INTL613Wk7

Office of the Director of National Intelligence (https://www.dni.gov/index.php)

 (intel_guide.html)

(intel guide html) 

INTRODUCTION

“State, local, and tribal governments are critical partners in securing and defending the United States from terrorism and other threats to the United States and its interests. Our

(intel_guide.html)

(intel guide html) 

national intelligence effort should take into account the responsibilities and requirements of State, local, and tribal governments and, as appropriate, private sector entities, when undertaking the collection and dissemination of information and intelligence to protect the United States.”

EXECUTIVE ORDER 12333

In the post-9/11 era, first responders have

incorporated protecting the Homeland against

terrorism into their daily mission. Law enforcement,

fire service, and emergency medical services

personnel play a vital role in detecting and

preventing attacks because of the nature of their

work, their frequent interaction with members of the

public, and the level of access their jobs provide.

People who hold these jobs often can identify

behaviors or activities that could signal a pending

terrorist attack; therefore, public safety personnel

must continue to report, according to the Nationwide

Suspicious Activity Reporting Initiative, observations

that raise reasonable suspicion.

The Intelligence Community routinely produces

information for public safety personnel that may help

first responders identify terrorist-related activities

and prevent, deter, or respond to terrorist attacks.

You can obtain this information through existing joint

partnerships and from Internet-based U.S.

Government information-sharing systems. It is

critical that first responders, who are entrusted with

keeping our citizens safe, be able to access,

understand, and use this information.

The Joint Counterterrorism Assessment Team

(JCAT)1 Intelligence Guide for First Responders was produced by first responders for first

responders and was designed to improve

information sharing among state, local, tribal, and

territorial jurisdictions and the federal government.

This reference aid will accomplish the following:

Highlight your role and responsibility as a

consumer of intelligence information

Demonstrate how to handle this information

and why it must be protected

Show you where to find this information and

how to gain access to Internet-based U.S.

Government systems

Help you understand and participate in the

Nationwide Suspicious Activity Reporting

Initiative

Provide an overview of the Intelligence

Community, the intelligence cycle, and the

(intel_guide.html)

(intel guide html) 

products available to you

Identify existing federal, state, local, tribal,

and territorial partnerships that you can use to

carry out your duties and responsibilities

1 JCAT consists of state, local, tribal, and territorial first responders and public safety professionals from around the country, working side by

side with federal intelligence analysts from the National Counterterrorism Center (NCTC), Department of Homeland Security (DHS), and

Federal Bureau of Investigation (FBI) to research, produce, and disseminate counterterrorism intelligence. We offer federal fellowship

opportunities to public safety professionals—law enforcement, emergency medical services, fire service, intelligence, homeland security, and

public health officials—from state, local, tribal, and territorial government agencies. For more information, please visit us at nctc.gov/jcat

(https://www.nctc.gov/jcat.html).

Abington Police Department, PA Albuquerque Police Department, NM Arlington Police Department, TX Atlanta Police Department, GA Aurora Police Department, CO Boston Police Department, MA City of Phoenix Fire Department, AZ Fairfax County Fire and Rescue Department, VA Federal Bureau of Investigation Fire Department City of New York, NY Florida Department of Health, FL Florida Highway Patrol, FL

Harris County Sheriff’s Office, TX Hennepin County Sheriff’s Office, MN Houston Fire Department, TX Illinois State Police, IL Indiana State Police, IN Las Vegas Metro Police Department, NV Los Angeles Police Department, CA Little River Band of Ottawa Indians, MI Little Rock Police Department, AR Maricopa County Department of Health, AZ Minneapolis Police Department, MN

National Counterterrorism Center Nebraska Health and Human Services, NE New Hanover County Sheriff’s Office, NC New Jersey State Police, NJ Oakland County Sheriff’s Office, MI Ohio Strategic Analysis and Information Center, OH Oneida Indian Nation Police, NY Orange County Sheriff’s Office, CA Philadelphia Police Department, PA Phoenix Police Department, AZ Seattle Fire Department, WA Simi Valley Police Department, CA

During 2007-16, the following jurisdictions were represented in JCAT and in the Interagency Threat Assessment and

Coordination Group (JCAT’s predecessor):

(intel_guide.html)

(intel guide html) 

U.S. Department of Homeland Security Union County Sheriff's Office, NC

Washington State Patrol, WA Washington D.C. Fire and EMS Department

Washington D.C. Metropolitan Police Department

HANDLING SENSITIVE BUT UNCLASSIFIED INFORMATION

“Our nation’s defense depends in part on the fidelity of those entrusted with our nation’s secrets.”

President Barack Obama, 2013

(intel_guide.html)

(intel guide html) 

Federal agencies routinely generate, use, store, and

share information that is sensitive enough to require

some level of protection. First responders should be

aware of the handling requirements for sensitive

information to ensure that only those who need it

can use it and only for its intended purpose.

Government agencies continue to use

dissemination control markings such as FOR

OFFICIAL USE ONLY, LAW ENFORCEMENT

SENSITITVE, PERSONALLY IDENTIFIABLE

INFORMATION AND SENSITIVE SECURITY

INFORMATION.

