NCIC is a law enforcement database maintained by the FBI’s Criminal Justice Information Services (CJIS) Division and was first established in 1967 to assist LEAs in apprehending fugitives and locating stolen property. In 1975, NCIC expanded to include the missing persons file to include law enforcement records associated with missing children and certain at-risk adults. The missing persons file contains records for individuals reported missing who: (1) have a proven physical or mental disability; (2) are missing under circumstances indicating that they may be in physical danger; (3) are missing after a catastrophe; (4) are missing under circumstances indicating their disappearance may not have been voluntary; (5) are under the age of 21 and do not meet the above criteria; or (6) are 21 and older and do not meet any of the above criteria but for whom there is a reasonable concern for their safety. The unidentified persons file was implemented in 1983 to include law enforcement records associated with unidentified remains and living individuals who cannot be identified, such as those individuals who cannot identify themselves, including infants or individuals with amnesia. When a missing persons record is entered or modified, NCIC automatically compares the data in that record against all unidentified persons records in NCIC. These comparisons are performed daily on the records that were entered or modified on the previous day. If a potential match is identified through this process, the agency responsible for entering the record is notified. Management of NCIC is shared between CJIS and the authorized federal, state, and local agencies that access the system. CJIS Systems Agencies (CSA)—criminal justice agencies with overall responsibility for the administration and usage of NCIC within a district, state, territory, or federal agency—provide local governance of NCIC use. A CSA generally operates its own computer systems, determines what agencies within its jurisdiction may access and enter information into NCIC, and is responsible for assuring LEA compliance with operating procedures within its jurisdiction. An Advisory Policy Board, with representatives from criminal justice and national security agencies throughout the United States, and working groups are responsible for establishing policy for NCIC use by federal, state, and local agencies and providing advice and guidance on all CJIS Division programs, including NCIC. NamUs became operational in 2009, and was designed to improve access to database information by people who can help solve long-term missing and unidentified persons cases—those cases that have been open for 30 days or more. NamUs is comprised of three internet-based data repositories that can be used by law enforcement, medical examiners, coroners, victim advocates or family members, and the general public to enter and search for information on missing and unidentified persons cases. These repositories include the missing person database (NamUs-MP), the unidentified person database (NamUs-UP), and the unclaimed persons database. NamUs-MP and NamUs-UP allow automated and manual comparison of the case records contained in each. The University of North Texas Health Science Center, Center for Human Identification (UNTCHI) has managed and administered the NamUs program under a cooperative agreement with NIJ since October 2011. Two Directors within UNTCHI’s Forensic and Investigative Services Unit are responsible for daily management, oversight, and planning associated with NamUs. Additionally, eight regional system administrators (RSAs) and eight forensic specialists provide individualized case support. To gain access to NCIC, an agency must have authorization under federal law and obtain an Originating Agency Identifier (ORI). In general, to be authorized under federal law for full access to NCIC, an agency must be a governmental agency that meets the definition of a CJA. Specifically, data stored in NCIC is “criminal justice agency information and access to that data is restricted to duly authorized users,” namely CJAs as defined in regulation. The CJIS Security Policy allows data associated with the missing and unidentified persons files to be disclosed to and used by government agencies for official purposes or private entities granted access by law. For example, there is a specific provision that allows these files to be disclosed to the National Center for Missing and Exploited Children, a nongovernmental organization, to assist in its efforts to operate a nationwide missing children hotline, among other things. As of February 2016, there were almost 118,000 active ORI numbers that granted authorized agencies at least limited access to NCIC. Table 1 shows the different types of users granted ORI numbers to access NCIC and their associated access levels. Unlike NCIC, any member of the public may register to use NamUs and access published case information. When cases are entered, the RSA carries out a validation process by reviewing each case entered within his or her region to ensure the validity and accuracy of the information provided and determine whether the case may be published to the public website. Before any case may be publicly published to the NamUs site, the RSA must confirm the validity of