More on suspicious activity reporting and the federal government's efforts to embed privacy and civil liberty controls into the process from Security Mangement associate editor, Matthew Harwood.
At the end of a nondescript hallway in a nondescript building in the heart of Washington, D.C.’s Chinatown, a tiny office of federal agents works to build a nationwide information-sharing network. They do so in the belief that information collected by local police can be shared with other state and federal law enforcement agencies in an effort to identify and disrupt terrorist plots against the United States, all without violating citizens’ civil liberties or privacy.
Established in March 2010, the Department of Justice’s (DOT) Nationwide Suspicious Activity Reporting (SAR) Initiative Program Management Office (NSI-PMO) performs two primary duties. The interagency office provides federal standards and training to state and local law enforcement to observe and report suspicious activities indicative of terrorist planning, while helping them implement the standardized business processes necessary to securely share those reports with homeland security stakeholders across all levels of government.
The effort, however, has been met with a cool reception from civil liberties and privacy watchdog groups, who caution that government programs such as these lead the United States further down the path to a surveillance society. “SAR programs increase the probability that innocent people will be stopped by police and have their personal information collected for inclusion in law enforcement and intelligence data bases,” the American Civil Liberties Union (ACLU) has warned. “They also open the door to racial profiling and other improper police practices by giving police unwarranted discretion to stop people who are not reasonably suspected of wrongdoing.”
While the NSI-PMO’s agents understand the fears associated with this aspect of America’s post-9-11 domestic intelligence architecture, they say that they’re doing everything in their power to prove to the public that they have created a system that respects and values civil liberties and privacy rights.
According to NSI-PMO Director Thomas O’Reilly, all participating sites have to adopt the NSI Privacy Protection Framework prior to gaining access to the Information Sharing Environment (ISE) Shared Space, a secure, federal, distributed IT network devoted to terrorism-related information.
Next, agencies must apply the federal government’s SAR standard, specifically the ISE-SAR Functional Standard v.1.5, which reiterates that the program must respect constitutional safeguards when gathering and sharing information. Finally, participating agencies’ personnel must receive privacy training.
It’s the NSI-PMO’s job to ensure that agencies integrated into the program understand what constitutes suspicious activity and what does not, says Senior Advisor Steven King. To do this, the NSI-PMO has developed three levels of training for local and state law enforcement officers. The three levels consist of executives, analysts, and cops on the beat; the training is intended to ensure that participants know what’s expected of them when it comes to protecting citizens’ civil liberties and privacy rights. Additionally, the NSI-PMO has enlisted the help of police associations—including the International Association of Chiefs of Police and the Major Cities Chiefs Association—as well as state and major urban area fusion centers to train officers nationwide.
For front-line officers, King emphasizes that the training instructs them to watch out for 16 different behaviors—for example, security testing, storing weapons caches, and surveillance—that could indicate terrorist activity. It stresses that an officer should never home in on individuals because of their race, religion, or ethnicity without the appropriate context.
The behaviors selected are not arbitrary or speculative. “They are behaviors that have been gleaned out of past terrorism events, domestically or internationally, where we have used the post-action investigative reports...to validate that these in fact were precursors to terrorist events,” says O’Reilly.
Approximately 46,000 front-line federal, state, local, and private sector partners have already received NSI training, according to the DHS. The NSI-PMO’s goal, however, is daring: train all of the country’s 800,000 law enforcement officers on how to identify and report suspicious activities related to terrorism, O’Reilly relates. “We want to make sure that there are no transgressions” committed by police officers, he says, and that “civil liberties and privacy rights of citizens are protected.”
Technical requirements also exist to ensure that personally identifiable information (PII) is protected when agencies share that data. Before every search, the system asks analysts, primarily at fusion centers, to articulate the purpose of each search they conduct. O’Reilly says this reduces the chance that analysts will go on fishing expeditions.
Participating agencies that create SARs have the discretion of not including personal information in the report as another privacy protection. Generally that decision is based on state privacy laws if they’re more strict than federal law. O’Reilly says that about 75 percent of all SARs do not contain PII. According to the SAR functional standard, even reports that do not include PII contain enough information to “support sufficient trending and pattern recognition to trigger further analysis” by NSI participants.
There are also methods of redress for individuals who were the subject of a SAR, notes O’Reilly. Persons who feel that they were inappropriately placed into the network can file a request with the appropriate fusion center to purge their information from that SAR report.
O’Reilly says the federal government instituted these safeguards after incidents where local, state, and federal law enforcement singled out nonviolent groups for investigation without evidence of criminal wrongdoing. While the number of transgressions are viewed as “de minimus out of the overall level of traffic that we’re dealing with,” explains O’Reilly, the NSI-PMO understands that the only way SAR programs will be effective is if people trust that law enforcement and federal domestic intelligence agents will not abuse their power.
After listening to complaints about SAR programs from civil liberties groups in 2008, O’Reilly notes that the federal government revised its SAR functional standard the next year to restrict law enforcement officers from creating a SAR unless there is a reasonable connection to terrorism. It also affirmed that activities like photography are protected under the First Amendment and that officers must be able to articulate why they stopped someone for engaging in activities that are ordinarily viewed as innocent.
Former FBI Agent Mike German, the ACLU’s national security, immigration, and privacy counsel, states that while his organization appreciates that NSI-PMO is open to working with the civil liberties and privacy community, the ACLU doesn’t believe “collecting innocuous behaviors of people is a good methodology.”
Rather, the ACLU believes that the SAR initiative only leads to more improper police stops of people who are doing nothing more than engaging in constitutionally protected activities such as photography.
He points to an incident last winter where a photographer in front of the White House was confronted by the Secret Service for taking pictures of them. In the video posted on YouTube, the photographer asks the officer whether he can stop him for taking pictures. “We do that a lot,” the officer tells the photographer, adding that the photographer looks suspicious.
German said such incidents demonstrate why SAR programs should not exist. “But if they’re going to exist,” he said, “the ACLU is pleased government takes its concerns seriously.”
Currently, the NSI-PMO is creating a SAR training program for employees who work at privately owned U.S. critical infrastructure facilities. The goal is to encourage private security personnel and employees to report to local law enforcement or their nearest fusion center any suspicious activities they encounter.