments.

Appendix III: Survey Responses Showing Categories of Homeland Security Information Deemed Needed by the Respondents

In order to establish a baseline for the information requirements of federal agencies, and state and city government officials, we provided survey respondents with a list of potential types of homeland security information and asked them to indicate what they thought they needed to meet their homeland security objectives. We then asked the respondents to tell us how frequently they received the information they perceived they needed. Table 9 is a summary of the types of information the respondents reported they needed or critically needed and the percentage that they frequently or regularly received the information. For example, 98 percent of state officials reported that they needed or critically needed specific and actionable threat information, while they also reported regularly receiving this type of information only 33 percent of the time.

Appendix IV: Survey Responses to Our Questions on the Elements of an Information- Sharing Process That Are Already in Place

GAO provided a list of criteria that it believes represents elements of a sharing framework and asked respondents to identify which best characterizes their current information-sharing framework. Table 10 shows that at all three levels of government, the sharing framework is incomplete, with cities—and small cities in particular—-having few elements of a sharing framework operational.

Appendix V: Survey Responses to Perceived Barriers Faced by States/Cities in Providing the Federal Government with Information

We asked state, large-city and small-city respondents to identify what they perceive to be factors that hinder their organizations from providing federal authorities with homeland security information or intelligence. In contrast to the several barriers identified by federal respondents to providing state and local officials with information and intelligence, table 11 shows that states and city respondents identified the lack of integrated databases as the only significant barrier.

Appendix VI: Comments from the Department of Homeland Security

Appendix VII: Comments from the Department of Defense

Appendix VIII: Comments from the Department of Justice

Appendix IX: GAO Contacts and Staff Acknowledgments

GAO Contacts

Acknowledgments

In addition to those named above, Lorelei St. James, Patricia Sari-Spear, Tinh Nguyen, Rebecca Shea, Adam Vodraska, and R.K. Wild made key contributions to this report.

Related GAO Products

Information Technology: Terrorist Watch Lists Should Be Consolidated to Promote Better Integration and Sharing. GAO-03-322. Washington, D.C.: April 15, 2003.

Combating Terrorism: Observations on National Strategies Related to Terrorism. GAO-03-519T. Washington, D.C.: March 3, 2003.

Homeland Security: Effective Intergovernmental Coordination Is Key to Success. GAO-02-1013T. Washington, D.C.: August 23, 2002.

Homeland Security: Key Elements to Unify Efforts Are Underway but Uncertainty Remains. GAO-02-610. Washington, D.C.: June 7, 2002.

Information Sharing: Practices That Can Benefit Critical Infrastructure Protection. GAO-02-24. Washington, D.C.: October 15, 2001.

Combating Terrorism: Selected Challenges and Related Recommendations. GAO-01-822. Washington, D.C.: September 20, 2001.

FBI Intelligence Investigations: Coordination within Justice on Counterintelligence Criminal Matters Is Limited. GAO-01-780. Washington, D.C.: July 16, 2001.