that case with the LEA or other responsible official with jurisdiction by obtaining an LEA case number or an NCIC number. The RSA also vets registration applications for non- public users—professionals affiliated with agencies responsible for missing or unidentified persons cases. In addition to the published case information, these non-public registered users may also access unpublished case information. Table 2 shows the types of individuals that may register as NamUs users for the missing persons and unidentified persons files, and their access levels. NCIC data include criminal justice agency information and access to such data is restricted by law to only authorized users. Because many users of NamUs are not authorized to access NCIC, there are no direct links or data transfers between the systems. In addition, NCIC and NamUs only contain information manually entered by their respective authorized users. As a result, while both NCIC and NamUs contain information on long-term missing and unidentified persons, they remain separate systems. DOJ could facilitate more efficient sharing of information on missing and unidentified persons cases contained in NCIC and NamUs. The two systems have overlapping purposes specifically with regard to data associated with long-term missing and unidentified persons cases—both systems collect and manage data that officials can use to solve these cases. Further, three key characteristics of NCIC and NamUs—the systems’ records, registered users, and data validation efforts—are fragmented or overlapping, creating the risk of duplication. We found that, as CJIS and NIJ proceed with planned upgrades to both databases, opportunities may exist to more efficiently use data related to missing and unidentified persons cases, in part because no mechanism currently exists to share information between NCIC and NamUs. Figure 3 below describes the purpose of each system and explains how certain characteristics contribute to fragmentation, overlap, or both. See appendix II for a non-interactive version of figure 3. Interactive graphic Figure 3: Comparison of Fragmentation and Overlap in Key Characteristics of the National Crime Information Center (NCIC) and National Missing and Unidentified Persons System (NamUs) Move mouse over headers for description. For a noninteractive version, please see appendix II. Database Records: NCIC and NamUs contain fragmented information associated with long-term missing and unidentified persons. Specifically, information about long-term missing or unidentified persons may be captured in one system, but not the other. As a result, if users do not have access to or consult the missing and unidentified persons files in both data systems, they may miss vital evidence that could help to solve a given case. For example, in fiscal year 2015, 3,170 missing persons cases were reported to NamUs. During the same time period, 84,401 of the missing persons records reported to NCIC remained open after 30 days and became long-term cases. Conversely, in fiscal year 2015, 1,205 unidentified persons cases were reported to NamUs, while 830 records were reported to NCIC. NamUs also accepts and maintains records of missing and unidentified persons cases that are not published on its public website, in part because they may not meet criteria for entry into NCIC. According to NamUs officials, cases may remain unpublished for several reasons, including (1) they are undergoing the validation process, (2) they lack information required to complete the entry, (3) the responsible agency has requested the report go unpublished for investigative reasons, (4) a report has not been filed with law enforcement, or (5) law enforcement does not consider the person missing. For example, according to NamUs officials, a non-profit agency entered approximately 800 missing migrant cases that have remained unpublished on the NamUs public website because they do not have active law enforcement investigations associated with the cases. Because they do not have active law enforcement investigations on file and NCIC only accepts documented criminal justice information, it is highly unlikely that these approximately 800 cases are present in NCIC. Since access to unpublished cases is limited to authorized LEA and medicolegal investigators that have registered as NamUs users, investigators using only NCIC cannot use information from these NamUs cases to assist in solving unidentified persons cases. In addition, the number of NCIC cases that are also recorded in NamUs varies greatly among states, further contributing to fragmentation. For example, of the long-term missing persons cases officials in each state reported to NCIC in fiscal year 2015, the proportion of these NCIC cases that were also recorded in NamUs ranged from less than 1 to almost 40 percent. However, in our nongeneralizeable review of laws in Arizona, California, and New York, the state laws specifically associated with reporting missing persons cases to NCIC or NamUs did not contribute to variation in reporting rates. Specifically, in fiscal year 2015, approximately 2 to 3.5 percent of the long-term cases reported by officials in each state to NCIC were ultimately reported to NamUs. These reporting rates are very similar despite the fact that, as discussed