Information Sharing
Federal Agencies Are Helping Fusion Centers Build and Sustain Capabilities and Protect Privacy, but Could Better Measure Results Gao ID: GAO-10-972 September 29, 2010Recent terrorist activity, such as the attempted Times Square bombing, underscores the need for terrorism-related information sharing. Since 2001, all 50 states and some local governments have established fusion centers, where homeland security, terrorism, and other intelligence information is shared. The federal government recognizes the importance of fusion centers; however, as GAO reported in October 2007, centers face challenges in sustaining their operations. GAO was asked to assess the extent to which (1) the Department of Homeland Security (DHS) has taken action to support fusion centers' efforts to maintain and grow their operations, and (2) DHS and the Department of Justice (DOJ) have supported fusion centers in establishing privacy and civil liberties protections. GAO reviewed relevant legislation and federal guidance; conducted interviews with 14 of 72 fusion centers, selected on the basis of location and time in operation, among other factors; and interviewed DHS and DOJ officials. The views of fusion center officials are not generalizable but provided insights
Fusion centers have cited DHS grant funding as critical to achieving the baseline capabilities--the standards the government and fusion centers have defined as necessary for centers to be considered capable of performing basic functions in the national information sharing network, such as standards related to information gathering and intelligence analysis. However, DHS has not set standard performance measures for the centers. Fusion centers nationwide reported that federal funding accounted for about 61 percent of their total fiscal year 2010 budgets, but DHS's Homeland Security Grant Program (HSGP), the primary grant program through which fusion centers receive funding, is not specifically focused on, or limited to, fusion centers. Rather, states and local governments determine the amount of HSGP funding they allocate to fusion centers each year from among a number of competing homeland security needs. As a result, fusion centers continue to raise concerns about the lack of a longer-term, predictable federal funding source. DHS, in coordination with the Program Manager for the Information Sharing Environment and DOJ, has a nationwide assessment of centers' baseline capabilities under way. To be completed in October 2010, the goal of the assessment is to provide federal agencies and fusion centers with more accurate information on the status of centers' abilities, help identify gaps between centers' current operations and the baseline capabilities, and use this information to develop strategies and realign resources to close those gaps going forward. Recent federal guidance also requires that, by October 29, 2010, DHS should develop an annual reporting process that will document the total operational and sustainment costs of each of the 72 fusion centers in the national network so as to assess the adequacy of current funding mechanisms. If centers are to receive continued federal financial support, it is important that they are also able to demonstrate their impact and value added to the nation's information sharing goals. However, there are no standard performance measures across all fusion centers to do this. DHS has not started developing such measures because the agency is currently focusing on completing the nationwide assessment and compiling its results and, as such, has not defined next steps or target timeframes for designing and implementing these measures. Defining the steps it will take to design and implement a set of measures and committing to a target timeframe for their completion could better position DHS to demonstrate the value and impact of the national network of fusion centers. To help fusion centers develop privacy and civil liberties policies and protections, DHS and DOJ have provided technical assistance and training, including a template on which to base a privacy and civil liberties policy, and a joint process for reviewing fusion centers' policies to ensure they are consistent with federal requirements. The 14 centers GAO interviewed were at different stages of the policy review process, with 7 completed as of June 2010. Officials from all 14 of the fusion centers GAO interviewed stated that the guidance DHS and DOJ provided was helpful and integral in assisting them to draft their policies. GAO recommends that DHS define steps to develop and implement standard performance measures for centers and commit to a timeframe for completing them. DHS concurred and described steps it is taking to address the recommendation.
RecommendationsOur recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.
Director: Eileen R. Larence Team: Government Accountability Office: Homeland Security and Justice Phone: (202) 512-6510GAO-10-972, Information Sharing: Federal Agencies Are Helping Fusion Centers Build and Sustain Capabilities and Protect Privacy, but Could Better Measure Results
This is the accessible text file for GAO report number GAO-10-972
entitled 'Information Sharing: Federal Agencies Are Helping Fusion
Centers Build and Sustain Capabilities and Protect Privacy, but Could
Better Measure Results' which was released on September 29, 2010.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as
part of a longer term project to improve GAO products' accessibility.
Every attempt has been made to maintain the structural and data
integrity of the original printed product. Accessibility features,
such as text descriptions of tables, consecutively numbered footnotes
placed at the end of the file, and the text of agency comment letters,
are provided but may not exactly duplicate the presentation or format
of the printed version. The portable document format (PDF) file is an
exact electronic replica of the printed version. We welcome your
feedback. Please E-mail your comments regarding the contents or
accessibility features of this document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
Report to Congressional Requesters:
United States Government Accountability Office:
GAO:
September 2010:
Information Sharing:
Federal Agencies Are Helping Fusion Centers Build and Sustain
Capabilities and Protect Privacy, but Could Better Measure Results:
GAO-10-972:
GAO Highlights:
Highlights of GAO-10-972, a report to congressional requesters.
Why GAO Did This Study:
Recent terrorist activity, such as the attempted Times Square bombing,
underscores the need for terrorism-related information sharing. Since
2001, all 50 states and some local governments have established fusion
centers, where homeland security, terrorism, and other intelligence
information is shared. The federal government recognizes the
importance of fusion centers; however, as GAO reported in October
2007, centers face challenges in sustaining their operations. GAO was
asked to assess the extent to which (1) the Department of Homeland
Security (DHS) has taken action to support fusion centers‘ efforts to
maintain and grow their operations, and (2) DHS and the Department of
Justice (DOJ) have supported fusion centers in establishing privacy
and civil liberties protections. GAO reviewed relevant legislation and
federal guidance; conducted interviews with 14 of 72 fusion centers,
selected on the basis of location and time in operation, among other
factors; and interviewed DHS and DOJ officials. The views of fusion
center officials are not generalizable but provided insights.
What GAO Found:
Fusion centers have cited DHS grant funding as critical to achieving
the baseline capabilities”the standards the government and fusion
centers have defined as necessary for centers to be considered capable
of performing basic functions in the national information sharing
network, such as standards related to information gathering and
intelligence analysis. However, DHS has not set standard performance
measures for the centers. Fusion centers nationwide reported that
federal funding accounted for about 61 percent of their total fiscal
year 2010 budgets, but DHS‘s Homeland Security Grant Program (HSGP),
the primary grant program through which fusion centers receive
funding, is not specifically focused on, or limited to, fusion
centers. Rather, states and local governments determine the amount of
HSGP funding they allocate to fusion centers each year from among a
number of competing homeland security needs. As a result, fusion
centers continue to raise concerns about the lack of a longer-term,
predictable federal funding source. DHS, in coordination with the
Program Manager for the Information Sharing Environment and DOJ, has a
nationwide assessment of centers‘ baseline capabilities under way. To
be completed in October 2010, the goal of the assessment is to provide
federal agencies and fusion centers with more accurate information on
the status of centers‘ abilities, help identify gaps between centers‘
current operations and the baseline capabilities, and use this
information to develop strategies and realign resources to close those
gaps going forward. Recent federal guidance also requires that, by
October 29, 2010, DHS should develop an annual reporting process that
will document the total operational and sustainment costs of each of
the 72 fusion centers in the national network so as to assess the
adequacy of current funding mechanisms. If centers are to receive
continued federal financial support, it is important that they are
also able to demonstrate their impact and value added to the nation‘s
information sharing goals. However, there are no standard performance
measures across all fusion centers to do this. DHS has not started
developing such measures because the agency is currently focusing on
completing the nationwide assessment and compiling its results and, as
such, has not defined next steps or target timeframes for designing
and implementing these measures. Defining the steps it will take to
design and implement a set of measures and committing to a target
timeframe for their completion could better position DHS to
demonstrate the value and impact of the national network of fusion
centers.
To help fusion centers develop privacy and civil liberties policies
and protections, DHS and DOJ have provided technical assistance and
training, including a template on which to base a privacy and civil
liberties policy, and a joint process for reviewing fusion centers‘
policies to ensure they are consistent with federal requirements. The
14 centers GAO interviewed were at different stages of the policy
review process, with 7 completed as of June 2010. Officials from all
14 of the fusion centers GAO interviewed stated that the guidance DHS
and DOJ provided was helpful and integral in assisting them to draft
their policies.
What GAO Recommends:
GAO recommends that DHS define steps to develop and implement standard
performance measures for centers and commit to a timeframe for
completing them. DHS concurred and described steps it is taking to
address the recommendation.
View [hyperlink, http://www.gao.gov/products/GAO-10-972] or key
components. For more information, contact Eileen Larence at (202) 512-
8777 or larencee@gao.gov.
[End of section]
Contents:
Letter:
Background:
Federal Efforts Are Under Way to Assess Centers' Capabilities, Target
Funding to Capability Gaps, and Assess Costs, but Measuring Results
Achieved Could Help Show Centers' Value to the ISE:
Federal Agencies Are Providing Technical Assistance and Training to
Centers to Help Them Develop Privacy and Civil Liberties Policies and
Protections, and DHS Is Assessing the Status of These Protections:
Conclusions:
Recommendation for Executive Action:
Agency Comments and Our Evaluation:
Appendix I: Qualifications of Fusion Center Privacy/Civil Liberties
Officials and Challenges Associated with Designating Them:
Appendix II: Privacy/Civil Rights and Civil Liberties Training and
Technical Assistance Program:
Appendix III: GAO Contact and Staff Acknowledgments:
Tables:
Table 1: DHS Funding Reported by Grantees to Support Fusion Center
Activities, Fiscal Years 2004 through 2009:
Table 2: Four Critical Operational Capabilities and Four Enabling
Capabilities Identified by Fusion Centers and Federal Personnel at the
2010 National Fusion Center Conference:
Figures:
Figure 1: Staffing Levels Reported by 62 of 72 Fusion Centers, as of
March 2009:
Figure 2: Average Funding Breakdown for Fiscal Year 2010 Budgets
Reported by 52 of 72 Fusion Centers:
Abbreviations:
ACLU: American Civil Liberties Union:
CLIA: Civil Liberties Impact Assessment:
CRS: Congressional Research Service:
CRCL: Office for Civil Rights and Civil Liberties:
DHS Department of Homeland Security:
DOJ: Department of Justice:
FBI: Federal Bureau of Investigation:
FEMA: Federal Emergency Management Agency:
HSGP: Homeland Security Grant Program:
I&A: Office of Intelligence and Analysis:
ISE: Information Sharing Environment:
NFCA: National Fusion Center Association:
PIA: Privacy Impact Assessment:
PM-ISE: Program Manager for the ISE:
SAA: State Administrative Agency:
SLPO: State and Local Program Office:
[End of section]
United States Government Accountability Office:
Washington, DC 20548:
September 29, 2010:
The Honorable Mark Pryor:
Chairman:
The Honorable John Ensign:
Ranking Member:
Subcommittee on State, Local, and Private Sector Preparedness and
Integration:
Committee on Homeland Security and Governmental Affairs:
United States Senate:
The Honorable Tom Coburn:
United States Senate:
Recent terrorist activity, such as the attempted Times Square bombing
and the attempted bombing of Northwest Airlines Flight 253, emphasizes
the importance of developing a national information sharing capability
to efficiently and expeditiously gather, analyze, and disseminate law
enforcement, homeland security, public safety, and terrorism
information. Since 2001, all 50 states and some local governments have
established fusion centers to address gaps in terrorism-related
information sharing that the federal government cannot address alone
and provide a mechanism for information sharing within the state.
