FinCEN is a relatively small agency with a fiscal year 1997 budget of about $23 million and an onboard staffing level (as of December 1997) of 162 employees. FinCEN does not initiate or carry out any investigations on its own. Rather, by serving as a central source for financial intelligence information and analysis, FinCEN supports the investigative and prosecutive efforts of numerous law enforcement authorities. These include federal agencies, such as the Federal Bureau of Investigation (FBI), the Drug Enforcement Administration (DEA), IRS, and the Customs Service; state police departments and attorney general offices; local police departments and district attorney offices; and others, including applicable foreign authorities. In supporting these law enforcement entities, FinCEN administers the largest financial transaction reporting system in the world, which is based on recordkeeping and reporting requirements mandated or authorized under the BSA, as amended. To supplement the BSA-related financial database, FinCEN procures access to a variety of commercially maintained databases, such as Autotrack and Lexis/Nexis, which can be used to locate individuals, determine asset ownership, and establish links among individuals, businesses, and assets. Moreover, through specific written agreements, FinCEN can access the investigative-case databases of various federal law enforcement agencies (e.g., DEA and the Customs Service). Further, FinCEN maintains an internal database of the cases or requests it has supported and the related products it has generated. This internal database enables FinCEN to help law enforcement agencies coordinate their efforts. Appendix II contains additional information about the databases used by FinCEN. Using these financial, commercial, and law enforcement databases, FinCEN provides five principal types of support. Historically, tactical support in response to law enforcement requests for data and analysis has been a mainstay of FinCEN’s various products and services. Tactical products can be database extracts on a single subject or detailed, in-depth analyses of the financial aspects of major criminal organizations. According to a FinCEN official, routine requests for tactical support are handled on a first-come, first-served basis, with federal, state, and local requests treated equally. The official added that FinCEN can respond to tactical requests requiring immediate attention (e.g., terrorism cases) within 24 hours and sometimes as quickly as 2 to 3 hours. At times, FinCEN may also provide off-site support to investigative teams or task forces working complex cases. Further, FinCEN provides tactical support to assist other types of cases, including classified, terrorism, and grand-jury investigations. As the name implies, rather than focusing on individual cases, FinCEN’s strategic support is designed to provide federal and state law enforcement officials with intelligence analyses and reports on longer term or more broadly scoped topics. An example is the analysis of trends, patterns, and fluctuations in currency flows to and from Federal Reserve banks to determine any money-laundering implications. Also, as part of its strategic efforts, FinCEN has developed a “case lab” unit to assist law enforcement agencies in addressing large-scale money-laundering activity, such as that conducted by drug cartels. According to FinCEN’s Strategic Plan (1997-2002), the agency’s overriding objective over the next few years will be to construct a viable model for determining the magnitude of money laundering. FinCEN’s artificial intelligence support is designed to help identify subjects (i.e., individuals and businesses) possibly involved in money laundering and other types of financial crimes. This support relies on computerized technology designed to identify suspicious transactions by reviewing and correlating (i.e., grouping or linking) currency transaction reports required by the BSA. FinCEN has used this technology to self-generate investigative leads as well as to respond to specific requests. In the former instances, FinCEN’s policy is to forward its results to the appropriate law enforcement agency for consideration. A fourth type of support is on-site tactical self-help (called a “platform concept”), whereby FinCEN encourages and trains agents and analysts from federal law enforcement and regulatory agencies to access the BSA financial database and commercial databases (accessible at FinCEN) to conduct their own research and analysis. FinCEN provides office space and database access for these personnel, who use FinCEN resources on a full- or part-time basis and work only on cases for their respective agencies. Most platform users do not have direct access to law enforcement databases or suspicious activity reports. A FinCEN official explained that (1) interagency agreements usually prohibit platform users from accessing law enforcement databases and (2) most federal agencies that use suspicious activity reports have their own access to the reports. When requested, a FinCEN employee will check these databases for platform users. Finally, the fifth type of support is off-site tactical self-help (called “Project Gateway”)—a joint effort between FinCEN and the IRS Detroit Computing Center, which receives and processes financial information reported under the BSA (e.g., currency transaction reports). Using custom-designed software, designated state and local law enforcement officials have direct, on-line electronic access to BSA records, including suspicious activity reports. These designated officials also conduct Gateway queries for other law enforcement agencies in their state and can also request information from the Autotrack commercial database. According to a FinCEN official, Gateway users have direct access to suspicious activity reports primarily because state and local law enforcement agencies do not have their own access to the reports. Further, through Gateway, FinCEN can “alert” or notify one agency that another agency has or had an interest in the same investigative subject (individual or entity). Each state’s access to Gateway is free of charge (except for telephone charges). While the types of products and services offered by FinCEN have expanded, the volume of tactical, strategic, and artificial intelligence reports has decreased over the past several years. While the reasons for the decreases varied, one significant factor cited by FinCEN was that it assigned fewer staff to support these activities. Since 1995, law enforcement officials have increased their use of FinCEN’s platform concept and Project Gateway to conduct their own research and analysis. FinCEN has been providing tactical support to the law enforcement community since the agency was established in 1990. As figure 1 shows, the volume of law enforcement requests to FinCEN for tactical support increased significantly from calendar year 1991—the first full year of operation—to 1995. However, from calendar year 1995 to 1997, the volume of requests decreased by approximately 38 percent. According to a FinCEN official, one primary reason for the decrease in the number of tactical requests was that, in recent years, FinCEN stopped accepting certain types of requests—such as requests involving background checks for employment or security clearance purposes—that did not directly support law enforcement functions. For example, FinCEN stopped supporting certain IRS and U.S. Postal Inspection Service investigations in 1996. As a result, FinCEN’s 1997 workload was reduced by approximately 3,300 cases. The official told us that FinCEN’s expertise is not needed to conduct these types of inquiries and that, as a result, FinCEN has made efforts to encourage agencies to conduct these types of research on their own or by using FinCEN’s platform concept or Project Gateway, as applicable. The official told us that FinCEN stopped accepting certain types of requests to compensate for reductions in staff assigned to provide tactical support. As figure 2 shows, from October 1994 to October 1997, the total number of staff (federal and contractor) responding to requests for tactical investigative support decreased from 77 to 40. Of this total, the number of federal staff (i.e., FinCEN employees and detailees from other agencies) decreased from 53 to 19. According to the FinCEN official, although the agency’s overall staff levels have remained fairly constant over the years, many tactical staff have been reassigned to support FinCEN’s expanded mission, which includes (1) responsibility for promulgating BSA regulations and (2) a leadership role in international efforts to combat money laundering. The official also told us that several tactical staff were reassigned in March 1997 to support FinCEN’s new Office of Research and Analysis. According to FinCEN officials, FinCEN also began to contact requesters in 1995 to determine specifically what type of data and analysis was needed. These contacts included determining which databases had already been researched (outside of FinCEN), which databases FinCEN should research, and what type of report should be provided (e.g., a database extract or an analytical report). The officials told us that, before 1995, FinCEN’s tactical support staff would generally research all of the financial, commercial, and law enforcement databases the agency could access. Further, over the past 2 years, an increasing number of tactical reports consisted of database extracts versus reports that contained detailed analysis. According to FinCEN officials, the percentage of tactical products that contained detailed analysis decreased from approximately 25 percent in calendar year 1996 to about 10 percent during calendar year 1997. According to FinCEN’s Strategic Plan (1997-2002), the agency intends to provide better tactical support to its customers by increasing the number of FinCEN analysts capable of performing complex research and analysis. As with tactical support, FinCEN has been providing strategic support to the law enforcement community since 1990. As shown in figure 3, the volume of strategic reports issued by FinCEN has decreased from a high of 23 in 1992 to 1 in 1997. According to a FinCEN official, fewer strategic reports were generated in recent years because (1) FinCEN assigned fewer staff to support strategic projects and (2) the products often did not provide the type of information law enforcement officials needed to do their work. To increase its emphasis on strategic support and to improve the usefulness of strategic products, FinCEN created a new Office of Research and Analysis in March 1997. Although FinCEN initially planned to staff this office with 23 analysts, only 14 staff were on board as of November 1997. Before this reorganization, FinCEN’s Strategic Analysis Division had five to seven analysts performing strategic analysis. Additional perspectives about the usefulness of FinCEN’s strategic products and initiatives are discussed later in this report. Since March 1993, FinCEN has been using its artificial intelligence targeting system to help the law enforcement community identify subjects possibly involved in money laundering and other financial crimes. As shown in table 1, the volume of products generated by FinCEN from artificial intelligence analyses has decreased significantly over the past 2 fiscal years. FinCEN officials provided several reasons for the decrease in artificial intelligence products. First, they said the artificial intelligence system was redesigned for fiscal year 1996 to focus on more complex cases, which they defined by the number of subjects per case. FinCEN data indicated there was an average of 