FOR OFFICIAL USE ONLY (FOUO) is not a

classification but one of the most widely used

dissemination control markings. Agencies

throughout the government typically, though not

consistently, use this marking to identify unclassified

but sensitive information that may or may not

otherwise be categorized by statute or regulation.

Unauthorized disclosure of this information could

negatively affect a person’s privacy or welfare, the

way federal programs are conducted, or other

programs or operations essential to the national or

other government interests.

Dissemination of FOUO information is typically

restricted to persons with a “need to know,” which is

defined as “the determination made by an

authorized holder of information that a prospective

recipient requires access in order to perform or

assist in a lawful and authorized governmental

function (that is, access is required for the

performance of official duties).” Other FOUO

requirements include the following:

FOUO information will not be disseminated in

any manner—orally, visually, or electronically

—to unauthorized personnel.

The holder of the information will comply with

access and dissemination restrictions.

The recipient of FOUO information will have a

valid need to know, and precautions will be

taken to prevent unauthorized individuals

from overhearing the conversation, observing

the materials, or otherwise obtaining the

information.

FOUO is used in the Intelligence Community to

mark unclassified official government information

that is withheld from public release until approved

for release by the originator. It can be used by all

agencies, and each agency can provide further

guidance on handling procedures.

INFORMATION LABELED FOUO OR WITH ANY

OTHER CONTROL MARKING NEEDS TO BE

SAFEGUARDED AND WITHHELD FROM PUBLIC

RELEASE UNTIL THE ORIGINATING AGENCY

CLARIFIES THE NATURE OF THE HANDLING

REQUIREMENTS OR APPROVES IT FOR PUBLIC

RELEASE.

LAW ENFORCEMENT SENSITIVE (LES) refers to

unclassified information originated by agencies with

law enforcement missions that may be used in

(intel_guide.html)

(intel guide html) 

criminal prosecution and requires protection against

unauthorized disclosure to protect sources and

methods, investigative activity, evidence, or the

integrity of pretrial investigative reports. Any law

enforcement agency employee or contractor

performing assigned duties may label information as

LES if he or she is authorized by department-

specific policy and directives.

LES is a content indicator and handling caveat that

indicates the information was compiled for law

enforcement purposes and contains operational law

enforcement information or information that would

reveal sensitive investigative techniques. You can

release or disclose LES information to foreign

persons, organizations, or governments only if you

have previous approval from the originating agency

and follow all Office of the Director of National

Intelligence foreign sharing agreements and

directives.

Agencies that originate LES information may

choose to disseminate the information they have

caveated by posting it on a website on a classified

network or on an unclassified virtual private network

with proper access controls. However, if the

originating agency chooses to disseminate the

information only on a point-to-point basis, the

warning statement must be expanded to include the

statement:

“Recipients are prohibited from subsequently posting the information marked LES on a website or an unclassified network.”

You cannot use information carrying the LES

warning statement in legal proceedings without first

receiving authorization from the originator. The

originating organization may authorize other sharing

of LES information (for example, with victims of a

crime) when the specific circumstances justify it. If

such a request is granted, the individual sharing the

information must educate the recipient on how the

information must be used and protected.

Unclassified LES information is withheld from public

release until approved for release by the originator.

PERSONALLY IDENTIFIABLE INFORMATION (PII) as defined in OMB Memorandum M-07-1616

refers to information that can be used to distinguish

or trace an individual’s identity, either alone or when

combined with other personal or identifying

information that is linked or linkable to a specific

individual. The definition of PII is not anchored to

any single category of information or technology.

Rather, it requires a case-by-case assessment of

the specific risk that an individual can be identified.

In performing this assessment, it is important for an

agency to recognize that non-PII can become PII

whenever additional information is made publicly

available in any medium and from any source that,

when combined with other available information,

could be used to identify an individual.

(intel_guide.html)

(intel guide html) 

SENSITIVE SECURITY INFORMATION (SSI) is a

specific category of sensitive but unclassified

information that is governed by federal law. SSI is

information obtained or developed which, if released

publicly, would be detrimental to transportation

security. SSI is not classified national security

information and is not subject to the handling

requirements governing such information, but is

subject to the handling procedures required by the

SSI Federal Regulation (49 CFR Part 1520).

Unauthorized disclosure of SSI may result in civil

penalties and other enforcement or corrective

actions.

GAINING ACCESS TO UNCLASSIFIED INFORMATION

(intel_guide.html)

(intel guide html) 

First responders can gain access to unclassified

information through several systems and websites

that require only that users perform homeland

security or law enforcement activities on behalf of a

state, local, tribal, or territorial government.

Strengthening SBU Information Sharing: Simplified Sign-On (SSO): Across the public safety

community, authorized personnel need to have

access to the right information at the right time to

perform their duties. First responders must draw on

complete information to make informed decisions

before responding to an emergency, threat, tip, or

lead. Independent organizations and their networks

and services have this mission-critical information,

but the Information Sharing Environment (ISE)

bridges the gaps to enable seamless discovery of

and access to information and services, including

readily accessible information about officer safety,

criminal intelligence, disaster coverage, and cyber

threats.