Although fusion centers vary because they were primarily established
to meet state and local needs, under federal law, a fusion center is
defined as a collaborative effort of two or more federal, state,
local, or tribal government agencies that combines resources,
expertise, or information with the goal of maximizing the ability of
such agencies to detect, prevent, investigate, apprehend, and respond
to criminal or terrorist activity. As of August 2010, there were 72
fusion centers nationwide.[Footnote 1] Fusion centers are a component
of the nation's Information Sharing Environment (ISE), which was
established by the Intelligence Reform and Terrorism Prevention Act of
2004 (Intelligence Reform Act) to facilitate information sharing,
access, and collaboration in order to combat terrorism more
effectively.[Footnote 2]
The Implementing Recommendations of the 9/11 Commission Act of 2007
(9/11 Commission Act) requires the Secretary of Homeland Security, in
consultation with others, to establish a state, local, and regional
fusion center initiative within the Department of Homeland Security
(DHS) to establish partnerships with fusion centers.[Footnote 3]
Through the initiative, DHS is required to provide to fusion centers
operational and intelligence advice and assistance, as well as
management assistance, and facilitate close communication and
coordination between fusion centers and DHS. In addition, the
initiative is to provide training to fusion centers and encourage the
centers to participate in terrorism-threat-related exercises conducted
by DHS. Accordingly, the federal government has recognized that fusion
centers represent a critical source of local information about
potential threats for federal agencies and a mechanism for these
agencies to disseminate terrorism-related information and
intelligence. DHS, the Department of Justice (DOJ), and the Program
Manager for the ISE (PM-ISE) have taken steps to partner with and
leverage fusion centers as part of the overall ISE. Further, the
National Strategy for Information Sharing (National Strategy) states
that fusion centers will serve as the primary focal points within
states and localities for the receipt and sharing of terrorism-related
information. Through the National Strategy, the federal government is
promoting fusion centers to achieve a baseline level of capability and
to ensure compliance with all applicable privacy laws and standards to
become interconnected with the federal government and each other in a
national network capable of sharing terrorism-related information.
In January 2005, we designated information sharing for homeland
security a high-risk area because the government had continued to face
formidable challenges in analyzing and disseminating this information
in a timely, accurate, and useful manner. We reported that information
is a crucial tool in fighting terrorism and that its timely
dissemination is critical to maintaining the security of our nation.
This area remained on the high-risk list for our January 2009 update.
[Footnote 4] In 2007, we reviewed the status of fusion centers
nationwide and reported that fusion center officials faced challenges
in obtaining and maintaining the funding and personnel necessary to
conduct their operations.[Footnote 5] According to the officials,
uncertainties in the amount of federal grant funding to be allocated
from year to year made it difficult to plan for the future and created
concerns about the centers' ability to sustain their capability for
the long-term. To improve efforts to create a national network of
fusion centers, we recommended that the federal government should
articulate its role in supporting fusion centers and determine whether
it expects to provide resources to centers over the long-term to help
ensure their sustainability. DHS and the PM-ISE concurred with our
recommendation, stating that recent efforts to define DHS's, and the
federal government's, roles and responsibilities in supporting the
development of the nationwide network of fusion centers demonstrates a
long-term commitment to helping to ensure their sustainability.
[Footnote 6] However, federal, state, and local entities continue to
raise concerns about fusion centers' ability to maintain their
operations with limited or uncertain federal grant funding, especially
as many state and local governments face near-term and long-term
fiscal challenges.
In addition, the 9/11 Commission Act requires the Secretary of
Homeland Security, in consultation with the Attorney General, to
establish guidelines that include standards for fusion centers related
to the privacy of information. For example, these standards are to
include that any fusion center shall develop, publish, and adhere to a
privacy and civil liberties policy consistent with federal, state, and
local law. Because fusion centers collect, analyze, and disseminate
information on potential criminal and terrorist threats, some entities
have raised concerns that centers are susceptible to privacy and civil
liberties violations. For example, according to the American Civil
Liberties Union (ACLU), the fusion center concept encourages state and
local law enforcement personnel to gather intelligence that could
potentially lead to violations of citizens' rights to privacy and
civil liberties. According to a senior DOJ official, such violations
by fusion centers could lead to a loss of public support or confidence
in fusion centers, harm to individuals, proliferation of inaccurate
data, or liability. In light of these risks, questions remain about
how centers are implementing privacy and civil liberties policies to
ensure that centers handle information in a manner that protects
citizens' constitutional rights.
Considering these issues and the fusion centers' role in the ISE, you
asked us to provide Congress with an assessment of the current status
of fusion centers' efforts to maintain and grow their operations and
establish privacy and civil liberties protections with support from
the federal government. Specifically, this report addresses the
following questions:
* To what extent has DHS taken action to support fusion centers'
efforts to maintain and grow their operations?
* To what extent are DHS and DOJ supporting fusion centers in
establishing privacy and civil liberties protections?
To assess the extent to which DHS has supported centers in their
efforts, we analyzed relevant laws and strategies, such as the 9/11
Commission Act and the National Strategy, related to fusion centers'
role in the ISE and federal efforts to support centers. We also
examined guidance, such as the Baseline Capabilities for State and
Major Urban Area Fusion Centers (Baseline Capabilities), which
describes the minimum capabilities and operational standards necessary
for fusion centers.[Footnote 7] We focused our review on DHS's efforts
because DHS is the Executive Agent in managing federal interaction
with fusion centers and is to coordinate its efforts with DOJ and the
PM-ISE. To obtain fusion center views, we conducted interviews with
officials from a non-probability sample of 14 of 72 fusion centers.
[Footnote 8] We selected these centers to reflect a range of
characteristics, including whether the center is a state or major
urban area fusion center; length of time in operation; geographic
region;[Footnote 9] and fiscal year 2010 funding allocations for the
centers' states or urban areas from the DHS Homeland Security Grant
Program (HSGP), which is the primary federal grant program through
which fusion centers may receive funding. Specifically, we interviewed
fusion center directors, or their designees, to obtain information on
their centers' approaches and plans to sustain operations, and their
perspectives on federal efforts to support these approaches as well as
any challenges or issues encountered in sustaining operations. While
their comments cannot be generalized to all fusion centers nationwide,
the interviews provided a range of perspectives and useful insights on
the issue of sustainability.
To assess DHS support provided to fusion centers, we examined
guidance, such as for the DHS Fiscal Year 2010 HSGP. We also analyzed
documents, such as program descriptions, related to federal efforts to
assess fusion centers' baseline capabilities and provide training,
technical assistance, and grant funding. We interviewed officials from
DHS's Office of Intelligence and Analysis (I&A), which oversees the
fusion center program; DHS's Federal Emergency Management Agency's
(FEMA) Grant Programs Directorate and Office of Counterterrorism and
Security Preparedness within Protection and National Preparedness,
which administer the HSGP and provide support to fusion centers; DOJ's
Office of Justice Programs, which provides training and technical
assistance to centers; the Federal Bureau of Investigation (FBI),
which provides personnel and support to centers; and the Office of the
PM-ISE, which oversees management of the ISE. We discussed plans and
efforts related to establishing performance measures for fusion
centers and compared these plans with criteria in standard practices
for program management.[Footnote 10] In addition, we conducted
interviews with the National Fusion Center Association (NFCA), a
nonprofit association that represents the interests of fusion centers,
to obtain a broad perspective on fusion center sustainability and the
role of DHS, DOJ, and the PM-ISE in supporting centers' efforts.
Lastly, we attended the 2010 National Fusion Center Conference to
obtain information about federal plans and efforts to support centers
and issues and concerns of centers nationwide.[Footnote 11]
To assess the extent to which DHS and DOJ are supporting fusion
centers in establishing privacy and civil liberties protections, we
analyzed relevant statutes, including the 9/11 Commission Act and the
Intelligence Reform Act, and guidance, such as the ISE Privacy
Guidelines, Baseline Capabilities, and DHS HSGP guidance to identify
required and recommended actions for fusion centers to take to
establish these protections.[Footnote 12] We analyzed plans and
documentation, such as the DHS Privacy Office's 2008 Privacy Impact
Assessment of fusion centers and privacy-related training and
technical assistance materials. We also assessed the DHS and DOJ
Fusion Center Privacy, Civil Rights, and Civil Liberties Policy
Template, which is intended to assist fusion center personnel in
developing their privacy and civil liberties policies. We compared
this template against the ISE Privacy Guidelines to determine the
extent to which the template included components of that guidance. In
addition, we interviewed officials from DHS's Privacy Office, DHS's
Office for Civil Rights and Civil Liberties (CRCL), DOJ's Office of
Privacy and Civil Liberties, and the PM-ISE about efforts to review
centers' policies, the status of centers' policy development, privacy-
related training and technical assistance, and plans for supporting
fusion centers' implementation of privacy and civil liberties
protections. We also interviewed representatives from the Institute
for Intergovernmental Research, the DOJ contractor that reviews fusion
centers' privacy and civil liberties policies, to obtain additional
information about the review process and any challenges encountered
related to the development of these policies.[Footnote 13] To describe
steps fusion centers are taking to establish privacy and civil
liberties protections, we included questions in our interviews with
officials from 14 fusion centers about the development of privacy and
civil liberties policies and procedures; support provided by DHS, DOJ,
and the PM-ISE; and any challenges or issues encountered in
establishing the protections. Lastly, we included questions in our
interviews with NFCA and ACLU officials to obtain a broad perspective
on privacy issues in fusion centers.
We conducted this performance audit from March 2010 through September
2010 in accordance with generally accepted government auditing
standards. Those standards require that we plan and perform the audit
to obtain sufficient, appropriate evidence to provide a reasonable
basis for our findings and conclusions based on our audit objectives.
We believe that the evidence obtained provides a reasonable basis for
our findings and conclusions based on our audit objectives.
Background:
Fusion Centers:
Nationwide, states and major urban areas have established fusion
centers to coordinate the gathering, analysis, and dissemination of
law enforcement, homeland security, public safety, and terrorism
information. After centers had begun to be established around the
country, Congress passed the 9/11 Commission Act to require the
Secretary of Homeland Security to share information with and support
fusion centers. The National Strategy identifies fusion centers as
vital assets critical to sharing information related to terrorism
because they serve as focal points for the two-way exchange of
information between federal agencies and state and local governments.
According to DHS, fusion centers are the primary way that DHS shares
intelligence and analysis with state and local homeland security
agencies. For example, fusion centers typically issue analytical
products, such as daily or weekly bulletins on general criminal or
intelligence information and intelligence assessments which, in
general, provide in-depth reporting on an emerging threat, group, or
crime. These products are primarily created for law enforcement
entities and other community partners, such as members of the critical
infrastructure sectors. In recent years, fusion centers have been
credited with being influential in disrupting a planned terrorist
attack on the New York City subway system, investigating bomb threats
against U.S. airlines, and providing intelligence support to several
political conventions and summits. Other fusion centers have been
instrumental in providing intelligence and analytical support to
assist with securing our nation's borders. For example, the Arizona
Counterterrorism Information Center and the New York State
Intelligence Center routinely (i.e., either twice a week or quarterly,
respectively) issue border-specific intelligence products to enhance
the situational awareness of law enforcement agencies in border
communities.
While all fusion centers were generally created by state and local
governments to improve information sharing across levels of government
and to prevent terrorism or other threats, the missions of fusion
centers vary based on the environment in which the center operates.
Some fusion centers have adopted an "all-crimes" approach,
incorporating information on terrorism and other high-risk threats
into their jurisdiction's existing law enforcement framework to ensure
that possible precursor crimes, such as counterfeiting or narcotics
smuggling, are screened and analyzed for linkages to terrorist
planning or other criminal activity. Other fusion centers have adopted
an "all-hazards" approach. In addition to collecting, analyzing, and
disseminating information on potential terrorist planning and other
crimes, these fusion centers identify and prioritize types of major
disasters and emergencies, such as hurricanes or earthquakes, which
could occur within their jurisdiction. In doing so, they gather,
analyze, and disseminate information to assist relevant responsible
agencies--law enforcement, fire, public health, emergency management,
critical infrastructure--with the prevention, protection, response, or
recovery efforts of those incidents.