2.5 subjects per case in fiscal year 1995 versus an average of 16.2 subjects per case in fiscal year 1996. Second, they said that the majority of the artificial intelligence products generated in fiscal years 1993 to 1995 were self-initiated, and that FinCEN self-initiated very few artificial intelligence products in fiscal years 1996 and 1997, in part because federal law enforcement agencies reportedly did not take any action on many of the former products. Third, they said that FinCEN reduced the number of full-time analysts working on artificial intelligence cases from three in fiscal year 1995 to the equivalent of one-half full-time analyst in fiscal year 1997. In an effort to increase the number and usefulness of investigative leads and products generated, FinCEN assigned three full-time staff to support artificial intelligence cases in early fiscal year 1998. In an effort to expand the availability and use of its tactical support resources, FinCEN developed the platform concept in 1994, offering employees of federal law enforcement agencies space at FinCEN and access to BSA financial data and commercial databases so they could conduct their own research and analysis. As table 2 shows, law enforcement agencies have increased their use of platforms. As of April 1998, 51 personnel representing 31 agencies were using platforms on a full- or part-time basis at FinCEN. According to data provided by FinCEN, platform users supported 1,477 investigative cases during fiscal year 1997. These data show that the most frequent platform users during this period were the Defense Criminal Investigative Service; the Capitol Police; the Bureau of Alcohol, Tobacco and Firearms; and the Washington/Baltimore HIDTA. Also in 1994, FinCEN initiated Project Gateway to provide state and local law enforcement agencies with remote access to BSA financial data. In 1997, FinCEN expanded Gateway’s remote research capability by providing states with (1) access to suspicious activity reports to support ongoing investigations; (2) the capability to identify potential subjects (i.e., new leads) by proactively searching BSA records, including currency transaction reports and suspicious activity reports (generated within the users’ own state); and (3) access to information from one commercial database (i.e., Autotrack) via Gateway’s bulletin board system. As shown in figure 4, the states’ use of Gateway has steadily increased since 1995—the first full year when all 50 states had access. According to FinCEN data, the most frequent Gateway users during fiscal year 1997 were California, Illinois, Pennsylvania, and Texas. Wyoming was the only state that did not use Gateway during this period. According to FinCEN’s records, the 57,663 Gateway queries in fiscal year 1997 supported 3,327 law enforcement cases. Approximately 84 percent of the BSA reports reviewed during these queries were currency transaction reports. Also, 21 states made a total of 3,440 automated queries of Autotrack during fiscal year 1997. Further, the number of times FinCEN used Gateway to alert or notify one agency that another agency had an interest in the same investigative subject (individual or entity) increased from 356 in fiscal year 1996 to 920 in fiscal year 1997. Responses to the surveys we sent to officials from 31 federal agencies and 15 states indicated that FinCEN’s tactical products have been useful in identifying, developing, and prosecuting cases involving money laundering and other financial crimes. Also, FinCEN has taken steps to address concerns with and improve the usefulness of its strategic and artificial intelligence products, such as attempting to “partner” with the law enforcement community in developing these products. Further, according to the federal and state officials we interviewed, the platform concept and Project Gateway are excellent tools for helping agencies combat money laundering and other financial crimes. To assess the usefulness of FinCEN’s tactical support, we surveyed by mail a stratified, statistical sample of 352 officials from 31 federal agencies and a simple random sample of 95 officials from 15 states who requested tactical support from April 1996 through March 1997 and to whom FinCEN had responded before August 1997. Based on the results of these surveys, we estimated that 97 percent of all requesters from the 31 federal agencies found that, overall, all types of products they received (i.e., database extracts, analytical reports, and responses to expedited requests) were useful in supporting their investigations. Similarly, we estimated that 98 percent of the requesters from the 15 states found that, overall, the products they received were useful. The survey results indicated that FinCEN’s tactical products assisted law enforcement investigations in various ways. As shown in figure 5, we estimated that the majority of the requesters from the 31 federal agencies found that the tactical products (1) verified or confirmed information already known, (2) saved them time and money, (3) provided investigative leads that were previously unknown, or (4) identified assets that were previously unknown. We also estimated that the majority of the requesters from the 15 states found that the tactical products assisted their investigations in various ways (see app. IV for additional details on state responses). Additionally, on the basis of the survey responses, we estimated that 84 percent of the federal officials received products that responded to their requests in a complete and thorough manner. We estimated that another 14 percent found that some, but not all, of the products addressed their requests in a complete and thorough manner. Also, we estimated that 81 percent of the federal officials found the products to be “very” (29 percent) or “somewhat” (52 percent) timely, and an estimated 97 percent would “definitely” (78 percent) or “probably” (19 percent) request tactical support from FinCEN in the future. Although we estimated that 81 percent of the requesters from the 31 federal agencies found FinCEN’s tactical products timely, the most frequent comment or suggestion regarding how FinCEN’s tactical products could be improved concerned the timeliness of responses. We estimated that 17 percent of the federal officials who received tactical products would suggest that FinCEN should respond to requests in a more timely manner. Although the number of requests received by FinCEN decreased during fiscal year 1997 and FinCEN has taken steps to better focus the scope of each request, the average turnaround time—i.e., the number of calendar days from when a request is received at FinCEN to the day the product is mailed to the requester—for routine requests increased to 2 to 3 months during most of fiscal year 1997. According to a FinCEN official, the primary reason for this lengthy turnaround time was because many staff responding to tactical requests were reassigned in March 1997 to support FinCEN’s new Office of Research and Analysis. Consequently, the number of FinCEN staff supporting tactical requests decreased from 19 in October 1996 to as few as 7 during the summer of 1997 before increasing back to 19 in October 1997. The official told us the average turnaround time for routine requests was reduced to about 3 weeks in September 1997—about 6 months after the sample period used for our questionnaire—by authorizing overtime and temporarily having more staff do casework. He noted that FinCEN had 22 tactical staff on board as of February 1998, which should help prevent backlogs and adverse turnaround times in the future. He added that FinCEN has also authorized overtime to address any backlogs that may occur. According to a FinCEN official, the feedback FinCEN received from the law enforcement community indicated that many of the strategic reports FinCEN issued from 1990 to 1996 were of limited use to law enforcement agencies, regulators, and banking institutions. He noted that many law enforcement officials told FinCEN the reports were informative but that many of the reports were not effective or useful in supporting investigative efforts and, some of them did little more than repackage what law enforcement officials had previously reported to FinCEN. The official also told us that, in the past, FinCEN had not taken an active partnership role with law enforcement agencies, regulators, and financial institutions to help make the products more useful to them. In response to law enforcement’s observations regarding the usefulness of FinCEN’s strategic products, FinCEN reorganized and reallocated its resources in March 1997 to create a new Office of Research and Analysis. This office plans to generate products that help agencies improve their money-laundering detection and prevention programs, while providing case-specific support to the law enforcement and regulatory communities. For example, according to a FinCEN official, since mid-1997, FinCEN has analyzed suspicious activity reports and provided selected federal field offices with target lists of potential suspects. He added that this office also intends to take an active partnership role with law enforcement agencies, regulators, and financial institutions in developing future strategic products. To assess the usefulness of strategic products, we interviewed officials who received state-specific money-laundering threat assessment reports in 1996 or 1997—Georgia (April 1996), Louisiana (April 1996), and Florida (June 1997). Generally, FinCEN’s threat assessment reports focus on specific industries, businesses, financial entities, and geographic locations exhibiting unusual currency movements that may be indicative of money-laundering activity. According to officials from Georgia and Louisiana, the threat assessment reports FinCEN prepared for their states were informative but, at the time of our review, had resulted in limited or no investigative actions. However, according to a Louisiana state official, FinCEN’s 1996 report contributed to the state enacting comprehensive money-laundering legislation and expanding its statutory wiretap authority. The June 1997 South Florida Money Laundering Threat Assessment—a joint effort between FinCEN and the South Florida HIDTA Task Force—was the first partnership effort and first report issued by the Office of Research and Analysis. According to a HIDTA official in Florida, as of January 1998, this report had not led to any new investigations. However, he told us the report provides information that will help the law enforcement community in the region reallocate its resources. He added that the partnership meetings associated with the report have been useful in bringing together officials from the law enforcement, regulatory, and banking communities to discuss money-laundering issues. To assess the usefulness of FinCEN’s artificial intelligence products, we attempted to contact 24 law enforcement officials who, according to FinCEN’s records, received the 85 artificial intelligence reports FinCEN generated from April 1996 to March 1997. The 13 officials we eventually were able to contact received 51 (60 percent) of the 85 artificial intelligence products. The 51 products supported 15 separate cases. According to these officials, the information contained in FinCEN’s artificial intelligence products was useful in various ways. For example, in reference to the 15 cases, the products identified potential subjects that were previously unknown (9 cases), provided investigative leads that were previously unknown (11 cases), identified assets that were previously unknown (6 cases), and verified or confirmed information already known (12 cases). According to the 13 officials, the information