Over the past year, the NSI PMO has continued its implementation efforts and outreach to NSI stakeholders to help ensure that law enforcement and homeland security partners are afforded another tool to help identify and prevent terrorism and other related criminal activity. The ongoing collaboration among DOJ, DHS, the FBI, SLTT partners, and the National Network of Fusion Centers has strengthened, allowing the NSI to expand its nationwide information sharing capability. As of March 2013, 73 fusion centers have met the requirements outlined by the NSI PMO to be fully NSI-Operational—an increase of 5 centers from the same time last year—and all 78 fusion centers now maintain the capability to contribute and share suspicious activity reports through the Shared Space or eGuardian. This expansion of the NSI has allowed the Federated Search Tool to be accessed by more trained users—increasing the number of searches to more than 76,400—and more than 25,900 Information Sharing Environment (ISE)-SARs had been submitted and shared by the end of March 2013. Further, with the support of the National Network of Fusion Centers, 46 states and the District of Columbia are participating in statewide implementation of the NSI; implementation efforts are currently under way in Guam, Puerto Rico, and the U.S. Virgin Islands to ensure a strengthened nationwide capacity for sharing ISE-SAR information.
The Commonwealth Critical Infrastructure Program (CCIP) analyzed school shooting incidents from 1992-2012 to identify patterns in attacker backgrounds or tactics which could assist officials. Observations are presented in summary format to allow officials to draw their own conclusions. Mitigation steps included in this document are presented to facilitate discussion and are not comprehensive or prescriptive.
Analysis conducted by the Central Florida Intelligence Exchange (CFIX) has found that 79% of mass shootings since 2011 have been perpetrated by individuals with “demonstrated signs of continuous behavioral health issues and mental illness.” In a July case study titled “Acts of Violence Attributed by Behavioral and Mental Health Issues”, CFIX analyzed 14 mass shooting incidents that occurred between 2011 and 2013 finding that only three of the shooters had no history of mental illness.
(U//FOUO) Central Florida Intelligence Exchange Analysis: Violence Attributed by Behavioral and Mental Health Issues
The purpose of this bulletin is to increase the awareness and improve response to acts of violence perpetrated by individuals acting out in violent behavior towards healthcare providers and emergency responders. This bulletin provides an analytical overview of significant acts of violence, specifically throughout the Central Florida region, statewide (FL), a nationwide perspective from 2009 – 2013, and statistical analysis of notorious mass shooting incidents throughout the U.S. attributed by claims of mental illness.
In 2011, the U.S. Department of Homeland Security’s (DHS) Office of Intelligence and Analysis (I&A), in coordination with federal and SLTT partners, began conducting an annual assessment of fusion centers to evaluate their progress in achieving the COCs and ECs and to collect additional data to better understand the characteristics of individual fusion centers and the National Network as a whole. DHS/I&A initiated the 2012 Fusion Center Assessment (2012 Assessment) in August 2012 as the second iteration of the annual assessment process and the first assessment to provide data on year-over-year progress in implementing the COCs and ECs. The 2012 Assessment was also the first assessment to collect National Network performance data based on an initial set of five performance measures adopted in 2011. This 2012 National Network of Fusion Centers Final Report (2012 Final Report) summarizes and characterizes the overall capabilities and performance of the National Network based on the results of the 2012 Assessment. This report does not include fusion center-specific capability or performance data. Instead, it uses aggregated data from the 2012 Assessment to describe the capability and performance achievements of the National Network.
During the 112th Congress, then-Committee on Homeland Security (Committee) Chairman Peter T. King, currently the Chairman of the Subcommittee on Counterterrorism and Intelligence, directed Committee Majority staff to conduct a comprehensive study of the National Network in an effort to understand current strengths and gaps and provide recommendations for improvement. This work continued into the 113th Congress under the additional direction of current Committee Chairman Michael T. McCaul. Over the course of nineteen months (January 2012-July 2013), the Committee logged 147 meeting hours during visits to 32 fusion centers, in addition to numerous briefings and discussions with various Federal partners, representatives of the National Fusion Center Association, and follow-up conversations with fusion center directors and personnel.
An “Active Shooter” is an individual actively engaging in killing or attempting to kill people in a confined and populated area; in most cases, active shooters use firearm(s) and there is no pattern or method to their selection of victims. Active Shooter situations are unpredictable and evolve quickly. Typically, the immediate deployment of Law Enforcement is required to stop the shooting and mitigate harm to victims. Because Active Shooter incidents are often over within 5-15 minutes, before Law Enforcement arrives on the scene, individuals must be prepared both mentally and physically to deal with an active shooter situation.