Fusion centers also vary in their personnel composition and staffing
levels. Consistent with the statutory definition of a fusion center,
these centers typically bring together in one location representatives
from several different state or local agencies, such as state and
local law enforcement agencies--state police, county sheriffs, and
city police departments--homeland security agencies, emergency
management agencies, and the National Guard. In addition, as DHS is
required to the maximum extent possible to assign officers and
intelligence analysts to fusion centers, many centers have federal
personnel working on-site, such as DHS intelligence operations
specialists and Customs and Border Protection agents, along with
others such as FBI intelligence analysts and Drug Enforcement
Administration agents. In terms of staffing levels, a 2009 joint DHS
and PM-ISE survey of fusion centers reported that the number of
personnel working at these centers ranged from under 10 employees to
over 75 per center, as shown in figure 1.
Figure 1: Staffing Levels Reported by 62 of 72 Fusion Centers, as of
March 2009:
[Refer to PDF for image: pie-chart]
Less than 10 employees: 23%;
10 to 25 employees: 28%;
25 to 50 employees: 22%;
51 to 75 employees: 17%;
Greater than 75 employees: 10%.
Source: GAO (presentation), PM-ISE (data).
Note: Information was aggregated, but not verified by the PM-ISE or
GAO.
[End of figure]
Federal Role in Relation to Fusion Centers:
Recognizing that DHS had already begun to provide support to fusion
centers but needed to play a stronger, more constructive role in
assisting these centers, Congress passed the 9/11 Commission Act,
which required the Secretary of Homeland Security to create the State,
Local, and Regional Fusion Center Initiative.[Footnote 14] The Act
also required the Secretary, in coordination with representatives from
fusion centers and the states, to take certain actions in support of
the initiative. Specifically, the Act requires that the Secretary take
a number of steps to support the centers, including supporting efforts
to integrate fusion centers into the ISE, assigning personnel to
centers, incorporating fusion center intelligence information into DHS
information, providing training, and facilitating close communication
and coordination between the centers and DHS, among others. The law
also required the Secretary to issue guidance that includes standards
that fusion centers shall undertake certain activities. These include,
for example, that centers collaboratively develop a mission statement,
identify expectations and goals, measure performance, and determine
center effectiveness; create a collaborative environment for the
sharing of intelligence and information among federal, state, local,
and tribal government agencies, the private sector, and the public,
consistent with guidance from the President and the PM-ISE; and offer
a variety of intelligence and information services and products.
DHS has taken steps to organize and establish a management structure
to coordinate its support of fusion centers. In June 2006, DHS tasked
I&A with the responsibility for managing DHS's support to fusion
centers. I&A established a State and Local Program Office (SLPO) as
the focal point for supporting fusion center operations and to
maximize state and local capabilities to detect, prevent, and respond
to terrorist and homeland security threats.
Consistent with the 9/11 Commission Act and Intelligence Reform Act,
DHS, in conjunction with DOJ and the PM-ISE, has issued a series of
guidance documents to support fusion centers in establishing their
operations. In 2006, through the Global Justice Information Sharing
Initiative (Global), DHS and DOJ jointly issued the Fusion Center
Guidelines, a document that outlines 18 recommended elements for
establishing and operating fusion centers consistently across the
country, such as establishing and maintaining a center based on
funding availability and sustainability; ensuring personnel are
properly trained; and developing, publishing, and adhering to a
privacy and civil liberties policy.[Footnote 15]
To supplement the Fusion Center Guidelines, in September 2008, DHS,
DOJ, and Global jointly published the Baseline Capabilities, which
were developed in collaboration with the PM-ISE and other federal,
state, and local officials. The Baseline Capabilities define the
capabilities needed to achieve a national, integrated network of
fusion centers and detail the standards necessary for a fusion center
to be considered capable of performing basic functions by the fusion
center community. For example, the Baseline Capabilities include
standards for fusion centers related to information gathering,
recognition of indicators and warnings, processing information,
intelligence analysis and production, and intelligence and information
dissemination. In addition, the Baseline Capabilities include
standards for the management and administrative functioning of a
fusion center. Among these are standards for ensuring information
privacy and civil liberties protections, developing a training plan
for personnel, and establishing information technology and
communications infrastructure to ensure seamless communication between
center personnel and partners. The development of these baseline
standards is called for in the National Strategy, which identifies
their development as a key step to reaching a national integrated
network of fusion centers. By achieving this baseline level of
capability, it is intended that a fusion center will have the
necessary structures, processes, and tools in place to support the
gathering, processing, analysis, and dissemination of terrorism,
homeland security, and law enforcement information.
In accordance with the 9/11 Commission Act, DHS, DOJ, and the PM-ISE
rely on fusion centers as critical nodes in the nation's homeland
security strategy and provide them with a variety of other support.
* Federal Grant Funding: DHS's HSGP awards funds to states,
territories, and urban areas to enhance their ability to prepare for,
prevent, protect against, respond to, and recover from terrorist
attacks and other major disasters.[Footnote 16] The fiscal year 2010
HSGP consists of five separate programs, two of which are primarily
used by states and local jurisdictions, at their discretion, for
fusion-center-related funding.[Footnote 17] These grant programs are
not specifically focused on, or limited to, fusion centers. Thus,
fusion centers do not receive direct, dedicated funding from DHS;
rather, the amount of grant funding a fusion center receives is
determined by a state's State Administrative Agency (SAA)--the state-
level agency responsible for managing all homeland security grants and
associated program requirements--or an urban area's working group,
which has similar responsibilities. A fusion center typically
contributes to the development of a state's federal grant application
by providing information on how it will use the proposed funding
needed, called an investment justification.
* Personnel: DHS and DOJ have deployed, or assigned, either part-time
or full-time personnel to fusion centers to support their operations
and serve as liaisons between the fusion center and federal
components. For example, DHS personnel are to assist the center in
using ISE information; review information provided by state, local,
and tribal personnel; create products derived from this information
and other DHS homeland security information; and assist in
disseminating these products. As of July 2010, DHS's I&A had deployed
58 intelligence officers and the FBI had deployed 74 special agents
and analysts full time to 38 of the 72 fusion centers.
* Access to Information and Systems: DHS and DOJ also share classified
and unclassified homeland security and terrorism information with
fusion centers through several information technology networks and
systems. For example, in February 2010, DHS's I&A reported that it had
installed the Homeland Secure Data Network, which supports the sharing
of federal secret-level intelligence and information with state,
local, and tribal partners, at 33 of 72 fusion centers. DHS also
provides an unclassified network, the Homeland Security Information
Network, which allows federal, state, and local homeland security and
terrorism-related information sharing.
* Training and Technical Assistance: DHS has partnered with DOJ,
through Global, to offer fusion centers a variety of training and
technical assistance programs. These include training on intelligence
analysis and privacy and civil liberties protections, as well as
technical assistance with technology implementation, security, and the
development of liaison programs to coordinate with other state and
local agencies.
Privacy Requirements for Fusion Centers:
Fusion centers have a number of privacy related requirements. As
provided under the 9/11 Commission Act, DHS is required to issue
standards that fusion centers are to develop, publish, and adhere to a
privacy and civil liberties policy consistent with federal, state, and
local law. In addition, the standards must provide that a fusion
center give appropriate privacy and civil liberties training to all
state, local, tribal, and private sector representatives at the center
and have appropriate security measures in place for the facility,
data, and personnel. Because fusion centers are within the ISE when
they access certain kinds of information, federal law requires they
adhere to ISE privacy standards issued by the President or the PM-ISE
under the authority of the Intelligence Reform Act, as amended. Other
federal requirements found in 28 C.F.R. part 23, Criminal Intelligence
Systems Operating Policies, apply to federally funded criminal
intelligence systems, and fusion centers receiving criminal
intelligence information must follow these procedures, which also
include privacy requirements.
In 2006, the PM-ISE issued the ISE Privacy Guidelines, which establish
a framework for sharing information in the ISE in a manner that
protects privacy and other legal rights. The ISE Privacy Guidelines
apply to federal departments and agencies and, therefore, do not
directly impose obligations on state and local government entities.
However, the ISE Privacy Guidelines do require federal agencies and
the PM-ISE to work with nonfederal entities, such as fusion centers,
seeking to access protected information to ensure that the entities
develop and implement appropriate policies and procedures that are at
least as comprehensive as those contained in the ISE Privacy
Guidelines.[Footnote 18] Among the primary components of these
guidelines, agencies are required to, for example, ensure that
protected information is used only for authorized, specific purposes;
properly identify any privacy-protected information to be shared; put
in place security, accountability, and audit mechanisms; facilitate
the prevention and correction of any errors in protected information;
and document privacy and civil liberties protections in a privacy and
civil liberties policy.
Federal Efforts Are Under Way to Assess Centers' Capabilities, Target
Funding to Capability Gaps, and Assess Costs, but Measuring Results
Achieved Could Help Show Centers' Value to the ISE:
Officials in all 14 fusion centers we contacted cited federal funding
as critical to expanding their operations and achieving and
maintaining the baseline capabilities needed to sustain the national
network of fusion centers. An assessment of fusion centers, led by the
PM-ISE, DHS, and DOJ, is under way to obtain data about the current
capabilities of centers nationwide, identify the operational gaps that
remain, and determine what resources centers may need to close the
gaps. DHS is evaluating whether to amend its grant guidance to require
fusion centers to use future funding to support efforts to meet and
maintain the baseline capabilities. DHS also has plans to assess the
costs of the fusion center network to help inform decisions about the
extent to which the funding mechanisms in place in support of fusion
centers are adequate, or if other funding avenues need to be explored.
However, taking steps to implement standard performance measures to
track the results of fusion centers' efforts to support information
sharing and assess the impact of their operations could help
demonstrate center value to the ISE and enable the federal government
to justify and prioritize future resources in support of the national
network.
Fusion Center Officials We Interviewed Cited Federal Funding as
Critical to Sustaining Operations:
Officials in all 14 fusion centers we contacted stated that without
continued federal grant funding, in particular DHS grant funding,
their centers would not be able to expand, or in some instances even
maintain, operations. States have reported to DHS that they have used
about $426 million in grant funding from fiscal year 2004 through 2009
to support fusion-related activities nationwide, as shown in table 1.
Table 1: DHS Funding Reported by Grantees to Support Fusion Center
Activities, Fiscal Years 2004 through 2009:
Fiscal year: 2004;
Funding reported by grantees to support fusion center activities:
$100,320,799.
Fiscal year: 2005;
Funding reported by grantees to support fusion center activities:
$57,246,542.
Fiscal year: 2006;
Funding reported by grantees to support fusion center activities:
$62,664,343.
Fiscal year: 2007;
Funding reported by grantees to support fusion center activities:
$78,723,783.
Fiscal year: 2008;
Funding reported by grantees to support fusion center activities:
$61,864,080.
Fiscal year: 2009;
Funding reported by grantees to support fusion center activities:
$65,402,360.
Fiscal year: Total;
Funding reported by grantees to support fusion center activities:
$426,221,907.
Source: DHS.
Note: Data are as of June 16, 2010, and include all FEMA preparedness
grant programs. Figures represent activities aligned to project types
that support fusion center activities, such as the following:
establish/enhance a terrorism intelligence/early warning system,
center, or task force; establish/enhance public-private emergency
preparedness program; and develop/enhance homeland security/emergency
management organization and structure. Data are self-reported by
grantees every 6 months, and according to FEMA officials, are not
validated to ensure that funds were exclusively used to support fusion
center activities.
