Transcript Nationwide Suspicious Activity Reporting (SAR) Initiative

Nationwide
Suspicious Activity Reporting (SAR)
Initiative
IJIS Institute Winter Briefing
Nationwide SAR Initiative (NSI)
•
Purpose: To establish a unified approach at all levels of government to
gather, document, process, analyze, and share information about terrorismrelated suspicious activities
•
Responds directly to the Intelligence Reform and Terrorism Prevention Act
of 2004 requiring the Program Manager, Information Sharing Environment
(ISE) to provide “a decentralized, distributed, and coordinated environment”
for sharing of terrorism-related information
•
Responds to the direction of the National Strategy for Information Sharing
(October 2007) to establish a “unified process for reporting, tracking, and
accessing [SARs]” for federal, state, local, and tribal entities
•
Ensures that terrorism-related SARs are made available to federal, state,
and local law enforcement agencies and state and major urban area fusion
centers
•
Integrates state, local, and tribal law enforcement agencies’ SAR processes
into a nationwide standardized and institutionalized effort
2
What Makes an Activity Suspicious?
•
A citizen observes or reports to law enforcement
authorities that something is alarming, out of the
ordinary, or “just not right”
•
Law enforcement or government official observes
something
• Based on training or experience to recognize behaviors and
indicators that are associated with a criminal activity associated
with terrorism
• Knowledge of laws and regulations
• Interactivity with other agencies
•
Studies and research done on activities leading to
crimes and terrorist acts (e.g., LAPD, NCTC, FBI)
3
What Is the SAR Process?
•
A grassroots effort
•
Involves the gathering, processing, reporting, analyzing,
and sharing of suspicious activity
•
Focuses on what law enforcement agencies have been
doing for years—gathering information regarding
behaviors and incidents associated with crime and
establishing a process whereby information can be shared
to detect and prevent criminal activity, including that
associated with domestic and international terrorism
State, Local, Tribal LE Agency Involvement Is
Critical
•
SAR process will assist local efforts to identify emerging crime, including terrorism
•
Each agency’s internal SAR process can be tailored to the needs of its city and state
but should be based on general standards that provide interoperability and the
sharing of information
•
Each agency’s internal SAR process, once developed, can be incorporated into the
nationwide SAR capability and will support efforts to protect our nation from terrorist
attack
•
Build upon community policing advancements
•
Harness the more than 800,000 full-time sworn law enforcement officers in the
United States
•
Without the support and participation by local, state, and tribal agencies, the amount
of valuable terrorism-related SARs in the ISE would be limited (e.g., Oklahoma City
bombing, Japanese bomber case, New Jersey Fort Dix plot case)
5
Implementation Challenges for the NSI
•
How to institutionalize law enforcement processes to ensure that a SAR
has been legally gathered and is determined to have a potential nexus with
terrorism-related criminal activity
•
How to ensure that citizen privacy and civil liberties are protected
•
How to implement common ISE-SAR business processes that can be
accomplished within an agency’s existing procedural and legal framework
to gather, process, analyze, and report behaviors and events that are
indicative of criminal activity
•
How to establish effective guidance and feedback mechanisms between
local, state, tribal and federal agencies to communicate risks and results
•
How to provide comprehensive and uniform training to all participants in the
SAR process: Front-line Officers, Analysts, Executives
•
How to leverage information exchange standards and existing technology,
where possible, to securely share terrorism-related SARs across the ISE
6
Defining a Comprehensive ISE-SAR Process
Federal agencies
produce and make
available information
products to support the
development of
geographic risk
assessments by state
and major urban area
fusion centers
National
coordinated
information
needs on
annual and
ad hoc basis
Frontline law enforcement
personnel (federal, state,
State and major urban local, and tribal) trained to
State and major area fusion centers, in
urban area fusion coordination with local recognize behavior and
incidents indicative of
centers, in
and federal officials,
criminal activity
coordination with develop information
associated with terrorism.
local and federal needs based on risk
Community outreach plan
officials, develop assessment
implemented
risk assessments
Observation and
reporting of
behaviors and
incidents by
trained law
enforcement
personnel during
Supervisory review
their routine
of the report in
activity
accordance with
departmental policy
Nationwide SAR Cycle
Authorized ISE
participants
access and
view ISE-SAR
ISE-SAR posted in
Determination and
an ISE Shared Space documentation of
an ISE-SAR
Suspicious Activity Processing Steps
Planning
Gathering and Processing
SAR made
At fusion center or JTTF,
available to fusion
a trained analyst or law
center and/or JTTF
enforcement officer
determines, based on
information available,
knowledge, experience, and
personal judgment, whether
the information meeting the
ISE-SAR criteria may have a
terrorism nexus
Analysis and Production
Dissemination
In major cities,
SAR reviewed by
trained
counterterrorism
expert
Reevaluation
7
Overall Progress to Date
•
Responding to the National Strategy for Information Sharing-issued
direction to establish a “unified process for reporting, tracking, and
accessing [SARs]” for federal, state, local, and tribal entities (October 2007)
•
Developed and issued ISE-SAR Functional Standard (January 2008)
•
Integrated all ISE-SAR activities into a Nationwide SAR Initiative (NSI)
•
• Major City Chiefs Association (MCCA) project
• DoD Force Protection components
• FBI eGuardian and DHS participation
Defined the top-level business processes and
information flow based upon state, local, and tribal
agencies in Los Angeles, Boston, Chicago, etc.
•
Developed the NSI CONOPS
•
Established an ISE-SAR Evaluation Environment and
technical infrastructure to test ISE-SAR concepts
and objectives and evaluate outcomes
practices
8
Progress to Date (continued)
•
•
MCCA, IACP, and BJA are developing training for frontline personnel,
senior officers, investigators, and analysts to . . .
•
Recognize indicators (incidents, behaviors, and modus operandi of
individuals and organizations) of criminal activity associated with
terrorism
•
Safeguard privacy and civil liberties
Standard Privacy Guidelines and Templates
have been developed and distributed to
assist LE agencies adopt best practices
•
Operational SAR-EE capabilities have been
deployed in New York, Florida, Virginia, D.C
•
Ten addition SAR-EE sites planned by May 09
a
9
What is the ISE-SAR Evaluation Environment?
•
The ISE-SAR Evaluation Environment (ISE-SAR EE) was established in
2008 to provide an operational technical infrastructure to enable
•
Operational testing of Common Terrorism Information Sharing Standards
(CTISS) and NIEM data exchange standards,
•
Identification of best practices (training, analysis, privacy, technology)
•
Evaluation of business and technical performance measures /outcomes.
•
Per PM-ISE guidance and the IRTPA of 2004, the ISE-SAR EE represents
a distributed and decentralized solution to allow agencies to locally hold
and control SAR data and yet make data easily and securely accessible
(viewable) by other authorized agencies.
•
This local repository of suspicious activity reports having a “potential” nexus
with terrorism is referred to as an ISE “Shared Space” and collectively as
the ISE Shared Spaces.
•
SAR data in the ISE Shared Spaces is accessible via secure CUI networks
by authorized users using a federated search / query tool hosted at
www.ncirc.gov
10
Conducting a Federated SAR Search
Secure Networks
(HSIN Intel, LEO, RISS)
Federated Search
(www.ncirc.gov)
Server
Server
Server
Server
Server
Server
Server
Server
Server
Server
Server
Server
Server
ISE Shared Spaces
Server
Federal
Servers
(eGuardian
DHS)
Sharing SAR Information
OPTION 1
JTTF
REQUIRING IMMEDIATE ACTION
eGuardian
OPTION 2
Fusion
Center
LEO
S
A
R
Department
Approval
Server
Shared Spaces
Server
OPTION 3
NATIONAL SAR INITIATIVE
Federated Search
Want to Learn More About the NSI?
The primary source for information about the NSI is at the PM-ISE website:
www.ise.gov/pages/sar-initiative.html
Specific documents in suggested reading order:
•
Fact Sheet: Nationwide Suspicious Activities Reporting Initiative
•
Fact Sheet: Suspicious Activity Reporting (SAR) Functional Standard for
the Information Sharing Environment
•
NSI Concept of Operations
•
Information Sharing Environment (ISE) Functional Standard (FS)
Suspicious Activity Reporting (SAR) Version 1.0
•
ISE-SAR Evaluation Environment Segment Architecture
•
Fact Sheet: Initial Privacy and Civil Liberties Analysis of the Information
Sharing Environment‐Suspicious Activity Reporting (ISE‐SAR) Functional
Standard and Evaluation Environment
•
Initial Privacy and Civil Liberties Analysis
13
What does this mean to you?
Despite the fact that there have been no actual terrorist attacks within the United
States since 9/11, there is a growing sense that the risk is increasing.
•
•
Commission on the Prevention of WMD Proliferation and Terrorism (Dec 08)
“The United States can expect a terror attack using nuclear or more likely
biological weapons before 2013”
The Mumbai, India attack brought terrorism back into focus
The Nationwide SAR Initiative will involve new processes, policies, training
initiatives and public outreach.
Technology will play a major role in providing the enabling infrastructure to
support improved information sharing and agency collaboration.
Over time, Case Management systems, Records Management systems, CAD
systems, Analytics and Modeling systems, etc, will all need modifications to
support SAR information exchange standards being tested now.
While funding streams are uncertain at this point, if the Commision is correct,
that situation could change very quickly and early positioning will pay off.
14
Questions?
Thomas O’Reilly
Senior Policy Advisor, BJA
(202) 353-8590
Thomas.O’[email protected]
David Lewis
Senior Policy Advisor, BJA
(202) 305-5618
[email protected]
Don Sutherland
SAR Proj Manager, IJIS
(703) 726-2167
[email protected]