The Nationwide SAR Initiative

Briefing for the National Maritime Security Advisory Committee

April 2, 2013

• The need for the NSI is shown by intelligence failures of September 11, as noted in The 9/11 Commission Report

• National Criminal Intelligence Sharing Plan• Intelligence Reform and Terrorism Prevention Act of 2004

– Establishment of the Information Sharing Environment

• Information Sharing Environment Implementation Plan• President’s National Strategy for Information Sharing• White House memo creating two Program Management Offices

A Brief History of the NSI

• Lack of terrorism-related information sharing among federal, state, local, tribal, and territorial law enforcement agencies

• Partnered with SLTT LE to define the needs, scope, and processes for suspicious activity reporting

• Used the SLATT® database, LAPD, and other local LE agencies to determine behaviors

• Developed the 16 behaviors based on SLATT and feedback from SLTT LE that are potentially indicative of terrorism activity

• Decentralized, distributed system—allows local control and ownership of information (called for by federal law)

• Standards-based allows for information to be shared easily and seamlessly• Built in privacy framework• Partnership with the FBI’s JTTFs and fusion centers

NSI: The Need and Response

4

SAR Indicators and Behaviors

• Vetting and Submission

– Information submitted by law enforcement is reviewed by a trained analyst against the NSI Vetting Guidelines

– Totality of the circumstances and interpretation of the behaviors

– Functional Standard-compliant information is submitted to the NSI Federated Search and shared with other NSI users

– Only the information determined by the local agency as shareable is available for search/view

• Training

– Executive Briefing

– Analytic/Investigative-Level Training

– Line Officer Training

– Hometown Security Partners Training

• Probation/Parole/Corrections

• Public Safety Telecommunicators

• Private Sector Security

• Fire Service/EMS

• Emergency Management

NSI Process and Training Programs

6

NSI Milestones• The NSI PMO set three preliminary milestones to determine whether the

collective NSI effort was a success and whether the advancements directly relate to the mission of state, local, tribal, and territorial (SLTT) law enforcement decision makers:

1. SAR data should advance terrorism-related investigative efforts of the FBI

2. The NSI’s SAR data should advance the situational awareness of SLTT law enforcement decision makers

3. NSI data* should empower SLTT analysts with the ability to deliver strategic SAR-related intelligence products

* SAR data is not criminal intelligence (CI) and requires adherence to additional privacy and CRCL handling safeguards. Those safeguards complicate the ability to leverage SAR data for analytical purposes.

Related NSI Advancements: • Over 27,000 SARs in the system. Of those, over 1,400 FBI terrorism-related investigations

have been conducted• 500 additional analysts have been trained this past year. This empowers SLTT law

enforcement personnel to review, vet, and analyze SAR data—enabling analysts to share their respective SARs with the FBI for investigative purposes and with the greater community for analytical purposes

• The NSI has invested in making technical advancements that enable SLTT analysts to seamlessly push SAR data from the Shared Space into the FBI’s eGuardian platform. This technical solution directly addresses an FBI investigative requirement

• NSI outreach has led to the training of almost 100,000 more officers over the past year, reaching approximately 280,000 officers in total

Law Enforcement Relevance:• LE decision makers are now able to effectively share SAR data with the FBI in a timely manner

and in accordance with the recent “Unified Message,” which provides an agreed- upon road map for SAR investigation, analysis, training, and outreach

Milestone #1

Related NSI Advancements:• NSI has made considerable investments in enhancing its Federated Search by introducing “user-driven”

analytical upgrades– New linkage features– Mapping upgrades– Report capabilities– Simplified tracking of SAR trends and anomalies

• Development of a technical assistance program for analysts• Partnered with DHS to develop an analyst training course

Law Enforcement Relevance:• LE decision makers are able to quickly review a color-coded, single-page, graphic profile of their respective

AOR as it relates to SAR. Who, what, where, and when become instantly clarified and help assist in effectively deploying assets against homeland security missions

• LE is now able to compare their SAR trends with any other AOR• NSI facilitates the goal of informed decision making—a necessity in today’s environment

Milestone #2

Related NSI Advancements:• NSI is designing an architecture that will allow SLTT analysts to integrate SAR data with

selected RMS/CAD data within an analytical tool for the purpose of obtaining a result set of data

• Over the past year, the NSI has delivered 17 analyst trainings to help ensure that analysts know how to search and develop products with the current analytic tools

• The NSI will factor in technical safeguards within this capability so as to comply with attendant privacy and CRCL concerns

• SLTT analysts will now be able to effectively incorporate SAR data into their intelligence products—reaching that goal is critical

• Partnering with DHS to develop a SAR drill for fusion centersLaw Enforcement Relevance:• LE decision makers will directly benefit from having their respective SAR data become part of

an analytical regimen for the purpose of producing AOR-specific intelligence– This capability will enhance every AOR to increase the value of information that it shares with the

Intelligence Community

Milestone #3

David SobczykDirector

david.sobczyk@hq.dhs.gov202-713-7683 (bb)

Steve HewittSenior Executive Advisorsteven.hewitt@usdoj.gov

202-532-5570 (bb)

Contact Information