Pocket Guide for Law Enforcement

Law Enforcement
Intelligence

Bureau of Justice Assistance

 Introduction

Gathering information
is a critical part of every
law enforcement officers
duties. Whether you
are a patrol officer, an
investigator, or an agency
administrator, from a
small town or a large
metropolitan area, you
have an important role
in collecting, evaluating,
and sharing information.
Because you are among
the first to collect and
assess information, you
play a vital role in the
security of your community
and the nation.

1
 Background

Intelligence, at its most basic level, is produced using

information and analysis. When appropriately collected
and accurately analyzed, intelligence enhances officer
safety and provides law enforcement agencies with
important information for tactical, investigative,
and strategic decisionmaking. The National Criminal
Intelligence Sharing Plan emphasizes the need for
state, local, and tribal law enforcement agencies
to practice intelligence-led policing. Providing local
agencies with the tools and resources necessary for
developing, gathering, accessing, receiving, and sharing
intelligence information is critically important to
improving public safety and homeland security.1
Because a variety of criminal activities precedes terrorist
attacks, law enforcement officers and administrators
should use an all-crimes approach when collecting and
analyzing information to produce intelligence. Nationwide,
there is growing recognition that a local intelligence
capacity is essential to the law enforcement community.
Quickly and efficiently sharing information and intelligence
with the appropriate agencies greatly enhances crime
prevention and investigation capabilities.
1
National Criminal Intelligence Sharing Plan, Global Justice
Information Sharing Initiative, U.S. Department of Justice,
July 2005, p. iii. 2
 Intelligence Purposes

Tactical intelligence is very focused and is used in

a short time period. It is the most concrete intelligence
and is used as part of the day-to-day operation of a law
enforcement agency. This intelligence might be used in raid
planning or be the result of crime analysis that leads to the
redirection of resources to address an immediate spike in a
certain type of crime, such as robbery or burglary.
Strategic intelligence is the broadest type of
intelligence. It is used to plan and allocate resources.
This type of intelligence incorporates the concepts in
intelligence-led policing. Information about the nature
and extent of problemsboth current and foreseenis
gathered and analyzed to help determine the appropriate
strategic response.

3
 Intelligence Purposes

Intelligence-Led Policing (ILP) uses both tactical

and strategic intelligence to plan the best use of agency
resources. This is the model for law enforcement in the
21st century. The ILP process is ideally suited to addressing
all crime issues. By using intelligence wisely,
proactive law enforcement can become reality
rather than theory. But how is intelligence used?
Intelligence may be focused on a specific short-term
problem, such as a tactical situation, or it may be broader
in time and scope. Intelligence may be used to link
criminal subjects, foster coordinated investigations, and
provide deconfliction information. In the broadest sense,
intelligence is used to plan and allocate resources, thus
giving form to the concepts in intelligence-led policing.

4
Intelligence From Information

Information is collecteda tip, field contact card,

newspaper article, banking record, drivers license
information, criminal history record, witness statement,
officer observation, suspicious activity report, and others.
Intelligence is produced, and it implies or tells you
somethinga gang intelligence bulletin, threat assessment
of a nuclear power plant, crime trends, development
of leads in a case, identification of a likely suspect in a
homicide, or a warning to the public about a possible threat.
ExampleAn officer responds to a domestic disturbance
between an Arabic husband and his Western wife. After
separating the couple, the officer discovers the argument
is about the wifes refusal to wear a veil. She complains
that he has recently joined a local mosque and has become
increasingly rigid with respect to Islamic traditions. She also
mentions that she does not like his new friends, who frighten
her with their talk of martyrdom and jihad. (Information)
The officer passes this information, including the
names of the husbands friends, to the departments
intelligence unit, which passes it on to the fusion center.
After analysis and further investigation, this information,
along with other information, reveals the emergence of
a local terrorist cell. (Intelligence)

5
 Investigation vs. Intelligence

Investigation and intelligence

overlap, but there are fundamental
differences.
The primary goal of investigation is
arrest and prosecution. Investigation
generally is:
Crime-driven.
Narrow, offender-specific information
collection that deals with facts and
evidence to support burden of proof.
The primary goal of intelligence is
prevention. Intelligence generally is:
Threat-driven.
Broad, threat-specific information
collection.
Information that deals with facts and
probabilities.
Based on reasonable suspicion of
a subjects involvement in current
criminal activity.

