RS21283 -- Homeland Security: Intelligence Support Updated February 23, 2004 Better intelligence is held by many observers to be a crucial factor in preventing terrorist attacks. Concerns have been expressed that no single agency or office in the federal government prior to September 11, 2001 was in aposition to "connect the dots" between diffuse bits of information that might have provided clues to the plannedattacks. Testimony before the two intelligence committees' Joint Inquiry on the September 11 attacks indicated thatsignificant information in the possession of intelligence and law enforcement agencies was not fully shared withother agencies and that intelligence on potential terrorist threats against the United States was not fully exploited. For many years, the sharing of intelligence and law enforcement information was circumscribed by administrative policies and statutory prohibitions. Beginning in the early 1990s, however, much effort has gone intoimprovinginteragency coordination. (1) After the September 11attacks, a number of statutory obstacles were addressed by the USA-Patriot Act of 2001 and other legislation. (2) Nevertheless, there had been no one place where theanalyticaleffort is centered; the Department of Homeland Security (DHS) was designed to remedy that perceived deficiencyas is the Terrorist Threat Integration Center announced by the President in his January 2003 State of the Unionaddress. The Homeland Security Act ( P.L. 107-296 ), signed on November 25, 2002 established within DHS a Directorate for Information Analysis and Infrastructure Protection (IAIP) headed by an Under Secretary for Information Analysisand Infrastructure Protection (appointed by the President by and with the advice and consent of the Senate) with anAssistant Secretary of Information Analysis (appointed by the President). The legislation, especially theInformation Analysis section, seeks to promote close ties between intelligence analysts and those responsible forassessing vulnerabilities of key U.S. infrastructure. The bill envisions an intelligence entity focused on receivingandanalyzing information (3) from other governmentagencies and using it to provide warning of terrorist attacks on the homeland to other federal agencies and to stateand local officials, and for addressing vulnerabilities that terroristscould exploit. DHS is not intended to duplicate the collection effort of intelligence agencies; it will not have its own agents, satellites, or signals intercept sites. Major intelligence agencies are not transferred to the DHS, although some DHSelements, including Customs and the Coast Guard, will continue to collect information that is crucial to analyzingterrorist threats. The legislation establishing DHS envisioned an information analysis element with the responsibility for acquiring and reviewing information from the agencies of the Intelligence Community, from law enforcementagencies, stateand local government agencies, and unclassified publicly available information (known as open source informationor "osint") from books, periodicals, pamphlets, the Internet, media, etc. The legislation is explicit that, "Except asotherwise directed by the President, the Secretary [of DHS] shall have such access as the Secretary considersnecessary to all information, including reports, assessments, analyses, and unevaluated intelligence relating to threatsofterrorism against the United States and to other areas of responsibility assigned by the Secretary, and to allinformation concerning infrastructures or other vulnerabilities of the United States to terrorism, whether or not suchinformation has been analyzed, that may be collected, possessed, or prepared by any agency of the FederalGovernment." (4) DHS analysts are charged with using this information to identify and assess the nature and scope of terrorist threats; producing comprehensive vulnerability assessments of key resources and infrastructure; identifying prioritiesforprotective and support measures by DHS, by other agencies of the federal government, state and local governmentagencies and authorities, the private sector, and other entities. They are to disseminate information to assist in thedeterrence, prevention, preemption of, or response to, terrorist attacks against the U.S. The intelligence element isalso charged with recommending measures necessary for protecting key resources and critical infrastructure incoordination with other federal agencies. DHS is responsible for ensuring that any material received is protected from unauthorized disclosure and handled and used only for the performance of official duties. (This provision addresses a concern that sensitivepersonalinformation made available to DHS analysts could be misused.) As is the case for other federal agencies that handleclassified materials, intelligence information is to be transmitted, retained, and disseminated in accordance withpolicies established under the authority of the Director of Central Intelligence (DCI) to protect intelligence sourcesand methods and similar authorities of the Attorney General concerning sensitive law enforcement information. (5) Despite enactment of the Homeland Security