[End of table]
According to a nationwide survey conducted by DHS and the PM-ISE, of
the 52 of 72 fusion centers that responded, on average, over half of
their 2010 budgets were supported by federal funding.[Footnote 19]
Specifically, as shown in figure 2, these centers reported that
federal grant funding accounted for 61 percent of their total current
budgets of about $102 million and state or local funds accounted for
39 percent ($40 million), according to information reported to DHS and
the PM-ISE.[Footnote 20] For the 14 centers we contacted, officials in
6 of the centers reported relying on federal grant funding for more
than 50 percent of their annual budgets, which ranged from $600,000 to
about $16 million.[Footnote 21]
Figure 2: Average Funding Breakdown for Fiscal Year 2010 Budgets
Reported by 52 of 72 Fusion Centers:
[Refer to PDF for image: stacked vertical bar graph]
Fiscal year: 2010;
Federal funds: $62 million (61%);
State funds: $30 million (29%);
Local funds: $10 million (10%);
Total: $102 million (52 fusion centers).
Source: GAO (presentation), PM-ISE (data).
Note: Above amounts rounded to the nearest whole number. Information
was aggregated, but not verified by the PM-ISE or GAO.
[End of figure]
Officials in all 14 of the centers we contacted stated that federal
funding was critical to long-term sustainability and provided varying
examples of the impact that not having federal grant funding would
have on their fusion centers. Officials in four fusion centers stated
that without federal funding, their centers would not be able to
continue operations. For example, an official in one of these centers
stated that with the state's economic recession, the fusion center
does not expect to grow operations over the next 5 years and is
struggling to maintain the personnel and funding needed to maintain
their current operations, which includes fewer than 10 full-time
personnel with an estimated budget of a little over $500,000.
Officials in another fusion center stated that while they have a
comparatively large budget of about $10 million, they could not
maintain their level of operations without the federal grant funding,
about $5 million per year, they receive.
Fusion Centers See Federal Funding as Necessary to Achieve and
Maintain the Baseline Capabilities; a Nationwide Assessment to Gauge
Gaps in Centers' Capabilities Is Under Way:
Officials in all 14 fusion centers we contacted stated that without
sustained federal funding, centers could not expand operations to
close the gaps between their current operations and the baseline
capabilities, negatively affecting their ability to function as part
of the national network. For example, officials from one fusion center
stated that they currently do not have the resources to hire a
security officer, which affects the center's development,
implementation, maintenance, and oversight of security measures,
including ensuring that security measures are in place to provide the
proper information protection in compliance with all applicable laws
and the center's privacy and civil liberties policy. Officials in
another fusion center stated that federal grant funding is essential
to expanding their outreach and coordination with other state and
local entities--a recommended baseline capability and one of the
primary ways that centers maintain partnerships with other entities.
Consistent with fusion center views reported at the 2010 National
Fusion Center Conference, officials in all 14 fusion centers we
contacted stated that achieving and maintaining the baseline
capabilities was key to sustaining their centers. By achieving and
maintaining these capabilities, fusion centers should have the
necessary structures, processes, and tools in place to support the
gathering, processing, analysis, and dissemination of terrorism,
homeland security, and law enforcement information as part of the
national, integrated network. At the 2010 National Fusion Center
Conference, fusion center directors reported that achieving the
critical operational capabilities at each fusion center was necessary
to ensure an effective flow of information throughout the national
network of fusion centers.[Footnote 22] To do so, these directors
cited the importance of performing baseline capability self-
assessments, identifying gaps between operations and the baseline
capabilities, developing plans to address the gaps, and leveraging
existing resources more effectively and efficiently to close those
gaps. For example, assessing gaps in centers' current information
technology and communication infrastructure and the associated costs
of implementing the necessary systems may enable fusion centers to
focus resources more efficiently to address these needs and close the
identified gaps. Officials in all of the 14 fusion centers we
contacted said that, in recognizing the importance of meeting the
baseline capabilities, they had taken some steps to review their own
operations and identify gaps between their current operations and the
recommended baseline capabilities. For example, an official in one
center said that he had conducted a systematic gap analysis of the
center's current operations against the baseline capabilities and
determined that the center still had to achieve an estimated 80
percent of the capabilities, such as developing performance metrics
and an outreach program. Gaps identified by officials at the 14 fusion
centers included, for example, the need to develop information
technology and related tools for analysis; not having a privacy and
civil liberties policy in place; not having identified a privacy/civil
liberties officer; and not having identified a security officer.
To provide data about the baseline capabilities of fusion centers
nationwide, the PM-ISE, DHS, and DOJ are conducting an ongoing
systematic assessment of centers' capabilities. The goal of the
nationwide assessment, according to DHS senior officials, is to help
enable both federal and fusion center representatives to (1) obtain
more accurate information on the current status of centers' abilities
to meet the baseline capabilities, (2) help identify gaps between
centers' current operations and the capabilities, and (3) use this
information to develop strategies and realign resources to support
centers' efforts to close those gaps going forward. Further, according
to both DHS senior officials and fusion center representatives, the
results of the assessment are also intended to provide centers with
the information needed to develop more accurate and specific
investment justifications to their SAAs in competing for DHS HSGP
funding.
According to DHS and a senior official from the NFCA, personnel from
DHS, the PM-ISE, and DOJ coordinated with state and local government
representatives and fusion center officials prior to and during the
National Fusion Center Conference in February 2010 to jointly identify
four critical operational capabilities and four enabling capabilities
to be prioritized in developing the national network of fusion
centers.[Footnote 23] Among the four enabling capabilities are those
that relate to establishing a sustainment strategy and establishing
privacy and civil liberties protections, as shown in table 2.
Table 2: Four Critical Operational Capabilities and Four Enabling
Capabilities Identified by Fusion Centers and Federal Personnel at the
2010 National Fusion Center Conference:
Operational capabilities:
* Ability to receive classified and unclassified information from
federal partners.
* Ability to assess local implications of threat information through
the use of a formal risk assessment process.
* Ability to further disseminate threat information to other state,
local, tribal, territorial, and private sector entities within their
jurisdiction.
* Ability to gather locally generated information, aggregate it,
analyze it, and share it with federal partners as appropriate.
Enabling capabilities[A]:
* Sustainment Strategy.
* Privacy and Civil Rights/Civil Liberties.
* Communications and Outreach.
* Security and Clearances.
Source: DHS.
[A] Enabling capabilities are those that support the administrative
and management functions of a fusion center.
[End of table]
The nationwide assessment of fusion centers consists of two phases--a
self-report survey followed by onsite validation. First, the PM-ISE
sent a self-assessment questionnaire, which was to be completed in May
2010, to all 72 designated fusion centers to use to assess their
current operations against all baseline capabilities. Second, starting
in June 2010, seven validation teams consisting of federal and fusion
center personnel began making site visits to fusion centers to
validate centers' responses to the self-assessment.[Footnote 24]
Specifically, the validation teams are to conduct a review of the four
critical operational capabilities that were identified collaboratively
by federal officials and fusion center directors as being critical to
the functioning of the national network. Validation teams are also to
review information on the privacy and civil liberties protections
established by these fusion centers and to discuss the centers'
sustainment strategies. Senior DHS officials stated that this review
is to involve discussions on each fusion centers' experiences and
related issues, challenges, and associated costs of achieving and
maintaining the four critical operational capabilities, as well as the
privacy and civil rights/civil liberties enabling capability, to
provide additional information on why gaps may exist and how to
address them.
According to DHS senior officials, the site visits were completed in
September 2010. The results of the assessment, which are to include
the aggregate of both the self-assessment and on-site validation data,
are expected to be analyzed and shared in a report with the
participating fusion centers by the end of October 2010. Further,
according to DHS senior officials, they are planning to conduct the
assessment on a recurring basis. Thus, this initial assessment is
expected to serve as a baseline against which to measure the
development of the baseline capabilities in individual fusion centers,
as well as across the national network.[Footnote 25]
DHS Has Efforts Under Way to Link DHS Grants to Filling Baseline
Capabilities Gaps and Plans to Assess Costs of the Fusion Center
Network:
DHS has opportunities to better target federal fusion center funding
to fill critical baseline capability gaps and is taking steps to do
so. Both the National Strategy and DHS emphasize that federal agencies
are to play an active role in addressing the challenge of sustaining
fusion centers by ensuring that they are able to achieve and maintain
the baseline capabilities. Specifically, the National Strategy states
that federal agencies are to assist fusion centers in incorporating
the baseline capabilities into their operations by amending and
modifying grants and grants guidance, and other applicable funding
programs, to ensure that centers are able to meet and sustain the
baseline capabilities and operational standards. In its fiscal year
2010 HSGP grant guidance, DHS encourages, but does not require, that
fusion centers prioritize the allocation of HSGP funding they receive
through their SAAs to meet and maintain the baseline capabilities.
Further, senior DHS officials stated, generally, that the results of
the nationwide assessment will be used to address future fusion center
funding and that the office will determine how it may leverage DHS's
HSGP to ensure that centers have access to grant funds and assist with
putting these mechanisms in place for the future.
Senior officials from DHS as well as all 14 of the fusion centers we
contacted stated that linking, or tying, future HSGP grant funding to
achieving and maintaining the baseline capabilities may better enable
fusion centers to obtain the resources needed to address the gaps in
baseline capabilities by allowing them to more specifically detail how
grant funding is to be used in their investment justifications. For
example, by tying future grant funding to developing fusion centers'
ability to gather information, aggregate it, analyze it, and share it
as appropriate, centers may be more likely to obtain the funding
necessary to develop the specific information systems and analytical
tools needed to enable them to achieve these capabilities. An Acting
Director with FEMA's Office of Counterterrorism and Security
Preparedness stated that, as part of developing the Fiscal Year 2011
HSGP guidance, FEMA is currently working with DHS and fusion center
stakeholders to evaluate the potential for amending the guidance to
accomplish two goals. Specifically, they are working to (1) require,
rather than encourage, that fusion centers use 2011 grant funding
allocated from SAAs to achieve and maintain all of the baseline
capabilities; and (2) focus funding to specifically address gaps in
baseline capabilities identified during the assessment process. For
example, the official said that they are exploring options such as
requiring centers to include in their investment justifications the
results of the nationwide assessment and indicating how the center
would use funding to fill any identified gaps. Further, this official
added that FEMA has also begun collaborating within DHS and with DOJ
to discuss current grant programs and possibilities for future
interagency coordination on the support specifically for fusion
centers. Directives such as these could help ensure that capabilities
are met by enabling fusion centers to provide specific data about
operational gaps and needs in their investment justifications.
While DHS could ensure that fusion centers target the federal funding
they receive on filling baseline capabilities gaps, fusion centers
have called on the federal government to establish a dedicated funding
stream for them. DHS's HSGP is the primary grant program through which
fusion centers receive funding, but these grants are not specifically
focused on, nor limited to, fusion centers. As such, fusion centers
compete with other state homeland security, law enforcement, and
emergency management agencies and missions for a portion of the total
amount of HSGP funding awarded to the SAA, which decides what portion
of the total funding centers will receive. This process has generated
long-standing concerns by the fusion center community about the lack
of a longer-term, predictable funding source for the centers. For
example, we reported in October 2007 that fusion centers reported
challenges with funding, that these issues made it difficult to plan
for the future, and that fusion centers were concerned about their
ability to sustain their capability for the long term.[Footnote 26]
The Congressional Research Service (CRS) similarly reported in January
2008 that the threat of diminished or eliminated federal or state
funding, such as a decrease in DHS grant funding programs, poses a
risk to the development of fusion centers.[Footnote 27] The DHS Office
of Inspector General subsequently reported in December 2008 that
fusion center officials they spoke with remained concerned with
sustainability and funding, emphasizing that sustainment planning and
funding from the federal government is essential for the success of
fusion centers.[Footnote 28]
Officials from 13 of the 14 centers we contacted cited a number of
challenges with obtaining funding and the lack of a dedicated funding
source, which affected their ability to plan long term or expand their
operations.[Footnote 29] For example, officials in 9 of these centers
stated that uncertainty around the amount of federal grant funding the
fusion center will receive from their states each year made it
difficult to plan and expand operations. For instance, an official
from a fusion center stated that the center relies on federal funding
for 80 percent of its annual operating budget, but has to compete with
several other state agencies and about 75 counties for a portion of
HSGP funding each year. Officials in another fusion center stated that
competition for limited federal grant funding has made getting the
necessary funding more difficult and, as a result, they have had to
scale back part of their outreach efforts to state and local entities,
which is one of the four critical enabling capabilities.