6
 Intelligence Cycle

The National Criminal Intelligence

Sharing Plan Intelligence Cycle
The intelligence cycle is an administrative function
that may occur at the federal, regional, state, or local
level. The cycle may be contained within a single agency,
or the individual steps may be spread across several
agencies, including local agencies, Joint Terrorism Task
Forces (JTTFs), and fusion centers. Either way, the
process starts with youthe information provided
at the local level empowers the intelligence cycle.
The ongoing process includes the following steps:

Planning and
Reevaluation
Direction

The
Dissemination Intelligence Collection

Cycle

Analysis Processing/Collation

7
 Intelligence Cycle

Planning and Direction

The intelligence process attempts to predict where
agency resources will be most effective by analyzing
collected information. Once the analysis is completed,
agencies are better able to position their resources
to meet the communitys needs. This process drives
staffing and resource allocation.

Collection
It is critical for officers to know what information agency
administrators need. This knowledge allows officers
to provide the raw information that will be used in
the analysis process that may produce intelligence.
The collection phase of the cycle ensures that agency
planning is based on an accurate assessment of what is
happening in the jurisdiction.

8
 Intelligence Cycle

Processing/Collation
Officers should know that information they collect will
be assessed for usefulness and relevancy in defining a
threat or aiding an investigation. There are two accepted
standards or variables related to the assessment of
information that determine the level of confidence that
can be placed in the information:
Reliability of the source of the information.
Validity of the information itself, which is an
assessment of its accuracy.

Analysis
Analysis seeks to objectively provide meaning based on
the quality and quantity of information that has been
assembled. Essentially, analysis transforms pieces of
information into collective knowledge or intelligence
that can be used to make decisions to deploy resources.

9
 Intelligence Cycle

Dissemination
To be useful, information and intelligence must be
shared. It is critical that officers understand which
persons have the need to know and the right
to know the specific intelligence within the law
enforcement community. Beyond that community, there
may be a need to share an assessment of the
intelligence with the public or private sector in order to
prevent criminal activity or ensure public safety.

Reevaluation
The intelligence process is ongoing. Often, additional
information is needed to understand a given threat more
fully. This additional informationknown as intelligence
requirementsmust be collected and processed
through the intelligence cycle repeatedly until there is a
thorough understanding of the threat.

10
 Fusion Centers

Intelligence Fusion
The fusion process is a way of managing the flow of
information and intelligence across levels and sectors
of government to integrate information for analysis.
The fusion process seeks to identify threats posed by
terrorists or criminal enterprises and stop them before
they occur. A fusion center is an analysis-driven
support center. Most states and many urban areas have
developed fusion centers.

Intelligence
Community
Input

Federal Law Private

Enforcement Security
Intelligence Input

State, Local,
and Tribal Law Fusion Public
(Tips)
Enforcement Center
Intelligence

11
 Fusion Centers

In developing our countrys response to the threat of

terrorism, law enforcement, public safety, and private
sector leaders recognize the need to improve the
sharing of information and intelligence across agency
borders. Every official involved in information and
intelligence sharing has a stake in this initiative. Law
enforcement must move forward with a new approach
to the exchange of information and intelligence, one
that includes the integration of law enforcement, public
safety, and the private sector.
Fusion centers have been developed to fuse information
and share it with those who have a need and right to
know. The U.S. Department of Justice and the U.S.
Department of Homeland Security collaborated with
state, local, and tribal law enforcement, as well as with
other public safety and private sector organizations, to
develop a standard set of guidelines for use by fusion
centers. The guidelines help ensure that fusion centers
are established and operated effectively and efficiently in
a manner that protects the privacy and civil liberties of
citizens.