Single sign-on (SSO)—also known as simplified

sign-on—provides one of the underlying capabilities

that make discovery and access easier. With SSO,

users from one organization can gain access to

multiple information sets and services from other

organizations without needing to log in to different

networks or requiring manual intervention.

Operationalizing SSO has been a practical success

story in the Sensitive But Unclassified (SBU)

information-sharing arena. The members of the SBU

Working Group can easily discover and gain access

to mission services provided by other members of

the group.

The SBU Working Group currently includes four

core members: the DHS Homeland Security

Information Network (HSIN), the FBI Law

Enforcement Enterprise Portal (LEEP), Intelink, and

the Department of Justice grant–funded State and

Local Regional Information Sharing Systems

Program (RISSNet). These members have created

a trust network through operational and technical

agreements allowing users of one system to gain

access to the resources of another system more

seamlessly, responsibly, and securely than with

previous approaches.

In operation today, an authorized RISSNet user can

log on to RISSNet and gain access to resources on

RISSNet, LEEP, Intelink, and HSIN without having

to use another set of credentials or access method.

A LEEP user can log on to LEEP and use resources

in RISS and Intelink and so on. The goal is to take

advantage of the success of connecting

independent organizations to collaborate and share

information. This also includes organizations that

may not be formal members of the SBU Working

Group. Collaboration between LEEP and the

Chicago Police Department enabled police officers

to gain access to FBI’s information resources, as

well as the resources of other members of the SBU

Working Group—RISS, HSIN, and Intelink—by

using their existing login credentials.

(intel_guide.html)

(intel guide html) 

Efforts are under way to expand access to

additional services by identifying and providing

incentives for new members to be part of the trust

framework exemplified by the SBU Working Group.

This approach to sharing and exchanging

information among independent organizations

enables stronger intelligence that strengthens the

mission of the first responder community. Likewise,

the SBU Working Group promotes additional

information-sharing efforts, such as Security

Trimmed Federated Search that allows

organizations to share and gain access to

information and, at the same time, safeguard the

information by only returning results that the user

performing the search is authorized to see.

There is much more to be done, but SSO is real and

working today. If you have access to one of these

systems (HSIN, RISS, LEEP, Intelink), we

encourage you to explore the capabilities mentioned

above. For additional information, please visit

www.ise.gov.

Homeland Security Information Network (HSIN): (https://hsin.dhs.gov/) The DHS Office of

Intelligence and Analysis (I&A) continues to

strengthen support for the National Network of

Fusion Centers and for broader homeland security

and law enforcement partners. To offer partners at

all levels of government a forum for information

sharing and analytic collaboration, I&A partnered

with the Office of the Chief Information Officer to

support the Homeland Security State and Local

Intelligence Community of Interest transition to a

new technology platform—Homeland Security

Information Network (HSIN) Release 3 in 2013.

HSIN is a national, secure, and trusted web-based

portal for information sharing and collaboration

among federal, state, local, tribal, territorial, private-

sector, and international partners engaged in the

homeland security mission. HSIN provides secure,

real-time collaboration tools, including a virtual

meeting space, instant messaging, and document

sharing. HSIN allows partners to work together

instantly, regardless of their location, to

communicate, collaborate, and coordinate and is

made up of a growing network of sites called

Communities of Interest (COI). COIs are organized

by state organizations, federal organizations, or

mission areas, such as emergency management,

law enforcement, critical sectors, and intelligence.

Users can securely share within their communities

or reach out to other communities as needed using

HSIN (https://hsin.dhs.gov/).

HSIN-Intelligence (HSIN-Intel): HSIN-Intel is a COI

within HSIN. The purpose of HSIN-Intel is to provide

stakeholders across the Homeland Security

Enterprise a platform for effective and efficient

collaboration for tiered secure access to data,

analytic exchange, and timely information sharing

and situational awareness.

HSIN-Intel, as the designated unclassified

intelligence-sharing portal for DHS and its

homeland security partners, serves as the

(intel_guide.html)

(intel guide html) 

principal platform for consolidation and

interoperability with DHS information-sharing

portals. HSIN-Intel is the only federal portal

that provides intelligence information sharing

between DHS and its federal, state, local,

tribal, and territorial partners across the full

spectrum of homeland security missions.

HSIN-Intel COI membership is open to all

those who collaborate on homeland security–

related analytic issues, analysts, and

personnel from federal, state, local, tribal, and

territorial law enforcement and homeland

security communities, as well as the National

Network of Fusion Centers.