contained in the artificial intelligence products led to five preliminary investigations, and three new cases were opened. One official told us the artificial intelligence analyses compiled by FinCEN provided several investigative leads, which indicated criminal activity involving people and/or businesses located nationally and internationally. Three of the officials told us they did not use the products at all. Overall, 12 of the 13 officials indicated they would definitely or probably request additional products in the future. In an effort to provide artificial intelligence products that are more useful to the relevant agencies, FinCEN is attempting to “partner” with the law enforcement community. For example, in November 1997, FinCEN analysts began working directly with agents from U.S. Customs Service field offices to help them generate, understand, and use artificial intelligence products. According to a FinCEN official, the agency intends to provide continuing support and updates to these agents. This initiative has not been in effect a sufficient period of time to assess its usefulness. As shown earlier in table 2, both the number of agencies using platforms and the number of cases supported increased significantly from 1995 to 1997. To assess the usefulness of FinCEN’s platform concept, we interviewed officials from three agencies that were among the top four user agencies in 1997—the Defense Criminal Investigative Service; the Bureau of Alcohol, Tobacco and Firearms; and the Washington/Baltimore HIDTA. According to FinCEN’s records, these agencies accounted for 971 (66 percent) of the 1,477 investigative cases that were supported by platforms in 1997. According to these officials, access to financial and commercial databases using FinCEN’s platforms is an important and useful tool in helping their respective agencies initiate cases and conduct investigations. For example, a Defense Criminal Investigative Service analyst told us she uses a platform to support every new case initiated by the agency and, at the request of field offices, prepares detailed research reports. The analyst commented that she would like FinCEN to provide access to additional sources of data, such as suspicious activity reports and law enforcement databases via platforms. Also, an official from the Washington/Baltimore HIDTA told us that use of platforms is the HIDTA’s primary means for obtaining commercial data. The official noted that having access to platforms has enabled analysts to respond to requests for information in a timely manner. According to a FinCEN official, providing agencies with access to financial and commercial data via platforms should allow FinCEN to focus its efforts on more complicated cases that require FinCEN’s expertise and analytical support. As shown earlier in figure 4, 49 states used the Gateway system in fiscal year 1997 to make a total of 57,663 queries for BSA financial data. To assess the usefulness of the Gateway system, we interviewed the state coordinator for each of the four states that made the most Gateway queries in fiscal year 1997—California, Illinois, Pennsylvania, and Texas. According FinCEN data, these states made 22,876 (or 40 percent) of the total 57,663 Gateway queries during this period. According to these officials, remote access to BSA financial data via the Gateway system is useful for helping their states combat money laundering and other financial crimes. The officials also told us Gateway’s expanded capabilities were useful, including (1) remote access to commercial data and (2) proactive searches of BSA financial records, including currency transaction reports and suspicious activity reports, to generate targets in their state for possible money laundering and other financial crimes investigations. In August 1997, FinCEN began providing additional agencies in some states with direct access to the Gateway system. According to FinCEN’s records, 310 state law enforcement officials had Gateway user accounts as of the end of fiscal year 1997. Also, selected law enforcement officials from DEA have been granted access to Gateway. According to a FinCEN official, other federal agencies can join Project Gateway if they agree to (1) identify the case file under which Gateway queries are run, (2) reasonably share case information with other agencies, and (3) execute appropriate legal agreements. He added that the case information is needed to help FinCEN assist Gateway users in coordinating their investigative efforts. According to a FinCEN official, in 1998, the agency intends to expand Gateway’s capabilities to include additional commercial databases and, when available, data on money services businesses. Our analysis of FinCEN’s records revealed that some federal field offices, states, and HIDTAs requested little or no tactical support from FinCEN during the period we reviewed, April 1996 to March 1997. To determine the reasons why this support was not requested, we surveyed the U.S. investigative units of 129 Treasury and Justice field offices and each of the 22 HIDTAs that had been designated as of December 1997. We also interviewed officials from 9 of the 10 states that, according to FinCEN’s records, made either one or no requests for FinCEN’s tactical support from April 1996 to March 1997. In summary, respondents from many of the federal field offices, states, and HIDTAs surveyed said they have in-house capabilities or use sources other than FinCEN for tactical support. Also, respondents from some federal field offices said that agents and investigators are not aware of the products and services offered by FinCEN. From our surveys and interviews, the most frequently mentioned reason why many of the federal field offices, states, and HIDTAs requested few, if any, tactical products from FinCEN was the availability and use of in-house capabilities and sources other than FinCEN for financial, commercial, and law enforcement data and analysis. Dissatisfaction with FinCEN’s tactical products was rarely cited as a reason for the limited use of FinCEN. Of the IRS, Customs, FBI, and DEA field offices that responded to our survey, 6 percent noted that they did not request FinCEN’s tactical support “over the past year.” An additional 42 percent noted that they requested tactical support 5 times or fewer during this period (see app. V, question 1). Table 3 shows the various reasons why FinCEN was not the primary source for financial, commercial, or law enforcement data or analysis for the federal field offices. Also, according to the survey responses, the IRS and Customs investigative field offices had direct access to BSA financial databases, while the FBI and DEA offices primarily used grand jury subpoenas to obtain financial data. Almost all of the field offices noted they had access to one or more commercial databases. Most of the offices also indicated they had access to a variety of sources for law enforcement information outside of FinCEN, such as the National Crime Information Center and the National Law Enforcement Telecommunications System. Also, several offices noted their office and/or agency had staff and other resources to provide analytical support for money laundering and other financial crime investigations. Several offices indicated that they had access to intelligence or investigative support centers (other than FinCEN) that provide financial, commercial, and/or law enforcement data and analysis. These sources include, for example, the FBI’s Savannah (Georgia) and Butte (Montana) Information Technology Centers, the South Florida Investigative Support Center (part of the South Florida HIDTA), the National Drug Intelligence Center (Johnstown, Pennsylvania), and the El Paso Intelligence Center (El Paso, Texas). In commenting on a draft of this report, Department of Justice officials noted that while many agencies have in-house capabilities or use sources other than FinCEN for financial, commercial, and law enforcement data and analysis, FinCEN still plays an important role in facilitating the sharing of financial information and is a leader in the financial database field. Officials we interviewed from the nine states that made either one or no requests for FinCEN’s tactical support from April 1996 to March 1997 cited several reasons for not requesting more support. These reasons include (1) the lack of authority to conduct investigations into money laundering; (2) the lack of resources to pursue financial crimes; and (3) the use of other sources of information, such as FinCEN’s Gateway system and direct access to commercial databases. Sixteen of the 22 HIDTAs surveyed responded to our questionnaire. Survey results showed that 4 of the 16 respondents were designated as HIDTAs in 1997 and had not performed the type of money laundering or financial crime investigations that FinCEN supports. Of the 12 HIDTAs that were performing such investigations, 8 noted that (1) the HIDTA had all or most of the capabilities it needed in-house or (2) it was easier to access data or get analytical support from other sources. Of these 10 respondents, 6 noted that other sources were more timely than FinCEN and 2 (of the 6) indicated that the HIDTA was not aware of the products and services provided by FinCEN. Our survey responses and interviews indicated another reason for the limited use of FinCEN’s tactical support. That is, many agents and investigators located in federal field offices were not aware of the products and services offered by FinCEN. For example, as shown in table 3, 28 (24 percent) of the 116 federal field offices that responded to our survey noted that their agents and investigators were not aware of FinCEN’s products and services. FinCEN officials told us the agency has informed federal and state officials about its products and services on several occasions. For example, in mid-1996, FinCEN initiated a three-phased approach to inform and obtain feedback from Treasury Department officials. The three phases were (1) telephone surveys; (2) on-site visits with U.S. Customs Service; Bureau of Alcohol, Tobacco and Firearms; and IRS field offices in six cities and the U.S. Customs Service in a seventh city; and (3) training on how to use FinCEN resources at events such as Special-Agent-in-Charge meetings, internal training, and new agent training. One Treasury Department component, the U.S. Secret Service, declined FinCEN’s offer to participate in the outreach program. FinCEN followed this effort with telephone or fax surveys to approximately 100 officials from other federal agencies. According to FinCEN’s records, the agency’s tactical staff also provided information about FinCEN at meetings, training events, or conferences 51 times in fiscal year 1996 and 48 times in fiscal year 1997. This included presentations to or meetings with state police departments, other intelligence centers (e.g., the El Paso Intelligence Center and the National Drug Intelligence Center), and federal agencies’ asset forfeiture personnel. Also, according to FinCEN’s records, from February to October 1997, FinCEN officials visited 24 states to brief state officials about FinCEN’s support. FinCEN drew several conclusions from its 1996 efforts to inform and obtain feedback from federal agency officials about its products and services. Specifically, FinCEN concluded that it should seriously consider (1) providing potential requesters with a one-page summary of FinCEN’s capabilities, missions, and programs and (2) advising potential customers about the capabilities of new or enhanced commercial and law enforcement databases. In March 1998, FinCEN updated its site on the Internet to include information on the types of support it provides