During recent weeks, various sources in law enforcement and media outlets have been reporting phone kidnapping scams occurring in Central and Northern New Jersey and New York. In most incidents, scammers have alleged that a member of the phone scam victim’s family had been involved in a car accident and claimed to have taken the victim’s family member hostage. The scammers then claim they will drop their hostage at a hospital after a certain amount of money (usually $1500‐2000) is wired via Western Union to the scammers, as restitution for damage to the scammer’s vehicle. In addition, the scammers state that they have the hostage’s cell phone and any attempts to call the cell phone or disengage from the conversation will result in the murder or beating of the hostage.
This report attempts to analyze the indicators and commonalities of recent school shootings in an effort to inform public safety officials and assist in the detection and prevention of potential school shooter plots or attacks. All incidents included in this assessment occurred in the United States while classes were in session. Domestic violence shootings and gang violence were not included in an effort to differentiate between “active shooter” incidents and other acts of violence. DHS defines an “active shooter” as an individual actively engaged in killing or attempting to kill people in a confined and populated area.
This report examines the 29 deadliest mass shootings in the past 13 years, starting with the shootings at Columbine High School in Colorado in 1999, to identify commonalities and trends. These 29 incidents include shooting incidents in which at least five people were killed.
The Central California Intelligence Center (CCIC)/Sacramento Regional Threat Assessment Center (RTAC) has prepared the following Situational Information Report on exploding targets, a commercially available binary explosive agent, to provide law enforcement and public safety officials with a better understanding of the potential public safety risks involving its use. While exploding targets are legally permissible depending on state and local regulations, the CCIC is concerned that the mixture may be more dangerous than what is stated on the manufacturer’s website especially if mishandled by individuals with novice experience in handling explosive components or when used in large quantities to detonate bigger targets and, in essence, creating an explosives or incendiary device.
Four days after the mass shooting last July in Aurora, Colorado, a project of the Houston Office of Public Safety and Homeland Security called Ready Houston released a training video to help educate members the public about how to survive a mass shooting. The six-minute video, which was produced with $200,000 from the Department of Homeland Security’s Urban Area Security Initiative, includes a dramatic recreation of a man dressed entirely in black walking into an office building and beginning to shoot people at random with a shotgun that he pulls from a small satchel. Variously described as “outlandish”, “surreal” and “over-the-top”, the video has met with mixed responses since it was re-released by several fusion centers and local agencies, including most recently the Alabama Department of Homeland Security.
What kind of “suspicious” behaviors might put you in the sights of your local fusion center? A collection of Fusion Liaison Officer (FLO) reports from the Washington State Fusion Center (WSFC) obtained by police accountability activist Andrew Charles Hendricks via a Washington Public Records Act request provide insight into the mechanics of suspicious activity reporting at the local level. More than a dozen reports, which are minimally redacted, detail monthly reporting by the WSFC to its “statewide network of agency-selected law enforcement, fire-fighting and critical infrastructure agency representatives” that ensure “vital disciplines are incorporated into the fusion process by serving as the conduit through which homeland security and crime related information flows to the WSFC for assessment and analysis through the state homeland security Regional Intelligence Groups.” According to the State of Washington, the “end state” of the FLO program “is to have FLOs throughout the state in all aspects of law enforcement, fire service and critical infrastructure” to facilitate the flow of information both to and from the state fusion center.
The Central Florida Intelligence eXchange (CFIX) recently received a brief from the Arizona Counter Terrorism Information Center (ACTIC – TLO Program) that included a report of a stolen ambulance in Phoenix, AZ. At the request of an Intelligence Liaison Officer (ILO) in the Central Florida region (R-5 Hospital/Medical Sector), CFIX was asked to collect, research, analyze and develop a ‘Situation Brief’ based on this report to determine if this was a significant trend that could cause concern for Region 5 partners.
Within the past year, first responders and members of the public have died of asphyxiation, or fallen ill, following accidental inhalation of concentrated carbon dioxide (CO2) gas in public locations. At least two recent incidents are connected with significant gas leaks caused by the failure of liquid CO2 lines connected to beverage dispensers in commercial facilities. Emergency personnel responding to medical or service calls can use signs and symptoms to determine possible CO2 exposure and correspondent risks to first responders.
The Subcommittee investigation found that DHS-assigned detailees to the fusion centers forwarded “intelligence” of uneven quality – oftentimes shoddy, rarely timely, sometimes endangering citizens’ civil liberties and Privacy Act protections, occasionally taken from already-published public sources, and more often than not unrelated to terrorism. Congress directed the Department of Homeland Security (DHS) to lead this initiative. A bipartisan investigation by the Permanent Subcommittee on Investigations has found, however, that DHS’ work with those state and local fusion centers has not produced useful intelligence to support federal counterterrorism efforts.