To request HSIN-Intel access, send an e-mail to the

HSIN-Intel team at HSIN.Intel@hq.dhs.gov with the

following information:

Name

Affiliated organization

Official/business e-mail address

Official/business phone number

Brief justification

Minimum eligibility requirements include the

following:

Be a U.S. citizen

Be a full-time, current employee (government

or contractor personnel) of a law

enforcement, criminal justice, emergency

responder, or homeland security federal,

state, local, tribal, or territorial government

agency engaged in seeking to detect, defeat,

or deter terrorist acts

Have a government e-mail address (or other

e-mail address approved by the state,

territory, or urban area point of contact and

the HSIN Intel Chief or designee)

If you would like access to other COIs, follow these

instructions:

From the main HSIN screen, hover over the

“About” menu

Click on “Communities.” Read through the

text and click on “Site Directory” to see other

COIs to which you may want to gain access

SitAware—The National Situation Awareness Room: (https://share.dhs.gov/sitaware) HSIN-

Intel contains within its utilities suite an online

conferencing, meeting, and intelligence-sharing

application called Connect, which is a program

created by Adobe to host online meetings, briefings,

and training sessions in real time. Dedicated to

providing updated intelligence and related

information briefings during periods of regional crisis

or during a national emergency, the HSIN Situation

Awareness Room (SitAware) provides a meeting

and information portal for analytic staff and law

enforcement personnel to monitor and post relevant

items during an incident of national or regional

significance. SitAware is already established as a

room within the HSIN-Connect portal to assist in

responding to large-scale incidents, significantly

(intel_guide.html)

(intel guide html) 

elevated terrorist threats, or large national events,

such as a general election, large sporting event, or

inauguration. You can use your HSIN user name

and password to log in to the site at SitAware

(https://share.dhs.gov/sitaware).

If you want to use the National Situation Awareness

Room on your mobile device, follow these

instructions:

Download the Adobe Connect mobile

application to your smartphone

Type the following into the application

address: share.dhs.gov/sitaware

Use your HSIN user name and password to

log in

Intelink-U: (https://www.intelink.gov) Intelink-U is

the Intelligence Community’s SBU information-

sharing network. Content is provided by the

Intelligence Community, other government

agencies, foreign partners, academics, and open

sources. Individuals with federal, state, local, tribal,

and territorial homeland security and law

enforcement responsibilities can request accounts

at www.intelink.gov (https://www.intelink.gov)

Law Enforcement Enterprise Portal (LEEP): (https://www.cjis.gov) You can use LEEP on any

computer with an internet connection. This official

government information-sharing and electronic-

communications portal currently provides SSO

access to LEO, RISSNet, the Joint Automated

Booking System (JABS), the National Gang

Intelligence Center (NGIC), eGuardian, the Internet

Crime Complaint Center (IC3), the National Data

Exchange (N-DEx), Intelink, and the U.S.

Department of Justice myFX. You can find LEEP at

www.cjis.gov (https://www.cjis.gov).

Law Enforcement Online (LEO): Law Enforcement

Online (LEO) is a secure, Internet-based

information-sharing system for agencies around the

world involved in law enforcement, first response,

criminal justice, counterterrorism, and intelligence.

With LEO, members can access or share SBU

information anytime and anywhere, from any

computer system with an Internet connection. This

official government information-sharing and

electronic-communications platform provides FBI,

joint FBI and DHS, NCTC, and non–federally

produced intelligence products at the LES/FOUO

level. LEO also provides members access to tactical

tools, such as the Virtual Command Center, ORION,

Trax, and the National Alert System. Federal, state,

local, tribal, and territorial personnel performing

homeland security or law enforcement duties and

foreign law enforcement personnel can request

accounts.

Here are just a few examples of what is available to

all levels of law enforcement, criminal justice, and

public safety communities on LEO:

Virtual Command Center (VCC): A real-time

situational awareness tool that can help law

enforcement and other authorities during

(intel_guide.html)

(intel guide html) 

many situations, such as special public

events, warrant sweeps, investigations, and

natural disasters.

Law Enforcement Online Special Interest

Groups (LEOSIGs): Allow members to

participate in COIs to securely share

information and receive specialized training.

Virtual Office: Enables agencies to store and

retrieve information needed on scene and

gain access to that information from any

Internet connection, eliminating the need for

an officer to travel to a physical office.

Active Shooter Initiative: The FBI Active

Shooter Resources page provides a

clearinghouse for materials available to law

enforcement agencies and other first

responders around the country to ensure

preparedness for active-shooter cases and

mass-casualty incidents.

Thanks to LEEP, access to LEO has been

streamlined, and you can find critical law

enforcement information in one location. In addition

to the individual accounts that LEO grants, LEEP

can provide access to entire law enforcement

agencies, which means every member of an agency

can have access to LEEP’s many services.

OpenSource.gov: (https://www.opensource.gov) The Open Source Center (OSC) and its partners

provide timely and tailored translations, reporting,

and analysis on foreign policy and national security

issues. The website features reports and

translations from thousands of publications,

television and radio stations, and Internet sources

around the world. Also among the site’s holdings are

a foreign video archive and fee-based commercial

databases for which OSC has negotiated licenses.

OSC’s reach extends from hard-to-find local

publications and video to reports from some of the

most renowned thinkers on national security issues

inside and outside the U.S. Government. Federal,

state, and local government employees and

contractors can apply for an account at

OpenSource.gov (https://www.opensource.gov).