to the law enforcement community and to offer viewers the opportunity to send comments or questions via electronic mail. Also, in his April 1, 1998, statement before the House Banking and Financial Services’ Subcommittee on General Oversight and Investigation, the Treasury Assistant Secretary (Enforcement) said that FinCEN will work to further communicate its capabilities to its potential customers. While FinCEN has taken several actions to better ensure that potential customers are aware of the availability of FinCEN’s various products and services, it has not developed written criteria or guidance specifying the types of cases that FinCEN can best support. According to a FinCEN official, tactical support is generally best suited for (1) cases that involve large criminal organizations, are of significance to the jurisdiction, or require expert financial analysis and (2) cases where support is not available from in-house sources (e.g., requests for BSA data). The official told us that for cases or investigations that do not require FinCEN’s expertise or analysis, other sources of data and analysis can be used, including FinCEN platform concept and Project Gateway. He also mentioned that FinCEN staff are available to train agencies to use their own resources to conduct research and analysis. The FinCEN official added that, to his knowledge, FinCEN has never turned down a request to support an ongoing law enforcement investigation that required FinCEN’s capabilities. FinCEN has established several controls to reduce the risk of unauthorized access to and use of sensitive information obtained via Project Gateway.As a primary set of controls, FinCEN has established policies and procedures that states are to follow in accessing and using Gateway information. However, FinCEN has not evaluated the states’ compliance with these controls. Although FinCEN has taken some steps to review Gateway queries, this review does not include a direct assessment of the states’ controls over Gateway information. FinCEN’s Gateway system provides designated state and local agency officials with direct, on-line access to sensitive BSA information. For example, these officials have direct access to currency transaction reports that reflect transactions with financial institutions that exceed $10,000. Gateway users also have direct access to suspicious activity reports that are filed by banks and other depository institutions when they know, suspect, or have reason to suspect that a crime has occurred or that a transaction is suspicious. Security management of the Gateway system is a joint effort between the IRS Detroit Computing Center and FinCEN. The Detroit Computing Center is responsible for ensuring that the host system that contains the BSA data is secured to the level required by the Treasury Department’s policy for systems that process sensitive data. The Center’s Project Gateway Users Guide specifies additional access controls to BSA information, including (1) password requirements and (2) disconnecting users from the Gateway host computer after 5 minutes of inactivity. The Center also records Gateway user activity and provides this information to FinCEN. FinCEN’s Gateway Security Plan specifies additional controls designed to ensure that BSA information and other sensitive data, including information and data transmitted to FinCEN and the Detroit Computing Center from the states, are safeguarded or protected appropriately by Gateway users. Among other things, this plan presents policies and procedures that designated state officials are to follow in (1) verifying requesters’ validity and identity, (2) determining that requests are made pursuant to bona fide criminal investigations or other authorized purposes, and (3) maintaining records of Gateway requests. A basic internal control objective for any management information system is to protect data and programs from unauthorized access, modification, and disclosure. Organizations can help protect their data by establishing controls to prevent unauthorized access and by monitoring the access activities of individuals to help identify any significant problems and deter individuals from inappropriate and unauthorized activities. According to our recent study of information security management best practices,evaluating the effectiveness of controls and preparing summary reports for management attention are important elements in ensuring that controls are operating as intended. FinCEN has not evaluated the states’ compliance with specified policies and procedures designed to control access to and use of information obtained through the Gateway system. The Gateway Security Plan contains provisions for FinCEN officials to inspect states’ records, including FinCEN staff visits to the states, to determine if the Gateway system and the BSA data have been misused. However, although Project Gateway has been operational since 1994, FinCEN had not inspected any states’ records, scheduled any FinCEN staff visits to the states, or developed any audit plans for on-site evaluations of the states’ compliance with applicable policies and procedures, as of May 1998. However, FinCEN has taken some steps—based on limited sampling and self-reporting questionnaires—to determine if selected Gateway cases were done for official purposes and were requested by authorized individuals. That is, in October 1997, FinCEN screened fiscal year 1997 user data recorded by the IRS Detroit Computing Center to identify cases that appeared to be irregular, such as those requested by agencies that do not usually conduct criminal investigations. In doing so, FinCEN identified 76 cases from 23 states that appeared to be irregular. To obtain more information about these 76 cases, and 98 additional cases that were randomly selected from 39 states, FinCEN distributed questionnaires to applicable state and local agency officials. Nine agencies did not respond to the questionnaires. According to FinCEN’s audit report dated May 15, 1998, the self-reporting questionnaires indicated that the Gateway cases sampled, for which responses were received, were made in connection with a criminal investigation and were requested by an authorized law enforcement official. However, the audit report indicated that 13 agencies did not follow the proper procedures for redissemination of Gateway information. According to a FinCEN official, while they proved useful, the self-reporting questionnaires do not constitute a direct assessment of state and local compliance with controls over Gateway information. FinCEN and IRS plan to increase security of the Gateway telecommunications network by January 1999. Even with these improvements, control over access to BSA information at state locations will still largely depend on the states’ verification that individual user requests for information have been properly authorized. Therefore, evaluating the states’ compliance with applicable policies and procedures will remain an important element in ensuring that controls are operating as intended. In an effort to enhance its investigative support, FinCEN is seeking approval from IRS to provide IRS Form 8300 information (Report of Cash Payments Over $10,000 Received in a Trade or Business) to the law enforcement community. Several federal and state law enforcement officials we interviewed also told us FinCEN could enhance its investigative assistance by providing access to selected information from these forms. Although IRS has taken steps to implement 1996 legislation authorizing the Secretary of the Treasury to disclose Form 8300 information to federal, state, and local agencies, several issues must still be resolved before FinCEN can obtain approval from IRS to disseminate this information. Section 6050I of the Internal Revenue Code, in general, requires any person engaged in a trade or business (other than financial institutions required to report under the BSA) who receives more than $10,000 in cash, in a single transaction or a series of related transactions, to file a report with the Secretary of the Treasury. The Secretary of the Treasury requires this report to be filed on an IRS Form 8300. The form provides a paper trail that can help identify assets acquired with illegal funds, as well as help identify a lifestyle that is not commensurate with an individual’s known sources of legitimate income. The Form 8300 is designed to identify cash transactions in excess of $10,000 between retail merchants (e.g., automobile dealers, boat dealers, furriers, etc.) and their customers, much like the BSA currency transaction report is designed to identify deposits, withdrawals, exchanges, or other payments in excess of $10,000 between financial institutions and their customers. The Form 8300 and currency transaction report provide very similar information (e.g., name, address, Social Security number, and amount of the transaction). The Form 8300 was originally created and is still used to assist IRS in identifying individuals who might be attempting to evade taxes. Given that the requirement for filing the Form 8300 is contained in the Internal Revenue Code, Form 8300 information is tax return information and, as such, is confidential and may not be disclosed to any persons or used in any manner not authorized by the Internal Revenue Code. Authorized disclosures of Form 8300 information are subject to the procedural and recordkeeping requirements of Internal Revenue Code section 6103. For example, section 6103(p)(4)(E) requires recipient agencies to file a report with the Secretary of the Treasury that describes the procedures established and utilized by the agency for ensuring the confidentiality of returns or return information. IRS requires that agencies requesting return information, such as Form 8300 information, file a “Safeguard Procedures Report,” and that the report be approved by IRS. In comparison, the currency transaction report and other BSA information are used to target large currency transactions that may be suspicious, support investigative cases, assist in tax examination and collection, and support other law enforcement functions. Under FinCEN’s authority and oversight, Treasury agencies (i.e., Customs Service; IRS; Secret Service; and the Bureau of Alcohol, Tobacco and Firearms) have direct, on-line access to BSA information. If they are jointly working a case, law enforcement agencies outside of Treasury can access this information from one of the Treasury agencies. For other law enforcement agencies, FinCEN is the official contact point within Treasury to request BSA information. Also, designated state and local officials have direct, on-line access to BSA information via Project Gateway. These officials conduct Gateway queries for other law enforcement agencies in the state. According to FinCEN, agencies may receive BSA information directly from FinCEN or via Project Gateway only after they have clearly specified the purpose of their request, and after the identity and authority of the requester have been confirmed by FinCEN or a designated state official. FinCEN regulations provide that BSA information shall be received in confidence and shall not be disclosed to any person except for official purposes relating to the investigation, proceeding, or matter in connection with the information. Although originally intended primarily to assist IRS for tax administration purposes, Form 8300 information is also used to support law enforcement investigations. The Anti-Drug Abuse Act of 1988 provided a special temporary rule permitting IRS to disclose these information returns to other federal agencies for the purpose of administering statutes not related to tax administration. The