HLSS613Wk6%
Rawono1
817528.pdf
2017 National Network of Fusion Centers
October 2018
Final Report
2017 National Network of Fusion Centers Final Report Page i
Table of Contents
Executive Summary ........................................................................................................................................................................... ii Methodology ................................................................................................................................................................ ......................................... ii Findings ................................................................................................................................................................................................ .................. ii Recommendations ................................................................................................................................................................ .............................. ii
Introduction ......................................................................................................................................................................................... 1 Purpose ................................................................................................................................................................................................ ................... 1 Background ................................................................................................................................................................ ........................................... 1 2017 Snapshot ................................................................................................................................................................ ..................................... 2
Key Findings & Recommendations .............................................................................................................................................. 3
Data Sources and Methodology..................................................................................................................................................... 6 Fusion Center Profiles ...................................................................................................................................................................................... 6 Key Customer Survey ........................................................................................................................................................................................ 6 Partner Agency Data ................................................................................................................................................................ .......................... 7 Fusion Center Communications Drill ......................................................................................................................................................... 8
Findings ................................................................................................................................................................................................. 9 Hours of Operations ................................................................................................................................................................ .......................... 9 Colocation with Partner Agencies ............................................................................................................................................................. 10 Fusion Center Staff ........................................................................................................................................................................................... 11 Governance Structure ..................................................................................................................................................................................... 14 Operational Costs ............................................................................................................................................................................................. 15 Mission .................................................................................................................................................................................................................. 17 Information Sharing ........................................................................................................................................................................................ 19 Event and Incident Support.......................................................................................................................................................................... 21 Key Stakeholder Survey ................................................................................................................................................................................. 23 Performance Measures .................................................................................................................................................................................. 24 Fusion Center Communications Drill ....................................................................................................................................................... 26
Homeland Security Grant Program ........................................................................................................................................... 27
Appendix A: Key Terms and Acronyms ...................................................................................................................................A-1 Key Terms ................................................................................................................................................................ .......................................... A-1 Acronyms ................................................................................................................................................................ ........................................... A-3
Page ii 2017 National Network of Fusion Centers Final Report
Executive Summary
The National Network of Fusion Centers Final Report (Final Report) documents the results of the annual Fusion Center Assessment (Assessment). The Assessment provides a comprehensive picture of the performance of the National Network of Fusion Centers (National Network), measures the effectiveness of Federal Emergency Management Agency (FEMA) grant funding, and guides partners to focus on mission areas with the greatest potential benefit.
Methodology The 2017 Final Report is based on data collected from the 2017 Assessment. The U.S. Department of Homeland Security (DHS) collects this data from self-reporting federal, state, local, tribal, and territorial (F/SLTT) partners, and homeland security and public safety associations. The U.S. Department of Homeland Security (DHS) collected data through various methods, to include the Homeland Security Information Network-Intelligence (HSIN-Intel) Fusion Center Profile System, external surveys, partner agencies, and fusion center-focused exercises and drills. DHS analyzed the data to evaluate the performance of the National Network.
Findings The findings derived from the analysis of the collected data are located throughout the “Key Findings & Recommendations” and “Findings” section, and are synopsized in the following bullets.
• Fusion centers continue to prioritize counterterrorism, general crime, narcotics, cybersecurity, and critical infrastructure issues.
• Fusion center leadership, particularly at the director level, continues to experience a high level of turnover. • The number of major events or incidents supported by fusion centers in their area of responsibility (AOR) is
increasing. These include special events (i.e., pre-planned), disasters, and active shooter incidents. • One-third of fusion centers’ analytic products are shared throughout the National Network via the HSIN-Intel
Community of Interest (COI). • Overall performance of the National Network, as evaluated against 23 performance measures, hovers at a
largely stable baseline, with positive trends in over half of these measures. For example, the percentage of fusion center distributable analytic products that address state/local customer information needs has held over the past three years.
Recommendations The Final Report recommendations focus on actions for both DHS and the fusion centers to enhance the performance of the National Network. The following overarching recommendations are derived by DHS from a more detailed list in the “Key Findings & Recommendations” section of this report.
• DHS should ensure that DHS-provided services and assistance (e.g., grant funding, training, exercises, and technical assistance) align with fusion center needs and priorities. The extent, timing, and availability of these resources should be communicated with fusion centers to minimize duplication of effort with other federal partners.
• Fusion centers should ensure their partnerships, staffing, and products align to their priorities, in order to support an increase set of missions. At the same time, fusion centers should consider how any changes in key mission areas result in change in resource alignment.
2017 National Network of Fusion Centers Final Report Page iii
• DHS and fusion centers should work together to assess the restrictions that state and local laws and policies impose on many fusion centers in sharing analytic products on HSIN-Intel in order to understand both the opportunities and challenges related to information sharing processes and platforms.
• DHS should continue to find ways to enhance the data collection for the Assessment. This process should include reviewing the performance measures to determine the need to add new measures, adjust existing measures, or collect additional data to conduct further analysis.
2017 National Network of Fusion Centers Final Report Page 1
Introduction
Purpose The National Network of Fusion Centers Final Report (Final Report) documents the findings of the Fusion Center Assessment (Assessment) and poses a list of recommendations. The U.S. Department of Homeland Security (DHS) conducts the Assessment to provide a comprehensive picture of the performance of the National Network of Fusion Centers (National Network), measure the effectiveness of Federal Emergency Management Agency (FEMA) grant funding, and guide partners to invest in mission areas with the greatest potential benefit to the homeland. The Assessment primarily evaluates fusion centers’ adherence to selected performance measures. It also strives to ensure functional consistency across the National Network, regardless of fusion center size, scope, geography, or mission.
Background The Assessment is a critical element of a broader Fusion Center Performance Program (FCPP). The FCPP provides a picture of the National Network in action; and helps to inform state and local leaders on ways to strengthen fusion center performance and mitigate capability gaps. It also allows fusion centers to justify investment requests, including targeted Investment Justifications associated with the Homeland Security Grant Program (HSGP). The FCPP framework consists of the following interconnected elements:
• Measuring the performance of the National Network as a whole through a structured, standardized annual Assessment;
• Hosting and participating in prevention-based exercises that test fusion center capabilities against real-world scenarios; and,
• Mitigating identified gaps to improve performance, and sustain fusion center operations.
The 2015 Final Report concluded that the National Network had reached maturity. This conclusion led to the closeout of measures focused on the National Network’s achievement of critical operational capabilities (COCs) and enabling capabilities (ECs). Beginning in 2016, the Assessment, focused on evaluating the National Network based on performance measures developed by a DHS-led working group of fusion center directors.
19
18 21
35
39 35
23
20 21
Law Enforcement
Homeland Security Agency
Other
State National Guard
Corrections/Parole/Probation
Healthcare and Public Health
Fire Service
2011 2012 2013 2014 2015 2016 2017 Direct Federal Costs $97,456,195 $77,358,662 $69,653,432 $68,216,940 $68,502,223 $45,415,484 $44,268,025
Federal Grants $52,258,930 $75,269,656 $65,231,769 $73,499,366 $63,707,217 $72,225,816 $63,106,830
Local $34,144,222 $63,778,109 $70,304,104 $71,519,890 $79,159,778 $80,949,377 $89,953,402
State $83,338,580 $90,969,472 $102,150,250 $113,297,130 $108,401,570 $111,581,870 $120,950,770
STAFF
Products
Total SLTT and private sector staff: 2,666 Fusion center analysts: 1,279
New fusion center Directors: 20 in 2017, for a total of 89 since 2014
28% of all SLTT fusion center personnel are representatives funded by partner agencies.
Fusion centers deployed 34 individuals to other fusion centers or law enforcement intelligence units, a decrease of 67% from the previous assessment period.
Fusion centers collaborated with other fusion centers and/or federal partners on 239 distributable products in the 2017 Annual Assessment period, a 29% increase from the previous year.
PERFORMANCE MEASURES
OPERATIONAL COSTS Primary Discipline Of Personnel
2,103 189
161 87
58 37 36
2015 2016 2017 % Change in 2017 Percentage of fusion center distributable analytic products that address state/local customer information needs 10% 10% 13% 3% Percentage of federal Information Intelligence Reports (IIRs) originating from fusion center information that address a specific Intelligence Community need 90% 100% 100% 0% Percentage of federally designated special events in which fusion centers played a direct role 49% 28% 42% 14% Number of Suspicious Activity Reports (SAR) vetted and submitted by fusion centers that result in the initiation or enhancement of an investigation by the Federal Bureau of Investigation (FBI) 225 123 258 95% Number of distributable analytical products co-authored by one or more fusion centers and/or federal agenciesncies 137 160 182 14% Percentage of key customers reporting that fusion center products resulted in increased situational awareness of threats within their AOR 86% 84% 85% 1%
$ Management and Admin increased 1.8%
Staff spending increased 4.2% Info Systems spending increased 2.9% Training and Exercise decreased
by 40.7%40.7%
The overall funding for the National Network increased
by 2.7% in 2017.
