By Scott Kelberg

Every day, law enforcement officers at all levels of government—state, local, tribal and federal—observe suspicious behaviors or receive reports from concerned civilians, private security and other government agencies about behaviors that could have a potential nexus to terrorism. Until recently, this information was generally stored at the local level and shared within the agency—or, at the most, regionally shared—as part of an incident reporting system.

The findings in the 9/11 Commission and the Markel Foundation reports clearly demonstrated the need for a nationwide capacity to share information that could detect, prevent or deter a terrorist attack. The Intelligence Reform and Terrorism Prevention Act (IRPTA) of 2004, followed by 2007 National Strategy for Information Sharing, indicate both legislative and executive intent to establish locally controlled, distributed information systems wherein potential terrorism-related information could be contributed by the 18,000 state, local and tribal law enforcement agencies for analysis to determine if there are emerging patterns or trends.

Following this guidance, the Nationwide Suspicious Activity Reporting (SAR) Initiative (NSI) was born. The NSI is a partnership that establishes a capacity for sharing terrorism-related suspicious activity reports (SAR) or information sharing environment (ISE) SARs (ISE-SARs).

As outlined in the ISE-SAR Functional Standard vs. 1.5, “an ISE-SAR is a SAR that has been determined, pursuant to a two-part process, to have a potential terrorism nexus (i.e., to be reasonably indicative of criminal activity associated with terrorism).”

The NSI provides law enforcement with another tool to connect the dots to combat crime and terrorism by establishing a national capacity for gathering, documenting, processing, analyzing and sharing SARs—also referred to as the SAR process—in a manner that rigorously protects the privacy and civil liberties of Americans.

The Functional Standard also provides a definition of suspicious activity as “observed behavior reasonably indicative of preoperational planning related to terrorism or other criminal activity.” This definition was developed after critical input from several privacy, civil rights and civil liberties advocacy groups, including the American Civil Liberties Union (ACLU). The SAR process is critical to preventing crimes, including those associated with domestic and international terrorism.

In developing the standards and processes, the NSI leveraged the guidance and expertise provided by the Global Justice Information Sharing Initiative (Global), which serves as a federal advisory committee and advises the U.S. Attorney General on justice information sharing and integration initiatives. This includes leveraging the National Information Exchange Model (NIEM), which is the backbone of the technology component of the NSI process, as well as privacy guidelines and checklists to develop a comprehensive program.

The NSI is a collaborative effort among state, local, tribal and federal agencies, including the Bureau of Justice Assistance (BJA), Office of Justice Programs, U.S. Department of Justice (DOJ); the Program Manager for the Information Sharing Environment (PM-ISE); the U.S. Department of Homeland Security (DHS); the Federal Bureau of Investigation’s (FBI’s) eGuardian; the Global Justice Information Sharing Initiative (Global); and the Criminal Intelligence Coordinating Council (CICC).

On Dec. 17, 2009, the U.S. Department of Justice (DOJ) was named the Executive Agent to establish and operate the Program Management Office (PMO) for the NSI. The PMO is responsible for nationwide implementation of the SAR process by coordinating existing resources and managing additional support. Then in March 2010, DOJ established a Program Management Office (PMO) within the BJA to support nationwide implementation of the SAR process.

Since the standup of the Program Management Office, the NSI has made substantial progress with standardizing these ad hoc methods of reporting and analysis and implementing these standards, policies and processes within the National Network of Fusion Centers so that timely, relevant information can be shared across federal, state, local and tribal law enforcement agencies, while also working to ensure that the privacy civil rights and civil liberties of citizens are protected.

The NSI process includes five steps that must be completed prior to being granted full access to the information: adherence to the NSI Privacy Framework; training; stakeholder outreach; enabling technology; implementation of standardized processes for reporting, vetting and sharing terrorism related SAR information.