Regional Information Sharing Systems Network (RISSNET): (https://www.riss.net) RISSNet

facilitates information sharing within the law

enforcement community to combat criminal activities

and conspiracies that take place in several

jurisdictions. It contains six multistate intelligence

centers (RISS Intelligence Centers), and members

include federal, state, local, tribal, and territorial law

enforcement agencies. You can request access

through the regional RISS Intelligence Centers or

apply online at www.riss.net (https://www.riss.net)

Technical Resources for Incident Prevention (TRIPwire): (https://tripwire.dhs.gov) TRIPwire is

DHS’s 24/7 online, secure, collaborative

information-sharing network for bomb squad, law

enforcement, and other emergency services

personnel to learn about current terrorist improvised

explosive device (IED) tactics, techniques, and

procedures, including design and emplacement

(intel_guide.html)

(intel guide html) 

considerations. TRIPwire combines expert analyses

and reports with relevant documents, images, and

videos gathered directly from terrorist sources to

help law enforcement officials anticipate, identify,

and prevent IED incidents. You can find more

information at www.tripwire.dhs.gov

(https://www.tripwire.dhs.gov), or by contacting the

Office for Bombing Prevention at OBP@dhs.gov or

through the TRIPwire help desk at help@tripwire-

dhs.net.

UNDERSTANDING ESTIMATIVE LANGUAGE

THE USE OF JUDGMENTS

(intel_guide.html)

(intel guide html) 

When the Intelligence Community (IC) uses phrases

such as “we judge” or “we assess”—used

synonymously—as well as “we estimate,” “likely,” or

“indicate,” the IC is trying to convey an analytic

assessment or judgment. These assessments,

which analysts must base on incomplete or at times

fragmentary information, are not facts, proof, or

knowledge. Analysts base some judgments directly

on collected information; others rest on

assessments that serve as building blocks. In either

type of judgment, the IC does not have “proof” that

shows something to be a factor that definitively links

two items or issues.

Intelligence judgments pertaining to likelihood reflect

the community’s sense of the probability of a

development or event. The IC does not intend the

term “unlikely” to imply that an event will not

happen. It uses “probably” and “likely” to indicate

that there is a greater than even chance. The IC

uses phrases such as “we cannot dismiss,” “we

cannot rule out,” and “we cannot discount” to reflect

an unlikely—or even remote—event whose

consequences are such that it warrants mentioning.

Words such as “may be” and “suggest” are used to

reflect situations in which the IC cannot assess the

likelihood generally because relevant information is

nonexistent, sketchy, or fragmented.

In addition to using words within a judgment to

convey degrees of likelihood, the IC also ascribes

“high,” “moderate,” or “low” confidence levels

according to the scope and quality of information

supporting analytic judgments.

HIGH CONFIDENCE generally indicates that

the IC’s judgments are based on high-quality

information or that the nature of the issue

makes it possible to develop a solid

judgment.

MODERATE CONFIDENCE generally means

that the information could be interpreted in

various ways, that the IC has alternative

views, or that the information is credible and

plausible but not corroborated sufficiently to

justify a higher level of confidence.

LOW CONFIDENCE generally means that

the information is scant, questionable, or very

fragmented, so it is difficult to make solid

analytic inferences; it could also mean that

the IC has significant concerns about or

problems with the sources.

(intel_guide.html)

(intel guide html) 

REPORTING SUSPICIOUS ACTIVITY WITH A NEXUS TO TERRORISM

“We will continue to integrate and leverage state and major urban area fusion centers that have the capability to share classified information and implement an integrated approach to our counterterrorism information system to ensure that the analysts, agents, and officers who protect us have access to all relevant intelligence throughout the government. We are improving information sharing and cooperation by linking networks to facilitate federal, state, and local capabilities to seamlessly exchange messages and information, conduct searches, and collaborate.”

National Security Strategy, December 2012

(intel_guide.html)

(intel guide html) 

Because of the nature of their work, the more than

800,000 law enforcement officers and 1.2 million

firefighters in the U.S. are positioned to identify

activities that may be associated with terrorism. In

many instances, information based on suspicious

behavior has led to the disruption of a terrorist

attack, the arrest of individuals intending to do harm,

or the corroboration of existing intelligence. It is of

utmost importance that information on suspicious

activities be shared with and between federal, state,

local, tribal, territorial, and private-sector partners.

SUSPICIOUS ACTIVITY REPORTS (SARS)

SHOULD BE MADE AVAILABLE TO THE JOINT

TERRORISM TASK FORCES (JTTFS) AND TO

YOUR LOCAL AREA FUSION CENTERS IN A

TIMELY MANNER.

The Nationwide Suspicious Activity Reporting Initiative (NSI): The NSI is a collaborative effort led

by the U.S. Department of Homeland Security

(DHS) and the Federal Bureau of Investigation (FBI)

in partnership with state, local, tribal, and territorial

law enforcement and hometown partners. The NSI

provides law enforcement and homeland security

agencies with another tool to help prevent terrorism

and other related criminal activity by establishing a

national capacity for gathering, documenting,

processing, analyzing, and sharing terrorism-related

information.

THE PROTECTION OF PRIVACY, CIVIL RIGHTS,

AND CIVIL LIBERTIES (P/CRCL) IS PARAMOUNT

TO THE SUCCESS OF THE NSI. GIVEN THIS

IMPORTANCE, THE NSI HAS WORKED WITH

VARIOUS ADVOCACY GROUPS AND OTHER

STAKEHOLDERS TO DEVELOP PROTECTIONS

THAT, WHEN CONSOLIDATED, MAKE UP A

COMPREHENSIVE NSI PRIVACY PROTECTION

FRAMEWORK. THESE EFFORTS HAVE SERVED

AN IMPORTANT ROLE IN SUCCESSFULLY

SHAPING NSI POLICIES AND PROCESSES.