previously, we chose these three states because they had different reporting requirements associated with reporting missing and unidentified persons. Registered Users: Fragmentation between the records reported to NCIC and NamUs also exists because different user groups with different responsibilities enter data on missing and unidentified persons. The fact that different user bases report information to each system means that certain types of cases may be found in one system but not the other. This creates inefficiencies for officials seeking to solve long-term missing and unidentified persons cases who have to enter information and search both systems to get all the available information. Further, the NCIC user base is significantly larger than the NamUs user base, which likely contributes to the discrepancies in the number of long-term missing persons cases reported to each system. As of February 2016, almost 118,000 agencies had at least limited access to NCIC, with approximately 113,000 granted full access to all 21 NCIC files, including the missing and unidentified persons files. As of November 2015, just over 3,000 individuals were registered as non- public users of NamUs-MP and approximately 2,000 individuals were registered as non-public users of NamUs-UP. These registered users represent at least 1,990 agencies, less than 2 percent of the number of agencies registered to use NCIC. In 1996, a person was reported missing and the case was entered into National Crime Information Center (NCIC). Three days later, a decomposed body was found a few miles away; however, no police report was ever generated for the person’s death nor was an entry made into NCIC. In 2013, the detective following up on the missing person case searched National Missing and Unidentified Persons System (NamUs) and found that a medical examiner had entered the unidentified remains case into NamUs. As a result, 16 years after the missing persons case was originally reported, DNA testing verified a match between the unidentified remains reported by a medical examiner to NamUs and the missing person case reported by law enforcement to NCIC in 1996. In addition to the difference in the number of agencies registered to use NCIC or NamUs, there is variation in the types of agencies that are registered with each system, possibly contributing to differences in the type of case information reported. For instance, NamUs has a larger number of registered users in the medicolegal field (either as medical examiners, coroners, forensic odontologists, or other forensic personnel), which may explain why a greater number of unidentified persons cases are reported to NamUs. Specifically, while medical examiners and coroners represent less than 0.1 percent of NCIC’s total active ORIs, approximately 18 percent of agencies registered with NamUs have at least one user registered in the medicolegal field. Similarly, virtually all LEAs use NCIC, with only a small fraction registered to use NamUs, likely contributing to the low proportion of long term missing persons cases reported to both NCIC and NamUs by LEAs. Additionally, members of the public who do not have access to NCIC and are not affiliated with any type of agency can report missing persons cases to NamUs. The variation in the types of users registered with NCIC or NamUs ultimately limits the usefulness of either system, as important case information may be missed by individuals who do not access both systems. According to one LEA official we spoke with, his unit has had more than a dozen resolutions of cold cases as a result of information contained in NamUs since NamUs was established in 2009. Data Validation Efforts: NamUs uses a validation process to ensure that all missing and unidentified persons cases include either the local LEA case number or an NCIC number before they are published to the public website. NamUs also has some ad hoc processes in place, beyond routine RSA responsibilities, designed to help ensure that data in selected states on missing and unidentified persons contained in NCIC are captured by NamUs. However, while intended in part to minimize fragmentation, these processes introduce additional inefficiencies caused by overlapping and potentially duplicative activities. Specifically, as part of the NamUs validation process, at least once a year, the RSA requests records from NCIC and manually reviews the data in both systems to ensure consistency. For example, from January 2015 through September 2015, RSAs requested and manually reviewed statewide NCIC records for at least 22,000 missing persons and 4,532 unidentified persons cases to ensure that if cases entered into NamUs were present in NCIC, the two systems contained comparable information. According to NIJ officials, if RSAs identify errors or missing information in an NCIC record during the course of their work, they will alert the agency responsible for the case. It is then the responsibility of that agency to enter or update the NCIC record. The potential for duplication also exists when agencies want to utilize both NCIC and NamUs. For example, if agencies with access wanted their case data to exist in both systems, the system limitations would require them to enter the information in one system and then enter the same data