U. S. Department of Justice
United States Marshals Service
Judicial Security Division

Washington, D.C. 20530-000

March 30, 2007

Mr. Paul A. Price
Assistant Inspector General
Office of the Inspector General
Evaluation and Inspections Division
Department of Justice
1425 New York Avenue, Suite 6100
Washington, D.C. 20530

Dear Mr. Price:

In 2003, your office conducted a review of the United States Marshals Service (USMS) Judicial Security Process and issued a report in March of 2004. In July 2006, your office returned and is conducting an audit to determine what progress we have made since your last review.

The Judicial Security Division (JSD) was reorganized in November 2006. I was appointed as Assistant Director, and transferred several senior field operational personnel to USMS headquarters to assist in managing the division's core functions. The division is now comprised of two mission-oriented components, Judicial Operations and Judicial Services.

Since the March 2004 report, JSD also established the Office of Protective Intelligence (OPI) in July 2005 which falls under the Judicial Operations component. This office is responsible for collecting, analyzing and disseminating information about groups, individuals and activities that pose a potential threat to the judiciary and persons and property protected by the USMS. OPI provides this information to districts, protective details, USMS senior leadership, JSD and other headquarters divisions to support their responsibilities. The most substantive responsibility for OPI is to provide centralized guidance, oversight and coordination for the districts in conducting threat investigations, known as protective investigations.

I would like to share with you some of JSD's accomplishments and initiatives to demonstrate the progress we arc making in the area of protective investigations. My staff has been discussing the following accomplishments and initiatives with your staff:

Staffing:

• In July 2005, OPI was established with nine personnel. At present, our staffing has increased to 19 personnel and, in the next few months. We intend to expand to a total of 25 personnel with an additional Inspector, Intelligence Research Specialists (IRS) and Program Analysts.
• For fiscal year (FY) 2008, the President's budget will request 10 District Threat Investigator positions which will be dedicated to work protective investigations.

Training:

• Since your last review, JSD and the USMS Training Academy conducted five Protective Investigations Training Program (PITP) classes for Inspectors and Deputy U.S. Marshals (DUSM). In December 2004, one class of 48 received training and in July and August of2006, four PITP classes were conducted with 190 DUSMs and Inspectors receiving training in protective investigations. Four of your Inspectors attended the last two classes.
• We have two PITP classes scheduled in the third and fourth quarters of FY 2007.
• In December 2005, a total of 210 Inspectors and DUSMs attended the Judicial Security Protection Training Conference in Baltimore, Maryland, and received protective investigations training, along with protective operations training.
• OPI is working with the USMS Training Academy to improve the protective investigations training included in the curriculum of the Basic Deputy, the GS-­0082 to GS-1811 Conversion classes and the Advanced Deputy classes. The benefit will be more personnel trained in protective investigations.

Interaction with Districts:

• The OPI Investigations Branch is structured with six circuit teams, covering two circuits each. At present, each team consists of an Inspector and shared IRS. This staffing combination offers consistent, frequent and familiar interaction on cases between OPI and the districts. As the new personnel come on board, each team will have an IRS or a Program Analyst assigned.

Case Load:

• Since the PITP classes in July and August 2006, there has been an increase in the number of cases reported to OPI. This is due to the education of the DUSMs and Inspectors to focus on the behavior of protective investigations subjects, rather than the content of their statements or inappropriate communications.
• Compared to FY 2006, where OPI had limited staffing, FY 2007 has seen improvements in meeting the goal of further processing cases with analysis by conducting MOSAIC and Comparative Analysis (CA). Upon receipt of a written report from the field, OPI immediately conducts an initial review of each case and then conducts further analysis. In FY 2006, OPI processed 33 percent of standard cases in the 7 business day time requirement and 22 percent of the expedite cases in the 3 business day time requirement. In the first quarter of FY 2007, OPI processed 93 percent ofstandardcasesin7 business days and 100 percent of the expedite cases in 3 business days.
• As late as July 2006, there were approximately 900 pending cases in an active or "open" posture that required MOSAIC and CA analysis. OPI has taken an aggressive approach to these pending cases by communicating with the district Judicial Security Inspectors, Chief Deputy U.S. Marshals and U.S. Marshals to ascertain the status of the investigations by requesting official case updates via the USM-11, Report of Investigations. These USM-11s provide additional information for analysis. OPI's efforts have led to the number of pending cases requiring analysis to be reduced to 73 cases. Analysis of these 73 cases was completed by March 16, 2007. Therefore, as of March 16, 2007, OPI no longer has any pending cases requiring analysis.
• Twelve of the 19 OPI personnel started after May 1, 2006. This staffing increase provided the necessary staffing to address our case load and time requirements.