special rule, originally set to expire in 1990, was extended 2 years and then expired in 1992. Our earlier work addressed the usefulness of Form 8300 information. In 1991, for example, we reported on the usefulness of Form 8300 information in conducting investigations of tax evasion and other criminal activity, such as money laundering. We reported that law enforcement officials believed that Form 8300 information could be instrumental in tracing cash payments by drug traffickers and other criminals for luxury cars, jewelry, and other expensive items. In 1992, we reported that federal law enforcement officials regarded Form 8300 information as extremely useful and a critical complement to BSA reports. We noted that, in an attempt to obtain Form 8300 information, several states required that copies of the form also be filed with the state. We recommended to Congress that (1) the temporary and soon-to-expire authority of the Secretary of the Treasury to disclose Form 8300 information filed under section 6050I of the Internal Revenue Code be made permanent and (2) the Secretary of the Treasury be allowed to disclose these returns to state law enforcement agencies. The IRS supported this recommendation and noted that, if the disclosure provisions were amended, IRS would work closely with the Treasury Department to provide access to the states. In 1996, the act entitled the Taxpayer Bill of Rights 2 reinstated, on a permanent basis, the Secretary of the Treasury’s authority to disclose Form 8300 information to other federal agencies. The Secretary was further authorized to disclose Form 8300 information to state, local, and foreign agencies. The 1996 Act provided, in general, that any such disclosure is to be made on the same basis, and subject to the same conditions, as apply to disclosures of information on BSA currency transaction reports. However, the 1996 Act also required, in general, that such disclosures of Form 8300 information be subject to the disclosure and safeguard policies and guidelines under section 6103(p) of the Internal Revenue Code. Consequently, according to an IRS official, Form 8300 information must be controlled like other IRS tax return information. According to an IRS headquarters official, in May 1997, IRS initiated a process for federal, state, local, and non-U.S. law enforcement agencies and regulatory agencies to access Form 8300 information directly from IRS. The official told us that, before being permitted to obtain Form 8300 information, the requesting agency must file and IRS headquarters must approve a Safeguard Procedures Report that specifies how the agency plans to comply with applicable safeguard requirements. The IRS official added that, after an agency’s plan is approved, it can request Form 8300 information as needed from any IRS Criminal Investigation Division field office. The IRS official explained that Safeguard Procedures Reports are approved on an agency-by-agency basis. That is, one approved report covers all requests from the respective federal agency, such as the U.S. Customs Service or the FBI. A separate report is required for each state and local agency (e.g., police department and district attorney’s office). The official noted that, as of February 1998, five federal and two state law enforcement agencies had been approved to obtain Form 8300 information from IRS Criminal Investigation Division field offices. Although IRS has taken measures to provide Form 8300 information to law enforcement agencies, several issues must still be resolved before FinCEN can obtain approval from IRS to directly disseminate this information or provide it to state and local agencies via Project Gateway. Two days after the passage of the 1996 Act that authorized the Secretary of the Treasury to disclose Form 8300 information to other agencies, including law enforcement agencies, FinCEN issued a news release commenting, in part, substantially as follows: With the passage of this law, FinCEN anticipates being able to make the highly useful Form 8300 information available as part of its support to both federal and state law enforcement. Specifically, FinCEN anticipates being granted authority to (1) provide Form 8300 information quickly and easily to federal law enforcement agencies that do not have direct access to this information and (2) provide Form 8300 information directly on-line to state law enforcement through its Project Gateway. FinCEN and IRS officials began discussing FinCEN’s dissemination of Form 8300 information soon after passage of the 1996 Act. In June 1997, FinCEN and IRS officials met to discuss the difficulties IRS’ proposed operating rules for disseminating Form 8300 information (as outlined in the Safeguard Procedures Report) would create for FinCEN programs. According to a FinCEN official, this meeting was followed by a September 11, 1997, memorandum from FinCEN’s Director to the Acting Commissioner of IRS, in which FinCEN noted that the particular safeguard procedures identified as appropriate by IRS (1) were virtually impossible for law enforcement agencies to satisfy efficiently and (2) appear to subject Form 8300 information to the same safeguards as information generated by individual or corporate tax returns. The official noted that the memorandum proposed a high-level meeting to determine if the issues could be resolved. Although FinCEN has not yet been granted approval by IRS to disseminate Form 8300 information, an IRS administrative action regarding such dissemination is presently under consideration by Treasury. According to an IRS official, in October 1997, IRS proposed to Treasury that certain IRS implementing regulations be modified to allow FinCEN to act on behalf of the IRS Commissioner to disseminate Form 8300 information. The IRS official noted, however, that such dissemination would still be subject to IRS disclosure and safeguard policies and guidelines that implement section 6103 of the Internal Revenue Code. According to a Treasury official, Treasury plans to consider the IRS proposal in late 1998. Regarding Project Gateway, a FinCEN official called our attention to a September 22, 1997, memorandum from FinCEN’s Office of Legal Counsel to the IRS Office of Disclosure, in which FinCEN explained its position as to why Gateway’s existing security procedures (for electronic disclosure of BSA information to state authorities) could be read to satisfy most of the safeguard procedures IRS was requiring for disseminating Form 8300 information. According to the official, the memorandum noted that IRS procedures appeared to contemplate only manual dissemination and that Project Gateway was apparently not considered when the procedures were written by IRS. The official added that, in this memorandum, FinCEN requested that IRS accept a certification by FinCEN with respect to all recipients of electronically disseminated Form 8300 information rather than apply IRS procedures to each recipient of such information. At the time of our review, IRS had not issued a formal response to FinCEN’s September 22, 1997, memorandum. However, in March 1998, an IRS official told us that FinCEN would not be granted approval to use Project Gateway, as it currently operates, to provide state and local agencies with Form 8300 information. The official explained that (1) the current Gateway system does not meet Treasury Department requirements for systems that handle sensitive information and (2) IRS regulations do not allow for the type of redisclosures that would occur with Gateway. That is, authorized Gateway users would not be permitted to act as conduits or middlemen in providing Form 8300 information to other state and local agencies. The official added that, even without these barriers, IRS regulations would not allow FinCEN to certify safeguard procedures on behalf of all recipient agencies. Rather, each agency that requested Form 8300 information via Project Gateway would be required to file a Safeguard Procedures Report. In summary, there are several issues that must be resolved before FinCEN can disseminate Form 8300 information or provide it to state and local agencies via Project Gateway. At this point, it is not clear if these issues can be resolved administratively among FinCEN, IRS, and Treasury or if Congress may need to revisit these issues in the future. Over the years, FinCEN has faced a challenge of defining its support role in providing the law enforcement community with value-added products and services in a timely manner. In and of itself, this is a significant challenge, and given the existence of various intelligence and investigative support centers and other sources of information and financial analysis, it is likely to be a continuing challenge. Also, compounding this challenge, since its inception in 1990, FinCEN’s staffing levels have remained fairly constant, while its mission has expanded beyond its original law enforcement support role to include responsibility for promulgating BSA regulations and assuming a leadership position in international efforts to combat money laundering. Nonetheless, to FinCEN’s credit, the agency has expanded its law enforcement support role from providing tactical and strategic products to include use of an artificial intelligence system and implementation of self-help services (i.e., the platform concept and Project Gateway). However, due in part to reallocations of staff to other mission functions, the expansion of FinCEN’s line of products and services has, at times, experienced some growing pains. These include, for example, occasional backlogs and lengthy response times for routine tactical support requests and reductions in the number of strategic and artificial intelligence products generated. Similarly, the expansion or evolution of FinCEN’s line of products and services inherently entails some “role-definition” issues. To the extent feasible, for instance, FinCEN considers its expertise best used to support nonroutine cases or analytically intensive cases, which may include tactical and strategic as well as artificial intelligence support. In recent years, however, while users reported that all types of FinCEN’s tactical support have been useful, an increasing number of FinCEN’s tactical reports consisted of database extracts versus detailed analysis. And, the number of analytical products FinCEN generated from strategic and artificial intelligence analyses decreased due, in part, to users’ concerns about the usefulness of these products. To better focus its efforts and ensure usefulness, particularly regarding strategic and artificial intelligence products, FinCEN has begun various “partnering” arrangements with its customers. Also, to better ensure that its tactical staff are available to support traditional law enforcement needs, in 1995, FinCEN discontinued accepting requests for background and regulatory investigations. FinCEN is also taking steps to ensure that its tactical staff are used to support complex or significant rather than routine cases. However, FinCEN has not developed and disseminated general criteria or guidelines concerning the types of cases that FinCEN can best support and the most appropriate uses for FinCEN’s resources. We believe such guidance would help FinCEN better utilize its tactical resources. In a similar vein, while FinCEN had taken steps to inform the law enforcement community about its support, some federal law enforcement officials said they were not aware of the various products and services offered by FinCEN. (FinCEN has since taken additional steps to inform the law enforcement community about its products and services.) FinCEN’s efforts to promote self-help services have been well