COLOCATION*
State Homeland Security Agency
State, County, or City Law Enforcement
State, County, or City Emergency Management Agency
RISS Node and/or RISSaleTM Watch Center
FBI (Field Offices, JTTFs, FIGs, and/or other FBI)
State, County, or City Fire Services
State National Guard 27
22
25
17
33
15
61
77 fusion centers are colocated with one or more partners, including:
* Data represents number of fusion centers. Note 77 of 79 fusion centers submitted data
TX
OK
PR VI
FL
GA
NM AZ
CA NV
UT CO
KS
NE
SD
MN
WI MI
IL
MO
AR
LA
MS
TN
KY
IN OH
WV VA
NC
SC
PA
NY
NJ
MD DE
CT
ME
NHVT
MA RI
AL
IA
ND
WY
MT
ID OR
WA
AK
HI GU
FUSION LIAISON OFFICER (FLO) PROGRAM*
Fire Service46
Emergency Management 41
Public Health 39
Law Enforcement 63
68
FLO Programs
Corrections 39
GOVERNANCE BODIES*
Fusion centers that have governance bodies or formal alternatives
Public Health
Law Enforcement
Fire Service
National Guard
Emergency Management
Critical Infrastructure
14
21 69
9
22
55
24
Governance bodies or formal alternatives include multidisciplinary participation.
Fusion center FLO Programs include multidisciplinary participation.
PRIMARY AGENCY DISCIPLINE
48% State Law Enforcement
Other
9% State, City, and/or County
Homeland Security Agency
26%
7%
City/County Law Enforcement
1%Emergency Management 9%Multi-agency
HOURS OF OPERATION*
Core Business hours (10 or less a day, 5 days a week)
24 hours a day 7 days a week (24/7)
Extended hours (over 10 a day, 5 or more days a week, but not 24/7)
2017
2016
2015
ACCESS TO CLASSIFIED INFORMATION 97% of fusion centers have access to either Homeland Secure Data Network (HSDN) and/or Federal Bureau of Investigation Network (FBINet).
70% of all state, local, tribal, and territorial (SLTT) fusion center personnel who need a clearance have one; an additional 6% have requested a clearance.
9% of SLTT fusion center personnel have Top Secret clearance and Sensitive Compartmented Information (SCI) access, and such systems are located either in 17 fusion centers or in the same building.
PRIMARY MISSION*
2017SNAPSHOT Summary of the National Network of Fusion Centers
The National Network is composed of an integrated system of state and local fusion centers. Fusion centers serve as the focal points for the receipt, analysis, gathering, and sharing of threat-related information. A summary of the National Network in 2017 can be depicted through a snapshot of budget, personnel, focus, partners, and output. This snapshot represents data submitted by 77 of the 79 fusion centers.
18-263-IA
UNCLASSIFIED // FOR OFFICIAL USE ONLY
UNCLASSIFIED // FOR OFFICIAL USE ONLYPage 2 2017 National Network of Fusion Centers Final Report
2017 National Network of Fusion Centers Final Report Page 3
Key Findings & Recommendations
The table below presents the key findings and associated recommendations from the 2017 Final Report. Hours of Operations Key Findings • Over the past three years, there has been an increase in fusion centers that operate 24 hours a day, 7 days a week.
• Fusion centers with more resources are more likely to have longer hours of operations. Recommendations • No recommendations are associated with these key findings.
Colocation with Partner Agencies Key Findings • A continued increase in colocation with partner agencies has coincided with an increase in coauthored products. • Law enforcement continues to be the discipline that is most often colocated with a fusion center.
Recommendations • No recommendations are associated with these key findings.
Fusion Center Staff Key Findings • The focus areas of fusion center staff align with the fusion center priorities. • Fusion centers are leveraging more state, local, tribal, and territorial (SLTT) representatives to support fusion center functions.
• The level of competency of fusion center analysts continues to increase. • We lack a meaningful measure of fusion center analyst proficiency level. • There is a high rate of fusion center director turnover.
Recommendations • DHS should work with the National Network to ensure resources (e.g., training, guidance documents, and technical
assistance) are available to analysts in order maintain and/or enhance their professional competencies. • DHS should update its process for meaningfully defining and evaluating relative levels of analyst proficiency. • DHS should provide new fusion center directors with onboarding information and assist with account access (e.g., Homeland
Security Information Network-Intelligence [HSIN-Intel], SitRoom, and Exchange) required for coordination with DHS. • FEMA should continue to offer the new directors workshop on an annual basis to address the yearly turnover rate. • Fusion centers should ensure that their strategic and operational documents are up to date to ensure continuity during
changes to the director position.
Governance Structure Key Findings • The number of fusion centers with a formal governance body has remained relatively consistent over the past two years.
Recommendations • Fusion centers should continue to maintain their governance bodies to ensure continuity through changes to fusion center
directors and deputy directors. • DHS should collaborate with the National Network to develop a common lexicon to support governance body and oversight
initiatives.
Page 4 2017 National Network of Fusion Centers Final Report
Operational Costs Key Findings • Fusion centers are leveraging more state and local funding to pay for increased operational costs. • Large fusion centers allocate more funding to information systems and technology, while small fusion centers allocate more
funding to management and administration, and training and exercises. Recommendations • No recommendations are associated with these key findings.
Mission Key Findings • More fusion centers are taking on an increasing number of mission areas. • Top focus area priorities have remained consistent from previous years. • There has been an increase in fusion center cyber capabilities and cyber focused staff. • Fusion centers that have prioritized critical infrastructure have an opportunity to increase their engagement with the private
sector and critical infrastructure community through the Fusion Liaison Officer (FLO) Program or governance. Recommendations • DHS should update the HSIN-Intel Fusion Center Profile System to allow fusion centers to explain changes in mission areas in
next year’s Assessment so that we may better determine why changes are occurring. • Fusion centers should consider how any changes in their mission area (i.e., all-hazards, all-crimes, and counterterrorism) result
in changes to alignment of resources (staff, training, etc.) while safeguarding their top threat priorities. • Fusion centers should ensure their partnerships, staffing, and products align to their priorities, as more fusion centers take on
an increasing set of missions. • DHS should ensure cyber related resources and products are available to fusion centers via HSIN-Intel to allow them to stay
current on cyber trends, techniques, and requirements. • DHS should further examine fusion center analytic production to determine alignment with increased cyber capability. • FEMA should review opportunities to further prioritize information sharing, intelligence, and prevention-focused use of grant
funds, with a specific attention on the ability of fusion center to leverage grants funds in addressing current and emerging issues, including but not limited to threats associated with terrorism, drugs, gangs, active shooters, transnational organized crime, and cyber.
• FEMA should promote awareness of available resources for engaging critical infrastructure partners through FLO Programs.
• Fusion centers should increase partnerships with private sector and critical infrastructure partners through FLO Programs, governance board membership, and staffing.
Information Sharing Key Findings • Fusion centers shared more analytic products on HSIN-Intel. • Fusion centers share about one third of their overall analytic products on HSIN-Intel. • Fusion centers are allocating more time towards addressing requests for information (RFIs), tips and leads, and case
support/tactical products than they are producing analytic or situational awareness products. • Participation in FLO Programs across all disciplines have seen a decline.
Recommendations • DHS should continue to hold an annual HSIN-Intel Seminar to assist fusion center personnel in utilizing the system to share
products and collaborate with partners. • Fusion centers should review their state and local policies to determine their ability to share products on HSIN-Intel. • DHS should update the Profile System to allow fusion centers to explain their ability to share analytic products on HSIN-Intel
and share general conclusions with the National Network. • FEMA should promote awareness of available resources and continue to provide technical assistance on maintaining a FLO
Program. • Fusion centers should re-examine current FLO Programs to ensure representation aligns with mission and priorities, and
include additional disciplines and expertise as needed.
2017 National Network of Fusion Centers Final Report Page 5
Event and Incident Support Key Findings • Special Event Assessment Rating (SEAR) Level 4 and Level 5 events represented the largest increases in SEAR event support
from Fiscal Year (FY) 2016. • There was an increase in the percentage of Federally-declared disasters and active shooter events supported by fusion
centers. Recommendations • DHS should provide a common lexicon of support roles. • Fusion centers should coordinate with their state homeland security agency to provide input on identifying SEAR level events
within their area of responsibility (AOR). • Fusion centers should bolster engagement with emergency management and law enforcement partners by ensuring
memorandum of understandings (MOUs) are established, information exchange procedures are documented, and staff have the necessary training and access to systems.
Key Stakeholder Survey Key Findings • Survey results showed a decrease in satisfaction across most topic areas.
Recommendations • Fusion centers should work with governance and advisory bodies to identify customer expectations for the timeliness and
relevancy of products and services.
Performance Measures Key Findings • Over half of the performance measures have leveled off or showing a continued positive trend. • The number of suspicious activity reporting (SARs) submitted by fusion centers that resulted in the initiation or enhancement
of a Federal Bureau of Investigation (FBI) investigation increased. • There was an increase in the number of distributable analytic products co-authored by one or more fusion centers and/or
federal agencies. Recommendations • DHS should continue to deliver SAR related training, technical assistance, and/or guidance documents to continue to increase
the percentage of SARs that resulted in the initiation or enhancement of an FBI investigation to a level consistent to previous years.
• DHS should consider collecting additional data and conducting further analysis to determine the types of agencies that are co- authoring products with fusion centers.
Fusion Center Communications Drill Key Findings • Fusion centers with connectivity to Homeland Secure Data Network (HSDN) has declined.
Recommendations • DHS should further determine the reason for this decline and determine how to increase HSDN connectivity and usage.
Page 6 2017 National Network of Fusion Centers Final Report
Data Sources and Methodology
The Final Report is based on 2017 Assessment period data (October 1, 2016 – September 30, 2017) collected from federal, state, local, tribal, and territorial (F/SLTT) partners and homeland security and public safety associations. DHS collected data through various methods, including the Profile System, external surveys, partner agencies, and fusion center-focused communications drills. DHS analyzed the data to evaluate the performance of the National Network.
Fusion Center Profiles DHS gathered fusion center data for the 2017 Assessment using the Profile System. The 2017 data collection process took place from November 2017 – December 2017. Fusion centers input data that addressed their management and operations, as well as compliance to grant requirements. During this time, DHS held multiple trainings and conference calls to assist fusion centers with data entry. At the completion of the data collection process, 77 of the 79 fusion centers submitted completed profiles. Of the two fusion centers that did not submit data, one fusion center opted not to participate and the other fusion center had only partial data because it became a nationally recognized fusion center after the assessment period began.
DHS personnel conducted detailed reviews of individual fusion center profiles to identify gaps in data collection. DHS shared the results of these reviews with fusion center directors and their key staff. DHS staff were available for phone calls when additional clarity and guidance were required. Fusion center directors were given the opportunity to adjust their data or provide clarifying comments before verifying their center’s profile data. DHS personnel reviewed aggregate-level data from the profile system, then analyzed and compared it to FY 2016 inputs.
Key Customer Survey DHS previously worked with partner agencies to define fusion center “key customers” as state and territorial Homeland Security Advisors (HSAs); the heads of state police agencies, state investigative agencies, and state emergency management agencies; major city police chiefs; and major county sheriffs. DHS coordinated with the National Fusion Center Association (NFCA) to conduct a survey through prominent associations, including the National Governor’s Association, Homeland Security Advisors Council (GHSAC), International Association of Chiefs of Police (IACP), Association of State Criminal Investigative Agencies (ASCIA), National Emergency Management Association (NEMA), Major Cities Chiefs Association (MCCA), Major County Sheriffs’ of America (MCSA), and National Sheriffs’ Association (NSA). The survey focused on a wide range of topics related to the fusion centers within their respective AOR. One hundred forty-three individuals responded to the survey in 2017. DHS aggregated the survey data to determine customer satisfaction with fusion centers services and products.
2017 National Network of Fusion Centers Final Report Page 7
Partner Agency Data DHS collected additional 2017 Assessment data from a combination of sources, to include internal DHS directorates, partners, and other agencies.
Department of Homeland Security DHS gathered data on the origins and results of Intelligence Information Reports (IIRs), SARs, and Office of Intelligence and Analysis (I&A) watchlist nominations related to fusion centers. DHS used the data to address specific fusion center performance metrics associated with IIRs, SARs, and the watchlist.
DHS collected a list of National Special Security Events (NSSE) and other events that received a SEAR. NSSEs are events of national significance deemed by the Secretary of Homeland Security to be a potential target of terrorism or other criminal activity. NSSE events include presidential inaugurations, major international summits held in the U.S., major sporting events, and presidential nominating conventions. SEAR events are preplanned special events below the level of NSSE. DHS identifies SEARs via the annual National Special Event Data Call. DHS also compiled a list of Federally Declared Disasters, derived from FEMA, which included emergency declarations and major disaster declarations. As part of the data collection process, DHS provided these three lists to fusion centers to identify which events they had a direct role in supporting.
Partners DHS coordinated with several partners to collect public safety event data. The University of Maryland National Consortium for the Study of Terrorism and Responses to Terrorism (START) provided a list of defined terror related incidents. START defines terror related incidents as incidents that had an intentional act of violence or threat of violence by a non-state actor. In addition, two of the following three criteria must also apply:
• The violent act was aimed at attaining a political, economic, religious, or social goal. • The violent act included evidence of an intention to coerce, intimidate, or convey some other message to a
larger audience (or audiences) other than the immediate victims. • The violent act was outside the precepts of International Humanitarian Law.
The Texas State University Advanced Law Enforcement Rapid Response Training (ALERRT) Center provided a list of defined active shooter events. ALERRT identified these events using the following criteria:
• Individuals actively engaged in killing or attempting to kill people in populated areas. • At least one of the victims must be unrelated to the shooter. • The primary motive appears to be mass murder; that is the shooting is not a by-product of an attempt to
commit another crime.
DHS provided both lists to fusion centers to identify which events they had a direct role in supporting. If events did not meet these criteria they were not included in the data collection.
Other Agencies The Federal Cost Inventory (FCI) is a catalog of all federal personnel, related costs, and programmatic support provided to the National Network. As part of the FY 2017 FCI conducted by I&A, 37 government agencies provided spending data relating to personnel, information systems and technology, training and exercises, management and administration, or programmatic costs that supported fusion centers.
Page 8 2017 National Network of Fusion Centers Final Report
Fusion Center Communications Drill DHS I&A conducts an annual Communications Drill to test the National Network’s ability to access and share information from the federal government. In 2017, the following systems were tested:
• Fusion center unclassified e-mail; • HSIN-Intel; • HSDN; • Secure telephone equipment (STE) and the classified audio bridge; and • Secure video teleconference (SVTC).
Seventy-seven fusion centers participated in the 2017 communications drill to assist in operational preparedness. Each fusion center received an after action report detailing its results.
2017 National Network of Fusion Centers Final Report Page 9
Findings
This section examines the results of the 2017 Assessment and compares the data to previous years to draw key findings regarding the National Network and its recent progress. As of September 30, 2017, the National Network is comprised of 79 fusion centers. All but two of the 77 fusion centers participated in the 2017 Assessment. 1,2 Fifty-four of the 77 fusion centers that participated in the Assessment have an AOR that encompasses an entire state or territory. Twenty-five of the 77 fusion centers have an AOR within a major urban area, covering smaller geographic areas in and around cities.
Hours of Operations Fusion centers establish their business hours based on mission requirements and available resources. For the purposes of the Assessment, DHS categorizes business hours into one of three categories:
• Twenty-four hours a day, seven days a week • Extended operating hours, typically over 10 hours a
day or more than five days a week, but less than 24 hours a day, seven days a week
• Core business hours, typically 10 hours or less a day, five days a week
As shown in Figure 1, fusion center business hours vary across the National Network. The hours of operations have remained consistent over the past three years, with a slight increase in the fusion centers that operate at 24/7.
To understand how the size of a fusion center aligns with its hours of operations, fusion centers were broken into three size categories based on the number of staff reported in 2017:
• Small: 1 – 15 Staff (28 of 77 fusion centers) • Medium: 15 – 49 Staff (30 of 77 fusion centers) • Large: 50 and over Staff (19 of 77 fusion centers)
As depicted in Figure 2, the majority of small fusion centers (64%) operate at core business hours; large fusion centers tended to operate 24/7 (68%). The alignment of fusion center size to operating hours is likely due to availability of resources. Larger fusion centers generally have more resources, which allows them to operate at extended hours.
1 The fusion centers that make up the National Network can be found at https://www.dhs.gov/fusion-center-locations-and-contact-information. 2 One fusion center was excluded because it became a nationally recognized fusion center during the assessment period and only submitted partial year data.
64% 53% 5%
21% 27%
26%
14% 20%
68%
0%
20%
40%
60%
80%
100%
Small Fusion Center Medium Fusion Center
Large Fusion Center
Core Business hours Extended hours 24/7
Figure 1: Hours of Operation (2015-2017)
51%
23% 26%
45%
27% 27%
45%
25% 30%
0%
20%
40%
60%
Core Business hours Extended hours 24/7
2015 2016 2017
Figure 2: Fusion Center Size vs. Hours of Operations (2017)
Key Findings: • Over the past three years, there has been an increase in fusion centers that operate 24 hours a day, 7 days a week. • Fusion centers with more resources are more likely to have longer hours of operations.
Page 10 2017 National Network of Fusion Centers Final Report
Colocation with Partner Agencies Fusion center colocation with partner agencies continues to increase in 2017. One hundred percent of fusion centers reported being located in either the same office or building with at least one other F/SLTT agency (Table 1) for the second consecutive year. This continued increase in colocation improves opportunities for distribution to and synchronization with other organizations on counterterrorism, law enforcement, critical infrastructure protection, and public safety objectives.
Entity Number of Fusion Centers % Change
in 2017 2015 2016 2017 Colocated with one or more partners, including: 90% 100% 100% 0% State, county, or city law enforcement 52% 74% 79% 5% State, county, or city law enforcement intelligence unit 36% 40% 42% 1% FBI (field offices, JTTFs, FIGs, and/or other FBI) 16% 35% 43% 8% State homeland security agency 25% 32% 35% 3% State, county, or city emergency operations center 27% 30% 32% 3% State National Guard 16% 30% 32% 3% State, county, or city emergency management agency 26% 29% 29% 0% State, county, or city fire service 17% 21% 19% -1% High Intensity Drug Trafficking Area (HIDTA) (ISC or Watch Center) 13% 19% 14% -5% Real-time crime center 14% 18% 16% -3% RISS Node and/or RISSafe™ Watch Center 9% 18% 22% 4% Customs and Border Protection (CBP) Border Intelligence Center 4% 8% 5% -3% Other fusion center 5% 4% 6% 3% Maritime Interagency Operations Center (USCG Sector) 0% 1% 1% 0%
Table 1: Colocation of Fusion Centers with Other Entities (2015-2017)
Fusion centers have increased their colocation with each partner agency since 2015. The highest increases in colocation were with Regional Information Sharing Systems (RISS) Nodes, State National Guard, and the FBI, where colocation with each of these agencies doubled since 2015. DHS compared colocation data to fusion center products. The data shows that increased colocation has coincided with an increase in fusion center coauthored products from 2015 to 2017 (Figure 3).
134
185
239
0
50
100
150
200
250
300
2015 2016 2017
N um
be r o
f P ro
du ct
s
Figure 3: Fusion Center Coauthored Products (2015-2017)
Key Findings: • A continued increase in colocation with partner agencies has coincided with an increase in coauthored products. • Law enforcement continues to be the discipline that is most often colocated with a fusion center.
2017 National Network of Fusion Centers Final Report Page 11
Fusion Center Staff The composition of fusion center staff varies based on fusion center’s resources, area of operation, and mission focus. Table 2 provides a breakdown of fusion center staff across the National Network by origin and job function. In 2017, fusion centers reported 2,666 SLTT and private sector staff members working on a full-time or a part-time basis. Each fusion center averages 34 staff members. DHS found that 21 was the median number of fusion center staff in 2017. Fusion centers reported that “analysis” was the most common job function across the National Network. Fifty-seven fusion centers (74%) were managed by law enforcement personnel in 2017, and nine fusion centers (9%) were managed by a state, city, and/or county homeland agency. Fusion centers identified 34 individuals (1%) that were deployed to other fusion centers or law enforcement intelligence entities (not including Joint Terrorism Task Forces [JTTF] or Field Intelligence Groups [FIGs]) to serve as liaisons). This represents a decline from the 2016 Assessment period, when fusion centers deployed 103 individuals (4%) outside their fusion center.
Management & Administration Analysis Training &
Exercise Investigative Legal Liaison & SME Other TOTAL
State 276 813 19 290 13 189 152 1,752 Local 171 356 27 159 4 82 79 878 Tribal 0 0 0 0 0 0 0 0 Territorial 3 7 0 0 0 2 0 12 Private Sector 4 3 3 0 0 13 1 24 TOTAL 454 1,179 49 449 17 286 232 2,666
Table 2: Fusion Center Staff by Function (2017) *5 Fusion center personnel were omitted due to data inconsistences
There was a 12% increase (128 positions) in staff performing analysis in fusion centers (Figure 4). This was the largest increase of any of the function areas. The greatest reduction was the investigative function, which decreased by 43 positions (9%). This is the second consecutive year in which the investigative function has decreased.
Fusion centers identified the primary focus area for each of their staff members in 2017. The reported data shows that the majority of staff had a generalist focus area, followed by general crime and counterterrorism. Additionally, all of the top five-fusion center priorities (counterterrorism, general crime, narcotics, cybersecurity, and critical infrastructure) are aligned to the staff focus areas (Figure 5).
Figure 4: Increase/Decrease in Staff by Function (2017)
17
128 -4
-43
0
20
9
-50 0 50 100 150
Management & Admin
Analysis
Training & Exercise
Investigative
Legal
Liaison & SME
Other
Figure 5: Fusion Center Primary Focus (2017)
Generalist
General Crime
Counterterrorism
Other
General Critical Infrastructure
Narcotics
Cybersecurity
Page 12 2017 National Network of Fusion Centers Final Report
State, Local, Tribal, and Territorial Representatives The 2017 Assessment also collected data on SLTT representatives working in fusion centers. Representatives are SLTT personnel that work at the fusion center on at least a part-time basis, but whose salaries are not funded by the fusion center.
Fusion centers increased the number of representatives in 2017, consistent with the increase in overall fusion center personnel. Seven hundred fifty-two representatives (28% of all SLTT personnel) are working at fusion centers, compared to 644 representatives (25% of all SLTT personnel) in 2016. SLTT representatives support various elements of fusion center operations (Figure 6), with large numbers serving as analysts (224, or 30%), liaisons/subject matter experts (211, or 28%), or investigative support (166, or 22%). The large number of SLTT representatives serving as analysts is consistent with the overall composition of fusion center staff. Additionally, representatives serving as liaisons/subject matter experts (SMEs) help bridge the gap between fusion centers and their customers. They also provide expertise in a given area or field with no cost to the fusion center.
Analysts The analyst role continues to be paramount in successfully sharing information across the National Network. The importance of the analyst role is reflected in the fact that they make up over 40% of the workforce at fusion centers. Additionally, the number of analysts has increased from 999 to 1,179 since 2013.
In order to measure analytic-related knowledge, skills, and abilities, fusion centers identified three overarching analyst proficiency levels that best described their analysts: basic, intermediate, or advanced.3 As shown in Figure 7, the majority of analysts (35%) are at the intermediate level. However, there are no significant differences across the analyst level of proficiency. DHS compared 2017 proficiency levels to 2016 and found that 336 (33%) analysts reported having basic level proficiency compared to 311 (37%) in 2016. This shows that the analyst level of proficiency has increased at all levels since 2016. It is important to note that fusion centers did not identify a proficiency level for 167 analysts (14%) in 2017.
3 For more details and descriptions of the analyst levels of proficiency, see the Analyst Professional Development Road Map located at https://it.ojp.gov/GIST/179/File/Analyst%20Professional%20Development%20Road%20Map1.pdf
Figure 7: Analyst Proficiency (2017)
30%
28%
22%
10%
4% 6%
Analysts Liaison/SME
Investigative M&A
Training/ Exercise Other (Includes Legal)
Figure 6: SLTT Representatives (2017)
2017 National Network of Fusion Centers Final Report Page 13
Key Positions Five key positions—director, deputy director, privacy/civil rights and civil liberties (P/CRCL) officer, security officer, and lead analyst—play a vital role in the full operations of fusion centers. Stability in these key positions helps ensure consistent implementation of the fusion process, P/CRCL protections, and information and personnel security.
When comparing average tenure of the five key positions across the National Network (Figure 8), DHS found that the core positions (lead analyst, security liaison, and privacy officer) of fusion centers have the highest average tenure. This is consistent with previous years. Of the five key positions, the lead analyst had the longest average tenure (5.3 years) and directors had the lowest tenure (3.3 years).
Low turnover in leadership positions promotes mission continuity. In 2017, almost half of fusion center directors (49%) have held their positions for 1-3 years (Figure 9). This indicates a National Network with relatively new leadership in place. It will be important in future years to determine if the director tenure increases or decreases, which will better indicate the turnover rate.
21%
49%
14% 13%
1% 1% 0%
10%
20%
30%
40%
50%
60%
Less than 1 year 1-3 years 4-6 years 7-10 years 11-13 years 14-16 years
Pe rc
en ta
ge o
f D ire
ct or
s
4.2
4.4
5.3
3.5
3.3
0 1 2 3 4 5 6
Security Officer
P/CRCL Officer
Lead Analyst
Deputy Director
Director
Years
Figure 8: Average Tenure (2017)
Figure 9: Director Tenure (2017)
Key Findings: • The focus areas of fusion center staff align with fusion center priorities. • Fusion centers are leveraging more SLTT representatives to support fusion center functions. • The level of competency of fusion center analysts continues to increase. • We lack a meaningful measure of fusion center analyst proficiency level. • There is a high rate of fusion center director turnover.
Page 14 2017 National Network of Fusion Centers Final Report
Governance Structure A formal governance structure enhances fusion center operations and management by guiding mission priorities. A governance structure has decision-making authority, capable of committing resources and personnel to the fusion center. In 2017, fusion center governance structures were generally consistent with 2016 (Figure 10). For the second year, the majority of fusion centers (69%) reported having a formal governance body. Another 16 fusion centers (21%) have an alternative to a governance body, which includes leveraging an oversight body or their chain of command. The consistency in governance structure from year-to-year would indicate a level of stability at the executive level across the National Network.
Governance Body Membership Governance bodies are comprised of appropriate representation for the disciplines in the fusion center’s AOR. There were no significant changes to the governance structure representation in 2017. Law enforcement had the largest governance representation, with 71% of fusion centers having representation from law enforcement. Ninety-six percent of fusion centers have either law enforcement or homeland security representation on their governance structure. The governance representation of law enforcement and homeland security aligns to the fusion centers primary mission area, where 99% indicated their primary mission involves all-crimes, counterterrorism, or a combination of both.
Figure 10: Governance Structures (2015-2017)
61
6 7 3
53
6 9 9
53
6 10 8
0
10
20
30
40
50
60
70
Formal governance body
Alternative Oversight Body
Chain of command for oversight
No formal governance body
but could
N um
be r o
f F us
io n
Ce nt
er s
2015 2016 2017
Key Finding: • The number of fusion centers with a formal governance body has remained relatively consistent over the past two years.
61
6 7 3
53
6 9 9
53
6 10 8
0
10
20
30
40
50
60
70
Formal governance body
Alternative Oversight Body
Chain of command for oversight
No formal governance body
N um
be r o
f F us
io n
Ce nt
er s
2015 2016 2017
2017 National Network of Fusion Centers Final Report Page 15
Operational Costs The National Network receives operational funding (Table 3) from federal (both through grants and direct contributions), SLTT, and private sector sources. Overall, funding for the National Network in the 2017 Assessment period was $326 million, a 2.7% ($8.66 million) increase from 2016.4
Staff Information Systems & Technology
Training & Exercise
Management & Administration Other 2017 Totals
Direct Federal Expenditures* $37,988,880 $2,524,116 $731,438 $2,027,731 $995,860 $44,268,025
Federal Grants Expended by SLTT $42,335,541 $13,091,616 $3,002,286 $2,846,658 $1,830,729 $63,106,830
DHS $33,821,558 $12,787,039 $2,826,145 $2,440,835 $1,707,971 $53,583,548
DOJ/COPS $1,582,478 $93,671 $1,512 $18,317 $0 $1,695,977
DOJ/BJA $822,560 $0 $12,000 $0 $0 $834,560
HIDTA $6,108,945 $210,906 $162,629 $387,506 $122,758 $6,992,744
State $107,318,018 $6,166,749 $639,745 $6,172,948 $653,313 $120,950,772
Local $82,963,765 $2,302,392 $632,293 $2,509,860 $1,545,092 $89,953,402
Tribal $0 $2,500 $1,000 $0 $0 $3,500
Territorial $3,561,582 $5,705 $51,054 $15,628 $0 $3,633,969
Private Sector $748,000 $2,500 $19,823 $0 $0 $770,323
Other $1,590,956 $1,549,482 $77,596 $625 $240,000 $3,458,660
Total $276,506,742 $25,645,060 $5,155,234 $13,573,450 $5,264,994 $326,145,481 Table 3: Operational Costs (2017)
*Staff salary expenditures were calculated using the GS-13 step 5 salary in the Washington-Baltimore-Arlington locality of $107,439. An additional 30% benefits cost estimate was added to this base salary resulting in an estimated yearly expenditure of $139,670, per employee. There were a reported 297 federal employees dedicated to support the fusion centers in FY 2016.
Year-Over-Year Funding Changes Year-over-year funding increased at the state and local levels, including tribal, territorial, and the private sector. As shown in Figure 11, the biggest funding increase came from local funding (11%) and the biggest decrease from federal grants (12.6%). DHS further examined the proportion of funds from SLTT, private sector, and federal sources. There has been a steady decline in the percentage of overall funding from federal sources (Figure 12). This trend could be due to the National Network reaching the “mature” stage of the Network Maturity Model.5
4 The Direct Federal Expenditures from the 2016 Final Report were updated after the release of Final Report. 5 The 2015 Final Report concluded that the National Network had reached the “Mature” state of the Network Maturity Model.
$1.66
$68.50
$63.71
$79.16
$108.40 $7.31
$50.08
$72.23
$80.95
$111.58
$7.87
$44.27
$63.11
$89.95
$120.95
$- $20 $40 $60 $80
$100 $120
Tribal, Territoral,
Private, Other
Direct Federal Expenditures
Federal Grants
Expended by SLTT
Local State
M ill
io ns
2015 2016 2017
Figure 11: Funding Sources (2015-2017)
0%
20%
40%
60%
80%
100%
2015 2016 2017 Federal Funds (Direct & Grants) SLTT
Figure 12: Funding Proportions (2015-2017)
Page 16 2017 National Network of Fusion Centers Final Report
Non-Staff Spending Eighty-five percent of all expenditures are dedicated to personnel, as was the case in 2016 (84%). Although there was an overall increase in operational cost, there was a decrease in non-staff spending (-4%). DHS found a 40% ($3 million) decrease in training and exercises (Figure 13) attributed to the decrease in non-staff spending. It should be noted that this does not account for the free training offered to fusion center personnel via DHS and other government entities. The decrease could indicate that fusion centers are finding other means to complete necessary training.
To understand how the size of a fusion center aligns with its non-staff spending, fusion centers were broken into three size categories (small, medium, and large) based on the number of staff reported in 2017. As depicted in Figure 14, small fusion centers (1-15 staff) allocate more funding to management and administration and training and exercise than large fusion centers (50+ staff). However, large fusion centers reported allocating almost double what small fusion centers do in information systems and technology.
$23
$10 $11
$3
$25
$9
$13
$5
$26
$5
$14
$5
$0
$5
$10
$15
$20
$25
$30
Information Systems & Technology Training & Exercise Management & Administration Other
M ill
io ns
2015 2016 2017
37% 45% 62%
10% 13%
9%42% 29%
21%
11% 13% 8%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90%
100%
Small Fusion Center (1-15 Staff)
Medium Fusion Center (16-49 Staff)
Large Center (50+ Staff)
Information Systems & Technology Training & Exercise
Management & Administration Other
Figure 13: Non-Staff Spending (2015-2017)
Figure 14: Non-Staff Spending by Fusion Center Size (2017)
Key Findings: • Fusion centers are leveraging more state and local funding to pay for increased operational costs. • Large fusion centers allocate more funding to information systems and technology, while small fusion centers allocate
more funding to management and administration and training and exercises.
2017 National Network of Fusion Centers Final Report Page 17
Mission Fusion centers categorized their primary mission into one or more of the following areas — counterterrorism, all-crimes, and/or all-hazards. Four fusion centers moved from a single mission area focus to multiple mission areas in 2017 (Figure 15). This year’s change could signal a shift in the threat environment or indicate a different policy was put into place.
Focus Areas Fusion centers ranked their top ten focus area priorities in order of importance, based on a list of 24 choices. To determine the top focus areas, DHS examined the number of times fusion centers selected a focus area as a top five priority. In 2017, the top focus areas included counterterrorism, general crime, narcotics, cybersecurity, and critical infrastructure (general and sector specific).6 Counterterrorism was the most selected top focus area, selected by 94% of fusion centers (Figure 16). It was also selected as the number one priority for over half (60%) of the National Network. The data shows no significant increases in focus area priorities. Fusion centers consistently identified counterterrorism, general crime, narcotics, cybersecurity, and critical Infrastructure (general and sector specific) as a top focus area over the past three years. Counterterrorism and general crime were both the most selected focus areas in the top five. An average of 70 fusion centers selected counterterrorism, and 59 selected general crime over the last three years.
Cybersecurity Focus Thirty-nine fusion centers (51%) selected cybersecurity as a top five priority in 2017, an increase of 11% from the previous year. Fusion centers also identified which cyber-related activities they contribute to and/or conduct. These activities include strategic cyber analysis, tactical cyber analysis, technical cyber analysis, or none. Of the 39 fusion centers that reported cybersecurity as a top five priority, 59% indicated they have capability in all three of the cyber analysis activities (Figure 17). The increase in fusion centers contributing to and/or conducting all three cyber activities, and subsequent decrease in one or two cyber activities, could be a result of an increase in cybersecurity staff.
6 This data point combines selections of priorities for general critical infrastructure and sector specific critical infrastructure (Chemical; Commercial Facilities; Communications; Critical Manufacturing; Dams; Defense Industrial Base; Emergency Services; Energy, Financial Services; Food and Agriculture; Government Facilities; Healthcare and Public Health; Information Technology; Nuclear Reactors, Materials, and Waste; Transportation Systems; and Water)
94%
77%
57% 51% 48%
0%
25%
50%
75%
100%
Counterterrorism General Crime Narcotics Cybersecurity Critical Infrastructure
(General & Sector Specific)
Figure 15: Fusion Center Mission Areas (2015-2017)
Figure 16: Top Focus Areas (2017)
10%
16%
4%
25%
22%
23%
65%
62%
73%
0% 20% 40% 60% 80% 100%
2017
2016
2015
Single Mission Area Two Mission Areas Three Mission Areas
Page 18 2017 National Network of Fusion Centers Final Report
Critical Infrastructure Focus A focus on one or more elements of critical infrastructure was a top five priority for nearly 50% (37 total) fusion centers in 2017. About two thirds (68%) of those 37 fusion centers either do not have a FLO Program or have a FLO Program with no critical infrastructure members. Additionally, 87% of those 37 fusion centers reported having a governance structure with no critical infrastructure representation. This gap indicates that the fusion centers that have prioritized critical infrastructure have an opportunity to increase their engagement with the critical infrastructure community through the FLO Program or governance membership. Fusion centers can leverage the FLO Program to establish new partnerships or enhance existing partnerships with critical infrastructure.
Figure 17: Cybersecurity Focus and Capabilities (2017)
Key Findings: • More fusion centers are taking on an increasing number of mission areas. • Top focus area priorities have remained consistent from previous years. • There has been an increase in fusion center cyber capabilities and cyber focused staff. • Fusion centers that have prioritized critical infrastructure have an opportunity to increase their engagement with the private
sector and critical infrastructure community through the FLO Program or governance.
39 Fusion Centers with Cybersecurity as a Top Five Priority
59% Capability in all
three Cybersecurity Related Activities
15% Capability in two
Cybersecurity Related Activities
21% Capability in one
Cybersecurity Related Activity
5% Capability in no Cybersecurity
Related Activities
2017 National Network of Fusion Centers Final Report Page 19
Information Sharing Fusion centers are designed to serve as a focal point for information sharing within their respective AOR.7 To be successful in their information sharing role, fusion centers produce and disseminate information and intelligence products (through working with partners and other fusion centers). To this end, fusion centers reported the number of situational awareness products, case support/tactical products, distributable analytic products8, requests for information (RFIs), and tips and leads.9 The range of self-reported totals for products between fusion centers show that like-named products are not taking the same amount of resources to complete. It is important to note output numbers can lead to a misleading characterization of the National Network, as products of the same type (e.g., two situational awareness products) may not require the same amount of resources.
2017 Information Sharing Activities per Staff Member DHS analyzed fusion center information sharing activities per staff member to highlight the impact of the National Network in this regard given its available staff resources. Figure 18 shows the averages of the five types of production per staff member and points out fusion center activities mainly consist of responding to RFIs, tips, and leads. Fusion centers produced an average of two distributable analytic products per staff member, a decrease from three in 2016. Fusion centers also reviewed and processed an average of 160 RFIs and 25 tips and leads per staff member. The average situational awareness and case support/tactical products per staff member increased by 49% and 5% respectively.
Distributable Analytic Production Distributable analytic products are analytic products shared on HSIN-Intel. Analytic products shared on HSIN-Intel allows them to be distributable across the National Network. However, fusion centers are unable to share some analytic products because they contain law enforcement or other sensitive information or they are being used in an active investigation. Fusion centers can also be restricted from sharing products due to their state and local laws and/or policies. Figure 19 shows fusion centers overall production on distributable analytic products decreased by 21%, but the number of products shared on HSIN-Intel increased by 22% or by 293 products.
7 See the 2014-2017 National Strategy for the National Network of Fusion Centers, p.8, at https://nfcausa.org/html/National%20Strategy%20for%20the%20National%20Network%20of%20Fusion%20Centers.pdf 8 A distributable analytic product is a report or document that contains assessments, forecasts, associations, links, and/or other outputs from the analytic process that is disseminated via HSIN-Intel for use in the improvement of preparedness postures, risk mitigation, crime prevention, target hardening, or apprehension of offenders, among other activities. Analytic products may be created or developed jointly with federal, state, and local partners. 9 Fusion centers reported outputs of these three products types outside of six standard deviations of one another (this could also be a result of varying definitions of the product types themselves). Given the magnitude of differences, data outside of one standard deviation above the average in these three categories was removed as outliers .
0
10
20
30
40
Situational Awareness Products
Case Support/Tactical
Products
Analytical ProductsRFIs (100s)
Tips and Leads
2015 Production Per Employee 2016 Production Per Employee 2017 Production Per Employee
6323 6763
5316
1886 1337 1630
30%
20%
31%
0% 5% 10% 15% 20% 25% 30% 35%
0
2000
4000
6000
8000
2015 2016 2017
Produced Posted to HSIN-Intel Percent Posted to HSIN-Intel
Figure 18: Average Production per Staff Member (2015-2017)
Figure 19: Products Produced vs. Products Shared (2015-2017)
Page 20 2017 National Network of Fusion Centers Final Report
Tips and Leads and RFIs While the number of tips and leads received decreased by 17% in 2017, the number of tips and leads sent to other F/SLTT for action increased by 5% (Figure 20). Fusion centers do not control the amount of tips and leads received, but the increase in tips and leads sent to the F/SLTT may be the result of increased outreach and partnerships. This increase coincides with an increase in colocation with federal partners, formal governance members, and liaisons/subject matter experts.
The number of RFIs processed per staff member and by net number increased in 2017. The increase is a result of a significant increase in RFIs submitted from other fusion centers. Fusion centers processed and responded to 99.77%, or 426,394 of the 427,387 of RFIs received. Similar to tips and leads, fusion centers do not control the number of RFIs they receive. However, an increase in RFIs may be an indication of stakeholders leveraging the fusion centers resources.
Fusion Liaison Officer Program The primary goal of a FLO Program is to facilitate the exchange of information between fusion centers and stakeholders within the fusion center’s AOR. FLO Programs can provide an improved quality and efficiency of information exchange as well as access to a cadre of multidiscipline SMEs to enhance fusion center products. Eighty-eight percent of fusion centers have an existing FLO Program, but participation among disciplines varies. Despite a general increase in 2017, discipline participation in FLO Programs have not returned to 2015 levels (Figure 21). Since 2015, there have been decreases in participation from key disciplines, including fire service (-19%), emergency management (-17%), critical infrastructure (-22%), and cybersecurity (-19%). A lack of participation from multiple disciplines limits the ability for the fusion centers to share information with stakeholders.
77 67 39 38
51%
56%
48%
50%
52%
54%
56%
58%
0
50
100
2016 2017
Th ou
sa nd
s
Tips and Leads Received Tips and Leads sent to other F/SLTT for action Percentage of Tips and Leads sent to other F/SLTT for action
Figure 20: Tips and Leads (2016-2017)
Key Findings: • Fusion centers posted shared more analytic products to HSIN-Intel. • Fusion centers share about one third of their overall analytic products on HSIN-Intel. • Fusion centers are allocating more time towards addressing RFIs, tips and leads, and case support/tactical products than
they are producing analytic or situational awareness products. • Participation in FLO Programs across all disciplines has seen a decline.
88% 79% 70% 65%
62% 58%
57%
57%
57% 44% 29%
71% 57% 48%
48% 44% 25%
39% 34%
32%
31%
14%
82%
60% 53%
51%
51%
35%
43% 27%
35% 25%
18%
0%
20%
40%
60%
80%
100%
Law Enforcement
Fire Service Emergency Management
Corrections/ Parole/
Probation
PH and Healthcare
EMS Private Sector
State National
Guard
Critical Infrastructure
Cybersecurity Tribal
2015 2016 2017
Figure 21: FLO Program Discipline Participation (2015-2017)
2017 National Network of Fusion Centers Final Report Page 21
Event and Incident Support Fusion centers report “direct role” support provided to both pre-planned events and no-notice incidents as outlined in the National Preparedness Goal.10 A fusion center has a “direct role” in an event when it actively supports agencies in the impacted AOR before, during, and/or immediately after the event. Examples of support activities include conducting threat or vulnerability assessments, deploying personnel to the incident site or operations center, or managing RFIs for an impacted fusion center.
Special Events In capturing pre-planned events, fusion centers identified direct role support they provided to both Special Event Assessment Rating (SEAR) events—Levels 1-5—and National Special Security Events (NSSE). SEAR events are preplanned special events below the level of NSSE that have been submitted via the annual National Special Event Data Call. SEAR Level 1 events involve federal support, while SEAR Level 5 typically only require state and/or local resources. The majority of these events are state and local events that may require support augmentation from the federal government. Meanwhile, NSSEs are events of national significance deemed by the Secretary of Homeland Security to be a potential target of terrorism or other criminal activity. NSSE events include presidential inaugurations, major international summits held in the U.S., major sporting events, and presidential nominating conventions.
Fusion centers provided direct support to 3,563 SEAR Level 1-5 and NSSE events in 2017, a 35% increase from the previous year. The majority of the support (87%) went to SEAR Level 4 and 5 events (Figure 22).11 The focus on SEAR Level 4 and 5 events is likely due to the fact that they occur most often. State and local resources primarily support these events. Fusion centers increased their support to SEAR Level 4 and 5 events by 35% in 2017. This indicates that fusion centers are supporting more of these localized events occurring in their AOR.
Disasters Fusion centers also captured their direct role in supporting federally-declared disasters.12 These types of disasters are of such severity and magnitude that effective response is beyond the capabilities of the state and local governments and that supplemental federal disaster assistance is necessary.
In 2017, fusion centers supported 38% (24 of 63) of federally declared disasters. This percentage is relatively consistent with 2016, but it was a significant decrease from 2015 (50%). In that year, fusion centers provided direct support to 50% of federally- declared disasters (Figure 23). Fusion centers support to disasters can help provide a more coordinated, timely and effective response to emerging incidents or threats, as well as the integration of law enforcement-focused prevention efforts with emergency management-focused efforts.
10 Find the complete National Preparedness Goal at https://www.fema.gov/national-preparedness-goal. 11 Given anonymized data in 2017, these numbers assume no overlap with reported event response. 12 As identified by FEMA in the official list of federally declared disasters. https://www.fema.gov/disasters/year
44 44
63
22 15 24
50%
34% 38%
0%
10%
20%
30%
40%
50%
60%
70%
0
10
20
30
40
50
60
70
2015 2016 2017
Declared Disasters Direct Role
% Direct Role
52 4 14
274
827
1193
30 5 11
406
1294
1817
0
500
1000
1500
2000
NSSE SEAR 1 SEAR 2 SEAR 3 SEAR 4 SEAR 5
2016 2017
Figure 22: Direct Role to NSSE and SEAR Events (2016-2017)
Figure 23: Direct Role to Federally-declared Disasters (2015-2017)
Page 22 2017 National Network of Fusion Centers Final Report
Active Shooter Events Fusion centers also identified active shooter events that they had a direct role in supporting. For the purposes of the Assessment, fusion centers only identified events from a list collected by the ALERRT Center at Texas State University.13 ALERRT identifies active shooter events using the following criteria:
• Individuals actively engaged in killing or attempting to kill people in populated areas.
•
•
At least one of the victims must be unrelated to the shooter. The primary motive appears to be mass murder; that is the shooting is not a by-product of an attempt to commit another crime.
Figure 24 compares the total number of active shooter events in 2016 and 2017 to the number of instances that fusion centers had a direct role. While fusion centers had a direct role in the same number of active shooter events as the previous years, there was a 14% increase in the percentage of events supported.
Terror Related Incidents For the purposes of the Assessment, fusion centers only identified terror related incidents from a list collected by START.14 START identifies terror related incidents that had to be an intentional act of violence or threat of violence by a non- state actor. In addition, two of the following three criteria also had to be met:
•
•
The violent act was aimed at attaining a political, economic, religious, or social goal. The violent act included evidence of an intention to coerce, intimidate, or convey some other message to a larger audience (or audiences) other than the immediate victims.
• The violent act was outside the precepts of International Humanitarian Law.
Figure 25 compares the total number terror related incidents in 2016 and 2017 to the number of instances that fusion centers had a direct role. In 2017, fusion centers had a direct role in 10 less terror related incidents than the previous year. This marked a 20% decrease in the percent of terror related incidents that occurring.
13 As identified in the Active Shooter Data published by Texas State University’s Advanced Law Enforcement Rapid Response Training (ALERRT) initiative. http://www.alerrt.org/ 14 Data obtained by START is pre-decisional and is intended to showcase the different types of support provided by fusion centers. As identified by the National Consortium for the Study of Terrorism and Responses to Terrorism, a Department of Homeland Security Center of Excellence headquartered at the University of Maryland. http://apps.start.umd.edu/gtd/.
21 17
13 13
62%
76%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90%
0
5
10
15
20
25
2016 2017
Active Shooter Events Direct Role
Percentage
55 59
24 14
44%
24%
0%
10%
20%
30%
40%
50%
0
10
20
30
40
50
60
70
2016 2017
Terror Related Incidents Direct Role Percentage
Figure 24: Direct Role to Active Shooter Events (2016-2017)
Figure 25: Direct Role to Terror Related Incidents (2016-2017)
Key Findings: • The SEAR Level 4 and Level 5 events represented the largest increases in SEAR event support from FY 2016.
• There was an increase in the percentage of Federally-declared disasters and active shooter events supported by fusion centers.
2017 National Network of Fusion Centers Final Report Page 23
Key Stakeholder Survey Fusion centers provide products and services of value and impact to support the customers and partners in their AOR. DHS worked with partner agencies to survey HSAs, heads of state police and investigative agencies, major city police chiefs and major county sheriffs, and state emergency management directors located within fusion center AORs. The purpose of this survey was to evaluate the overall satisfaction of key customers.
Satisfaction decreased slightly across nearly all key customers, with the average customer satisfaction decreasing by 2% (Table 4). In the 2017 survey, participants strongly agreed fusion center products and services were relevant, timely for mission needs, and increased situational awareness of threats within the AOR. Around 70% of participants indicated that fusion center products and services “influence my decision-making related to threat response activities within my AOR.” This category scored the lowest, which indicates room for improvement for fusion centers.
Question 2015 2016 2017
Percentage of key customers reporting that fusion center products are timely for mission needs
79%* 84% 83%
Percentage of key customers reporting that fusion center services are timely for mission needs 86% 83%
Percentage of key customers reporting that fusion center products are relevant 85%*
89% 86%
Percentage of key customers reporting that fusion center services are relevant 90% 87%
Percentage of key customers reporting that fusion center products influenced their decision making related to threat response activities within their AOR
71%* 73% 73%
Percentage of key customers reporting that fusion center services influenced their decision making related to threat response activities within their AOR 72% 71%
Percentage of key customers reporting that fusion center products resulted in increased situational awareness of threats within their AOR
86%* 84% 85%
Percentage of key customers reporting that fusion center services resulted in increased situational awareness of threats within their AOR 82% 80%
Percentage of key customers reporting that they are satisfied with fusion center products
74%* 85% 85%
Percentage of key customers reporting that they are satisfied with fusion center services 82% 77%
Average 79% 83% 81% Table 4: Percent “Strongly Agree” or “Agree” Key Stakeholder Survey (2015-2017)
* Questions regarding products and services were combined into one question in 2015. The 2016 survey was changed to differentiate between products and services
Key Findings: • Survey results showed a decrease in satisfaction across most topic areas.
Page 24 2017 National Network of Fusion Centers Final Report
95%
26%
14%
-60%
-18%
-13%
Performance Measures Fusion center performance measures were created to demonstrate the impact and value of the National Network in supporting national information sharing and homeland security outcomes. DHS also uses the performance measures to identify potential areas of growth in order to direct the right resources (e.g., training, personnel, and policies) to make steady, visible progress. DHS engaged with a working group of fusion center directors to develop performance measures.
Data collected against the performance measures (Table 6 on the following page) indicates a National Network that is performing strongly. Some of the measures are leveling off and others show a continued positive trend. For example, the percentage of federal IIRs originating from fusion center information that address a specific Intelligence Community need remained at 100%. Additionally, the percentage of fusion center distributable analytic products that address a specific Intelligence Community need remained constant at around 50%. This data shows that the relationship between the National Network and Federal Intelligence Community have reached a mature level with each side better understanding each other’s capabilities and needs.
There were several notable trends in the performance measures when comparing 2016 to 2017 (Table 5). First, coordination between fusion centers (and with their federal partners) also appears to be trending upward—the number of distributable analytic products co- authored by one or more fusion centers and/or federal agencies increase by 14% in the last year, up 33% since 2015. Additionally, the percentage of fusion center distributable analytic products that address state/local customer information needs increased by 3% from last year, after having remained the same from 2015 to 2016.
Another notable trend in the performance measures was the use of the Nationwide Suspicious Activity Reporting (SAR) Initiative (NSI). Fusion centers play an important role in identifying, reporting, evaluating, and sharing suspicious activity reports, both for national awareness and for follow-up by the FBI. Although the number of SARs submitted by fusion centers decreased by 27% from 2016 to 2017, the number of SARs submitted by fusion centers that resulted in the initiation or enhancement of an FBI investigation increased by 95%. This was the highest level in the last three years. These changes may reflect the increase in the quality of the SARs being submitted, with centers better evaluating the information they receive before passing it along.
Performance Measures Percent
Change in 2017
Number of SARs vetted and submitted by fusion centers that result in the initiation or enhancement of an investigation by the FBI
Number of case support and/or tactical products developed and disseminated by fusion centers
Number of distributable analytic products co-authored by one or more fusion centers and/or federal agencies
Number of SAR vetted and submitted by fusion centers that involve an individual on the Watchlist
Percentage of RFIs from the TSC for which fusion centers provided information for a TSC case file
Number of tips and leads vetted by the fusion center Table 5: Notable Performance Measure Trends (2017)
Key Findings: • Over half of the performance measures have leveled off or showing a continued positive trend.
• The number of SARs submitted by fusion centers that resulted in the initiation or enhancement of a FBI investigation increased.
• There was an increase in the number of distributable analytic products co-authored by one or more fusion centers and/or federal agencies.
2017 National Network of Fusion Centers Final Report Page 25
Performance Measures 2015 2016 2017 Percent Change in 2017
Percentage of federal Information Intelligence Reports (IIRs) originating from fusion center information that address a specific Intelligence Community need 90% 100% 100% 0%
Percentage of federal IIRs originating from fusion center information that the Intelligence Community otherwise used in performing its mission (e.g., contained first-time reporting; corroborated existing information; addressed a critical intelligence gaps; or helped to define an issue or target).
86% 98% 93% -5%
Percentage of fusion center distributable analytic products that address a specific Intelligence Community need N/A 53% 53% 0%
Number of Suspicious Reports (SAR) vetted and submitted by fusion centers that result in the initiation or enhancement of an investigation by the Federal Bureau of Investigation (FBI) 225 132 258 95%
Number of SAR vetted and submitted by fusion centers that involve an individual on the Watchlist 148 70 28 -60%
Percentage of Requests for Information (RFIs) from the Terrorist Screening Center (TSC) for which fusion centers provided information for a TSC case file 75% 67% 49% -18%
Percentage of I&A Watchlist nominations that were initiated or updated existing case files based on information provided by fusion centers N/A 13% 8% -5%
Number of distributable analytic products co-authored by one or more fusion centers and/or federal agencies 137 160 182 14%
Percentage of fusion center distributable analytic products that address Homeland Security topics 18% 25% 23% -2%
Percentage of fusion center distributable analytic products that address state/local customer information needs 10% 10% 13% 3%
Percentage of key customers reporting that they are satisfied with fusion center products 74%* 85% 85% 0%
Percentage of key customers reporting that they are satisfied with fusion center services 74%* 82% 77% -5%
Percentage of key customers reporting that fusion center products are relevant 85%* 89% 86% -3%
Percentage of key customers reporting that fusion center services are relevant 85%* 90% 87% -3%
Percentage of key customers reporting that fusion center products are timely for mission needs 79%* 84% 83% -1%
Percentage of key customers reporting that fusion center services are timely for mission needs 79%* 86% 83% -3% Percentage of key customers reporting that fusion center products influenced their decision making related to threat response activities within their AOR 71%* 73% 73% 0%
Percentage of key customers reporting that fusion center services influenced their decision making related to threat response activities within their AOR 71%* 72% 71% -1%
Percentage of key customers reporting that fusion center products resulted in increased situational awareness of threats within their AOR 86%* 84% 85% 1%
Percentage of key customers reporting that fusion center services resulted in increased situational awareness of threats within their AOR 86%* 82% 77% -5%
Number of tips and leads vetted by the fusion center 74,379 76,743 66,758 -13% Number of tips and leads vetted by the fusion center that were provided to other F/SLTT agencies for follow up action N/A 39,472 37,715 -4%
Number of responses to RFIs from all sources 443,881 375,222 426,394 14%
Number of situational awareness products developed and disseminated by fusion centers 99,820 87,741 202,007 130%
Number of case support and/or tactical products developed and disseminated by fusion centers 140,937 153,010 192,750 26%
Percentage of federally designated special events in which fusion centers played a direct role** 49% 28% 42% 14%
Percentage of federally declared disasters in which fusion centers played a direct role 61% 34% 38% 4%
Number of public safety incidents in which fusion centers played a direct role N/A 37 27 -27% Table 6: Performance Measures (2015-2017)
* 2016 survey was changed to show difference between products and services ** Given anonymized data in 2017, these numbers assume no overlap with reported event response
Page 26 2017 National Network of Fusion Centers Final Report
Fusion Center Communications Drill DHS I&A conducted the fifth annual Communications Drill during the week of August 14 – 18, 2017. The drill evaluated the ability of individual fusion centers to receive unclassified and classified communications from the federal government via the following communication methods:
• Unclassified E-mail; • HSIN-Intel (via the National Situational Awareness Training Room); • HSDN; • STE; and • SVTC.
This self-paced drill was scheduled by region with each fusion center participating in five stages over approximately two hours. Participants progressed through all stages at their own pace or until their block of time was complete. Drill participants accessed specific unclassified and classified information sharing mechanisms to establish and verify connectivity with drill controllers. Once system connectivity was established and acknowledged, participants proceeded to the next stage.
Results The ability for fusion centers to receive information via unclassified email and HSIN-Intel was mostly unchanged from the previous years. In each year, nearly all fusion centers were able to receive communications using these methods.