in the second system, resulting in duplicative data entry. Officials from one state agency we interviewed noted that they have a full time employee who is solely responsible for entering case data into NamUs after it has been entered into NCIC. Further, when attempting to use information from either NCIC or NamUs, users are required to access and search each system separately, and then manually compare results. Fragmentation and overlap between NCIC and NamUs result in inefficiencies primarily because there is no systematic mechanism for sharing information between the systems. According to CJIS officials, in lieu of a systematic sharing of information mechanism, they created a standard search that state and local agencies can use to request an extract of all of their missing and unidentified persons data contained in NCIC. Upon receipt of the resulting data extract, the requesting agency would then be responsible for entering the provided data into NamUs. However, this solution to share information does not address the inefficiencies created by the lack of an automated mechanism, as it requires additional work on the part of responsible officials and results in the potential for duplication. We have previously reported that when fragmentation or overlap exists, there may be opportunities to increase efficiency. In particular, our prior work identified management approaches that may improve efficiency, including implementing process improvement methods and technology improvements while documenting such efforts to help ensure operations are carried out as intended. Additionally, we have reported that federal agencies have hundreds of incompatible information-technology networks and systems that hinder governmentwide sharing of information and, as a result, information technology solutions can be identified to help increase the efficiency and effectiveness of these systems. According to CJIS officials, the most significant limiting factors to a systematic sharing of information mechanism between NCIC and NamUs are that (1) access to NCIC is restricted to authorized users, (2) NamUs has not been granted specific access to NCIC by law, and (3) NamUs has a public interface. Because NamUs lacks specific statutory authority to access NCIC and the public is prohibited from accessing NCIC data, CJIS officials stated that fully exchanging data with NamUs would constitute an unauthorized dissemination of NCIC information. As a result, these officials stated that the CJIS Advisory Policy Board determined that NCIC could not be fully connected to NamUs. While there are statutory limitations regarding direct access to NCIC, there may be options to better share information that are technically and legally feasible. Thus, opportunities may exist within the current statutory framework to address fragmentation and overlap between the two systems. Our review of the data elements required by each system indicates a high degree of commonality between the data that can be collected by NCIC and NamUs, which could help facilitate the sharing of information. Specifically, 12 of the 15 data fields required by NamUs for a missing persons case and 12 of the 14 data fields required by NamUs for an unidentified persons case are also present in NCIC. Further, stakeholders we interviewed from three states offered a variety of solutions to address the fragmentation and overlap between NCIC and NamUs. For example, A law enforcement official in one state noted that a notification alert could be added to NCIC to inform users when related case data was also present in NamUs. Another official stated that a query process that allowed authorized users to search information from both systems simultaneously would be helpful in minimizing the need to regularly check both systems. According to CJIS officials, a joint search function would likely require the systems to be fully integrated; however, CJIS officials noted that they had not formally evaluated the option because they believe it is currently precluded by federal law. While full integration of the two systems may be precluded, a joint search function may not equate to full integration. Authorized users with access to both systems could benefit from the efficiencies of such a search function. However, DOJ will not know whether this type of function could be technically or legally feasible until it evaluates the option. Implementing mechanisms to share information without fully integrating the systems could help improve the efficiency of efforts to solve long-term missing and unidentified persons cases using NCIC and NamUs. Officials in another state suggested that a single data entry point could be used to populate both NCIC and NamUs to minimize duplicate data entry. This solution to share information has also been put forward as a requirement in several bills that have been introduced in Congress since 2009. In 2010, DOJ undertook an effort in response to the requirement in proposed legislation to determine whether it would be technically possible for a check box to be added to NCIC that would allow users to indicate that they would like the case information to be automatically entered into NamUs as well. According to CJIS officials, this type of check box is already in use for other NCIC files, which