Civil Liberty Concerns Could Become a Factor in Grants to State Fusion Centers

By Matthew Harwood
Making Civil Liberties a Priority
DHS has also made it a priority to educate fusion centers in how to collect and store domestic intelligence while respecting civil liberties and privacy. After the two fusion center reports provoked public outcry last winter, the DHS's Office for Civil Rights and Civil Liberties deployed staff to conduct civil liberties and privacy training at MIAC and NCTFS.
In Missouri, DHS sent the civil liberties team to conduct a one-day training course after a DHS intelligence analyst inside the MIAC asked headquarters for guidance, Dave Hall, the fusion center's director, told Security Management. Neither DHS nor MIAC staff brought up the strategic report that caused the controversy, he said.
After the DHS training, Hall's fusion center instituted a review process to ensure that civil liberties are taken into account before a report is released as well as put a moratorium on strategic reports until further notice.
Things happened a little bit differently in North Central Texas.
The fusion center's chief, Kelley Stone, director of Collin County Department of Homeland Security, told Security Management that he didn't even learn of the report until DHS informed him of it. When the report was issued, Stone was overseas while his senior intelligence officer who would have normally reviewed the bulletin was in training. At that time, a private contractor, ADB Consulting, drew up the bulletin for the NCTFS. Stone said that the antiwar and Muslim-American activities the private contractor flagged as threatening were "obviously constitutionally protected."
After learning of the bulletin, Stone said he suspended publication of the bulletins and prohibited private contractors from writing the prevention awareness bulletins. Today, either Stone or his senior intelligence officer must approve the bulletins, which are now written in-house, before they are distributed to customers.
Stone then asked DHS for additional guidance on civil liberties and privacy issues. In June, DHS visited the fusion center for a one-day training session in key civil liberties and privacy concepts, including discussions on the First Amendment. Group workshops also broke down hypothetical situations involving the training's core concepts. The center then rewrote its privacy policy after DHS reviewed it and provided technical assistance. Stone finally reached out to the Texas chapter of the ACLU and the Freedom and Justice Foundation, an advocacy organization made up of Texas Muslims, to show its concern for civil liberties and privacy issues.
 "We've learned from our mistakes," he said. "We thought we had the appropriate checks and balances in place."
David Gersten, acting deputy officer at the Office for Civil Rights and Civil Liberties, told Security Management that the controversial reports issued by MIAC and NCTFS were isolated incidents and that no individual has ever come forward to complain about state fusion centers violating their privacy rights or civil liberties. The ACLU, however, has alleged violations and Gersten said his office is investigating. (Read a 2007 ACLU report questioning fusion centers, here.)
To further help state-based fusion centers to respect civil liberties and privacy rights, DHS has implemented a number of other initiatives besides civil liberties and privacy training sessions. The department now actively pushes fusion centers to adopt  Fusion Center Guidelines drafted by DHS and the Department of Justice, according to Bart R. Johnson, acting under secretary of intelligence and analysis.
Gerstein’s office also performs privacy impact assessments on fusion centers, one of which is forthcoming in the next few months.
Another way DHS  exerts oversight over fusion centers is through a federal regulation known as 28 CFR Part 23, said Johnson. The code regulates what type of information can be collected and stored in “criminal intelligence information systems” run by law enforcement agencies that receive federal money.
According to the code, police cannot collect or maintain information on any person or group—especially information about their “political, religious, or social views, associations, or activities"— unless there's reasonable suspicion they’re involved in a crime.

Enforcement Problems

A regulatory loophole seemingly remains nevertheless. Because fusion centers are not federal entities, both Johnson and Gersten told Security Management that there isn't a lot DHS can do to hold fusion centers accountable. Fusion centers, however, do rely substantially on federal funding to sustain operations, a fact not lost on groups like the ACLU.
Civil libertarians have seized upon this to force DHS to hold fusion centers more accountable. In a recent letter to the House Homeland Security Committee, a group of privacy and civil liberty organizations complained that DHS’s Chief Privacy Officer needed to use the power of the federal purse on fusion centers.
“Merely writing the [privacy impact assessment on fusion centers] does not provide this necessary oversight,” the letter signed by the ACLU and the Electronic Privacy Information Center said. “Neither does ‘encouraging’ fusion centers to take certain actions without mandating those actions as conditions of receiving funding.”
DHS is considering this approach, according to Johnson. He told Security Management that DHS is working on policy to make fusion centers implement privacy and civil liberties protections before they can receive homeland security grants.
But whether or not that policy will ever be adopted is still up in the air.

“It takes time in government for policies to be drafted, reviewed, cleared and finally approved,” I&A spokesman Andrew Lluberes said.

UPDATE: On December 15, DHS released its "Guidance and Application Kit" for the Homeland Security Grant Program for  fiscal year 2010, explicitly tying grant funding for fusion centers to civil liberties and privacy protections. 

Within the document, DHS mandates that all fusion centers that receive federal funding in fiscal year 2010 certify that they have civil liberties and privacy protections in place "at least as comprehensive as the ISE Privacy Guidelines" within 6 months of receiving the award.

If they do not submit their civil liberties and privacy protections for review to the ISE Privacy Guidelines Committee within the 6-month time frame, "DHS grants funds may only be leveraged to support the development and/or completion of the fusion center's privacy protections requirements."

DHS also expects all fusion center employees in 2010 to complete online 28 CFR Part 23 certification training.

♦ Photo by rpongsaj/Flickr

View Recent News (by day)


Beyond Print

SM Online

See all the latest links and resources that supplement the current issue of Security Management magazine.