In referring to the role fusion centers are to have in the national
information sharing network, officials from all 14 fusion centers
stated that there should be a federal grant funding stream or program
dedicated specifically to support fusion centers. For example,
officials from 6 centers stated that, since the National Strategy has
identified fusion centers as a key component of the success of the
ISE, the federal government should recognize the importance of
providing dedicated funding support so that centers with varying
missions and resources can continue to close baseline capability gaps
and function as key partners in the national network. An official from
one of these fusion centers stated that while centers are owned and
operated by state and local entities--and should thus be supported by
state and local resources--centers are also expected, as members of
the ISE, to support a national information sharing, homeland security
mission. Moreover, this official said that if fusion centers, as the
primary focal points of information sharing between state and local
and federal governments, are to support this mission, there should be
a targeted federal funding source to support centers' efforts to meet
and achieve the baseline capabilities, which have been identified as
being essential for centers to function in the national network.
Senior I&A and FEMA officials said that they understood the fusion
centers' concerns and recognized the challenges centers faced in
competing for funding. However, these FEMA officials stated that they
do not have the authority to create a fusion-center-specific grant
within the HSGP and that doing so would require congressional action.
These FEMA officials said that, in addition to the nationwide
assessment that is underway to identify gaps in baseline capabilities,
within the HSGP, they have broadened the allowable costs for which
fusion centers can use HSGP funding and prioritized funding on
achieving the baseline capabilities. However, DHS has not directed
that a certain percentage of HSGP funding be used for fusion centers
out of concern that other state agencies, such as emergency management
agencies, would likewise lobby for such specific funding. These
officials added that this would not be possible because they are
trying to balance ensuring that SAAs have flexibility in administering
HSGP funds while ensuring that federal fusion center requirements are
supported and met.
Further, senior DHS officials stated that DHS has recognized the need
to conduct extensive research on funding options for fusion centers,
stating that, after the nationwide assessment is completed, the SLPO
is to assess key budgetary processes to determine how support to
fusion centers can be affected and determine DHS's ability to identify
additional funding options for centers. In addition, Fiscal Year 2012
implementation guidance for the ISE requires that, by October 29,
2010, DHS should develop and promulgate an annual common reporting
process that will document the total operational and sustainment costs
of each of the 72 fusion centers in the national network. Senior DHS
officials stated that, while not yet completed, the SLPO has begun to
develop this reporting process and that it is to be based in part on
surveys implemented in previous years at fusion centers. These
officials added that the goal of the guidance is to develop annual
data on the costs to sustain fusion centers, and that these data are a
necessary first step to assessing the adequacy of current funding
mechanisms.
Taking Steps to Implement Standard Performance Measures to Track the
Results of Fusion Centers' Efforts to Support Information Sharing
Could Help Demonstrate Centers' Value to the ISE:
If fusion centers are to receive continued financial support, it is
important that centers are also able to demonstrate that they are
providing critical information that is helping the federal government
and state and local agencies protect against terrorist and homeland
security threats. We have previously emphasized the importance of
performance measures as management tools to track an agency's progress
toward achieving goals and to provide information on which to base
organizational and management decisions.[Footnote 30] Performance data
allow agencies to share effective approaches, recognize problems, look
for solutions, and develop ways to improve results.
The Fusion Center Guidelines recommend that individual fusion centers
develop and use performance measures as an ongoing means to measure
and track performance and determine and evaluate the effectiveness of
their operations to make better decisions and allocate resources. The
Baseline Capabilities expand on these guidelines and recommend that
fusion centers develop measures that allow them to, among other
things, track their performance and results against the centers'
individual goals and objectives. Officials from 5 of the 14 centers we
contacted stated that one of the gaps they identified between their
current operations and the baseline capabilities was development of
methods to monitor and evaluate their fusion center's performance.
[Footnote 31] Officials from these 5 fusion centers stated that it was
a challenge to develop performance measures to monitor their
operations and demonstrate results because their mission was to
prevent crimes, and it is difficult to know how many crimes were
averted due to their efforts. Additionally, officials from 3 of these
5 fusion centers stated that their ability to develop performance
measures was also affected by the fact that, due to limited personnel,
addressing other operational work responsibilities, such as analyzing
intelligence information and developing related reports, was the
priority. A senior official from NFCA said that these challenges are
similarly experienced across the broader network of fusion centers,
and that centers would welcome a collaborative process in developing
these measures to involve participation from, among others, federal
agencies such as DHS, DOJ, and the PM-ISE.
According to DHS senior officials, the nationwide assessment currently
under way is to gauge whether or not each fusion center has developed
methods to monitor and evaluate its own performance. For example, the
assessment results are to indicate to what extent a center has
developed mechanisms to receive feedback on the value of its products
or to determine the effectiveness of its operations in achieving
identified goals and objectives. DHS senior officials stated that the
results will be used to help federal agencies assess to what extent
there are gaps in this baseline capability across the national network
of fusion centers and to make decisions about where to allocate
resources to support centers' efforts to develop these individual
performance measures.
However, while federal guidance recommends that individual fusion
centers develop and use performance measures as a baseline capability,
currently there are no standard measures to track performance across
fusion centers and demonstrate the impact of centers' operations in
support of national information sharing goals. According to PM-ISE and
DHS senior officials, the results of the nationwide assessment are not
intended to provide standard measures for fusion centers to
demonstrate the results they are achieving in meeting broader
information sharing goals as part of the national network. For
example, the assessment results are not intended to provide
information about how well centers disseminated federal information to
local security partners or how useful federal agencies found the
information that centers provided them.
The PM-ISE and DHS have recognized the value of implementing standard
performance measures across fusion centers. In its 2009 annual report
to Congress, the PM-ISE stated that among the activities the office
would undertake in 2009 and 2010 would be designing a set of
performance measures to demonstrate the value of a national integrated
network of fusion centers operating in accordance with the baseline
capabilities. Senior PM-ISE officials stated that the PM-ISE had not
begun this effort and is no longer planning to develop these
performance measures however, because DHS, as the lead agency in
coordinating federal support of fusion centers, is now responsible for
managing development of these performance measures. Further, in
response to a requirement under the 9/11 Commission Act, DHS stated in
its 2008 fusion center Concept of Operations that it will develop
qualitative and quantitative measures of performance for the overall
network of fusion centers and relevant federal entities, such as DHS
and DOJ.[Footnote 32] According to senior DHS officials, the agency
recognizes that developing these measures is important to demonstrate
the value of agency efforts in support of the ISE. However, these
officials stated that, while DHS has started collecting some
information that will help in developing such measures, the agency is
currently focusing on completing the nationwide assessment to gauge
the capabilities and gaps across fusion centers.[Footnote 33] As such,
these officials said that they have not defined next steps or target
timeframes for designing and implementing these measures. Standard
practices for program and project management state that specific
desired outcomes or results should be conceptualized, defined, and
documented in the planning process as part of a road map, along with
the appropriate steps and time frames needed to achieve those
results.[Footnote 34] By defining the steps it will take to design and
implement a set of standard measures to track the results and
performance across fusion centers and committing to a target timeframe
for completion, DHS could help ensure that centers and federal
agencies demonstrate the value of fusion centers' operations to
national information sharing goals and prioritize limited resources
needed to achieve and maintain those functions deemed critical to
support the national fusion center network.
Federal Agencies Are Providing Technical Assistance and Training to
Centers to Help Them Develop Privacy and Civil Liberties Policies and
Protections, and DHS Is Assessing the Status of These Protections:
DHS and DOJ are providing technical assistance to assist fusion
centers in developing privacy and civil liberties policies, and fusion
centers nationwide are in varying stages of completing their policies.
Additionally, fusion center officials we interviewed reported taking
steps to designate privacy/civil liberties officials and conduct
outreach about their policies. Further, DHS and DOJ are providing
training to fusion centers on implementing privacy and civil liberties
policies and protections that officials in the 14 centers we contacted
found helpful and wanted to be continued. DHS also has several efforts
underway to assess the status of fusion centers' privacy and civil
liberties protections, including updating the privacy and civil
liberties impact assessments to help ensure centers' protections are
implemented.
DHS and DOJ Are Providing Technical Assistance to Help Fusion Centers
Develop Privacy and Civil Liberties Policies, and Centers Nationwide
Are in Varying Stages of Completing Their Policies:
Because fusion centers are collecting and sharing information on
individuals, federal law establishes requirements and federal agencies
have issued guidelines for fusion centers to establish policies that
address privacy and civil liberties issues. Consistent with the 9/11
Commission Act, the Fusion Center Guidelines call for fusion centers
to develop, publish, and adhere to a privacy and civil liberties
policy. Further, the Baseline Capabilities provide more specific
guidance on developing such a policy and contain a set of recommended
procedures for fusion centers to include in their policies to ensure
that their centers' operations are conducted in a manner that protects
the privacy, civil liberties, and other legal rights of individuals
according to applicable federal and state law. According to federal
guidance, if centers adhere to the Baseline Capabilities, they in turn
will be in adherence with the ISE Privacy Guidelines. Further, DHS's
fiscal year 2010 HSGP funding guidance stipulates that federal funds
may not be used to support fusion-center-related initiatives unless a
fusion center has developed a privacy and civil liberties policy
containing protections that are at least as comprehensive as the ISE
Privacy Guidelines within 6 months of the grant award. According to
senior DHS Privacy officials, the fiscal year 2010 grants were awarded
in September 2010, so fusion centers will have until March 2011 to
have their policies reviewed and certified by the DHS Privacy Office.
If a fusion center does not have a certified privacy and civil
liberties policy by March 2011, according to DHS guidance, DHS grants
funds may only be used to support the development or completion of the
center's privacy and civil liberties protection requirements.
To facilitate fusion centers meeting federal requirements for their
privacy and civil liberties policies, DHS and DOJ have published a
template and established a process to review and certify the policies.
The template incorporates the primary components of the ISE Privacy
Guidelines and provides sample language for the center to use as a
starting point when drafting procedures for a privacy and civil
liberties policy. To ensure fusion centers comply with the
certification requirements in DHS's grant guidance, DHS and DOJ have
established a joint process to review and certify fusion centers'
privacy and civil liberties policies. First, a fusion center sends its
draft policy to a team of attorneys contracted by DOJ's Bureau of
Justice Assistance to provide a detailed review of the policy and
compare its language and provisions against language in the template.
After its review, DOJ submits the center's completed draft policy to
the DHS Privacy Office for a final review. This office reviews the
policy specifically to determine whether it contains protections that
are at least as comprehensive as the ISE Privacy Guidelines. If the
policy satisfies the ISE Privacy Guidelines, the DHS Chief Privacy
Officer sends written notification to the fusion center director
stating that the policy has been certified.