received by the users of those services we interviewed. They commented very favorably about the platform concept and Project Gateway. These comments are corroborated by statistics showing that use of these systems has steadily increased. In turn, however, the increased use of these systems underscores the importance of FinCEN’s controls to ensure that only authorized personnel access the systems and use them for legitimate purposes. Because FinCEN has not evaluated states’ compliance with Gateway security policies and procedures, it cannot be sure the controls are working as intended. Periodically evaluating the states’ compliance with these controls and preparing summary reports to management would help FinCEN identify improvements or deterioration in control effectiveness, reassess the related risks, and take appropriate action. FinCEN and IRS have been unable to resolve administrative issues related to FinCEN’s dissemination of IRS Form 8300 information. Law enforcement officials believe this information can be useful in tracing cash payments by drug traffickers and other criminals for luxury cars, jewelry, and other expensive items. We recognize the long-standing concerns regarding the protection of taxpayer information, although we note that the Form 8300 contains the same basic information as is contained in the currency transaction report, which is more readily available to law enforcement. IRS has initiated a process for law enforcement agencies to access Form 8300 information directly from IRS. However, regarding FinCEN’s dissemination of Form 8300 information, additional issues must still be resolved to address IRS’ and Congress’ concerns about protection of taxpayer information. In addressing these issues, consideration must also be given to the value of Form 8300 information to law enforcement efforts in reducing money laundering. It is not clear if these issues can be resolved administratively among FinCEN, IRS, and Treasury or if Congress may need to revisit these issues in the future. We recommend that the Secretary of the Treasury take action to identify and resolve any administrative issues related to FinCEN’s dissemination of Form 8300 information to the law enforcement community. If FinCEN is given approval to disseminate Form 8300 information, we recommend that, prior to such dissemination, the Secretary ensure that sufficient access and disclosure controls over FinCEN’s programs and systems are in place and operating as intended. That is, these controls should be sufficient to protect against unauthorized access to and disclosure of sensitive information. We recommend that the Acting Director, FinCEN incorporate into the agency’s communications with potential customers general criteria or guidance on the types of cases that FinCEN can best support and the most appropriate uses of FinCEN’s capabilities. At a minimum, for example, such criteria or guidance could be included in information on FinCEN’s site on the Internet. develop and implement a program for on-site evaluations of the states’ compliance with control policies and procedures related to Project Gateway. Such a program should include periodic testing of the controls and summary reports for management attention. We requested comments on a draft of this report from the Department of the Treasury, FinCEN, and the Department of Justice. On May 29, 1998, the Director of Treasury’s Office of Finance and Administration informed us, via telephone, that the Department declined to provide comments on the draft report or on the recommendation to the Secretary of the Treasury related to FinCEN’s dissemination of IRS Form 8300 information. In a letter dated May 20, 1998, FinCEN’s Acting Director provided us written comments (see app. VI). The Acting Director did not concur with our draft report’s recommendation that FinCEN incorporate into the agency’s communications with potential customers specific criteria or guidance on the types of cases that FinCEN can best support and the most appropriate uses of FinCEN’s capabilities. The Acting Director commented that specific guidelines are impractical because (1) cases differ widely in circumstance and detail and (2) guidelines may result in perceived limitations in the inherent flexibility of FinCEN’s products and services. Also, the Acting Director noted that a more effective and efficient way to communicate is through the generalized meetings and other outreach efforts that FinCEN conducts, although those efforts are already very ambitious for a small agency like FinCEN. The intent of our draft recommendation was not that FinCEN develop or communicate inflexible or rigid guidelines for its customers. Rather, given the availability of various other intelligence and investigative support centers that are alternate sources of financial, commercial, and law enforcement data and analysis, we believe that FinCEN’s capabilities would be most fully and appropriately utilized if the agency widely communicates generally applicable criteria or guidance on the types of cases that it can best support. For example, a FinCEN official told us that tactical support is generally best suited for (1) cases that involve large criminal organizations, are of significance to the jurisdiction, or require expert financial analysis and (2) cases where support is not available from in-house sources. In our opinion, this kind of general guidance could be more widely disseminated to the law enforcement community, at a minimum, by being included in information on FinCEN’s site on the Internet. As previously noted, FinCEN updated its Internet site in March 1998 to include information on the types of support it provides to the law enforcement community. However, the update did not include general criteria or guidance on the types of cases that FinCEN can best support or on the most appropriate uses of FinCEN’s capabilities. Accordingly, with some modifications to the language in this report for clarification purposes, we are still recommending that FinCEN better communicate to potential customers general criteria or guidance on the types of cases that it can best support and the most appropriate uses of its capabilities. On the other hand, the Acting Director concurred with our recommendation that FinCEN develop and implement a program for on-site evaluations of the states’ compliance with control policies and procedures related to Project Gateway. Toward this end, the Acting Director noted that FinCEN had recently (1) reported on an early-1998 audit of Gateway use and activity and (2) issued a comprehensive Gateway Coordinator’s Handbook, which presents up-to-date rules, procedures, formats, dissemination instructions, and warning notices. Also, the Acting Director noted that FinCEN is beginning to develop guidelines for FinCEN staff to use in reviewing the compliance of state coordinators with policies and procedures. In the near future, according to the Acting Director, FinCEN will (1) use these guidelines to conduct audits in selected states and (2) share audit results with the state coordinators to provide a lessons-learned approach. On May 8, 1998, we received written comments from Justice that indicated that the draft was reviewed by representatives of the Criminal Division, DEA, FBI, and the Executive Office for U.S. Attorneys. Generally, the Department concurred with the substance of the draft report. Justice provided technical comments and also made suggestions for possible expansion of our discussion related to various topics in the draft report. These technical comments and suggestions have been incorporated in this report where appropriate. We are sending copies of this report to the Chairmen and Ranking Minority Members of the Senate Banking, Housing, and Urban Affairs Committee; the Senate Finance Committee; the House Ways and Means Committee; the Subcommittee on Treasury, Postal Service, General Government, and Civil Service (Senate Appropriations Committee); and the Subcommittee on Treasury, Postal Service, and General Government (House Appropriations Committee); the Secretary of the Treasury; the Acting Director, FinCEN; the Director, Office of Management and Budget; the Attorney General; and other interested parties. Copies will also be made available to others upon request. The major contributors to this report are listed in appendix VII. If you or your staffs have any questions about this report, please contact me on (202) 512-8777. This report focuses on the Financial Crimes Enforcement Network’s (FinCEN) products and services in support of law enforcement. Specifically, this report discusses (1) trends in the types and quantities of products and services provided by FinCEN to the law enforcement community; (2) the extent to which FinCEN’s products and services have been considered useful by the law enforcement community in identifying, developing, or prosecuting money laundering and other financial crime cases; (3) the extent to which FinCEN evaluates the states’ compliance with applicable controls over access to and use of information when state law enforcement officials directly access FinCEN’s resources; and (4) FinCEN’s efforts to obtain approval from the Internal Revenue Service (IRS) to provide IRS Form 8300 information (Report of Cash Payments Over $10,000 Received in a Trade or Business) to the law enforcement community. To determine the trends in and usefulness of FinCEN’s products and services, we focused on five principal types of support provided by FinCEN: (1) tactical products in support of agencies’ ongoing investigations; (2) strategic products designed to address longer-term or more broadly scoped topics; (3) artificial intelligence products designed to provide investigative leads; (4) a “platform concept,” whereby federal agency officials can access databases and do their own research using FinCEN resources; and (5) “Project Gateway,” which provides state agencies with remote, on-line access to financial and some commercial data. The scope of our work did not include a review of the Suspicious Activity Reporting System, which is administered by FinCEN. To determine the trends in the types of support provided by FinCEN to the law enforcement community, we obtained a description of FinCEN’s primary products and services, including the date when each type of product or service first became available. Also, to obtain an understanding of the processes and purposes for each type of product or service, we interviewed officials of FinCEN’s component offices. To determine the trends in the quantities of support provided since 1990, including which agencies requested which types of support, we obtained and analyzed FinCEN workload documents and relevant information from FinCEN’s computerized databases. Also, to ascertain reasons for the trends in FinCEN’s support, we interviewed FinCEN officials, Treasury and Justice headquarters’ officials, long-term agency detailees to FinCEN, and state agency officials. FinCEN generates a variety of products and services to support many different agencies or organizations. Therefore, to the extent practical, we used mail surveys and in-person and telephone interviews to collect information on the usefulness of the full range of FinCEN’s support. This included support of money laundering and other financial crimes investigations as well as support of regulatory or background checks for employment, security clearance, and business or professional licensing purposes. We surveyed or interviewed officials from the principal federal law enforcement agencies within the Treasury Department (i.e., IRS; the Bureau of Alcohol, Tobacco and Firearms; the Customs Service; and the Secret Service); the principal