SCIF and Threat Management Center:

• Currently, OPI has 24/7 coverage by a Duty Inspector. Any call to the main OPI line is call forwarded to the 24/7 Duty Inspector.
• On December 18, 2006, construction began on the Secure Compartmentalized Information Facility (SCIF) which will house the Threat Management Center (TMC). The estimated completion date is May 1, 2007.

OPI Products:

• Update the Protective Investigations Program, a Policy and Procedural Guide for Threat Management (aka: Protective Investigations Handbook). Interaction with the districts since the PITP classes and new management has generated changes in areas such as reporting requirements, the use of MOSAIC and Comparative Analysis and the future introduction of the 24/7 TMC. This document will be finalized after the TMC is in operation and the process is reviewed.
• Update Protective Investigation Policy 10.16 in the areas of reporting requirements, MOSAIC and Comparative Analysis and inclusion of the TMC. This document will be finalized after the TMC is in operation and the process is reviewed.
• In August 2006, instituted a Daily Briefing document for USMS management.
• Since October 1, 2006, issued 19 Alert Notices and 19 Information Bulletins.
• Issued four threat assessments for high threat trials.
• Since October 1, 2006, issued 40 foreign travel briefings for the judiciary.

Interagency Participation in the Targeted Violence Information Sharing System (TAVISS):

• TAVISS is a pointer system administered by the U.S. Secret Service. National Threat Assessment Center, and consists of a database of over [redacted] subjects who have threatened or inappropriately communicated with protectees from [redacted] federal, state and local agencies.
• The USMS continues to be the third largest contributor to TAVISS [redacted] [redacted]
• The USMS was one of the original four pilot agencies in TAVISS.
• [redacted]
• Having the opportunity to review the prior behavior of these subjects is of tremendous value to our District Threat Investigators conducting protective investigations. The knowledge of prior behavior offers the investigator insight when conducting the investigation and managing these subjects.

Benefits of Liaison/Detailee Positions:

Full-time:

• Bureau of Prisons/Sacramento Intelligence Unit (BOP/SIU): notification of the release of subjects that have threatened the judiciary in the past and coordinating prisoner issues. For example, on October 24, 2005, [redacted] mailed an explosive device from USP Leavenworth. Kansas, to the Fourth Circuit Court of Appeals in Richmond, Virginia. The package was detected by Court Security Officers. The USMS detailee worked with the BOP to revise their procedures for dealing with prisoner mail. This detailee routinely obtains Information on the pending release of subjects that have been incarcerated for threatening judges. This information is then provided to the respective districts prior to their release.
• National Joint Terrorism Task Force: notification of terrorist cases, situational awareness that impacts the judicial system and provides information valuable to threat assessments for high threat trials. This detailee frequently reviews terrorist and situational awareness information that is beneficial to the USMS. In addition, when OPI or a district has a need for information, this detailee is an expedient conduit to the proper Federal Bureau of Investigation (FBI) unit to obtain valuable information.
• Joint Terrorism Task Force (JTTF) field positions: notification of terrorist cases and situational awareness on the district level and increased communication with area law enforcement agencies. Recently, a JTTF member reviewed an FBI report in regard to several [redacted] subjects crossing the southern border that were headed to a particular district. Our member made the association that these individuals were headed to a district where a high threat trial involving [redacted] funding was being held. The information was important to pass to the USMS district securing the trial and to coordinate with the FBI.
• Increased the number of JTTF positions from 50 in 2004, to 80 in 2007. This includes 20 full-time, 22 part-time, 37 liaison, an NJITF representative and a program coordinator.
• [redacted]
• Department of Homeland Security, Office of intelligence and Analysis: this Chief Inspector started on February 20, 2007. Involvement in the analysis of intelligence information in regard to terrorism, access to intelligence advisories in regard to homeland security, to include information that would affect our Centers for Disease Control(CDC) mission. This detailee is a senior staff member of the Assistant Secretary of Intelligence and Analysis and has access to valuable intelligence products.