means it could be technically feasible for the missing and unidentified persons files. However, according to CJIS officials, this system change was not pursued for the missing and unidentified persons files because the proposed legislation did not pass, and consequently there was no legal requirement that CJIS implement this mechanism to share information. Nevertheless, without evaluating this mechanism, DOJ will not know whether it is technically and legally feasible. As a result, DOJ may be missing an opportunity to share information between NCIC and NamUs that would better help users close their missing or unidentified persons cases. Both NCIC and NamUs are in the early stages of upgrading their systems; however, neither effort includes plans to improve sharing information between these systems. These ongoing upgrade processes provide DOJ with an opportunity to evaluate and document the technical and legal feasibility of options to improve sharing NCIC and NamUs missing and unidentified persons information, and to integrate appropriate changes, if any, into the next versions of the systems. According to NIJ officials, the discovery phase of the NamUs upgrade to NamUs 2.0 has been completed, and officials have developed a prioritized list of 793 items that they would like to include in the upgrade. The feasibility of each item and timelines for implementation will be determined in an iterative process based on time and funding considerations. According to the officials, the highest priority items are related to enhancing the existing capabilities of NamUs to make them more efficient and user-friendly. Our review of the prioritization document does not indicate that efforts to improve sharing of information with NCIC are included in the ongoing upgrade. NIJ officials stated that their goal for the upgrade is to share data more easily with a variety of state and local systems. According to CJIS officials, the upgrade process for NCIC began in 2014, with a canvas of 500 state, local, tribal, and federal NCIC users to identify the type of functionality users would like to see included in an updated system. The officials said that this process yielded more than 5,500 recommendations related to all 21 files contained in NCIC. CJIS officials did not specify how many recommendations were related to the missing and unidentified persons files, but did note that they received some feedback related to improving the ability to share data with NamUs. Based on the user canvas, CJIS developed a high-level concept paper that will be discussed at the Advisory Policy Board’s June 2016 meeting. Following Advisory Policy Board approval, CJIS will begin the development process, including identifying specific tasks. CJIS officials explained that because of the uncertainty regarding approval, and the way in which the upgrade development process will be structured, there are no specific timeframes available related to the update. The officials stated it will likely be several years before there are any deliverables associated with the effort. While we understand there are statutory restrictions regarding access to NCIC that must be adhered to, and we recognize that stakeholders may use NCIC and NamUs in distinct ways, DOJ has opportunities to explore available options that could potentially allow for more efficient use of information on missing and unidentified persons by reducing fragmentation and overlap. Without evaluating the technical and legal feasibility of options for sharing information, documenting the results of the evaluation, and, as appropriate, implementing one or more of these options, potential inefficiencies will persist. As a result, users who do not have access to information from both systems may continue to miss vital case information. Every year, more than 600,000 people are reported missing, and hundreds of sets of human remains go unidentified. Solving thousands of long-term missing and unidentified persons cases requires the coordinated use of case data contained in national databases, such as NCIC and NamUs. However, because no mechanism exists to share information between these systems, the fragmented and overlapping nature of the systems leads to inefficiencies in solving cases. Although there are statutory differences between the systems, there are potential options for sharing information—such as a notification to inform NCIC users if related case data were present in NamUs —that could reduce inefficiencies between NCIC and NamUs within the existing legal framework. The ongoing upgrade processes for both systems provide DOJ with the opportunity to evaluate the technical and legal feasibility of various options, document the results, and incorporate feasible options, as appropriate. Without doing so, and without subsequently implementing options determined to be appropriate during the next cycle of system upgrades, potential inefficiencies will persist and users who do not have access to information from both systems may be missing vital information that could be used to solve cases. To allow for more efficient use of data on missing and unidentified persons contained in the NCIC’s Missing Persons and Unidentified Persons files and NamUs, the Directors of the FBI and NIJ should evaluate the feasibility of sharing