CONNECTING the DOTS

In the aftermath of the 9-11 terrorist acts, one of the most bothersome aspects was the notion espoused by many that the tragic incidents somehow could have been avoided. In hindsight, official government documents and news reports indicated that clues to the sinister plot were readily available, but these warnings either were missed or those with critical information lacked a way to process and disseminate the data as needed.

In this environment, the federal government embraced the development of fusion centers, where information from law enforcement, governments and the private sector can be aggregated in an effort to identify threats to the nation's critical infrastructure so that they can be thwarted.

“The ultimate goal of a fusion center is to provide a mechanism where law enforcement, public safety and private partners can come together with a common purpose and improve the ability to safeguard our homeland and prevent criminal activity,” states the Fusion Center Guidelines created under the leadership of the U.S. Department of Justice. “A police officer, fireman or building inspector should not have to search for bits of information. They should know to call one particular place — the jurisdiction's fusion center.”

Although the purpose is relatively simple to state and has been pursued vigorously during the past five years — there are more than 40 fusion centers nationwide, said Paul Wormeli, executive director of the Integrated Justice Information Systems (IJIS) Institute — realizing this ideal is proving to be more difficult as myriad challenges have emerged, particularly in the policy and funding arenas.

“On a national level, fusion centers are still in the embryonic stage,” Wormeli said. “Some fusion centers have been doing a lot of what people are defining fusion centers to be about for four to six years … and others are brand new.

“And there's still a lot of debate about what the exact role of a fusion center is and what the business structure is.”

HOW IT SHOULD WORK

The concept of government aggregating information from various databases is not new, as public-safety entities have been doing it for more than a decade with criminal intelligence in states like Florida, said Jennifer Pritt, chief of investigations for Florida's office of statewide intelligence. The twist introduced with the fusion center concept was the notion that intelligence gathering needed to expand beyond the typical scope of traditional law enforcement entities.

As a result, the Florida fusion center — supported by seven intrastate regional centers — works cooperatively with government entities such as the Department of Agriculture and the Florida Farm Bureau to gather information on a regular basis.

“While it may not be meaningful in terms of identifying suspects, it may be meaningful to assess what we need to know about protecting Florida's food supply, what we need to know about informing some of our private entities about how they can better protect themselves from threats and how to report threats,” Pritt said.

And the information-gathering process has expanded to the private sector, which owns more than 90% of the nation's critical-infrastructure assets, said Robert Hickes, national director for justice and public safety for integration company BearingPoint, which has devised a model for fusion center operations (see opening diagram).

This private-sector information gathering distinguishes today's fusion centers from intelligence centers that typically have used only information available in law-enforcement databases, said Morgan Wright, Cisco Systems' global industry solutions manager for public safety.

“Public safety doesn't own the bridges and tunnels; public safety doesn't own the Sears Tower,” Wright said. “But, if you're not bringing the threats they're detecting into an overall scenario, you're missing out on a lot of information.”

Data from public sector and private sector sources is submitted to a fusion center, where the information is analyzed in an effort to spot activity trends that could be precursors to an attack on critical infrastructure, whether the threat is man-made or is generated by the weather. If such information is verified as accurate, the nature of the threat is distributed to fusion center participants, along with recommended actions.

“The one thing that everyone agrees on is that the work product of fusion centers is actionable intelligence,” Wormeli said. “That word ‘actionable’ is very important because it means that they have investigated it and found out enough to take action — to arrest that guy or put him under surveillance. How they pull all of that data together to come up with that actionable intelligence is the tricky part.”

TECHNOLOGY: THE LEAST OF THE PROBLEMS

Indeed, U.S. law enforcement entities historically have not been proficient at sharing information, something that has been well chronicled by various government reports and news articles. But the establishment of the National Criminal Intelligence Sharing Plan and other information-sharing initiatives has laid a technological foundation for data to be queried securely from anywhere in the nation.

And certainly there are plenty of potential technological tools to be leveraged, from high-speed data networks to visual-analytics applications. Hickes said the technological needs of a fusion center most align with those of insurance companies, which specialize in risk-management evaluations.

“In essence, the heart of the fusion center would operate on the same technology as an insurance company — kind of a predictive analysis tool that says, ‘If these things exist, the likelihood of that occurring will be greater,’” Hickes said. But the real value of a fusion center is generated via traditional investigative methods, Pritt said.

“There's no one tool we would use to tell us that this is reliable and valid information — that depends on the field work of law enforcement officers and the human intelligence,” she said. “This is not [just] about visual analytics or some other tool telling us whether an association exists. Then we have to go out and verify that an association exists.”

FUNDING: A BIGGER PROBLEM

While adequate technology exists in the marketplace, not all fusion centers have state-of-the-art equipment, applications and resources to pursue intelligence efforts. In fact, many states lack any form of a fusion center at all, as the availability of funding to establish these intelligence repositories differs greatly by location.

Today, the funding for many fusion centers comes primarily from grants provided by the U.S. Department of Homeland Security, a fact that could become troublesome if political winds result in the shift of homeland-security priorities among members of Congress, Wormeli said.

“[Fusion centers are] being funded mostly out of DHS funding, and state legislatures in many states haven't gotten serious about supporting them,” he said. “Some states are saying, ‘This is really cool,’ and have fine fusion centers with state support, like New York. But some states are scrambling for grant funding to start something up, and when the grant runs out, so does the fusion center.”