James Eagan Holmes, a 24-year-old male, allegedly shot and killed12 people and wounded approximately 38 more after opening fire in a crowded movie theater during a showing of the new Batman movie, “The Dark Knight Rises.” The shooting erupted during the midnight showing at the multiplex in Aurora, Colorado, not far from Denver, where a large crowd had gathered, some dressed as characters from the highly anticipated Batman sequel. Holmes began the attack by throwing two gas canisters into the theater after entering through an exit door that had been propped open. Witnesses stated many assumed it was a promotional stunt related to the movie and did not initially react. After both canisters had deployed, Holmes commenced shooting into the crowd.
On May 9, 2012 the California Department of Forestry and Fire Protection (CAL FIRE) conducted a practical evaluation of the Ember Bomb incendiary device as described in the ninth issue of lnspre, a magazine published by al-Qa’ida in the Arabian Peninsula (AQAP).
A recent terrorist attack on a resort hotel in Afghanistan demonstrates the vulnerability of hotels and other “soft” targets to these types of assaults. On June 22, 2012, Afghan forces retook a lakeside hotel outside of Kabul from a Taliban suicide assault team that was holding dozens of civilian hostages. The Taliban claimed credit for the attack, calling the hotel and others near it a “hub of obscenity and vulgarity.”
Past statements from al‐Qa’ida Central, as well as their franchise groups, highlight the importance of targeting the U.S. economy as part of their strategy of confronting the West. Most recently, militant propagandists, such as Adam Gadahn, American mouthpiece for Al‐Qa’ida in Pakistan, have made statements advising Muslims in the West to “…undermine the West’s already struggling economies with…targeted attacks on symbols of capitalism which will shake consumer confidence and stifle spending”. Additionally, in November 2010, al‐Qa’ida in the Arabian Peninsula introduced the “strategy of a thousand cuts”, where they encouraged their mujahideen brothers to “attack the enemy with smaller, but more frequent operations…the aim is to bleed the enemy to death”.
(U//FOUO) New York Fusion Center Bulletin: Use of Cloned Vehicles in Terrorist or Criminal Operations
Criminals and terrorists have long used official vehicles, “cloned” vehicles (those painted/decorated to appear official), or seemingly legitimate vehicles (e.g. livery, maintenance or delivery) to circumvent security measures at targets of interest. There have been numerous terrorist attacks overseas wherein operatives used police vehicles or ambulances (or vehicles painted to resemble same) to conceal improvised explosive devices. Within the US Homeland, the most common use of cloned official vehicles by criminals is for drug smuggling; however, at least one terrorist targeting New York envisioned misusing vehicles that would appear to be legitimate, in order to conduct an attack. Dhiren Barot, an al Qaeda operative involved in the 2004 Financial Centers Plot, allegedly plotted to detonate three limousines packed with explosives and gas cylinders in underground parking lots in Manhattan. While the limousines would not have masqueraded as “official vehicles” per se they would have appeared to be legitimately entering those parking structures.
Al-Qaida in the Arabian Peninsula (AQAP) has released issue 9 of its English-language “Inspire” Magazine. There is a portion of the magazine dedicated to attacking the United States by starting wildfires. The article instructs the audience to look for two necessary factors for a successful wildfire, which are dryness and high winds to help spread the fire. Specific fire conditions that are likely to spread fire quickly are Pinewood, crownfires (where the trees and branches are close together), and steep slope fires (fire spreads faster going up a slope).
Do you want to know what kind of information fusion centers gather on you and your friends? A document contained in the recent Anonymous/AntiSec hack of the Lake County Sheriff’s Office provides a great deal of insight into what kind of information is gathered and processed by fusion centers at the request of local law enforcement. The document is described as a “biographical profile” and was produced by the Central Florida Intelligence Exchange (CFIX), a regional fusion center serving a number of counties including Brevard, Lake, Orange, Seminole and Volusia. CFIX is one of several fusion centers in the state of Florida, part of a larger network of more than seventy operating all around the country. When the Lake County Sheriff’s Office asked for a “workup” on a man being investigated for charges relating to child pornography, CFIX produced a six page profile on the subject, who had no prior criminal history. The report has a flashy cover festooned with logos, restrictive markings and even a graphical depiction of the man’s name, meaning that an employee of the fusion center did not just type the man’s name into a word processor, but actually took the time to produce an individualized graphic with stylistic highlights and shadows.