What Is an Information Sharing Environment SAR (ISE-SAR) and Why Is It Important? The

Information Sharing Environment (ISE)–SAR

Functional Standard v.1.5.5 defines suspicious

activity as “observed behavior reasonably indicative

of pre-operational planning associated with

terrorism or other criminal activity.” This definition

was developed after critical input from several

privacy, civil rights, and civil liberties advocacy

groups. The SAR process is critical to sharing

information about suspicious activity with a potential

nexus to terrorism, which can help prevent terrorist

attacks and other related criminal activity from

occurring.

Online ISE-SAR Training for Law Enforcement and Hometown Security Partners: The NSI

training strategy is a multifaceted approach

designed to increase the effectiveness of state,

local, and tribal law enforcement and public safety

professionals and other frontline partners in

(intel_guide.html)

(intel guide html) 

identifying, reporting, evaluating, and sharing pre-

incident terrorism indicators to prevent acts of

terrorism. The SAR Line Officer Training and each

sector-specific SAR Hometown Security Partners

Training discuss how to report identified suspicious

activity to the proper authorities while maintaining

the protection of citizens’ privacy, civil rights, and

civil liberties. Online training is available on the NSI

website (https://nsi.ncirc.gov/training_online.aspx)

and includes:

Scenarios to help illustrate the benefit and

importance of suspicious activity reporting

Descriptions of SAR-related behaviors and

indicators

Ten Ways To Integrate SARs Into Your Agency’s Operations

RECOGNIZE the importance of SARs,

understand your role in the SAR process, and

know that your involvement makes a

difference. Strong leadership is an essential

element. Gain support from personnel,

leaders, and policymakers both internally and

externally.

DEVELOP a data collection process and a

secure standardized reporting format for

sharing suspicious activity. Review other

agencies’ SAR process missions/standard

operating procedures to better understand the

process and identify promising practices.

Define and communicate trends in terrorism-

related activity, geographically specific threat

reporting, dangers to critical infrastructure,

and general situational awareness.

ADOPT common national standards to

enhance your capability to quickly and

accurately analyze suspicious activity data,

such as the ISE-SAR Functional Standard,

the National Information Exchange Model,

and the records management system and

computer-aided dispatch functional

standards.

INCORPORATE appropriate guidelines and

concepts into your operations, such as the

National Criminal Intelligence Sharing Plan,

the Fusion Center Guidelines, the Findings

and Recommendations of the SAR Support

and Implementation Project, and privacy and

civil liberties templates. Use these guidelines

to establish and integrate the SAR process.

IMPLEMENT and adhere to your agency’s

privacy policy, and ensure that the privacy,

civil rights, and civil liberties of citizens are

protected. Evaluate your privacy policy and

update it, if necessary, to ensure that it

specifically addresses gathering,

documenting, processing, and sharing

information regarding terrorism-related

criminal activity. Ensure that the privacy policy

is transparent, and communicate the policy to

the public and stakeholders.

(intel_guide.html)

(intel guide html) 

TRAIN all agency personnel on the SAR

process, and institutionalize it within your

agency. Ensure that law enforcement and

public safety personnel understand the SAR

process and what internal policies or

protocols exist to share appropriate

information. Familiarize yourself with

available training classes to enhance

capabilities, such as the NSI training

programs available at nsi.ncirc.gov

(https://nsi.ncirc.gov) or the State and Local

Anti-Terrorism Training (SLATT®) Program

available at www.SLATT.org

(https://www.SLATT.org).

INSTITUTIONALIZE the gathering of

suspicious activity information at the street

level, and standardize the reporting of such

data so that it may be shared with the JTTF

and other appropriate public safety partners,

such as your criminal intelligence unit or the

state or regional fusion center. Once your

agency’s SAR process has been developed,

continual improvements will ensure the

integrity and institutionalization of the process

within your agency.

EDUCATE citizens, businesses, and partners

on suspicious activity reporting and how to

report activity to the appropriate officials.

Consider instituting a Building Communities

of Trust (BCOT) program to engage

community leaders in your efforts. Guidance

on how to establish a BCOT program is

available here

(https://nsi.ncirc.gov/documents/BCOT_Fact_Sheet.pdf).

Develop outreach materials to educate the

public on recognizing and reporting behaviors

and incidents that point toward terrorism or

other criminal activity. Existing SAR

awareness training programs, such as NSI’s

Hometown Security Partners training

programs available at nsi.ncirc.gov

(https://nsi.ncirc.gov/training_online.aspx),

can be used to educate those partners with

missions similar to law enforcement.

PARTNER with other law enforcement, public

safety, private-sector, and state or major

urban area fusion centers. Foster interagency

collaboration to maximize resources and

create an effective and efficient information-

sharing environment.

CONNECT to a major information-sharing

network, such as RISSNet, LEO, or HSIN.

Take advantage of proven and trusted

technology to share information,

communicate, and gain access to additional

resources.