certain information among authorized users, document the results of this evaluation, and incorporate, as appropriate, legally and technically feasible options for sharing the information. We provided a draft of this product to DOJ for review and comment. On May 13, 2016, an official with DOJ’s Justice Management Division sent us an email stating that DOJ disagreed with our recommendation, because DOJ believes it does not have the legal authority to fulfill the corrective action as described in the proposed recommendation. Specifically, DOJ stated that NamUs does not qualify, under federal law, for access to NCIC and is not an authorized user to receive NCIC data. Therefore, DOJ does not believe there is value in evaluating the technical feasibility of integrating NamUs and NCIC. As stated throughout this report, we understand the legal framework placed on NCIC and that it may be restricted from fully integrating with a public database. However, this statutory restriction does not preclude DOJ from exploring options to more efficiently share information within the confines of the current legal framework. Moreover, our recommendation is not about the technical feasibility of integrating NCIC and NamUs but about studying whether there are both technically and legally feasible options for better sharing long-term missing and unidentified persons information. We continue to believe that there may be mechanisms for better sharing this information—such as a notification alert in NCIC to inform users when related case data is also present in NamUs—that would comply with the legal restrictions. However, until DOJ studies whether such feasible mechanisms exist, it will be unable to make this determination. Without evaluating the technical and legal feasibility of options for sharing information, DOJ risks continued inefficiencies through fragmentation and overlap. Moreover, authorized users who do not have automated or timesaving access to information from both systems may continue to miss critical information that would help solve these cases. DOJ also provided technical comments, which we incorporated as appropriate. We are sending copies of this report to the appropriate congressional committees, the Attorney General of the United States, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-9627 or maurerd@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III. In response to Senate Report 113-181 (accompanying the Consolidated and Further Continuing Appropriations Act of 2015) this report addresses the following objectives: 1. Describe access to and use of missing and unidentified persons information contained in the National Crime Information Center (NCIC) and the National Missing and Unidentified Persons System (NamUs). 2. To what extent do opportunities exist to improve the use of missing and unidentified persons information contained in NCIC and NamUs? To describe the access to and use of missing and unidentified persons information contained in NCIC and NamUs, we reviewed and compared NCIC and NamUs operating and policy manuals and data entry guides. In addition, we observed access to and use of missing and unidentified persons information in NamUs. To corroborate information above, we conducted interviews with officials who access and use NCIC and NamUs, including state criminal justice agencies, state and local law enforcement agencies (LEA), medical examiners, and coroners. To determine the extent to which opportunities exist to improve the use of missing and unidentified persons information using NCIC and NamUs, we analyzed summary level case data by state for each system for fiscal year 2015. Because of statutory limitations on access to criminal justice information contained in NCIC we did not assess record level case data from either NCIC or NamUs. However, we compared NCIC summary level data to NamUs summary level data, and found it sufficient for demonstrating the extent to which information contained in the two systems is similar or different. We assessed the reliability of the data contained in NCIC and NamUs by, among other things, reviewing database operating manuals and quality assurance protocols, and by interviewing officials responsible for managing the systems. We found the data to be reliable for our purposes. We also reviewed and compared NCIC and NamUs operating manuals and data entry guides to determine the comparability of minimum data requirements for record entry, individual data elements in each system, and their definitions. Our review of these documents allowed us to identify details about the purpose and design of each system that may support or preclude data sharing. In addition, we reviewed past and current CJIS and NIJ plans related to sharing information between NCIC and NamUs. We reviewed laws, policies, and information associated with reporting and sharing information on missing and unidentified persons, to include information about the types of users that can access or enter information into each system within three categories: (1) LEA, (2) non-LEA criminal justice agency (CJA)—such as a court; and (3) medicolegal investigator— such as a coroner. We assessed this information against Standards for Internal Control in the Federal Government and GAO’s evaluation and management guide for