Act, it is clear that significant concerns persisted within the executive branch about the new department's ability to analyze intelligence and law enforcement information. Mediaaccounts suggest that these concerns center on DHS' status as a new and untested agency and the potential risksinvolved in forwarding "raw" intelligence to the DHS intelligence component. (6) Another concern is that a new entity,rather than long-established intelligence and law enforcement agencies, would be relied on to produce all-sourceintelligence relating to the most serious threats facing the country. DHS Role in the Intelligence Community. The U.S. Intelligence Community consists of the Central Intelligence Agency (CIA) and some 14 other agencies; (7) it providesinformation in various forms to the White House and other federal agencies (as well as to Congress). In addition,law enforcement agencies, such as the Federal Bureau of Investigation (FBI), also collect information for use in thefederal government. (8) Within the IntelligenceCommunity, priorities for collection (and to some extent for analysis) are established by the DCI, (9) based in practice on inter-agency discussions. Being"at the table" when prioritiesare discussed, it is widely believed, helps ensure equitable allocations of limited collection resources. The Homeland Security Act makes the DHS information analysis element a member of the Intelligence Community, thus giving DHS a formal role when intelligence collection and analysis priorities are being addressed. DHSofficials have indicated that the new Department is actively participating in the process of setting priorities. The Question of "Raw" Intelligence. There has been discussion in the media whether DHS will have access to "raw" intelligence or only to finished analytical products, but thesereports may reflect uncertainty regarding the definition of "raw" intelligence. A satellite photograph standing byitself might be considered "raw" data, but it would be useless unless something were known about where and whenitwas taken. Thus, satellite imagery supplied to DHS would under almost any circumstances have to include someanalysis. The same would apply to signals intercepts. Reports from human agents present special challenges. Someassessment of the reliability of the source would have to be provided, but information that would identify a specificindividual is normally retained within a very small circle of intelligence officials so as to reduce the risk ofunauthorized disclosure and harm to the source. The issue of the extent and nature of information forwarded to DHS has proved to be difficult. Reviewing copies of summary reports prepared by existing agencies is seen by some observers as inadequate for the task ofputtingtogether a meaningful picture of terrorist capabilities and intentions and providing timely warning. On the otherhand, there is a need to ensure that DHS would not be inundated with vast quantities of data and that highly sensitiveinformation is not given wider dissemination than absolutely necessary. Analytical Quality. The key test for homeland security will of course be the quality of the analytical product -- whether terrorist groups can be identified and timely warning givenof plans for attacks on the U.S. A critical need exists for trained personnel. The types of information that have tobe analyzed come from disparate sources and require a variety of analytical skills that are not in plentiful supply. Academic institutions prepare significant numbers of linguists and area specialists, but training in the inner workingsof clandestine terrorist entities is less often undertaken. Analysts with law enforcement backgrounds may not beattuned to the foreign environments from which terrorist groups emerge. In July 2003 DHS had only some 53analysts and liaison officials with plans to increase this number to about 150. (10) President Bush, in his State of the Union address delivered on January 28, 2003, called for the establishment of a new Terrorist Threat Integration Center (TTIC) that would merge and analyze all threat information in a singlelocation under the direction of the DCI. According to Administration spokesmen, TTIC will eventually encompassCIA's Counterterrorist Center (CTC) and the FBI's Counterterrorism Division, along with elements of otheragencies, including DOD and DHS. TTIC's stated responsibilities are to "integrate terrorist-related informationcollected domestically and abroad" and to provide "terrorist threat assessments for our national leadership." (11) OnMay 1, 2003, TTIC began operations at CIA Headquarters under the leadership of John O. Brennan, who hadpreviously served as the CIA's Deputy Executive Director. By July 2003, it consisted of some 100 analysts andliaisonofficials with plans to increase to 300 by May 2004. (12) TTIC appears to be designed to assume at least some of the functions intended for DHS' information analysis division. Representative Cox, chairman of the Select Committee on Homeland Security, has welcomed theestablishment of TTIC, while noting that "The establishment of the Center in no way reduces the statutoryobligations of the Department [of Homeland Security] to