FOR ADDITIONAL INFORMATION GO TO:

NSI.NCIRC.GOV (HTTPS://NSI.NCIRC.GOV).

The nationwide “If You See Something, Say Something™” public awareness campaign is a

simple and effective program to raise public

awareness of indicators of terrorism and terrorism-

(intel_guide.html)

(intel guide html) 

WHAT IS INTELLIGENCE?

related crime and to emphasize the importance of

reporting suspicious activity to the proper local law

enforcement authorities. DHS launched the

campaign in conjunction with NSI to train members

of state and local law enforcement to recognize

behaviors and indicators related to terrorism and

terrorism-related crime, standardize how those

observations are documented and analyzed, and

ensure the sharing of those reports with the FBI-led

JTTFs for further investigation and fusion centers for

analysis. A critical element of the DHS mission is to

ensure that the privacy, civil rights, and civil liberties

of persons are not diminished by our security efforts,

activities, and programs. Consequently, the “If You

See Something, Say Something™” campaign

respects privacy, civil rights, and civil liberties by

emphasizing behavior, rather than appearance, in

identifying and reporting suspicious activity.

FOR MORE INFORMATION, PLEASE GO TO:

WWW.DHS.GOV (HTTPS://WWW.DHS.GOV/IF-

YOU-SEE-SOMETHING-SAY-SOMETHING).

(intel_guide.html)

(intel guide html) 

“Intelligence includes the organizations, capabilities, and processes involved in collection, processing, exploitation, analysis, and dissemination of information or finished intelligence. Intelligence products provide users with the information that has been collected and analyzed based on their requirements.”

23 October 2013 Edition of Joint Pub 2-0, Joint Intelligence

THE INTELLIGENCE COMMUNITY USES FIVE BASIC INTELLIGENCE DISCIPLINES

Geospatial intelligence (GEOINT) refers to the

exploitation and analysis of imagery, imagery

intelligence (IMINT), and geospatial information to

describe, assess, and visually depict physical

features and geographically referenced activities on

the Earth.

Human intelligence (HUMINT) is intelligence

derived from information collected and provided by

human sources. This information includes overt data

collected by personnel in diplomatic and consular

posts as well as otherwise unobtainable information

collected via clandestine sources, debriefings of

foreign nationals and U.S. citizens who travel

abroad, official contacts with foreign governments,

and direct observation.

Measurement and signature intelligence (MASINT) is technically derived data other than

imagery and signals intelligence (SIGINT). The data

is analyzed and results in intelligence that locates,

identifies, or describes distinctive characteristics of

targets. It employs a broad group of disciplines

including nuclear, optical, radio frequency,

acoustics, seismic, and materials sciences.

Examples include the distinctive radar signatures of

specific aircraft systems or the chemical

compositions of air and water samples.

Open-source intelligence (OSINT) is produced

from publicly available information collected,

exploited, and disseminated in a timely manner to

an appropriate audience to address a specific

intelligence requirement. OSINT draws from a wide

variety of information and sources, including the

following:

Mass media—newspapers, magazines,

radio, television, and computer-based

information.

Public data—government reports, official

data such as budgets and demographics,

(intel_guide.html)

(intel guide html) 

hearings, legislative debates, press

conferences, speeches, directories,

organization charts, marine and aeronautical

safety warnings, environmental impact

statements, contract awards, and required

financial disclosures.

Gray literature (a.k.a. grey literature)—open-

source material that usually is available

through specialized access for a specific

audience; can include, but is not limited to,

research reports, technical reports, economic

reports, trip reports, working papers,

discussion papers, unofficial government

documents, proceedings, preprints, studies,

dissertations and theses, trade literature,

market surveys, and newsletters; cuts across

scientific, political, socioeconomic, and

military disciplines.

Observation and reporting—significant

information not otherwise available that is or

has been provided by amateur airplane

spotters, radio monitors, and satellite

observers, among many others; availability of

worldwide satellite photography, often high

resolution, on the Internet has expanded

open-source capabilities into areas formerly

available to major intelligence services only.

Signals intelligence (SIGINT) is gathered from

data transmissions, including communications

intelligence (COMINT), electronic intelligence

(ELINT), and foreign instrumentation signals

intelligence (FISINT). SIGINT includes both the raw

data and the analysis of the data.

COMINT is the capture of information for the

purposes of tracking communications

patterns and protocols (traffic analysis),

establishing links between

intercommunicating parties or groups, or

analyzing the meaning of communications.

FISINT is information derived from the

intercept of foreign electromagnetic emissions

associated with the testing and operational

deployment of non-U.S. aerospace, surface,

and subsurface systems including, but not

limited to, telemetry, beaconry, electronic

interrogators, and video data links.

ELINT is information derived primarily from

electronic signals that do not contain speech

or text (which are considered COMINT). The

most common sources of this type of

information are radar signals.

(intel_guide.html)

(intel guide html) 

WHAT NATIONAL INTELLIGENCE CAN AND CANNOT DO

“Information on its own may be of utility to the commander, but when related to other information about the operational environment and considered in the light of past experience, it gives rise to a new understanding of the information, which may be termed ‘intelligence.’”

