During its first year, the FBI’s eGuardian system has proven a robust tool for aggregating terrorist threat information, in particular suspicious activity reports (SARs), according to a senior member of the agency’s Counterterrorism Division.
Launched in January 2009, eGuardian contains close to 3,400 reports that have generated 56 investigations, said FBI Section Chief J. Roger Morrison during a panel discussion session at this week’s FOSE/GovSec/U.S. Law conference in Washington, D.C.
The eGuardian system is one of the core technological elements of the Information Sharing Environment (ISE) established by congressional mandate in response to the intelligence failures that preceded the 9-11 attacks.
In a typical scenario, a law enforcement agency will either generate its own SAR or field one from the public. SARs describe legal behaviors that may be terrorist precursors, such as photographing critical infrastructure or inquiring with site staff about the nature and level of security at a location. Stakeholders believe that SARs are a key to “connecting the dots” and detecting unfolding terrorist plots. For example, reports of possible site surveillance in various states might all involve the same vehicle.
The reporting agency—local, state, or federal—then enters the information into an external eGuardian portal. The report is then reviewed by an intelligence analyst or trained law enforcement officer, typically at a state or regional intelligence fusion center. If the report constitutes a legitimate SAR, it is designated within eGuardian for follow-up by an FBI-led regional Joint Terrorism Task Force (JTTF). The SARs are simultaneously analyzed regionally and nationally to spot patterns.
JTTFs, composed of local, state, and federal officers, form the “tip of the spear” in domestic terrorism investigations, explained fellow panelist Tom O’Reilly, a senior policy advisor with the Department of Justice assigned to the inter-agency National SAR Initiative (NSI).
Morrison said the country’s JTTFs are busier now in the wake of the Fort Hood shootings and the failed Christmas Day attack on a Detroit-bound airliner than they have been since 9-11.
The eGuardian system maintains the original submitter’s “ownership” of the SAR by providing access and listing both feedback and, if applicable, contact information for the JTTF member investigating the tip, Morrison said.
The Department of Homeland Security, meanwhile, continues its NSI effort in collaboration with the DOJ and the ISE’s program manager to educate local, state, and federal law enforcement agencies on detecting possible terrorist precursor behavior—to the exclusion of First Amendment-protected activities—and generating SARs. The current pilot involves 12 agencies, O’Reilly said, plus federal partners.