Using this guidance and technical assistance, fusion centers
nationwide are in varying stages of completing their privacy and civil
liberties policies. Specifically, 21 centers had certified policies;
33 centers had submitted policies; and 18 centers, while they have not
yet submitted their policies, were currently receiving technical
assistance, as of August 2010.[Footnote 35] Senior DHS Privacy
officials stated that they expect that all 72 fusion centers will have
submitted their policies and the federal agencies will be able to
review and certify them by the March 2011 deadline to avoid any limits
on grant funding. The 14 centers we contacted were at different stages
of the review process and reported that they found the template and
technical assistance to be helpful. Specifically, 7 centers had
certified policies, 6 had policies in the review process, and 1 center
was drafting its policy. Officials from all 14 of the fusion centers
stated that they used or were using the template to write their
policies, and that the template was a helpful guide to developing
their policies. In addition, officials in 13 of these centers that had
submitted their policies for review stated that the technical
assistance and guidance DHS and DOJ provided was integral in assisting
them draft their policies, especially a tracking sheet the DOJ review
team used to document comments, feedback, and recommendations.
Consistent with Recommended Federal Guidance, Fusion Center Officials
We Interviewed Have Taken Steps to Designate Privacy/Civil Liberties
Officials and Conduct Outreach:
The Baseline Capabilities recommend that fusion centers designate a
privacy/civil liberties official or a privacy committee to coordinate
the development, implementation, maintenance, and oversight of the
fusion center's privacy and civil liberties policies and procedures.
Furthermore, the Baseline Capabilities recommend that if the
designated privacy/civil liberties official is not an attorney, fusion
centers should have access to legal counsel with the appropriate
expertise to help clarify related laws, rules, regulations, and
statutes to ensure that centers' operations are adhering to privacy
and civil liberties protections. Officials from all 14 fusion centers
we contacted stated that they have taken steps to designate
privacy/civil liberties officials or form privacy committees. For
example, officials in 12 of these centers said that they designated a
single individual to serve as the privacy/civil liberties official;
officials in 1 fusion center selected two officials--attorneys from
the state's bureau of investigation and the state's department of
safety; and officials in 1 center created a privacy committee. For
more information on the qualifications of privacy/civil liberties
officials and the challenges associated with designating them, see
appendix I.
In addition to developing a privacy and civil liberties policy and
designating a privacy/civil liberties official, the Baseline
Capabilities recommend that fusion centers facilitate public awareness
of their policy by making it available to the public. Officials in 7
of 14 fusion centers we contacted described taking steps to make the
public aware of their fusion center's privacy and civil liberties
protections.[Footnote 36] For example, officials in 3 centers said
that they met with privacy and civil liberties advocacy groups to
elicit feedback about the centers' policies. For instance, one
official said that his fusion center shared its policy with a local
chapter of the ACLU, which reviewed it and made suggestions for
revisions, some of which the center implemented. Additionally,
officials from 6 of 14 fusion centers we interviewed said that they
posted their policies on their centers' Web sites or planned to post
them once they are certified. To assist centers with their outreach
efforts, DHS and DOJ officials stated that they are developing a
communications and outreach guidebook that will include information on
how fusion centers can communicate their mission, operations, and
privacy and civil liberties protections to state and local
governments, privacy advocacy groups, and the general population.
These officials added that this guidebook will recommend that fusion
centers post their privacy and civil liberties policies online to help
centers achieve the baseline capability of promoting transparency and
public awareness of their privacy and civil liberties protections.
Fusion Center Officials We Interviewed Reported That DHS's and DOJ's
Training on Privacy and Civil Liberties Protections Was Helpful and
Would Like It Continued after Their Policies Are Developed:
The 9/11 Commission Act requires DHS to establish guidelines for
fusion centers that include standards for fusion centers to provide
appropriate privacy training for all state, local, tribal, and private
sector representatives at the fusion center, in coordination with
DHS's Privacy Office and CRCL. To support fusion centers in this
effort, DHS, in partnership with DOJ and Global, has implemented a
three-part training and technical assistance program for fusion center
personnel consisting of (1) a "Training the Trainers" Program, where
representatives from DHS's Privacy Office and CRCL provide instruction
to fusion center privacy/civil liberties officials with the intent
that these officials then implement and teach the material to
personnel at their centers; (2) a Web site "Tool Kit" or Web portal,
which provides a single point of access to federal resources on
privacy training and contains training material and video resources
for state and local personnel on privacy topics; and (3) an On-site
Training Program, where representatives from DHS's Privacy Office and
CRCL travel to fusion centers, upon request, to provide training on
privacy, civil rights, and civil liberties issues. Appendix II
discusses this training program in greater detail.
Officials from all 14 fusion centers we contacted stated that DHS's
and DOJ's three-part training and technical assistance program was
helpful and expressed a need for continued training or guidance as
they continue to establish their privacy and civil liberties
protections. Fusion center officials cited several reasons why they
wanted continued training and updated guidance, including evolving
privacy laws, and the recognition that some privacy/civil liberties
officials may lack privacy-related expertise or backgrounds. In
addition to training, six fusion center officials expressed a need for
continued privacy guidance, such as briefings on examples of fusion
center privacy violations and how they were corrected. For example, an
official from one of these centers expressed a need for federal
guidance on how centers should deal with certain groups who make
threats against state or local governments, as these groups can span
across multiple states. Recognizing that fusion centers would like
continued federal training and guidance on privacy, senior officials
from DHS's Privacy Office and CRCL stated that they plan to continue
the DHS-DOJ joint three-part training and technical assistance program
over the next several years and to tailor its privacy, civil rights,
and civil liberties instruction to the needs of individual centers.
Further, senior DHS Privacy officials stated that a goal of the
training program is to develop multiyear relationships with
privacy/civil liberties officials in each center, helping to establish
a professional cadre of trained privacy/civil liberties officials
across the national fusion center network.
DHS Has Efforts Under Way to Assess the Status of Fusion Centers'
Privacy and Civil Liberties Protections:
Senior DHS Privacy officials stated that the review of fusion centers'
privacy and civil liberties policies is a first step in providing
ongoing federal oversight of the development of privacy and civil
liberties protections across fusion centers. These officials stated
that continued assessment and oversight--by the federal government and
by fusion centers themselves--is necessary to ensure that the
protections described in centers' policies are implemented in
accordance with all applicable privacy regulations, laws, and
constitutional protections. For example, a Director with DHS's Privacy
Office noted that a fusion center can, in theory, have a model privacy
and civil liberties policy but not correctly implement its
protections, increasing the risk of potential violations such as the
proliferation of inaccurate data. The 9/11 Commission Act requires
that the Secretary issue guidelines that contain standards that fusion
centers shall not only develop and publish a privacy and civil
liberties policy, but also that they adhere to it. Further, the
Baseline Capabilities recommend that fusion centers, as part of their
privacy and civil liberties protections, identify methods for
monitoring the implementation of their privacy and civil liberties
policies and procedures to incorporate revisions and updates. While
the 9/11 Commission Act does not dictate specific oversight mechanisms
for fusion center privacy and civil liberties protections, DHS, in
coordination with DOJ and the PM-ISE, has two efforts under way to
assess the status of these protections across fusion centers and is
taking steps to encourage centers to assess their own protections
going forward to identify any existing privacy and civil liberties
risks and develop strategies to mitigate them.
First, the nationwide assessment asks fusion centers to provide
information on each of the privacy-related baseline capabilities,
including information on the centers' designated privacy/civil
liberties officials, components of their privacy and civil liberties
policies and related protections, policy outreach efforts, and
training. Following that, validation teams are to review the self-
reported information in detail with each fusion center. According to
senior DHS officials, this information may help to identify any
critical gaps in privacy and civil liberties protections across the
national network of fusion centers. Senior DHS Privacy officials
stated that this information will be an important tool in developing a
longer-term oversight and assessment strategy to ensure that resources
are aligned to address these gaps.
Second, the 9/11 Commission Act, enacted in August 2007, requires,
among other things, that DHS submit (1) a report within 90 days of the
enactment of the Act containing a Concept of Operations for the Fusion
Center Initiative that includes a privacy impact assessment (PIA) and
a civil liberties impact assessment (CLIA) examining the privacy and
civil liberties implications of fusion centers, and (2) another PIA
and CLIA within 1 year of enactment.[Footnote 37] In general, these
assessments allow agencies to assess privacy and civil liberties risks
in their information sharing initiatives and to identify potential
corrective actions to address those risks. DHS published a PIA in
December 2008[Footnote 38] that identified several risks to privacy
presented by fusion centers, explained mitigation strategies for those
risks, and made recommendations on how DHS and fusion centers can take
additional action to further enhance the privacy interests of the
citizens in their jurisdictions.[Footnote 39] CRCL similarly published
a CLIA in December 2008 that evaluated fusion centers' impact on the
civil liberties of particular groups or individuals, outlined
procedures for filing a civil liberties complaint with DHS, and
highlighted the importance of training fusion center personnel on
civil rights and civil liberties.
DHS has not completed the second PIA or CLIA, which were to be issued
by August 2008. However, according to senior DHS Privacy officials,
the DHS Privacy Office is currently beginning to develop the updated
PIA. These officials said that they identified two key milestones when
determining when to begin work on the updated PIA. First, the
officials said that they wanted to complete the "training the
trainers" program for designated fusion center privacy/civil liberties
officials, which they did in July 2010. Second, officials said that
they delayed the start of the updated PIA to allow time for fusion
centers to develop their privacy and civil liberties policies--which
are to be certified by DHS by March 2011. Ensuring that centers had
completed, and were beginning to implement, their policies would help
in assessing updates to any risks identified in the initial PIA,
according to these officials. Senior DHS Privacy officials stated that
they have begun planning for the updated PIA, and that the assessment
will be published in 2011. These officials stated that the updated PIA
will be comprehensive in its scope, and include an assessment of the
steps fusion centers have taken to address the recommendations of the
2008 PIA, an analysis of federal and state government involvement in
fusion center privacy and civil liberties protections, a description
of what federal agencies have done and are doing to assist fusion
centers in establishing these protections, and a discussion about
related initiatives. These officials added that the updated PIA will
be a useful tool in assessing where fusion centers are in implementing
protections and addressing the 2008 PIA recommendations, and that the
information will be used to inform decisions on where to focus their
training and oversight efforts going forward.
Further, senior officials from CRCL stated that they have also begun
to develop the updated CLIA, and plan to publish the assessment in
2011. According to these officials, the updated CLIA will address
topics such as oversight of fusion centers, common issues and
challenges that fusion centers face in establishing civil rights and
civil liberties protections, examples of civil rights and civil
liberties complaints directed at fusion centers, and key issues
brought up during fusion center trainings. Given the assessments'
proposed scope and content, completing the updates to the PIA and CLIA
as required will help provide critical information to help ensure that
fusion centers are implementing privacy and civil liberties
protections and that DHS, and other federal agencies, are supporting
them in their efforts.
In addition to the nationwide assessment and updated PIA and CLIA, DHS
is also taking steps to encourage fusion centers to conduct their own
PIAs once their privacy and civil liberties policies are reviewed and
certified by the DHS Privacy Office as a means to oversee their own
privacy and civil liberties protections going forward. According to
senior DHS Privacy officials, individual PIAs are integral for a
fusion center's development and promote transparency by describing
fusion center activities and authorities more fully than the policies
can alone. To assist fusion centers in developing their own PIAs, DHS
and DOJ jointly published a guide to conducting PIAs specific to
state, local, and tribal information sharing initiatives, including a
template to lead policy developers through appropriate privacy risk
assessment questions.[Footnote 40] In addition to the template itself,
according to senior DHS Privacy officials, the importance of
conducting a fusion center PIA is conveyed through the three-part
training and technical assistance program where the steps the office
took to conduct its own PIA in 2008 are covered.
