Intelligence Fusion Centers

(U//FOUO) Kansas Intelligence Fusion Center Nairobi Westgate Mall Attack Lessons Learned

On Saturday, September 21, 2013, members of Al Shabaab, a Somali based Islamic terrorist organization affiliated with the international Al Qaeda network, executed a complex terrorist attack on an upscale shopping mall in Nairobi, Kenya. The attackers simultaneously entered the mall from two different entrances, shooting shoppers with assault rifles and throwing hand grenades. The terrorists remained in the mall, engaging government security forces for the next four days, resulting in a major fire and partial collapse of the mall. The Kenyan government has officially reported 72 deaths and more than 200 injured as a result of the attack. A significant number of those killed and injured were foreign citizens, including 6 U.S. citizens who were injured in the attack.

(U//LES) Virginia Fusion Center Bulletin: TOR, Bitcoins, Silk Road and the Hidden Internet

The purpose of this bulletin is to provide awareness and a basic understanding of the “Hidden Internet” to investigators in the field, as well as provide some examples of how the Hidden Internet can be exploited by criminal elements. While the term “Hidden Internet” can be used in a broader context and refer to other internet terms such as the “Deep Web” or “Deepnet,” for the purpose of this bulletin the term “Hidden Internet” will refer to the hidden services provided by the TOR project to internet users, specifically relating to the Silk road website and use of Bitcoins.

(U//FOUO) Kansas Intelligence Fusion Center Bulletin: pH1N1 Emerging Infectious Disease

From November through December 2013, CDC has received a number of reports of severe respiratory illness among young and middle-aged adults, many of whom were infected with influenza A (H1N1) pdm09 (pH1N1) virus. Multiple pH1N1-associated hospitalizations, including many requiring intensive care unit (ICU) admission, and some fatalities have been reported. The pH1N1 virus that emerged in 2009 caused more illness in children and young adults, compared to older adults, although severe illness was seen in all age groups. While it is not possible to predict which influenza viruses will predominate during the entire 2013- 14 influenza season, pH1N1 has been the predominant circulating virus so far. For the 2013-14 season, if pH1N1 virus continues to circulate widely, illness that disproportionately affects young and middle-aged adults may occur.

(U//FOUO) New Jersey Fusion Center: School Attacks and Plots Since Sandy Hook

In the year since Sandy Hook, there have been a combined total of 22 actual school attacks and disrupted plots nationwide with some of the attacks resulting in the deaths of students and school personnel. The New Jersey Regional Operations Intelligence Center (ROIC) has examined recent reporting on the Sandy Hook attack and the incidents over the last year and provides the following analysis to law enforcement, school resource officers (SROs), and administrators to assist in school security planning efforts.

City of Oakland Domain Awareness Center Emails

Hundreds of emails from the City of Oakland relating to the construction of the City/Port of Oakland Joint Domain Awareness Center. The files were scanned from printouts held in a series of folders by the City of Oakland and were obtained via a public records request made by members of Occupy Oakland. The emails were the source material for a recent story in the East Bay Express by Darwin BondGraham stating that the City of Oakland had allowed the Domain Awareness Center’s prime contractor Science Applications International Corporation (SAIC) to perjure themselves by signing a disclosure form claiming that the company was in compliance with the city’s Nuclear Weapons Free Zone Ordinance which prohibits the city from doing business with contractors that are connected to the production or use of nuclear weapons. According to the article, SAIC has had a number of contracts relating to nuclear weapons for more than a decade, including a May 2013 U.S. Navy contact for “engineering services, testing, and integration for nuclear command control and communication (NC3) messaging systems.”

(U//FOUO) New Jersey Fusion Center Active Shooter Awareness for the 2013 Holiday Season

One of the most serious threats facing New Jersey and the entire U.S. Homeland continues to be that of the active shooter, regardless of motivation, who by the very nature of their associated tactics, techniques, and procedures, pose a serious challenge to security personnel based on their ability to operate independently, making them extremely difficult to detect and disrupt before conducting an attack.

(U//FOUO) New Jersey Fusion Center Mass Shootings Commonalities December 2012-October 2013

The New Jersey Regional Operations Intelligence Center (NJ ROIC) provides the following updated analysis of mass shootings in the last year (December 2012 to October 2013) in order to provide law enforcement personnel, security managers and emergency personnel with identified commonalities and trends, as well as indicators of potential violence.

Oakland Domain Awareness Center Purchasing Invoices March-July 2013

Scans of all invoices related to the City of Oakland’s contract with Science Applications International Corporation for the construction of the City/Port of Oakland Joint Domain Awareness Center. The documents were collected in a binder held by the City of Oakland and obtained via a public records request made by members of Occupy Oakland. The invoices are organized by month and range in date from March to July 2013.

(U//FOUO) Central Florida Intelligence Exchange Bulletin: Smoking Alcohol

This Brief was produced to alert emergency medical responders and healthcare providers to the dangerous levels of toxicity that can be presented by patients who have smoked alcohol. Although this practice is dangerous, it is not illegal. It is being practiced by young adults all over the country and causing serious medical emergencies and deaths as a result. Because this is a returning trend, unfamiliar to health care providers, there is no statistical data available concerning hospitalizations and deaths. The below information was assembled from open source research and can be duplicated and shared for the purposes of awareness and education.