Privacy Framework
The protection of privacy, civil rights and civil liberties is paramount to the success of the NSI. Given this importance, the NSI worked with key partners—including the ACLU and other advocacy groups—to develop protections that, when consolidated, make up the NSI Privacy Framework. The NSI requires each site to consider privacy throughout the SAR process by fully adopting the elements within the NSI Privacy Framework prior to NSI participation: having a privacy policy that is at least as comprehensive as the ISE Privacy Guidelines and has an SAR provision included; adherence to the ISE-SAR Functional Standard vs. 1.5; and conducting NSI training programs, which include a privacy, civil rights and civil liberties element.

For more information or to obtain copies of these documents, send an e-mail to NSIPMO@usdoj.gov.

Training
The NSI training strategy is a multifaceted approach designed to increase the effectiveness of state, local and tribal law enforcement professionals in identifying, reporting, evaluating and sharing pre-incident terrorism indicators to prevent acts of terrorism. The overarching goal of the training strategy is to facilitate agency implementation of the SAR process and to enhance a nationwide SAR capability. To increase the effectiveness of state, local and tribal law enforcement professionals in identifying, reporting, evaluating and sharing pre-incident terrorism indicators to prevent acts of terrorism, the Nationwide SAR Initiative has developed training programs for front-line officers, analysts and chief executives regarding the behaviors and indicators of terrorism related criminal activity.

These training efforts focus on behaviors that have been previously established as potential precursors to criminal acts leading to terrorist activity—the what, not the who.
To provide support to front-line officers in particular, the NSI PMO, in partnership with the IACP, Major Cities Chiefs Association, Major County Sheriffs’ Association, National Sheriffs’ Association, the Association of State Criminal Investigative Agencies and the National Network of Fusion Centers, is working to deliver a training video for law enforcement and support personnel, training them to recognize those behaviors and incidents that are potentially indicative of criminal activity associated with terrorism. The goal is to have all officers trained by fall 2011.

The NSI is now expanding the breadth of its training portfolio by developing training for other key constituencies, such as public safety communities and those charged with protecting the nation’s critical infrastructure that are so important to the SAR effort. In support of this need, the NSI PMO is working to identify gaps and develop the necessary training to ensure that timely, relevant information is shared among law enforcement agencies and other public safety partners.

With 9-1-1 being the number most people in the U.S. and some in other countries, call to get help in a police, fire or medical emergency, 9-1-1 calltakers can play an important role in SAR awareness with their unique position of receiving calls for emergency services. The U.S. has more than 1 million firefighters serving in more than 30 thousand fire departments who respond to more than 24 million emergencies annually. In their efforts to prevent and respond to life and property losses, firefighters enter homes, businesses, vehicles and other assets thousands of times each day. Community corrections professionals are in an ideal position to recognize potential terrorist activity, especially while it is in the planning phase, due to their contact with criminals and families and friends of criminals. There are more than 2 million security officers who protect our nation’s critical infrastructure; these security professionals can be “force multipliers” to sworn law enforcement officers.

In addition, the NSI aims to train the country’s other public safety professionals emergency service personnel, emergency managers, corrections and other related occupations.

The NSI PMO is committed to providing quality training programs on suspicious activity reporting to traditional as well as nontraditional SAR partners. To that point, the NSI is developing a training course built on the foundations of the SAR Line Officer Training that will be delivered to the above-mentioned categories of professionals. This course will cover the overall SAR process, privacy and civil liberties protections and important signs of potential terrorist planning and is expected to be completed in fall 2011.

Stakeholder Outreach
While developing the business processes, standards and privacy protections outlined above, the NSI recognized that as these new tools and business processes are adopted and implemented in local police departments and fusion centers, it’s important for local law enforcement to explain to their communities how these new tools will be used while ensuring the protection of citizens’ privacy and civil liberties. The success of the NSI largely depends on the ability of law enforcement to earn and maintain the public’s trust, therefore, NSI sites are encouraged to engage in outreach to members of the public, including privacy and civil liberties advocacy groups and private sector partners, in the course of privacy policy development and implementation. This has resulted in the creation of the Building Communities of Trust initiative, which focuses on developing relationships of trust between police departments, fusion centers and the communities they serve—particularly immigrant and minority communities—to prevent terrorist-related crime and to help keep our communities safe.