Conclusions:
Fusion centers--as the primary focal points for the two-way exchange
of information between federal agencies and state and local
governments--play a critical and unique role in national efforts to
combat terrorism more effectively. In light of their reliance on
fusion centers as critical components in the ISE, DHS, in
collaboration with DOJ and the PM-ISE, provide fusion centers with a
variety of support, including DHS grant funding, personnel, and
technical assistance. However, centers remain concerned about their
long-term sustainability and ability to meet and maintain the baseline
capabilities given the current federal funding sources and fiscally
constrained state and local economic environments. DHS's efforts to
require, rather than encourage, centers to target HSGP funding to
achieving and maintaining the baseline capabilities are aimed at
enabling fusion centers to close gaps in capabilities and develop more
accurate and specific investment justifications in competing for DHS
HSGP funding within their respective states. Further, by completing
the nationwide assessment and the required cost assessment of the
fusion center network, DHS can begin to address long-standing concerns
and questions about sustaining the fusion center network. If fusion
centers are to receive continued financial support, it is important
that centers demonstrate that they are providing critical information
that is helping the federal government protect against homeland
security and terrorist threats through a set of performance measures.
The PM-ISE and DHS have recognized the value of developing such
performance measures, but defining the steps it will take to design
and implement them and committing to a target time frame for
completion could help ensure that fusion centers and federal agencies
track fusion center performance in a manner that demonstrates the
value of fusion center operations within the ISE.
Recommendation for Executive Action:
To enhance the ability to demonstrate the results fusion centers are
achieving in support of national information sharing goals and help
prioritize how future resources should be allocated, we recommend that
the Secretary of Homeland Security direct the State and Local Program
Office, in partnership with fusion center officials, to define the
steps it will take to design and implement a set of standard
performance measures to show the results and value centers are adding
to the Information Sharing Environment and commit to a target
timeframe for completing them.
Agency Comments and Our Evaluation:
We requested comments on a draft of this report from the Secretary of
Homeland Security, the Attorney General, and the Program Manager for
the ISE on September 13, 2010. DHS, DOJ, and the PM-ISE did not
provide official written comments to include in our report. However,
in an email received September 23, 2010, a DHS liaison stated that DHS
concurred with our recommendation. DHS and DOJ provided written
technical comments, which we incorporated into the report, as
appropriate. In its technical comments, DHS stated that the agency has
recently started to develop a performance management framework to
demonstrate the value and impact of the national network of fusion
centers and is using the nationwide assessment data to support the
development of specific performance measures. With regard to target
timeframes, DHS stated that it is planning to (1) collaborate with
fusion center directors and interagency partners on the development of
these performance measures throughout the remainder of 2010 and (2)
provide performance management resources at the next National Fusion
Center Conference in March 2011. If properly implemented and
monitored, developing these standard performance measures should
enhance the ability to demonstrate the results fusion centers are
achieving in support of national information sharing goals and help
prioritize how future resources should be allocated.
DHS also noted that while the report emphasizes the importance of
sustainment funding for fusion centers, it does not recommend that DHS
develop a sustainment strategy to assist fusion centers in getting the
critical federal support they require. In our 2007 report, we
recommended that the federal government articulate such a sustainment
strategy for fusion centers--a recommendation with which DHS agreed
and that we consider to still be current and applicable. Specifically,
we recommended that the federal government define and articulate its
role in supporting fusion centers and determine whether it expects to
provide resources to centers over the long-term to help ensure their
sustainability. During our review, DHS described actions that it plans
to take that begin to build this strategy. More specifically, DHS said
that it plans to collect and assess cost data from centers--a
necessary first step to assessing the adequacy of current funding
mechanisms and level of the resources that DHS provides to fusion
centers. While a positive start, it will be important for DHS to
follow through on these plans and develop a sustainment strategy for
fusion centers. This would in turn be responsive to our recommendation.
We are sending copies of this report to the Secretary of Homeland
Security, the Attorney General, the Program Manager for the ISE, and
other interested congressional committees and subcommittees. In
addition, this report will be available at no charge on GAO's Web site
at [hyperlink, http://www.gao.gov].
If you or your staff have any questions concerning this report or wish
to discuss the matter further, please contact me at (202) 512-8777, or
larencee@gao.gov. Contact points for our Offices of Congressional
Relations and Public Affairs may be found on the last page of this
report. Key contributors to this report are listed in appendix III.
Signed by:
Eileen Regen Larence:
Director, Homeland Security and Justice Issues:
[End of section]
Appendix I: Qualifications of Fusion Center Privacy/Civil Liberties
Officials and Challenges Associated with Designating Them:
According to our interviews with officials in 14 fusion centers, the
individuals designated to be privacy/civil liberties officials varied
in terms of their position and legal experience. For example, in the
13 fusion centers with privacy/civil liberties officials, 3 of these
officials were center directors and 6 were analysts. The remaining 4
fusion centers designated attorneys from other bureaus or agencies
within their respective state or local governments, such as state
attorneys' general offices, as their privacy/civil liberties official.
These officials stated that because they either did not have the
appropriate legal expertise within the fusion center or had an
existing working relationship with a state bureau or agency,
designating officials outside their center as the privacy/civil
liberties official was the best option available in achieving this
baseline capability. Among the 9 centers that had designated fusion
center personnel as the privacy/civil liberties official, none of
these personnel was an attorney; however, officials in 3 of these
centers stated that their privacy/civil liberties officials had access
to other legal counsel within the state police agency or city police
department, for example, to help clarify laws and regulations
governing privacy and civil liberties protections and to assist with
the development of the centers' policies.
Fusion center officials we interviewed reported several challenges in
designating privacy/civil liberties officials, including concerns that
some officials had other operational duties at the fusion center or
may not have sufficient legal expertise to ensure implementation of
privacy and civil liberties protections. For example, of the nine
fusion centers with directors or analysts serving as the privacy/civil
liberties official, two had officials whose sole duty was to oversee
development of the center's privacy and civil liberties policy and
implementation of privacy and civil liberties protections. The other
seven privacy/civil liberties officials had other operational duties
at the fusion center. For instance, one fusion center's privacy/civil
liberties official also served as the center's critical infrastructure
and key resources analyst, which according to the center officials,
slowed the development of the center's privacy and civil liberties
policy. According to a Director with DHS's Privacy Office, it is
difficult to assess the effect of fusion center privacy/civil
liberties officials having responsibilities outside of their privacy-
related duties because the position is relatively new and this is
common. The official added that, in general, it is better to have the
designated privacy/civil liberties official be able to focus
exclusively on privacy-related duties. Additionally, officials in two
fusion centers were concerned that their privacy/civil liberties
officials may not have sufficient legal expertise to effectively
monitor privacy and civil liberties protections at the centers. For
example, one official stated that it was difficult to identify
personnel who, in addition to legal expertise, had experience in both
intelligence analysis and standard law enforcement practices which, in
his experience, were necessary skills for a center's privacy/civil
liberties official. Senior DHS Privacy officials said that, in
recognizing that fusion center privacy/civil liberties officials have
multiple duties and vary in terms of their experience and legal
expertise, DHS is committed to training and has taken steps to train
centers' designated officials and tailor DHS's privacy instruction to
the needs of individual fusion centers to help centers achieve this
baseline capability.
[End of section]
Appendix II: Privacy/Civil Rights and Civil Liberties Training and
Technical Assistance Program:
DHS, in partnership with DOJ and Global, has implemented a three-part
training and technical assistance program in support of fusion
centers' efforts to provide appropriate privacy, civil rights, and
civil liberties training for all state, local, tribal, and private
sector representatives at the fusion center:
* A "Training the Trainers" Program: In this 2010 program,
representatives from the DHS Privacy Office and CRCL provided
instruction to fusion center privacy/civil liberties officials at four
regional fusion center conferences that are held annually. These 1 1/2-
day classes were intended to provide privacy/civil liberties officials
with instruction on the requirements of a fusion center in
implementing privacy and civil liberties protections, the general
privacy law framework of the ISE, and instruction on how privacy/civil
liberties officials can best teach the material to fusion center
personnel at their centers. According to senior officials from CRCL,
privacy/civil liberties officials from 68 of 72 fusion centers have
received the training as of August 2010.[Footnote 41] According to
directors with the DHS Privacy Office and CRCL, the training delivered
at the conferences is specialized and tailored based on feedback the
offices receive from fusion center staff on key issues they would like
covered. Officials added that they obtain feedback at each training
session to also identify the privacy, civil rights, and civil
liberties-related subject areas in which privacy/civil liberties
officials may need more training. Participants in this program are
asked to teach the material to other fusion center personnel within
their centers within 6 months.
* A Web site "Tool Kit:" This tool-kit, or Web portal, provides a
single point of access to federal resources on privacy, civil rights,
and civil liberties training. The portal contains training material
and video resources for state and local personnel on a broad range of
privacy, civil rights, and civil liberties topics. The public Web
portal can be found at [hyperlink,
http://www.it.ojp.gov/PrivacyLiberty]. Furthermore, the Web portal
provides access to training resources on the requirements in 28 C.F.R.
part 23, which contains guidelines for law enforcement agencies
operating federally grant-funded criminal intelligence
systems.[Footnote 42] DHS HSGP guidance states that in fiscal year
2010, all fusion center employees are expected to complete the online
28 C.F.R. part 23 certification training. Officials from all 14 fusion
centers we contacted stated that fusion center staff have completed
the requisite online certification training, and that it was helpful
in making their staff aware of the regulations governing their
criminal intelligence systems. Furthermore, officials from 5 of these
14 fusion centers stated that they plan to require that fusion center
personnel complete the 28 C.F.R. part 23 certification training on an
annual basis to ensure that staff are well-versed on privacy
requirements.
* An On-site Training Program: For this program, representatives from
the DHS Privacy Office and CRCL travel to fusion centers, upon
request, to provide a full day of training on privacy, civil rights,
and civil liberties issues in the following core areas: civil rights
and civil liberties basics in the ISE, privacy fundamentals, cultural
competency, First Amendment issues in the ISE, and "red flags" when
reviewing or creating intelligence products. Additionally, fusion
centers have the option of selecting topics from a list of available
training modules, such as a civil rights and civil liberties case
scenario or an intelligence analysis product review exercise, and
receiving customized instruction based on the training needs of their
fusion center. Prior to the training, representatives from CRCL
conduct interviews with fusion center officials to learn about their
specific privacy, civil rights and civil liberties questions or
issues, review state constitution and relevant state law, and research
local media to identify the types of issues related to the work of the
fusion center that have raised concerns among citizens in their
jurisdictions. According to senior officials from the DHS Privacy
Office and CRCL, as of August 2010, 21 of 72 fusion centers have
received this on-site training. Officials we contacted in 3 fusion
centers stated that they had requested and received on-site training
on privacy, civil rights, and civil liberties protections from DHS
personnel at their fusion centers and that the training was helpful.
[End of section]
Appendix III: GAO Contact and Staff Acknowledgments:
GAO Contact:
Eileen R. Larence, (202) 512-8777 or larencee@gao.gov:
Acknowledgments:
In addition to the contact named above, Mary Catherine Hult, Assistant
Director; Hugh Paquette; Kevin Craw; Katherine Davis; John de Ferrari;
Matt Grote; David Plocher; Michael Silver; and Janet Temko made key
contributions to this report.
[End of section]
Footnotes:
[1] All 50 states have designated a primary fusion center to serve as
the focal point for information sharing. In general, these fusion
centers are statewide in jurisdiction and are operated by state
entities, such as the state police or bureau of investigation. In
addition, 22 major urban areas have established their own fusion
centers, which are regional centers that usually cover large cities
with substantial populations and numerous critical infrastructure
sites and may be operated by city or county law enforcement or
emergency management agencies. For purposes of this report, "fusion
centers" is used to refer to both state and major urban area fusion
centers.
[2] Pub. L. No. 108-458, 118 Stat. 3664, as amended. This act also
required, among other things, that the President designate a Program
Manager with governmentwide authority to manage the ISE, oversee its
implementation, assist in the development of ISE standards and
practices, and monitor and assess its implementation by federal
agencies. § 1016(f), 118 Stat. at 3667-68. The President was also
required to issue guidelines, in consultation with the Privacy and
Civil Liberties Oversight Board, which protect privacy and civil
liberties in the development of the ISE, and submit a report to
Congress describing the means that privacy and civil liberties will be
protected in the ISE. § 1016(d)(2)(A), (e)(8), 118 Stat. at 3665-67.