Part-time:

• Supreme Court Police, Threat Management Unit: the USMS protects the Supreme Court Justices when they travel outside of the Washington, D.C. area. This relationship improves the flow of information in protective investigations related to U.S. Supreme Court Justices.
• U.S. Capitol Police: subjects that threaten judges frequently threaten members of Congress. This relationship improves the flow of information.
• Washington, D.C. Metropolitan Police Department, Synchronized Operations Command Complex: during major events such as the funeral of former President Ford, the March for Life and the President's State of the Union Address, the USMS is able to tap into real time information concerning these events and provide this information to other USMS entities that may be affected.

Other law enforcement and intelligence agencies that we are networked into include:

• U.S. Secret Service
• [redacted]
• [redacted]
• Department of State, Diplomatic Security Service
• [redacted]
• Pentagon Force Protection Agency
• Drug Enforcement Administration
• Bureau of Alcohol, Tobacco, Firearms and Explosives
• Federal Air Marshal Service
• Transportation Security Administration
• Immigration and Customs Enforcement
• Customs and Border Protection
• Numerous state and local fusion centers (i.e., VA, NY and TX).

OPI initiatives for FY 2007, FY 2008, and FY 2009 (many of these will require additional positions and funding to implement):

• Formalize procedures and initiate operation of the Threat Management Center
• Finalize the Protective Investigations Handbook
• Update Policy 10.16
• Move away from MOSAIC and Comparative Analysis and concentrate on the behavior of subjects who make threats or inappropriate communications
• Enhance protective investigations training in Conversion, GS-1811 and Advance DUSM classes
• Coordinate with the FBI to enter subjects of concern into the NCIC Database so we are notified when their names are checked
• Expand and finalize the OPI website
• Establish Suspicious Activity Report (SAR) Project: collect, store and analyze SAR information
• Create a Counter-surveillance or Surveillance Detection Program to collect SAR information
• Increase participation on JTTFs in the districts
• Increase full-time liaison/detailee positions
• Finalize polygraph policy for liaison positions
• Short-term IT:

Modifications to the Justice Detainee Information System (JDIS) ($100k obligated in FY 2006 to ITS)
Move Court Security Information System (CSIS) SAR module into JDIS to capture incidents, demonstrations and suspicious activity information

• Long-term IT:

Procure a new OPI threat management database
Procure additional analytical tools/search engines
Establish a full-time IT FTE/Contractor to manage the SCIF, classified systems and OPI database.

• Requested 32 Criminal Investigator (includes 10 District Threat Investigators), IRS, Program Analyst and contractor positions for FY 2009 and will request 30 additional positions (25 District Threat Investigators) for FY 2010 to staff the following additional sections in OPI:


Behavioral Research Section
Information Technology Section
Internet Threat Section
Suspicious Activity Reporting Analysis & Coordination Section
Training Coordinator
Threat Assessment Section
Trip Briefings Section, foreign & domestic
Domestic Terrorism Section
International Terrorism Section
Country or Continent Sections


• Liaison/Detailee Positions at other agencies:


Department of Homeland Security, National Operations Center
Supreme Court Police
Federal Protective Service
Central Intelligence Agency, Counter-terrorism Center
Diplomatic Security Service
Office of Director National Intelligence


• In FY 2010 will request additional JITF positions in the districts and Secret/Top Secret computers where appropriate to receive classified information.

[redacted] We request that in your final report you minimize the amount of information published on the open source internet, to ensure that the security of the federal judiciary is not compromised.

If you have any questions in regard to this list of accomplishments and initiatives, hesitate to contact me at [redacted]. Thank you for your cooperation during this audit. We look forward to reviewing a draft of your report.

Sincerely,

{signature}

Robert J. Finan II
Assistant Director for Judicial Security