Wormeli and other fusion center advocates have expressed concern that fusion centers may experience the funding travails experienced by public-safety answering points (PSAPs) concerning the 911 network. While PSAPs in densely populated areas like New York City can identify the location of wireless 911 calls automatically and are pursuing data and video capabilities, other parts of the country struggle to maintain even the most basic 911 services.

“It is very analogous to PSAPs, and there really are no standards for PSAPs — what one should be and how you should do it,” Wormeli said. “We're trying to do a better job with that in terms of fusion centers. But right now it doesn't exist, so it's in the same chaotic state as the PSAPs.”

One way to help the funding cause may be to have private sector participants pay a membership fee to be a fusion center partner, but such a structure likely would only work after fusion centers have demonstrated their worth by helping private sector partners minimize their risks, BearingPoint's Hickes said.

“If I'm a port director, I lose sleep if my port shuts down. What causes your port to shut down? Hurricanes, tornadoes, broken cranes or the leakage of hazardous materials,” he said. “There is data and information in the public arena that can give you indications whether the likelihood of those things occurring is greater, whether they be weather reports, the maintenance reports on cranes or the maintenance records of ships.

“[Fusion centers] provide an analytical assessment that, frankly, [a private entity] lacks the resources and analytical tools to be able to do. … If you build these things appropriately, and you're adding significant value, there may be a price of membership.”

But such fees alone are unlikely to generate enough revenue to maintain and enhance fusion centers, leaving centers that lack adequate state or local funds to maintain operations in a quandary, especially if DHS funding is decreased in the future.

“The funding sustainability once the DHS funding runs out is a critical issue,” Wormeli said.

POLICY: A MORE EASILY SOLVABLE PROBLEM

But even with all the money and technology in the world at their disposal, fusion centers' success or failure ultimately may depend on participants' ability and willingness to share information. While media reports often note “turf wars” between various law enforcement entities and private entities wanting to protect proprietary information, the will to share information is not a significant problem, said Bart Johnson, chairman of the Criminal Intelligence Coordinating Council (CICC).

“The operators of the critical infrastructure have been very, very cooperative, and they understand the need to report suspicious activity,” Johnson said. “They, in turn, understand that we need to let them know when something could be afoot at their facility. I think it works pretty well, personally.”

Wormeli echoed this sentiment.

“I think there's a general awareness at all government levels that, in response to 9-11 and Katrina, that we've got to eliminate the stovepipe business,” Wormeli said. “The question is: What is the proper role for the federal government versus state and local? And how do we make this happen?

“I would say that there's a very strong national recognition that information has to be shared … but the devil's in the details.”

Indeed, even where there's a willingness to share information, there's not always a way, thanks to a patchwork quilt of laws established at all levels of government that effectively hinder information sharing, Wormeli said. For instance, laws in states such as Michigan are protective of information gathered during an investigation, but Florida has a very liberal open-records law that enables the public to access such records as soon as an investigation is closed — which would be a violation of Michigan's state laws.

“So Michigan doesn't want to send information to Florida because they don't know what they'll do with it,” Wormeli said. “It's not a matter of opinion, it's a matter of what Michigan law allows the data to be used for and under what circumstances.”

Meanwhile, there is considerable debate regarding the use of security clearances to access information in databases. State and local public-safety entities tend to shy away from security clearances because federal officials in the past have classified a public-safety entity's report in a manner that prohibits the public-safety entity from accessing its own information, Wormeli said.

In an effort to get around such issues, many fusion centers sign memorandums of understanding with data sources, but Wormeli said more sweeping measures are needed.

“This is a very important set of policy issues,” he said. “To really get information sharing the way we think it ought to be done, these things have to be resolved. It's going to take legislative changes at the federal level and the state level.”

Hickes said such measures would be helpful because the only fusion center guidelines available today are written “at a relatively high level” and do not address the specifics of information sharing. In addition, the federal guidelines are less likely to be followed by fusion centers in states where federal monies are not utilized, Johnson said.

“That's why it's important that it's being done in the cooperative manner that it is,” he said.

And determining the details of information-sharing policies also will help make network management much easier, Wright said.

“We build networks all the time — it's what we do — and we can make information as accessible or secure as you want,” Wright said. “But it's best if those kinds of policies are worked out in advance, not after the network has been deployed.”

Such policies also improve the ability of participants to act on the information and recommendations produced in the fusion center process, Johnson said.

“Although it's not a cookie-cutter approach, there certainly needs to be some level of standard operating procedures — as best we can — so that we're all collecting the same way and the same type of information,” he said. “So when [information] goes to the federal government, they're not receiving it 50 different ways.”

THE LONG-TERM VIEW

Ideally, CCIC's Johnson believes there will be a fusion center in every state, as well as a fusion center in the top 10 or 20 markets. Hickes agreed but said he would not be surprised if a group of less populous states — for instance, those in the largely rural western regions — banded together to establish a single fusion center to address their needs, for economic and cooperative purposes.

Despite the challenges facing fusion centers, the potential benefits are so great that the effort is more than worth the trouble, Johnson said.

“I think that, once people become aware of the importance and see that [the fusion center concept] actually works, they buy into it because they see something in return for the information that they're providing,” he said. “The days of competition, redundancies and compartmentalization need to be over, and we're making progress.

“I wouldn't want to put a timeline date on [the maturation of fusion centers], but we've come a very long way since Sept. 11, and we understand and know where we need to go.”