[3] Pub. L. No. 110-53, § 511, 121 Stat. 266, 317-324.
[4] GAO, High-Risk Series: An Update, [hyperlink,
http://www.gao.gov/products/GAO-09-271] (Washington, D.C.: January
2009).
[5] GAO, Homeland Security: Federal Efforts Are Helping to Alleviate
Some Challenges Encountered by State and Local Information Fusion
Centers, [hyperlink, http://www.gao.gov/products/GAO-08-35]
(Washington, D.C.: Oct. 30, 2007).
[6] DOJ did not provide comments on our recommendation.
[7] Global Justice Information Sharing Initiative, Baseline
Capabilities for State and Major Urban Area Fusion Centers, A
Supplement to the Fusion Center Guidelines (September 2008).
[8] We interviewed officials from the following 14 centers: Arkansas
State Fusion Center; Boston Regional Intelligence Center; Delaware
Information and Analysis Center; Georgia Information Sharing and
Analysis Center; Kansas City Regional Terrorism Early Warning Group,
Inter-Agency Analysis Center; Los Angeles Joint Regional Intelligence
Center/Los Angeles Regional Terrorism Threat Assessment Center; New
York State Intelligence Center; Northern California Regional
Intelligence Center; Oklahoma Information Fusion Center; Southern
Nevada Counterterrorism Center; Southeastern Wisconsin Threat Analysis
Center; Tennessee Fusion Center; Virginia Fusion Center; and the
Wisconsin Statewide Information Center.
[9] Specifically, we selected fusion centers whose directors were
identified as the chair or co-chair of a regional fusion center group.
DHS and DOJ established regional groups (i.e., western, central,
southeast, and northeast) in order to facilitate interaction among
fusion centers in the same area and communication with federal
partners.
[10] Program management standards we reviewed are reflected in the
Project Management Institute's The Standard for Program Management ©
(2006).
[11] The 2010 National Fusion Center Conference was sponsored by the
PM-ISE, DHS, and DOJ, among others. The conference brought together
close to 1,000 state, local, tribal, territorial, and federal partners
involved in state and major urban area fusion centers across the
country, including fusion center directors and senior leadership.
[12] In 2006, the PM-ISE issued the ISE Privacy Guidelines, which
outline guidelines and steps for ISE members to implement to protect
the information privacy rights and civil liberties of Americans.
[13] The Institute for Intergovernmental Research is a nonprofit
research and training organization that specializes in law
enforcement, juvenile justice, criminal justice, and homeland security
issues.
[14] In consultation with the PM-ISE and the Attorney General, as well
as the department's Privacy Officer, Officer for Civil Rights and
Civil Liberties, and Privacy and Civil Liberties Oversight Board.
[15] Global serves as a Federal Advisory Committee and advises the
U.S. Attorney General on justice information sharing and integration
initiatives. Global was created to support the broad exchange of
justice and public safety information and consists of organizations
and federal, state, and local agencies from a range of law
enforcement, judicial, and correctional disciplines.
[16] DHS's FEMA, specifically the Grant Programs Directorate within
Protection and National Preparedness, manages the grant process and
allocates these funds to state and local entities.
[17] The State Homeland Security Program supports the implementation
of State Homeland Security Strategies to address planning,
organization, equipment, training, and exercise needs to prevent,
protect against, respond to, and recover from acts of terrorism and
other catastrophic events. Each state receives a minimum allocation
under this program and additional funds are allocated based on the
analysis of risk and anticipated effectiveness. The Urban Area
Security Initiative program addresses the planning, organization,
equipment, training, and exercise needs of high-threat, high-density
urban areas, and assists them in building an enhanced and sustainable
capacity to prevent, protect against, respond to, and recover from
acts of terrorism. These funds are allocated on the basis of risk and
anticipated effectiveness to about 64 candidate areas.
[18] Protected information is information about U.S. citizens and
lawful permanent residents that is subject to information privacy or
other legal protections under the U.S. Constitution and federal laws.
[19] This figure is based on information reported to the PM-ISE by 52
of 72 fusion centers. Information was aggregated, but not verified, by
PM-ISE or GAO.
[20] While the average overall current fiscal year fusion center
budget was just under $2.1 million, the centers' budgets varied in
size. For example, 52 percent of the centers reported current fiscal
year budgets of $1 million or more, while 48 percent reported current
fiscal year budgets of less than $1 million.
[21] These figures are based on estimated annual operating budgets as
reported to us by officials from the 14 fusion centers we interviewed.
We did not independently verify the accuracy of these estimates.
[22] This information was reported to PM-ISE, DHS, and DOJ by fusion
center directors at the 2010 National Fusion Center Conference.
[23] Senior DHS officials stated that while these eight capabilities
have been identified as the most critical of the baseline capabilities
to achieve and maintain, the remaining capabilities are also to be
accomplished and will be subsequently prioritized.
[24] Each validation team consists of personnel from DHS, DOJ, and the
PM-ISE, as well as one fusion center director.
[25] According to a senior DHS I&A official, they have not determined
how often (e.g., annually or every other year) the assessment will be
conducted. They will make a determination using an after-action review
of the results of the assessment and the related costs of
administering it.
[26] [hyperlink, http://www.gao.gov/products/GAO-08-35].
[27] CRS, Fusion Centers: Issues and Options for Congress, RL34070
(Washington, D.C., Jan. 18, 2008).
[28] DHS OIG, DHS' Role in State and Local Fusion Centers Is Evolving,
OIG-09-12 (Washington, D.C., Dec. 10, 2008).
[29] An official from the remaining fusion center stated that, while
obtaining federal funding has not been challenging for his center, he
believed that funding across the national network of centers is a big
challenge and stated that, in his opinion, not having a dedicated
funding program has negatively affected fusion centers efforts to
effectively plan their operations.
[30] GAO, Executive Guide: Effectively Implementing the Government
Performance and Results Act, [hyperlink,
http://www.gao.gov/products/GAO/GGD-96-118] (Washington, D.C.: June
1996).
[31] Because we asked fusion center officials about baseline
capability gaps in general, not about gaps in performance metrics
specifically, not all fusion center officials provided information on
their status of developing performance measures.
[32] Ninety days after enactment of the 9/11 Commission Act, and
before it implemented the fusion center initiative, DHS was required,
in consultation with others, to submit a concept of operations for the
fusion center initiative that contained a developed set of
quantitative metrics to measure program output and a developed set of
quantitative instruments to assess the extent to which stakeholders
believe their needs are being addressed, among other things. Pub. L.
No. 110-53, § 511(d). The plan submitted did not contain the developed
set of metrics and acknowledged the Baseline Capabilities was the
framework from which measures of effectiveness for fusion centers
could be developed.
[33] For example, one senior DHS official stated that the agency has
begun collecting and aggregating information on fusion center "success
stories" as examples of the contributions centers provide to the ISE.
[34] Project Management Institute, The Standard for Program Management
© (2006).
[35] The 21 centers are: Ohio Strategic Analysis and Information
Center; Louisiana State Analytic & Fusion Exchange; Vermont Fusion
Center; Indiana Intelligence Fusion Center; Nevada Threat Analysis
Center; Austin Regional Intelligence Center; Iowa Fusion Center;
Georgia Information Sharing and Analysis Center; Statewide Terrorism
and Intelligence Center (Illinois); Oklahoma Information Fusion
Center; Washington State Fusion Center; Florida Fusion Center; Kansas
City Regional Terrorism Early Warning Group Interagency Analysis
Center; Houston Regional Information Sharing Center; Wisconsin
Statewide Information Center; Southern Nevada Counter-Terrorism
Center; California State Terrorism Threat Assessment Information
Center; Northern California Regional Intelligence Center; San Diego
Law Enforcement Coordination Center; Central California Intelligence
Center; and Los Angeles Joint Regional Intelligence Center.
[36] Because we asked fusion center officials about outreach and
training in general in establishing privacy and civil liberties
policies, protections, and plans, not about outreach to the public
specifically, not all fusion center officials provided information on
steps they may have taken in this particular area.
[37] According to DHS, the purpose of the State and Local Fusion
Center Concept of Operations (CONOPs) was to establish a framework for
a comprehensive, coordinated and consistent approach for outreach by
DHS to fusion centers. DHS published its CONOPs in December 2008.
[38] DHS, Privacy Impact Assessment for the Department of Homeland
Security State, Local, and Regional Fusion Center Initiative (Dec. 11,
2008).
[39] According to a Director with DHS's Privacy Office, the PIA was
not published within the 90-day time period stated in the 9/11
Commission Act because the CONOPs, in which the initial PIA was
required to be included, was itself not published until December 2008.
This official added that, in addition, within this 90 day time period,
many fusion centers were just beginning to establish their operations
and, similarly, federal efforts to support and provide guidance to
fusion centers on their privacy and civil liberties protections were
also in the early stages. By delaying issuance of the initial PIA
until December 2008, this official stated the DHS Privacy Office had
more time to assess the privacy implications of the fusion center
initiative.
[40] DHS and DOJ (Global), Guide to Conducting Privacy Impact
Assessments for State, Local, and Tribal Information Sharing
Initiatives.
[41] To train privacy/civil liberties officials from the fusion
centers who were not able to attend the regional conferences, CRCL
scheduled a fifth "Training the Trainers" session, which was held in
August 2010.
[42] The standards contained at 28 C.F.R. part 23 apply to federally
funded criminal intelligence systems. As described by the regulations,
because the intelligence data collected and exchanged could pose
potential threats to the privacy of individuals to whom the data
relates, guidelines are required. 28 C.F.R. § 23.2. Accordingly,
criminal intelligence sharing systems may only disseminate criminal
intelligence information to law enforcement agencies that agree to
follow procedures consistent with enumerated principles, such as
sanctions against unauthorized access and storing information such
that it cannot be modified without authorization, among others. 28
C.F.R. § 23.3.
[End of section]
GAO's Mission:
The Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting
its constitutional responsibilities and to help improve the performance
and accountability of the federal government for the American people.
GAO examines the use of public funds; evaluates federal programs and
policies; and provides analyses, recommendations, and other assistance
to help Congress make informed oversight, policy, and funding
decisions. GAO's commitment to good government is reflected in its core
values of accountability, integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each
weekday, GAO posts newly released reports, testimony, and
correspondence on its Web site. To have GAO e-mail you a list of newly
posted products every afternoon, go to [hyperlink, http://www.gao.gov]
and select "E-mail Updates."
Order by Phone:
The price of each GAO publication reflects GAO‘s actual cost of
production and distribution and depends on the number of pages in the
publication and whether the publication is printed in color or black and
white. Pricing and ordering information is posted on GAO‘s Web site,
[hyperlink, http://www.gao.gov/ordering.htm].
Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537.
Orders may be paid for using American Express, Discover Card,
MasterCard, Visa, check, or money order. Call for additional
information.
To Report Fraud, Waste, and Abuse in Federal Programs:
Contact:
Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]:
E-mail: fraudnet@gao.gov:
Automated answering system: (800) 424-5454 or (202) 512-7470:
Congressional Relations:
Ralph Dawn, Managing Director, dawnr@gao.gov:
(202) 512-4400:
U.S. Government Accountability Office:
441 G Street NW, Room 7125:
Washington, D.C. 20548:
Public Affairs:
Chuck Young, Managing Director, youngc1@gao.gov:
(202) 512-4800:
U.S. Government Accountability Office:
441 G Street NW, Room 7149:
Washington, D.C. 20548:
