nationwide suspicious activity reporting (sar) initiative€¢ establishes a unified,...

1

nsi.ncirc.gov

Nationwide Suspicious Activity Reporting (SAR) Initiative

2

nsi.ncirc.gov

NSI Project Partners

3

nsi.ncirc.gov

• The need for the NSI is shown by intelligence failures of September 11, as noted in The 9/11 Commission Report

• National Criminal Intelligence Sharing Plan• Intelligence Reform and Terrorism Prevention Act of 2004

• Establishment of the Information Sharing Environment• Information Sharing Environment Implementation Plan• President’s National Strategy for Information Sharing• White House memos creating two Program Management

Offices

A Brief History of the NSI

4

nsi.ncirc.gov

What We Know

• Information gathered may be a precursor to criminal activity, including terrorism

• Sharing information can prevent or solve crimes and even save lives when linked together

• Technology plays a role• Human verification is critical to ensure the

protection of an individual’s privacy and civil liberties

5

nsi.ncirc.gov

The Cornerstones of the NSI

• Establishes a unified, standards-based approach at all levels of government to gather, document, process, analyze, and share information about behavior-based suspicious activities that potentially have a nexus to terrorism (also referred to as the SAR process) while rigorously protecting the privacy, civil rights, and civil liberties of all Americans

• Integrates state, local, and tribal law enforcement agencies’ SAR processes into a nationwide effort

• Leverages existing processes and systems

6

nsi.ncirc.gov

Why SAR and Why Now

• Dhiren Barot• In 2000, began plotting to attack a host of

financial industry targets in the United States • The World Bank, the New York Stock Exchange, Citigroup

buildings, and the Prudential Building

• Mumbai preoperational planning actions• Detailed street maps leading to target

locations• Detailed diagrams of hotel

floor plans/layouts• Stayed at target hotels• Indian national arrested. Had detailed

drawings of targeted Mumbai hotels,train terminal, and other sites

7

nsi.ncirc.gov

NSI Privacy and Civil Liberties Protections

• NSI Privacy Protection Framework:• Privacy policy• ISE-SAR Functional Standard• Privacy training

• Executive Briefing• Analyst Training• Frontline Officer Training

• SAR Vetting Process

8

nsi.ncirc.gov

• State and major urban area fusion centers serve as primary focal points within the state and local environment for the receipt, analysis, gathering, and sharing of threat-related information among federal, state, local, tribal, and territorial partners

• NSI is implementing standards, policies, and business processes in fusion centers• Quality, relevant information is sent to trained fusion

center analysts for vetting and analysis• Key for national coordination and analysis

Importance of Fusion Centers

9

nsi.ncirc.gov

Training

• Current Offerings• Executive Briefing• Analytic/Investigative-Level Training• Line Officer Training• Community Awareness (In

collaboration with the “If You See Something, Say Something™” campaign)

• Under Development• Public Health and EMS• Public Safety / Criminal Justice /

Critical Infrastructure

10

nsi.ncirc.gov

Enabling Technology

• To support the operational mission, NSI Federated Search Tool facilitates information sharing using the National Information Exchange Model (NIEM)• Searches across a federated 

environment, using a standardized data format

• Decentralized, local agencies maintain control of information, privacy compliance with ISE Privacy Guidelines

• Map it/Link it Tool Added to NSI Federated Search Capabilities

11

Moving Local Data to the Shared Space(Common Box Server)

Local Data Sources

Local Data Sources

Local Data Sources

Fusion Center A

Fusion Center B

Fusion Center C

RESULTSPAGE

Server

ServerServer

Server

Server

Secure Portals

ISE Shared Spaces

Federated Search(www.ncirc.gov)

(HSIN Intel, LEO, RISS)

Conducting a Federated NSI Search

FederalServers

(eGuardianDHS)

13

nsi.ncirc.gov

The Driving Force

• The most important component of the program is supporting the operational mission. The job of homeland security, safety, or justice cannot be relegated to a fragmented approach

• Standards‐based method for the gathering, processing, reporting, analyzing, and sharing of suspicious activity (also referred to as the SAR process)

• Critical integration of state, local, and tribal law enforcement agencies’ SAR processes into a nationwide effort

14

nsi.ncirc.gov

Access toNSI Federated Search

SBU Networks

15

nsi.ncirc.gov

The user logs into LEO and is brought to this page

Goes to menu on the left and “clicks” on “CJIS Portal”

16

nsi.ncirc.gov

The user will then “click” on the RISSNET box

17

nsi.ncirc.gov

This is the RISS logon page

18

nsi.ncirc.gov

19

nsi.ncirc.gov

20

nsi.ncirc.gov

This is the NSIFederated Search page

21

nsi.ncirc.gov

Using the NSI Federated Search

22

nsi.ncirc.gov

NSI Federated Search Entrance Page

This is for test purposes

23

nsi.ncirc.gov

NSI Search Screen

OR

24

nsi.ncirc.gov

NSI Search Screen

25

nsi.ncirc.gov

NSI Search Screen

26

nsi.ncirc.gov

NSI Search Screen

27

nsi.ncirc.gov

28

nsi.ncirc.gov

29

nsi.ncirc.gov

30

nsi.ncirc.gov

SLATT Database Search

31

nsi.ncirc.gov

32

nsi.ncirc.gov

33

nsi.ncirc.gov

34

nsi.ncirc.gov

35

nsi.ncirc.gov

NSI Next GenerationSearch Tool

36

nsi.ncirc.gov

Map It/Link It

37

nsi.ncirc.gov

Map it

39

nsi.ncirc.gov

Link it

40

nsi.ncirc.gov

Single Line Search

41

nsi.ncirc.gov

Texas AND Blue Ford

This functionality enables the Analyst to search multiple parameters using a single line search parameter and allows the use of the AND/OR capabilities.

It also includes the current detailedsearch page usingthe Advanced search option.

42

nsi.ncirc.gov

43

nsi.ncirc.gov

Subscription/NotificationSaved Query Abilities

44

nsi.ncirc.gov

45

nsi.ncirc.gov

46

nsi.ncirc.gov

47

nsi.ncirc.gov

48

nsi.ncirc.gov

49

nsi.ncirc.gov

50

nsi.ncirc.gov

Success Stories—Private Sector (continued)

• VA Fusion Center received 3 reports of suspicious purchase of acetone and other products all on the same date, within a few hours of each other

• 3 different stores, total of 47 gallons • Subjects identified• Purchases tied to the manufacture of a drug – K2

51

nsi.ncirc.gov

Success Stories—Traffic Stop

• Motor officer attended behavior‐based SAR roll call training

• Conducted a traffic stop• Driver appeared extremely nervous, unable to answer 

routine questions• Officer discovered an expired international driver’s license• Officer contacted LAPD counterterrorism Major Crimes 

Division     • Officer completed a SAR• Further investigation revealed that the

vehicle was of interest

52

nsi.ncirc.gov

SAR Success Story

• Fusion center partner agencies continue to integrate SAR into their procedures, populating the shared space

Success Stories SAR Line Officer Training 

53

nsi.ncirc.gov

Questions?David P. LewisUSDOJ/BJA

NSI Chief Technology Officer(202) 616‐7829

david.p.lewis@usdoj.gov