Communications through SVTC and HSDN dropped by 4% and 7% (Figure 26), respectively from the previous year. Communication through the STE increased by 5%. It should be noted that this does not account for fusion centers who do not have access to the equipment tested. However, on average 89% of fusion centers can communicate using all five types of communication methods.
99%
100%
81%
82%
84%
100%
99%
88%
77%
88%
99%
99%
87%
81%
86%
0% 20% 40% 60% 80% 100%
Unclassified E-mail
HSIN Intel
HSDN
STE
SVTC
2015 2016 2017
Key Findings: • Fusion centers with connectivity to HSDN has declined.
Figure 26: Fusion Center Communications Drill (2015-2017)
2017 National Network of Fusion Centers Final Report Page 27
Homeland Security Grant Program
The Homeland Security Grant Program (HSGP), administered by the FEMA Grant Programs Directorate (GPD), continues to serve as the primary source of federal grant funding for fusion centers. HSGP supports state, local, tribal, and territorial efforts to prevent terrorism and other catastrophic events and to prepare the Nation for the threats and hazards that pose the greatest risk to the security of the United States. The FY 2017 HSGP supports the following fusion center related priorities: (1) Building and Sustaining Law Enforcement Terrorism Prevention Capabilities; and (2) Maturation and Enhancement of State and Major Urban Area Fusion Centers. To ensure fusion center funding, HSGP requires grantees to include one investment in support of the fusion center within the state or urban area. The Fusion Center Assessment is leveraged to both justify grant funding for projects in support of these priorities and ensure project implementation. Each proposed project included in the fusion center investment must align to, and reference, specific performance areas of the Assessment that the funding is intended to support. Additionally, to effectively measure implementation of this priority, designated State and major Urban Area fusion centers leveraging HSGP funds are evaluated based upon compliance with a set list of requirements. These requirements are tracked on a yearly basis through the Fusion Center Assessment. In 2017, 68 of the 77 participating fusion centers were compliant in all requirements. DHS will inform fusion center leaders of any instances in which requirements were not met, and work with them to take appropriate actions to ensure compliance in future years.
Homeland Security Grant Program
HSGP plays an important role in the implementation of the National Preparedness System (NPS) by supporting the building, sustainment, and delivery of core capabilities essential to achieving the National Preparedness Goal (NPG) of a secure and resilient Nation. Delivering core capabilities requires the combined effort of the whole community, rather than the exclusive effort of any single organization or level of government.
2017 National Network of Fusion Centers Final Report A-1
Appendix A: Key Terms and Acronyms
Key Terms Active Shooter Event: As defined by the Texas State University’s Advanced Law Enforcement Rapid Response Training Center (ALERRT), an active shooter event includes the following three criteria: (1) individuals actively engaged in killing or attempting to kill people in populated areas; (2) at least one of the victims must be unrelated to the shooter; and (3) the primary motive appears to be mass murder; that is the shooting is not a by-product of an attempt to commit another crime.
Case Support Product (may also be called Tactical Product): A product that supports a specific investigation or operational activity, and may be analytic in nature (e.g., toll or link analysis, association charts).
Direct Role: Provide active support before, during, and/or immediately after an event to agencies in the impacted AOR. Direct role support includes, but is not limited to, conducting threat or vulnerability assessments, deploying personnel to the incident site or operations center, and managing RFIs for an impacted fusion center.
Distributable Analytic Product: A report or document that contains assessments, forecasts, associations, links, and/or other outputs from the analytic process that is disseminated via HSIN-Intel for use in the improvement of preparedness postures, risk mitigation, crime prevention, target hardening, or apprehension of offenders, among other activities. Analytic products may be created or developed jointly with federal, state, and local partners.
Federally Declared Disasters: The formal action by the President of the United States, at the request of the Governor of an affected State, to make a State eligible for major disaster or emergency assistance under the Robert T. Stafford Disaster Relief and Emergency Assistance Act, 42 U.S.C. §§ 5121-5207 (the Stafford Act). These declaration types authorize the President to provide supplemental federal disaster assistance.
Fusion Liaison Officer (FLO): Individuals who serve as the conduit for the flow of homeland security and crime-related information between the field and the fusion center for assessment and analysis. FLOs can be from a wide variety of disciplines, provide the fusion center with subject matter expertise, and may support awareness and training efforts.
FLO Program: FLO programs vary in focus, complexity, and size, but all have the same basic goal of facilitating the exchange of information between fusion centers and stakeholders within the fusion center’s area of responsibility.
Governance Board: An oversight entity composed of officials with decision-making authority, capable of committing resources and personnel to a fusion center.
HSIN-Intel: A community of interest (COI) located on the Homeland Security Information Network (HSIN) that provides Federal partners, the National Network of Fusion Centers (National Network), and other select field-based information sharing partners, a secure platform to share unclassified products and information and facilitate analytic collaboration.
A-2 2017 National Network of Fusion Centers Final Report
Intelligence Information Report (IIR): A formal standardized method of disseminating raw unevaluated information, on behalf of the DHS Intelligence Enterprise (IE) and other information providers, to elements of the Intelligence Community (IC) and the DHS IE as appropriate.
Privacy, Civil Rights, and Civil Liberties (P/CRCL) Officer: A designated fusion center individual who helps promote the fusion center’s privacy, civil rights and civil liberties protections, processes and efforts. They also assess how their fusion center privacy policy is being implemented and provide annual training to fusion center personnel.
Representatives: Individuals who are not employed by the fusion center or the fusion center's home agency, but work at the fusion center on at least a part-time basis. These individuals apply specialized knowledge to assist various elements of fusion center operations, but are employed by other state, local, tribal, and territorial, or private sector entities— NOT federal entities. Their salaries are not part of the fusion center's direct budget and are provided by an agency other than the primary agency the fusion center is associated with.
Request For Information (RFI): A request that could include, but is not limited to, requests for information or intelligence products or services such as name traces, database checks, assessments, subject matter expertise assistance, or finished intelligence products.
Suspicious Activity Report (SAR): Official documentation of observed behavior that is reasonably indicative of pre- operational planning associated with terrorism or other criminal activity.
Situational Awareness Products: A situational awareness product describes an event or incident of interest to customers (e.g., Be-On-the-Lookout reports, notes, event reports, daily bulletins, Situational Reports, raw reporting).
Standard Deviation: A numerical value used to determine how widely numbers in a group vary.
Terror Related Incident: As defined by the University of Maryland National Consortium for the Study of Terrorism and Responses to Terrorism (START), a terror related incident is an intentional act of violence or threat of violence by a non- state actor and must meet two of the following three criteria: (1) the violent act was aimed at attaining a political, economic, religious, or social goal; (2) the violent act included evidence of an intention to coerce, intimidate, or convey some other message to larger audience (or audiences) other than the immediate victims; and (3) the violent act was outside the precepts of International Humanitarian Law.
Tips and Leads: Information provided from fusion center stakeholders, the general public, or other sources regarding potentially criminal or illicit activity, but not necessarily or obviously related to terrorism.
Watchlist: A single database that contains sensitive national security and law enforcement information concerning the identities of those who are known or reasonably suspected of being involved in terrorist activities.
2017 National Network of Fusion Centers Final Report A-3
Acronyms AOR Area of Responsibility
ALERRT Advanced Law Enforcement Rapid Response Training
CBP Customs and Border Protection
DHS Department of Homeland Security
F/SLTT Federal, State, Local, Tribal, Territorial
FBI Federal Bureau of Investigation
FIG Field Intelligence Group
FLO Fusion Liaison Officer
HSDN Homeland Secure Data Network
HSIN-Intel Homeland Security Information Network – Intelligence
I&A Office of Intelligence and Analysis
IIR Intelligence Information Report
JTTF Joint Terrorism Task Force
National Network The National Network of Fusion Centers
NFCA National Fusion Center Association
NSI Nationwide Suspicious Activity Reporting (SAR) Initiative (NSI)
NSSE National Special Security Events
P/CRCL Privacy, Civil Rights, and Civil Liberties
RFI Request for Information
RISS Regional Information Sharing Systems
SAR Suspicious Activity Report
SEAR Special Event Assessment Rating
SLTT State, Local, Tribal, Territorial
START Study of Terrorism and Responses to Terrorism
TSC Terrorist Screening Center
Page 4 2017 National Network of Fusion Centers Final Report
- Executive Summary
- Methodology
- Findings
- Recommendations
- Introduction
- Purpose
- Background
- 2017 Snapshot
- Key Findings & Recommendations
- Data Sources and Methodology
- Fusion Center Profiles
- Key Customer Survey
- Partner Agency Data
- Department of Homeland Security
- Partners
- Other Agencies
- Fusion Center Communications Drill
- Findings
- Hours of Operations
- Colocation with Partner Agencies
- Fusion Center Staff
- State, Local, Tribal, and Territorial Representatives
- Analysts
- Key Positions
- Governance Structure
- Governance Body Membership
- Operational Costs
- Year-Over-Year Funding Changes
- Non-Staff Spending
- Mission
- Focus Areas
- Cybersecurity Focus
- Critical Infrastructure Focus
- Information Sharing
- 2017 Information Sharing Activities per Staff Member
- Distributable Analytic Production
- Tips and Leads and RFIs
- Fusion Liaison Officer Program
- Event and Incident Support
- Special Events
- Disasters
- Active Shooter Events
- Terror Related Incidents
- Key Stakeholder Survey
- Performance Measures
- Fusion Center Communications Drill
- Results
- Homeland Security Grant Program
- Appendix A: Key Terms and Acronyms
- Key Terms
- Acronyms