build its own analytic capability. (13) " Making the DCI responsiblefor TTIC will facilitate its ability to use highly sensitive classified information and TTIC can expand upon therelationships that have evolved in the CTC that was established in CIA's Operations Directorate in the mid-1980s. According to testimony by Administration officials to the Senate Government Affairs Committee on February 26,2003, TTIC will in effect function as an information analysis center for DHS and DHS will require a smallernumber of analysts with less extensive responsibilities. Subsequent Administration testimony indicates that DHSwill receive much of the same intelligence data from other agencies and will undertake analysis. A key distinctionisthat DHS is not responsible for information relating to threats to U.S. interests overseas. (14) In FY2004, funds were appropriated for 206 intelligence analysts in IAIP;the Administration requested 225 for FY2005. Some observers express concern that the DCI's role in the TTIC -- responsibility for the analysis of domestically collected information and for maintaining "an up-to-date database of known and suspected terrorists that will beaccessible to federal and non-federal officials and entities," (15) -- may run counter to the statutory provision that excludes the CIA from "law enforcement orinternal security functions." (16) There are alsoquestions abouttransferring the FBI's Counterterrorism Division to the DCI. Some express concern about how the TTIC under theDCI will coordinate with state and local officials and with private industry as contemplated in provisions of theHouse-passed version of the FY2004 intelligence authorization bill ( H.R. 2417 ). The relationship between DHS and TTIC is also a continuing concern to Members of Congress. Some may consider modifications of the Homeland Security Act that could affect the analytical efforts of DHS. (17) Section 359 of theIntelligence Authorization Act for FY2004 ( P.L. 108-177 ) requires that the President report on the operations ofIAIP and TTIC by May 1, 2004. The report, which is to be unclassified (with the option of a classified annex), asksfor a delineation of the responsibilities of IAIP and TTIC and an assessment of whether areas of overlap, if any,"represent an inefficient utilization of resources." The President is asked to "explain the basis for the establishmentand operation of the Center [TTIC] as a 'joint venture' of participating agencies rather than as an element of theDirectorate [IAIP]...." The report is also to assess the "practical impact, if any, of the operations of the Center[TTIC]on individual liberties and privacy." Legislation creating a homeland security department recognized the crucial importance of intelligence. It proposed an analytical office within DHS that would draw upon the information gathering resources of othergovernmentagencies and of the private sector. It envisioned the DHS information analysis entity working closely with otherDHS offices, other federal agencies, state and local officials, and the private sector to devise strategies to protectU.S.vulnerabilities and to provide warning of specific attacks. The Administration appears to prefer a modification to the approach originally envisioned in the legislation that created DHS. TTIC, under the direction of the DCI, will provide the integrative analytical effort that the draftersofhomeland security legislation and others in Congress have felt to be essential in light of breakdowns incommunication that occurred prior to September 11, 2001. Whether TTIC is consistent with the intent of Congressin passingthe Homeland Security Act and whether it is ultimately the best place for the integrative effort is current a matterof discussion in Congress. Regardless of where the integrative effort is ultimately located, the task will remainfundamentally the same. Pulling together vast amounts of data from a wide variety of sources concerning terroristgroups, analyzing them, and reporting threat warnings in time to prevent attacks is and will remain a dauntingchallenge.

Summary: Legislation establishing a Department of Homeland Security (DHS) (P.L. 107-296) included provisions for an information analysis element within the new department. It did not transferto DHS existing government intelligence and law enforcement agencies but envisioned an analytical office utilizingthe products of other agencies -- both unevaluated information and finished reports -- to provide warning ofterrorist attacks, assessments of vulnerability, and recommendations for remedial actions at federal, state, and locallevels, and by the private sector. In January 2003, the Administration announced its intention to establish a newTerrorist Threat Integration Center (TTIC) to undertake many of the tasks envisioned for the DHS informationalanalysis element, known as Information Analysis and Infrastructure Protection (IAIP), but some Members ofCongress argue that TTIC cannot be a substitute for a DHS analytical effort. This report examines differentapproaches to improving the information analysis function and the sharing of information among federal agencies.It willbe updated as circumstances warrant.