(U//FOUO) Los Angeles Fusion Center: School Shootings Five-Year Analysis 2008-2013

From January 2008 to August 2013, 85 school shootings took place across the United States involving 97 attackers. Incidents analyzed met the definition of targeted school violence, including gang‐related shootings. “Targeted violence” is any incident of violence where an attacker selects a particular target prior to the violent attack. The number of incidents peaked at 29 in 2009 and have decreased to an average of 14 per year; two incidents have occurred this year to date.

(U//FOUO) Massachusetts Fusion Center School Shootings Analysis 1992-2012

The Commonwealth Critical Infrastructure Program (CCIP) analyzed school shooting incidents from 1992-2012 to identify patterns in attacker backgrounds or tactics which could assist officials. Observations are presented in summary format to allow officials to draw their own conclusions. Mitigation steps included in this document are presented to facilitate discussion and are not comprehensive or prescriptive.

(U//FOUO) Central Florida Intelligence Exchange Analysis: Violence Attributed by Behavioral and Mental Health Issues

The purpose of this bulletin is to increase the awareness and improve response to acts of violence perpetrated by individuals acting out in violent behavior towards healthcare providers and emergency responders. This bulletin provides an analytical overview of significant acts of violence, specifically throughout the Central Florida region, statewide (FL), a nationwide perspective from 2009 – 2013, and statistical analysis of notorious mass shooting incidents throughout the U.S. attributed by claims of mental illness.

National Network of Fusion Centers Final Report 2012

In 2011, the U.S. Department of Homeland Security’s (DHS) Office of Intelligence and Analysis (I&A), in coordination with federal and SLTT partners, began conducting an annual assessment of fusion centers to evaluate their progress in achieving the COCs and ECs and to collect additional data to better understand the characteristics of individual fusion centers and the National Network as a whole. DHS/I&A initiated the 2012 Fusion Center Assessment (2012 Assessment) in August 2012 as the second iteration of the annual assessment process and the first assessment to provide data on year-over-year progress in implementing the COCs and ECs. The 2012 Assessment was also the first assessment to collect National Network performance data based on an initial set of five performance measures adopted in 2011. This 2012 National Network of Fusion Centers Final Report (2012 Final Report) summarizes and characterizes the overall capabilities and performance of the National Network based on the results of the 2012 Assessment. This report does not include fusion center-specific capability or performance data. Instead, it uses aggregated data from the 2012 Assessment to describe the capability and performance achievements of the National Network.

House Homeland Security Committee Report on National Network of Fusion Centers

During the 112th Congress, then-Committee on Homeland Security (Committee) Chairman Peter T. King, currently the Chairman of the Subcommittee on Counterterrorism and Intelligence, directed Committee Majority staff to conduct a comprehensive study of the National Network in an effort to understand current strengths and gaps and provide recommendations for improvement. This work continued into the 113th Congress under the additional direction of current Committee Chairman Michael T. McCaul. Over the course of nineteen months (January 2012-July 2013), the Committee logged 147 meeting hours during visits to 32 fusion centers, in addition to numerous briefings and discussions with various Federal partners, representatives of the National Fusion Center Association, and follow-up conversations with fusion center directors and personnel.

DHS-Connecticut Intelligence Center (CTIC) Active Shooter Individual Response Guidelines

An “Active Shooter” is an individual actively engaging in killing or attempting to kill people in a confined and populated area; in most cases, active shooters use firearm(s) and there is no pattern or method to their selection of victims. Active Shooter situations are unpredictable and evolve quickly. Typically, the immediate deployment of Law Enforcement is required to stop the shooting and mitigate harm to victims. Because Active Shooter incidents are often over within 5-15 minutes, before Law Enforcement arrives on the scene, individuals must be prepared both mentally and physically to deal with an active shooter situation.

(U//FOUO) New Jersey Fusion Center Phone Kidnapping Scams Report

During recent weeks, various sources in law enforcement and media outlets have been reporting phone kidnapping scams occurring in Central and Northern New Jersey and New York. In most incidents, scammers have alleged that a member of the phone scam victim’s family had been involved in a car accident and claimed to have taken the victim’s family member hostage. The scammers then claim they will drop their hostage at a hospital after a certain amount of money (usually $1500‐2000) is wired via Western Union to the scammers, as restitution for damage to the scammer’s vehicle. In addition, the scammers state that they have the hostage’s cell phone and any attempts to call the cell phone or disengage from the conversation will result in the murder or beating of the hostage.

(U//FOUO) New York Fusion Center Threat Assessment: Major Terror Attacks Against Hotels 2002-2011

This product analyzes major terror attacks on hotels and provides a strategic-level assessment of the groups, tactics, and frequency of global terror attacks against hotels from 2002 – 2011. Additionally, the product identifies the deadliest types of attacks, comparing casualty counts and attack methods. The product was derived from media reporting and unclassified, for official use only sources.

(U//FOUO) New Jersey Fusion Center School Shootings Commonalities Analysis

This report attempts to analyze the indicators and commonalities of recent school shootings in an effort to inform public safety officials and assist in the detection and prevention of potential school shooter plots or attacks. All incidents included in this assessment occurred in the United States while classes were in session. Domestic violence shootings and gang violence were not included in an effort to differentiate between “active shooter” incidents and other acts of violence. DHS defines an “active shooter” as an individual actively engaged in killing or attempting to kill people in a confined and populated area.