federal law enforcement agencies within the Justice Department (i.e., the Federal Bureau of Investigation (FBI), the Marshals Service, the Drug Enforcement Administration (DEA), U.S. Attorney Offices, and the Immigration and Naturalization Service); other federal agencies that were high-volume requesters of FinCEN’s products and services, such as the Postal Inspection Service, the Department of Agriculture, the Air Force Office of Special Investigations, and the Naval Criminal Investigative Service (see table I.1 at the end of this app. for a complete list of the high-volume requesters we surveyed); and state requesters of FinCEN support. During our inquiries, we obtained case-specific information (if available and appropriate) as well as opinions, views, and anecdotal information from managers and agents of the applicable agencies and organizations. We focused on relatively recent support—that is, support generated since January 1996. We obtained opinions and views on support provided before January 1996 but could not provide a statistically valid or meaningful comparison of the usefulness of FinCEN today versus FinCEN in the past. We focused on requests for tactical products that FinCEN received or logged in during the 12-month period from April 1996 through March 1997 and responded to before August 1997. To obtain general or broad-based indications of the usefulness of FinCEN’s full range or types of tactical support, we surveyed by mail a stratified, statistical sample of 352 federal agency officials who requested various tactical work products (i.e., database extracts, analytical reports, and expedited reports). The 352 federal officials were selected from 2,379 officials in 31 agencies that, according to FinCEN’s records, made 4,409 (95 percent) of the 4,626 total federal requests for FinCEN’s tactical support during the 12-month period (see table I.1 at the end of this app.). We did not survey officials from the 34 agencies that made the remaining 217 (5 percent) federal tactical requests because of time constraints and the logistics involved in coordinating surveys with these agencies. We received usable responses from 251 (71 percent) of the 352 federal officials. The responses were weighted to represent the 2,379 federal officials who made the 4,409 requests for tactical support during the survey period. Unless otherwise noted, the estimates of percentages from this sample in the report have 95-percent confidence intervals of no more than plus or minus 10 percentage points. Also, we surveyed by mail a simple random sample of 95 state agency officials who requested FinCEN’s tactical support during the 12-month period. The 95 state officials were from 15 states that made 18 or more requests in the period. According to FinCEN’s records, these 15 states made 813 (75 percent) of the 1,077 total requests made through all state coordinators for FinCEN tactical support during the 12-month period (see table I.2 at the end of this app.). State coordinators were able to identify 504 requesters of FinCEN’s tactical support in these 15 states. We randomly selected 95 users for our survey. After making at least 2 attempts to contact nonrespondents by telephone, we received usable responses from 54 (57 percent) of the 95 state officials. The percentage estimates from this sample in the report have 95-percent confidence intervals of no more than plus or minus 13 percentage points and are projectable to all of the requesters in the 15 states. Further, to obtain additional perspectives on the usefulness of FinCEN’s tactical support, we conducted in-person or telephone interviews with (1) officials from the FBI and the Bureau of Alcohol, Tobacco and Firearms who were on detail to FinCEN at the time of our review and (2) senior FinCEN officials responsible for overseeing tactical support. In addition to these surveys and interviews, we determined why some federal and state agencies and offices submitted few if any requests for FinCEN’s tactical support. Based on our review of FinCEN’s records, we determined that many federal field offices, states, and High Intensity Drug Trafficking Areas (HIDTA) requested little or no tactical support from FinCEN during the period we reviewed, April 1996 through March 1997. To determine the reasons why: We surveyed by mail all U.S. field offices of the IRS (33 offices), the U.S. Customs Service (20 offices), the FBI (56 offices), and the DEA (20 offices) (see app. V for a copy of the questionnaire). Of the total 129 field offices, we received responses from 116 (90 percent). Also, we interviewed officials from 9 of the 10 states that, according to FinCEN’s records, made either one or no requests for FinCEN’s tactical support from April 1, 1996, through March 31, 1997. Further, we surveyed all 22 HIDTAs that had been designated by the Office of National Drug Control Policy at the time of our review to determine the extent to which FinCEN products are used to support their money laundering and other financial crimes investigations. We received responses from 16 HIDTAs. We did not project these responses to the 22 HIDTAs. In our mail surveys and interviews, we ascertained what other (non-FinCEN) sources of financial, commercial, and/or law enforcement information and analyses are used by the federal field offices, state agencies, and HIDTAs. Further, to determine how FinCEN informed the law enforcement community about the availability of FinCEN’s products and services, we (1) reviewed the results of FinCEN’s May 1996 outreach efforts, which were designed to obtain feedback from federal law enforcement agencies; (2) reviewed FinCEN’s records of participation at meetings, training events, and conferences at the federal and state levels; and (3) interviewed FinCEN officials. To determine the usefulness of FinCEN’s strategic support, we conducted telephone interviews with law enforcement officials who received or used three of the four strategic products FinCEN prepared from January 1996 through December 1997 (i.e., the Louisiana, Georgia, and South Florida money-laundering threat assessments). Also, we interviewed senior FinCEN officials about changes in strategic support, including how the newly formed Office of Research and Analysis was functioning. To determine the usefulness of FinCEN’s artificial intelligence products, we attempted to survey by mail all federal and state law enforcement officials identified in FinCEN’s database as having received artificial intelligence products from April 1996 through March 1997. First, we determined that FinCEN had provided 85 artificial intelligence products during this period. Next, we attempted to locate and survey the end user for each product. We identified and mailed a survey questionnaire to 13 officials who were end users for 51, or 60 percent, of the 85 products. If more than one product was associated with the same investigative effort, we requested that only one questionnaire be completed for the associated products. We received responses from all 13 officials. Further, we reviewed FinCEN data to determine the extent to which FinCEN self-initiated artificial intelligence products (versus products requested by law enforcement agencies). We also interviewed FinCEN officials to ascertain reasons for variations in the number of self-initiated products over the years, including the extent to which the self-initiated products were used by the law enforcement community. We conducted in-person or telephone interviews with officials from three agencies that, according to FinCEN officials, were frequent platform users—the Washington/Baltimore HIDTA; the Bureau of Alcohol, Tobacco and Firearms; and the Defense Criminal Investigative Service. According to FinCEN’s year-end records, the three agencies we contacted were among the four agencies that most frequently used platforms in 1997. The three agencies accounted for 971 (66 percent) of the 1,477 investigative cases that were supported by platforms in 1997. We asked these officials about their use of platforms, including the number and type of cases they support, the databases they access, and their views about the usefulness of the platform concept. We conducted telephone interviews with officials from the four states that made the most Gateway queries in fiscal year 1997—California, Illinois, Pennsylvania, and Texas. These 4 states made 22,876 (40 percent) of the total 57,663 Gateway queries in fiscal year 1997. We also interviewed officials from two states—Montana and Wyoming—that used Gateway fewer than 50 times in fiscal year 1997 to determine reasons for the low use. We interviewed FinCEN officials to determine future Gateway plans and to identify efforts to provide Gateway access for non-Treasury federal agencies. To determine how FinCEN controls access to and use of information obtained via Project Gateway, we (1) interviewed FinCEN officials and Gateway users and (2) reviewed FinCEN’s Gateway Security Plan (July 1996) and the IRS Detroit Computing Center’s Project Gateway Users Guide (May 1997). Also, we interviewed FinCEN officials to determine the extent to which FinCEN had evaluated the states’ compliance with applicable controls over access to and use of information obtained via Project Gateway. It was beyond the scope of our study to audit or test the controls or safeguards FinCEN maintains over Project Gateway. To determine the potential usefulness of IRS Form 8300 information for law enforcement purposes, we reviewed previous GAO reports and interviewed federal and state law enforcement officials. To determine what disclosure and safeguard requirements apply to the dissemination of Form 8300 information and Bank Secrecy Act data, we (1) reviewed applicable provisions in the 1996 act that authorized the use of Form 8300 information for law enforcement purposes, (2) interviewed IRS officials and reviewed applicable sections of the Internal Revenue Code, and (3) interviewed FinCEN officials and reviewed applicable documentation. Also, to determine how IRS currently makes Form 8300 information available to federal, state, local, and non-U.S. law enforcement agencies, we (1) interviewed IRS officials and (2) reviewed safeguard and reporting requirements contained in IRS’ guidance for completing a Safeguard Procedures Report. To determine the status of FinCEN’s efforts to obtain approval from IRS to provide IRS Form 8300 to the law enforcement community, we interviewed FinCEN, IRS, and Treasury Department officials. Total for Justice agencies we surveyed Bureau of Alcohol, Tobacco and Firearms Total for Treasury agencies we surveyed Other federal agencies we surveyed U.S. Postal Inspection Service Air Force Office of Special Investigations Department of Housing and Urban Development Office of the Secretary of the Air Force (continued) Department of Health and Human Services U.S. Probation and Parole Office Total for other federal agencies we surveyed Federal agencies we did not survey U.S. Army (other) Office of the Comptroller of the Currency National Aeronautics and Space Administration Office of Foreign Asset Control Total for federal agencies we did not survey (Table notes on next page) FinCEN’s information resources fall into four broad categories: financial, commercial, and law enforcement databases, and its own internal databases. The financial database consists of reports that are required to be filed under the Bank Secrecy Act (BSA). These reports can be retrieved from either the U.S. Customs Service’s computer center in Newington, Virginia, or the Internal Revenue Service’s (IRS) Detroit Computing Center. Both computer center systems are accessible on-line at FinCEN through either the Treasury Enforcement Communications System or the Currency and Banking Retrieval System. The financial database is available to bona fide entities for criminal, civil, regulatory, and foreign investigations. Table II.1 describes the various BSA reports used by FinCEN. Currency Transaction Report (IRS Form 4789) Filed by bank and nonbank financial institutions reflecting cash transactions of more than $10,000. The database contains reports since 1983. Filed by casinos reflecting cash transactions of more than $10,000. The database contains reports since 1985. Report of International Transportation of Currency or Monetary Instruments (U.S. Customs Service Form 4790) Filed by persons carrying currency or certain monetary instruments in aggregate amounts of more than $10,000 into or out of the United States. The database contains reports since 1989. Report of Foreign Bank and Financial Accounts (Treasury Department Form 90-22.1) Filed annually by U.S. persons with interest in, or signature authority over, bank securities or other financial accounts in a foreign country, which exceed $10,000 in total value at any time during a calendar year. The database contains reports since 1985. Suspicious Activity Report (Treasury Department Form 90-22.47) Filed by financial institutions which determine that some activity is suspicious.The database contains reports since April 1996 and some incomplete history files dating back to 1990. There are some restrictions on the release of Currency Transaction Reports, Currency Transaction Reports by Casinos, Reports of International Transportation of Currency or Monetary Instruments, or Reports of Foreign Bank and Financial Accounts. For example, FinCEN regulations provide that such information made available to other departments or agencies of the United States, any state or local government, or any foreign government shall be received in confidence and shall not be disclosed to any person except for official purposes relating to the investigation, proceeding, or matter in connection with the information. In addition, written approval must be obtained from the FinCEN Director prior to releasing BSA data to foreign governments. Suspicious Activity Reports are only researched and disseminated for designated user agencies and certain state agency officials. FinCEN procures access to a variety of commercial databases that are used to locate individuals, determine asset ownership, and establish links between individuals, businesses, and assets. These databases encompass a wide variety of demographic and census information, including corporate ownership, nationwide telephone directories, real estate purchases, and courthouse records. There are no restrictions on the release of commercial information to bona fide entities for criminal, civil, regulatory, and foreign investigations. Table II.2 describes the commercial databases FinCEN had access to as of February 1998. Provides on-line access to public records from selected states, with broad coverage of Florida and Texas (e.g., driver’s license number, motor vehicle registration, corporation filings, and real estate ownership) and less broad coverage of public records from New York, New Hampshire, Oregon, and Washington. Also available is a nationwide “National Dossier,” which compiles current and former addresses, telephone numbers, and a listing of neighbors. One of the nation’s large credit bureau services. FinCEN, by law, obtains only the “header” information from an individual’s credit report, which comprises current and former addresses, possibly a spouse’s name, and the month and year of birth. FinCEN does not obtain any information from the credit report relative to the credit history or employment history of an individual. Provides access to on-line public records that can assist in locating people and businesses, identifying and verifying assets, exposing and controlling fraud, and uncovering and verifying background information. Provides on-line access to names, dates of birth, addresses, phone numbers, and driver’s license information. (continued) A gateway to over 450 databases that provide access to millions of documents in the area of business news and industry analysis from full-text trade journals, newspapers, and news wires. Domestic and international company directories are also available, many of which include corporate financial statistics. Provides access to business information from millions of companies worldwide. For companies in the United States, a complete business information report is available, which includes a corporate history, financial data, banking relationships, public record filings, and biographical information on key officers. For international companies, directory information includes the names of up to 10 executives. All companies in the database are identified by a unique number, which allows a complete “corporate family tree” to be produced. One of the major providers of on-line public records, providing access to the corporation and limited partnership filings from most states; an asset locator that searches real property records (including tax assessor records and deed transfers) from over 30 states as well as nationwide Federal Aviation Administration aircraft and Coast Guard watercraft files; nationwide business bankruptcy filings; a nationwide people finder service; and an extensive file of liens and judgments from every state. One of the major providers of on-line public records with extensive files of real estate ownership and deed transfers, state corporation and limited partnership filings, personal and business bankruptcies, nationwide liens and judgments, a nationwide person and business locator file, and civil and criminal indices. The service also provides full-text access to more than 2,300 information sources from U.S. and overseas newspapers, magazines, journals, newsletters, wire services, and broadcast transcripts. A comprehensive company library provides numerous files of U.S. company reports, international company reports, bankruptcy filings, business biographical reports, and Securities and Exchange Commission filings. Provides biographical information on stock broker/dealer businesses and individuals. A set of five CD-ROM discs providing a nationwide telephone directory on both individuals and businesses. This database contains only listed telephone numbers. Through written agreements outlining the details of database access, dissemination authority, etc., FinCEN has access to some investigative databases maintained by other law enforcement agencies. FinCEN provides information from these law enforcement databases to bona fide entities for domestic criminal investigations. Several queries of Treasury Department’s system (see table II.3) are also available for domestic regulatory and foreign investigations. Table II.3 describes the law enforcement databases FinCEN had access to as of November 1997. The Treasury Enforcement Communications System is administered by the U.S. Customs Service on behalf of a consortium of over 25 federal agencies, for the purpose of providing a broad scope of information for law enforcement purposes. In addition to providing information on U.S. Treasury law enforcement investigations, it provides access to the National Crime Information Center, the National Law Enforcement Telecommunications Network, the Federal Aviation Administration’s Private Aircraft records, and U.S. Custom Service’s Automated Commercial Shippers record system of import/export declarations and related international shipping documents. The Narcotics and Dangerous Drugs Information System database contains information on Drug Enforcement Administration cases. U.S. Postal Inspection Service The Inspection Service Database Information System is a database of all current and closed Postal Inspection Service criminal cases. FinCEN uses its internal databases to index and track inquiries made on individuals and businesses. This includes the results of the intelligence reports prepared by FinCEN as well as information captured through FinCEN’s platform and Gateway programs. These databases enable FinCEN to “alert” or notify one agency that another agency has or had an interest in the same investigative subject, which can help the agencies coordinate their efforts. R. Eric Erdman, Evaluator-in-Charge Michael H. Harmond, Evaluator The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touchtone phone. A recorded menu will provide information on how to obtain these lists.

Summary: Pursuant to a congressional request, GAO reviewed the Financial Crimes Enforcement Network's (FinCEN) products and services in support of law enforcement, focusing on: (1) trends in the types and quantities of products and services provided by FinCEN to the law enforcement community; (2) the extent to which FinCEN's products and services have been considered useful by the law enforcement community in identifying, developing, or prosecuting money laundering and other financial crime cases; (3) the extent to which FinCEN evaluates the states' compliance with applicable controls over access to and use of information when state law enforcement officials directly access FinCEN's resources; and (4) FinCEN's efforts to provide Internal Revenue Service (IRS) Form 8300 information to the law enforcement community. GAO noted that: (1) FinCEN has expanded the types of products and services it provides to the law enforcement community; (2) in recent years, FinCEN has issued fewer tactical, strategic, and artificial intelligence products and has encouraged, trained, and increasingly relied on federal agencies to use the platform concept and state and local agencies to use Project Gateway to support cases that do not require FinCEN's expertise; (3) according to FinCEN, one significant reason for the decrease in the number of products issued was that its staffing levels have remained fairly constant over the years, while its overall mission has expanded to include: (a) responsibility for promulgating Bank Secrecy Act regulations; and (b) a leadership role in international efforts to combat money laundering; (4) respondents to surveys indicated that FinCEN's tactical products have been useful and assisted law enforcement investigations in ways not previously identified; (5) officials that had requested few or no tactical products from FinCEN generally did not indicate dissatisfaction with it; (6) some respondents were not aware of the various products and services offered, and FinCEN has neither developed nor widely disseminated general criteria or guidelines on when law enforcement officials should request its support; (7) according to federal and state officials, the platform concept and Project Gateway are useful tools for helping agencies combat money laundering and other financial crimes; (8) FinCEN data show that an increasing number of federal, state, and local agencies are using these self-help mechanisms to support their investigations; (9) while Project Gateway is designed to enhance the capabilities of state and local law enforcement agencies, this technological advancement increases the potential risk that sensitive information could be inappropriately accessed, used, or disclosed; (10) although FinCEN has established policies and procedures designed to limit access to and use of information obtained through the Gateway system, it has not evaluated the states' compliance with these controls; (11) in an effort to enhance its investigative support, FinCEN is seeking IRS approval to provide IRS Form 8300 information to law enforcement officials; and (12) however, several issues must still be resolved before FinCEN can obtain approval from IRS to disseminate this information.