Also, over the past year the NSI PMO has also been coordinating closely with DHS on the “If You See Something, Say Something” campaign. This campaign—originally implemented by the New York City Metropolitan Transit Authority—is a simple and effective program to raise public awareness of indicators of terrorism, crime and other threats and emphasize the importance of reporting suspicious activity to the proper transportation and law enforcement authorities.

Critical infrastructure are the assets, systems and networks so vital to the U.S. that their incapacitation or destruction would have a debilitating effect on security, national economic security, public health or safety, or any combination thereof. The NSI recognizes the importance of incorporating the private sector—which owns and operates over 80% of the critical infrastructure and key resources in our country—and has therefore been working with the Department of Homeland Security Office of Infrastructure Protection (DHS IP) to incorporate the 18 identified sectors with the DHS Office of Infrastructure Protection into the future NSI process.

Enabling Technology
To support the operational mission, the NSI Federated Search facilitates information sharing using the National Information Exchange Model (NIEM), which was developed by the Global Justice Information Sharing Initiative (Global). NIEM enables information sharing, focusing on information exchanged among organizations as part of their current or intended business practices. The NIEM exchange development methodology results in a common semantic understanding among participating organizations and data formatted in a semantically consistent manner. NIEM will standardize content (actual data exchange standards), provide tools and managed processes. By using NIEM, the NSI has made it possible for agencies to search and share terrorism-related SARs across a federated environment.

There are several ways in which NSI participants can make their SARs available to the NSI Federated Search; installing a NSI Shared Space Server; using an existing legacy CAD or RMS system that is in line with NIEM standards; or by creating an eGuardian account. NSI participants can access NSI Federated Search through either RISSNet or LEO and participants will be able access the search through HSIN LE sometime in the future.

Standardized Processes
The standardized processes and policies established by the NSI PMO provide federal, state, local and tribal law enforcement the capability to share timely, relevant SAR information that has been determined to have a potential nexus to terrorism and ensuring that privacy, civil rights and civil liberties are protected. The National Network of Fusion Centers is a critical part of this connectivity. The NSI PMO has closely coordinated with the State and Local Program Office within DHS Intelligence & Analysis, which has the lead for providing support to fusion centers and has also been tasked with providing NSI training and implementing NSI processes within all relevant DHS components. This continued relationship will be critical as the NSI completes initial implementation and capability of accessing these tools within state and major urban area fusion centers and capability of accessing the tools and moves toward sustainment and utilization of these capabilities.

Your Role in the NSI
One of the major challenges faced by the NSI PMO is the enormous task of training all law enforcement officers, private security officers, dispatchers, 9-1-1 telecommunicators and the operators and owners of critical infrastructure so that they understand these behaviors.

APCO International has agreed to help meet this challenge by committing to push the NSI line officer training to the entire membership and by participating in the development of the SAR training for non-traditional partners. While this training video is focused on law enforcement in particular, the behaviors identified in the video are applicable to those who would be receiving calls from the public, particularly those areas that have rolled out the “If You See Something, Say Something” campaign headed by the Department of Homeland Security (DHS). This training will help ensure quality, relevant information is sent to trained fusion center analysts for vetting and analysis.
For ease of delivery, this training is available on several online platforms, including the Nationwide SAR Initiative website, the Memorial Institute for the Prevention of Terrorism (MIPT) website and the LEAPS.tv website. Copies of the line officer video on DVD, as well as other supporting materials, can also be obtained by e-mailing NSIPMO@usdoj.gov or nsiinformation@ncirc.gov.

For more information on the NSI, please visit http://nsi.ncirc.gov or call 202/598-5365.

About the Author
Scott Kelberg is senior advisor, Nationwide SAR Initiative. He is detailed to the NSI from the Department of Homeland Security, FEMA, to head up all NSI training initiatives. Contact him via e-mail or by phone at 202/353-0790.