12
 ISE

The Intelligence Reform and Terrorism Prevention

Act (IRTPA) of 2004 created the national Information
Sharing Environment (ISE), which is composed
of policies, procedures, and technologies linking the
resources (people, systems, databases, and information)
of federal, state, local, and tribal entities and the private
sector to facilitate terrorism information sharing, access,
and collaboration.
Every law enforcement agency is a part of this
environment and as such will be able to receive and
share critical terrorism information with other agencies.
However, agencies must meet certain standards in
protecting the information and ensuring the privacy
of individuals whose personal information is received
from participating in this important information-sharing
initiative. For additional information on ISE, see
www.ise.gov.

13
 Intellligence Products

Once the analysis is completed, the findings are

typically placed in a report or criminal intelligence
system submission that is shared with those persons
who need the information. Reports and submissions are
referred to as intelligence products. The product should:
Identify the users of the information (patrol officers,
administrators, task force members, and others).
Relay the reliability of the information.
Convey the critical information clearly.
Identify time parameters wherein the intelligence is
applicable.
Provide recommendations for follow-up.
These regularly produced intelligence reports have a
specific format and type of message to convey. As a
general rule, only three products may be needed:
Reports that aid in investigating and apprehending
offenders.
Reports that provide threat advisories to harden
targets and enhance officer safety.
Reports that provide a strategic analysis to aid in
planning and resource allocation.
14
 Critical Concepts

Privacy and Civil Liberties

Law enforcement agencies must be fully aware of the
important privacy and civil liberties issues and
policies pertaining to law enforcement intelligence.
Intelligence operations must always be conducted and
managed within the scope of agency policies. Regulation
(28 CFR Part 23) as well as case law related to the
privacy and civil liberties liability of law enforcement
organizations mandate that the collection, receipt,
storage, and dissemination of intelligence records be
based on reasonable suspicion of involvement in current
criminal activity.
Among the more common sensitive issues are what
types of records a law enforcement agency can keep
on citizens, what information a citizen may view that is
being kept about him or her, what types of electronic
surveillance may be used, and whether library records,
e-mail, and Internet activities may be monitored.
Line officers must have a broad understanding of
criminal intelligence file guidelines and an
understanding of how civil rights litigationspecifically,
42 U.S.C. 1983, Civil Action for Violation of Civil Rights
applies to law enforcement intelligence activities.
15
 Critical Concepts

Sensitive But Unclassified (SBU)

Unclassified information that has
dissemination restrictionsinformation that is
Sensitive But Unclassified (SBU)typically
contains information similar to that in
classified documents, although the sources
of information and methods of gaining the
information have been eliminated.
There are two broad types of SBU information:
Law Enforcement Sensitive (LES),
which is typically limited in distribution to
law enforcement employees.
For Official Use Only (FOUO), which is
information that may be shared outside of
the law enforcement community to persons
who have the need to know and right
to know the information.
For example, if law enforcement received
FOUO information about a threat to a power
plant, that information should be shared with
the management and security personnel at
the plant.
16
 Be Proactive

What Do I Need to Know?

Who in your agency needs information.
How your agencys intelligence process works.
What information might be important.
Who may be granted access to sensitive information
and intelligence.
Where to go or whom to contact to receive relevant
information and intelligence.

What Should I Do?

Establish a Regional Information Sharing Systems
(RISS)/Law Enforcement Online (LEO) account.
Read the National Criminal Intelligence Sharing Plan.
Know your local fusion center contact information.
Know your agencys protocols for submitting a
suspicious activity report.
Review your agencys policies for documenting
activities and disseminating information.

17
 Intelligence Acronyms

ATAC Anti-Terrorism Advisory Council

ATIX Automated Trusted Information Exchange
CFR Code of Federal Regulations
CICC Criminal Intelligence Coordinating Council
CIP Critical Infrastructure Protection
CJIS Criminal Justice Information Services
COPS Office of Community Oriented Policing Services
CT Counterterrorism
DNI Director of National Intelligence
EPIC El Paso Intelligence Center
FIG Field Intelligence Group (FBI Field Offices)
FinCEN Financial Crimes Enforcement Network
FOUO For Official Use Only
GIWG Global Intelligence Working Group
Global U.S. Department of Justices Global
Justice Information Sharing Initiative
HIDTA High Intensity Drug Trafficking Area

18
 Intelligence Acronyms

HSIN Homeland Security Information Network

HSPD Homeland Security Presidential Directive
ILO Intelligence Liaison Officer
ILP Intelligence-Led Policing
ISE Information Sharing Environment
JTTF Joint Terrorism Task Force (FBI)
LECC Law Enforcement Coordinating Committee
LEIU Law Enforcement Intelligence Unit
LES Law Enforcement Sensitive
LEO Law Enforcement Online (operated by the FBI)
MOU Memorandum of Understanding
NCIRC National Criminal Intelligence Resource Center
NCISP National Criminal Intelligence Sharing Plan
NCTC National Counterterrorism Center
NDIC National Drug Intelligence Center
NOC National Operations Center, DHS
NVPS National Virtual Pointer System

19
 Intelligence Acronyms

ODNI Office of the Director of National Intelligence

OPSEC Operations (or Operational) Security
RICO Racketeer Influenced and Corrupt
Organizations Act
RISS Regional Information Sharing Systems
RISSNET Regional Information Sharing Systems
secure intranet
SAR Suspicious Activity Report
SCI Sensitive Compartmented Information
SCIF Sensitive Compartmented Information Facility
SLATT
State and Local Anti-Terrorism Training
Program (BJA)
TCL Targeted Capabilities List (Department of
Homeland Security)
TLO Terrorism Liaison Officer
TSC Terrorist Screening Center
UASI Urban Areas Security Initiative
VGTOF Violent Gang and Terrorist Organization File

20
 www.ncirc.gov

The National Criminal Intelligence Resource Center

(NCIRC) is a Web site (www.ncirc.gov) developed to
serve as a one-stop shop for federal, state, local, and
tribal law enforcement regarding the latest developments
in the field of criminal intelligence. NCIRC users will
find information regarding law enforcement intelligence
operations and practices. Criminal justice professionals will
now have a centralized resource information bank to access
a multitude of criminal intelligence resources. Sponsored by
the Bureau of Justice Assistance (BJA), the NCIRC Web site
provides access to the following resources:
Recommended criminal intelligence and training
standards.
Criminal Intelligence Training Master Calendar.
Best practices, model policies, and guidelines.
Information about federal, state, local, and tribal
information/intelligence-sharing initiatives.
Technology information.
Information about current issues such as fusion
centers and privacy concerns.
Discussion forums.

21
 www.slatt.org

The State and Local Anti-Terrorism Training

(SLATT) Program provides a Web site, www.slatt.org,
that offers online training and complements the Programs
on-site workshops and research products. The Web site
includes a restricted-access site for law enforcement and
criminal justice practitioners.

Online training is:

Focused on topics that involve current terrorism/
extremism issues.
Delivered by nationally recognized experts.
Presented in an easy-to-use format.
Updated with new topics on a regular basis.

Other features are:

Future training opportunities.
Anti-terrorism agency contact directory.
Summaries of recent terrorist/extremist events.
SLATT publication and multimedia catalog.
SLATT Program updates.
Links to useful resources.
22
 December 2007

This project was supported by Grant No. 2007-MU-BX-K002 awarded by the

Bureau of Justice Assistance. The Bureau of Justice Assistance is a component
of the Office of Justice Programs, which also includes the Bureau of Justice
Statistics, the National Institute of Justice, the Office of Juvenile Justice and
Delinquency Prevention, and the Office for Victims of Crime. Points of view or
opinions in this document are those of the author and do not represent the official
position or policies of the U.S. Department of Justice.

Copyright 2007 Institute for Intergovernmental Research. All rights reserved.

For permission to make copies or extractions, please contact IIR at Post Office
Box 12729, Tallahassee, Florida 32317, (850) 385-0600.

This publication was produced with the assistance of

Dr. David Carter of Michigan State University.

State and Local Anti-Terrorism Training Program

www.slatt.org