23 October 2013 Edition of Joint Pub 2-0, Joint Intelligence

INTELLIGENCE INFORMATION CAN BE AN EXTREMELY POWERFUL TOOL

(intel_guide.html)

(intel guide html) 

First responders will find national intelligence

information most useful when they have a clear

understanding of what it can and cannot do. While

laws, policies, capabilities, and standards are

constantly changing, these general guidelines can

help first responders make the most of this

resource.

What National intelligence can do

National intelligence can provide the following:

Decision advantage, by presenting

information and analysis that can improve the

decisionmaking process for consumers of

intelligence and partners while hindering that

of our enemies

Warning of potential threats

Insight into key current events

Situational awareness

Long-term strategic assessments on issues of

ongoing interest

Pretravel security overviews and support

Reports on specific topics, either as part of

ongoing reporting or upon request for short-

term needs

Knowledge about persons of interest

What National intelligence cannot do

Realistic expectations will help consumers of

intelligence fill their intelligence needs, but national

intelligence cannot do the following:

Predict the future. Intelligence can provide

assessments of probable scenarios or

developments, but there is no way to predict

what will happen with absolute certainty.

Violate U.S. law. IC activities must be

consistent with all applicable laws and

executive orders, including, the United States

Constitution, the National Security Act of

1947, as amended; the Foreign Intelligence

Surveillance Act; the Intelligence Reform and

Terrorism Prevention Act; the Privacy Act of

1974; the Detainee Treatment Act; the

Homeland Security Act of 2002, as amended;

Executive Order 12333; and the Military

Commission Act.

ALL ACTIVITIES OF THE IC ARE SUBJECT TO

EXTENSIVE AND RIGOROUS OVERSIGHT BOTH

WITHIN THE EXECUTIVE BRANCH AND BY THE

LEGISLATIVE BRANCH, AS REQUIRED BY THE

NATIONAL SECURITY ACT OF 1947, AS

AMENDED.

(intel_guide.html)

(intel guide html) 

THE INTELLIGENCE COMMUNITY

“The Intelligence Community exists to provide political and military leaders with the greatest possible decision advantage. We understand, now more than ever, that the best way to accomplish our goal is thorough integration of all national intelligence capabilities.”

James R. Clapper, Director of National Intelligence

THE U.S. INTELLIGENCE COMMUNITY The Intelligence Community (IC) is a coalition of 17

agencies and organizations within the Executive

Branch (as defined by the National Security Act of

1947, as amended) that work both independently

and collaboratively to gather the intelligence

necessary to conduct foreign relations and protect

national security. It includes other elements of the

government that may be designated by the

(intel_guide.html)

(intel guide html) 

President or jointly by the Director of National

Intelligence and the head of the department or

agency concerned. The IC’s primary mission is to

collect and convey essential information the

President and members of the policymaking, law

enforcement, and military communities require to

execute their appointed duties. Agencies such as

the Central Intelligence Agency, Defense

Intelligence Agency, and National Security Agency

perform intelligence as their primary function, while

other such as the Departments of State and

Defense perform intelligence duties in addition to

other primary functions. Some agencies focus on

specific problem sets, use selected intelligence

disciplines, or support a primary customer set, but

their overall mission remains the same—to protect

the U.S. and its interests.

The activities of the IC include the following:

Collection of information needed by the

President, the National Security Council, the

Secretaries of State and Defense, and other

Executive Branch officials for the

performance of their duties and

responsibilities

Production and dissemination of intelligence

Collection of information concerning, and the

conduct of activities to protect against,

intelligence activities directed against the

U.S., international terrorist and international

narcotics activities, and other hostile activities

directed against the U.S. by foreign powers,

organizations, persons, and their agents

Special activities

Administrative and support activities within

the U.S. and abroad necessary for the

performance of authorized activities

Such other intelligence activities as the

President may direct from time to time

The IC comprises the following 17 agencies and

organizations:

Central Intelligence Agency

Defense Intelligence Agency

Department of Energy, Office of Intelligence

Department of Homeland Security, Office of

Intelligence and Analysis

Department of State, Bureau of Intelligence and

Research

Department of the Treasury, Treasury Office of

Terrorism and Financial Intelligence

Drug Enforcement Administration, Office of National

Security Intelligence

Federal Bureau of Investigation

National Geospatial-Intelligence Agency

National Reconnaissance Office

National Security Agency

Office of the Director of National Intelligence

(intel_guide.html)

(intel guide html) 

THE INTELLIGENCE CYCLE

U.S. Air Force, Air Force Intelligence

U.S. Army, Army Intelligence

U.S. Coast Guard, Coast Guard Intelligence

U.S. Marine Corps, Marine Corps Intelligence

U.S. Navy, Office of Naval Intelligence

The term intelligence cycle refers to the five-step

process of developing raw information into finished

intelligence for policymakers, military commanders,

and other consumers to use in making decisions.

The cycle is highly dynamic and never ends, and it

often includes a sixth stage of evaluation,

sometimes referred to as feedback. Evaluation

occurs for each of the stages individually and for the

cycle as a whole.

STAGES OF THE INTELLIGENCE CYCLE:

(intel_guide.html)

(intel guide html) 