fragmentation, overlap, and duplication. NCIC and NamUs assign user access differently, with NCIC assigning access at the agency level, while NamUs provides access directly to individuals. Because of this, for the purposes of comparing NCIC and NamUs users, we consolidated information from NamUs for non-public users into their relevant agencies so as not to overstate the number of NamUs users as compared to NCIC. However, there are some limitations associated with this effort. For example, for a city-wide LEA such as the New York City Police Department, NCIC assigns Originating Agency Identifiers (ORI) numbers to each office within that particular agency, as the ORI number is used to indicate the LEA office directly responsible for a given NCIC record entry. When individuals register for NamUs, they may or may not provide the same level of detail regarding their specific office within a greater LEA, which means we may count an agency once for NamUs, even though that agency likely has multiple ORIs associated with it for NCIC. Further, because of the way user permissions are determined in NamUs, some LEAs with DNA or forensic specialists may also be included in the medicolegal investigator category, whereas they are likely to use only a single LEA ORI in NCIC. To address these limitations, this report presents information about both the number and type of individual users registered with NamUs, as well as the number and type of agencies that these users represent. To corroborate information above, and to obtain more in-depth perspectives about the extent to which opportunities exist to improve the collection and use of missing and unidentified persons information, we conducted interviews. Specifically, we interviewed Department of Justice (DOJ) officials, relevant stakeholders from selected states, and officials from nongovernmental agencies, in part to learn about past and current efforts to share information between NCIC and NamUs. In addition, we selected Arizona, California, and New York to include in this review, based in part on their respective state laws and policies associated with missing and unidentified persons, as well as the number of cases reported to each database for fiscal year 2015. Specifically, after identifying the 10 states that reported the highest number of cases to both NCIC and NamUs, we then compared four characteristics of state laws and policies related to reporting missing and unidentified persons. These included whether the state law specified (1) required reporting to NCIC, NamUs, or other federal databases; (2) reporting requirements for specific populations; (3) a timeframe for reporting missing persons cases; and (4) a timeframe for reporting unidentified remains. We chose Arizona, California, and New York to provide illustrative examples of different types of state laws. Table 1 provides a high-level comparison of the reporting laws for each state we reviewed. We then selected a nongeneralizeable sample of relevant stakeholders from each state to interview. Specifically, we interviewed relevant stakeholders in 3 state criminal justice agencies, 4 state and local LEAs, 2 medical examiner offices, and 1 coroner office. Although the views expressed from these interviews cannot be generalized to each state, they provide valuable insights about the types of experiences different stakeholder groups experience in states with varied reporting requirements. We also reviewed state documents associated with the data systems used by each state to report missing and unidentified persons information to NCIC. We conducted this performance audit from September 2015 to April 2016 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Appendix II: Comparison of Fragmentation and Overlap in Key Characteristics of the National Crime Information Center (NCIC) and National Missing and Unidentified Persons System (NamUs) Purpose Both systems contain data designed to be used to solve long- term missing and unidentified persons cases. Registered Users Registered users of both systems must populate one system with missing and unidentified persons cases and then go through the process again to enter the same data in the second system. To utilize information from either system, registered users must go through an inefficient process of accessing and searching each system separately, and then manually comparing results. Data Validation Efforts NamUs Regional System Administrators (RSA) check NCIC as part of the NamUs validation process. In fiscal year 2015, RSAs requested and manually reviewed NCIC records for at least 22,000 missing persons and 4,532 unidentified persons cases. NCIC contains significantly more missing persons cases than NamUs, while NamUs contains more unidentified persons cases, limiting the usefulness of either system. Specifically, in fiscal year 2015, 3,170 missing persons cases were reported to NamUs, while 84,401 long-term cases were reported to NCIC during the same time period. In contrast, 1,205 unidentified persons cases were reported to NamUs in fiscal year 2015, while 830 cases were reported to NCIC. Less than 0.1 percent of registered NCIC users are medical examiner or coroner offices, while approximately 18 percent of the agencies with at least one registered NamUs user are considered part of the medicolegal field. Additionally, many missing persons cases are initially reported in NamUs by members of the public who do not have access to NCIC. Consequently, potentially valuable information on missing persons cases may not be getting to all those who need it. Diana C. Maurer, (202) 512-9627 or maurerd@gao.gov. In addition to the contact named above, Dawn Locke (Assistant Director), Elizabeth Kowalewski, Susanna Kuebler, Amanda Miller, Jan Montgomery, Heidi Nielson, Janay Sam, Monica Savoy, and Michelle Serfass made key contributions to this report.

Summary: Every year, more than 600,000 people are reported missing, and hundreds of human remains go unidentified. Two primary federal databases supported by DOJ—NCIC and NamUs—contain data related to missing and unidentified persons to help solve these cases. NCIC contains criminal justice information accessed by authorized agencies to assist with daily investigations. NamUs information can be used by law enforcement, medical examiners, coroners, and the general public to help with long-term missing and unidentified persons cases. Senate Report 113-181 (accompanying the Consolidated and Further Continuing Appropriations Act of 2015) includes a provision for GAO to review NCIC and NamUs. This report describes the access to and use of missing and unidentified persons information contained in NCIC and NamUs, and the extent to which there are opportunities to improve the use of this information. GAO reviewed NCIC and NamUs data, and relevant state and federal statutes. GAO also conducted nongeneralizeable interviews with stakeholders in three states, selected in part on state laws. The Federal Bureau of Investigation's (FBI) National Crime Information Center (NCIC) database includes criminal justice agency information and access to such data is restricted to authorized users. In contrast, the Department of Justice's (DOJ) National Institute of Justice (NIJ) funds and oversees the National Missing and Unidentified Persons System (NamUs), a database for which the public may register to access published case information. Because many users of NamUs are not authorized to access NCIC, there are no direct links between the systems. As a result, while both NCIC and NamUs contain information on long-term missing and unidentified persons, they remain separate systems. DOJ could facilitate more efficient sharing of information on missing persons and unidentified remains (referred to as missing and unidentified persons cases) contained in these systems. GAO found, in part, that the following three key characteristics of NCIC and NamUs are fragmented or overlapping, creating the risk of duplication. Database Records: NCIC and NamUs contain fragmented information associated with long-term missing and unidentified persons (cases open for more than 30 days). For example, in fiscal year 2015, 3,170 long-term missing persons cases were reported to NamUs while 84,401 missing persons records reported to NCIC became long-term cases. NamUs also accepts and maintains records of missing and unidentified persons cases that may not be found in NCIC because, for example, they have not yet been filed with law enforcement. As a result, users relying on only one system may miss information that could be instrumental in solving these types of cases. Registered Users: The NCIC user base is significantly larger than the NamUs user base, and the types of users vary, which may contribute to the discrepancies in each system's data. For instance, almost all law enforcement agencies use NCIC, with only a small fraction registered to use NamUs. Additionally, members of the public do not have access to NCIC, but can report missing persons cases to NamUs. Data Validation Efforts: In part to minimize fragmentation, NamUs uses a case validation process and other ad hoc efforts to help ensure that data on missing and unidentified persons contained in NCIC is captured by NamUs. However, these processes introduce additional inefficiencies because they require officials to manually review and enter case data into both systems, resulting in duplicative data entry. Inefficiencies exist in the use of information on missing and unidentified persons primarily because there is no mechanism to share information between the systems, such as a notifier to inform NCIC users if related case data were present in NamUs. According to FBI officials, federal law precludes full integration of NCIC and NamUs; however, opportunities to share information may exist within the legal framework to address fragmentation and overlap without full system integration. By evaluating the technical and legal feasibility of options to share information, documenting the results, and implementing feasible options, DOJ could better inform those who are helping solve missing and unidentified persons cases and increase the efficiency of solving such cases. To allow for more efficient use of missing and unidentified persons information, GAO recommends that DOJ evaluate options to share information between NCIC and NamUs. DOJ disagreed because it believes it lacks the necessary legal authority. GAO believes DOJ can study options for sharing information within the confines of its legal framework, and therefore believes the recommendation remains valid.