U. S. Department of Justice
United States Marshals Service
Office of the Director
Washington, DC 20530-1000
September 28, 2007
|MEMORANDUM TO:||Paul A. Price
Office of Inspector General
Department of Justice
|FROM:||John F. Clark (signature)
|SUBJECT:||Response to the Review of the U.S. Marshals Service Judicial Security Process, Project Number A-2006-007
Before responding to the recommendations contained in the draft report, the USMS would like to take this opportunity to note the progress that has been made and the initiatives that have been undertaken to enhance our protective intelligence program from the time of the 2004 audit to the present.
In June 2004, the Office of Protective Intelligence (OPI) was established and was staffed with five positions by the close of FY 2004. As in many other government agencies, we worked with the staffing process, and competing priorities, to add more positions. In July 2005, we merged the protective investigations function into OPI from the Investigative Services Division and added four additional positions. In FY 2006, OPI received eight additional positions and four more in FY 2007. Presently, we have 25 positions in OPI.
In December 2004, we conducted a Protective Investigations Training Program (PITP) class at the USMS Academy in FLETC for 48 DUSMs and Inspectors who received training in protective investigations.
In January 2005, we drafted concept plans for the Threat Management Center (TMC), which is a secure compartmentalized information facility (SCIF).
In October 2005, we convened a Judicial Threat and Analytical Assessment Commission (JTAAC). The purpose of the JTAAC was to review and analyze the current protective intelligence and threat investigation activities within the USMS. A total of 10 people sat on the JTAAC which consisted of U.S. Marshals, Chief and Assistant Chief Deputy U.S. Marshals, Senior Inspectors and a member of the Administrative Office of the U.S. Courts (AOUSC). One U.S. Marshal had experience with the Lefkow case in Chicago, Illinois, and another had experience with the Fulton County Courthouse case in Atlanta, Georgia. The JTAAC made 22 internal recommendations, which were shared with the OIG office. At present, all or part of 12 recommendations have been accomplished. Many of these require additional funding or staffing resources to accomplish.
In December 2005, the USMS Protective Investigation Policy 10.16 was reviewed and updated. In addition, a total of 210 Inspectors and DUSMs attended the Judicial Security Protection Training Conference in Baltimore, Maryland, and received protective investigations and protective operations training.
In January 2006, we began the announcement/selection process for additional Supervisors, Senior Inspectors and Intelligence Research Specialist (IRS) positions in OPI. Selections were made on eight positions and in April 2006, they started reporting for duty.
In June 2006, the Protective Investigations Program, a Policy and Procedural Guide for Threat Management (Protective Investigations Handbook) was updated, but remains as a draft with anticipation of further development of policies and procedures for protective investigations as OPI developed and implemented the TMC.
In July and August of 2006, four additional PITP classes were conducted with 190 DUSMs and Inspectors receiving training in protective investigations. Four OIG Inspectors attended the last two classes.
In July 2006, we initiated the staffing of a full-time Senior Inspector at the National Joint Terrorism Task Force in McLean, Virginia.
In the summer of 2006, the OPI Investigations Branch was structured with Circuit Teams. At present, each team consists of an Inspector and shared IRS. This staffing combination offers consistent communication on cases between OPI and the districts.
In August 2006, OPI instituted a Daily Briefing document for USMS management.
Since October 1, 2006, OPI has officially issued protective intelligence products: 47 Alert Notices, 42 Information Bulletins, 7 threat assessments for high threat trials, and 65 foreign travel briefings for the judiciary. Prior to this, e-mails were forwarded unofficially to U.S. Marshals and Chief Deputies. OIG was provided with samples that dated back to March 2006. These products were also provided in 2004 and 2005 by the former Chief of OPI, but due to the limitations of e-mail, he did not have the capacity to save them.
Compared to FY 2004, 2005, and 2006, when OPI had limited staffing, FY 2007 has seen significant improvement in meeting the goal of processing cases by conducting analysis in a timely manner. OPI also identified and conducted analysis on 1,190 pending cases in an active or “open” status that were referred to as a “backlog.” We would like to clarify that these cases were initially reviewed by OPI for their threat potential and the districts that conducted the investigations felt they were appropriate. Due to lack of staffing, they were prioritized for analysis. These cases were not completely neglected as the term backlogged infers. These improvements were due to additional staffing.
On December 18, 2006, construction began on the SCIF to house the TMC.
In February 2007, we initiated staffing a full-time Chief Inspector at the Department of Homeland Security, Office of Intelligence and Analysis.
As of July 2007, the USMS has increased the number of Joint Terrorism Task Forces (JTTFs) positions from 50 in 2004, to 80 in 2007. In 2004, the 50 positions consisted of 25 full-time and 25 part-time DUSMs. In 2007, the USMS increased its participation to a total of 80: 17 full-time, one full-time National JTTF position, 23 part-time and 39 liaison positions. This is an overall increase of 29 positions.55 Even though 39 are liaison positions, this enhances information sharing for the USMS with other federal, state, and local agencies. These positions increase access to the JTTFs and the flow of information to and from the other agencies on the JTTFs.
In June 2007, personnel moved into the TMC and in August 2007, the Department of Justice certified the SCIF. Recently, a memorandum announcing the activation of the TMC on September 17, 2007, was sent out to the districts by JSD. This memo discusses policies and procedures for the TMC and identifies examples of protective intelligence information, such as threats, inappropriate communications, demonstrations, suspicious activity and other information that the district should report to the TMC. We hope to receive six additional Inspector positions in FY 2008 to staff the TMC on a 24/7 basis.
The primary mission of the USMS is to protect the judiciary. The USMS takes this responsibility seriously and with a vigilant sense of urgency. We have improved the way we investigate and analyze threats to the Judiciary making it a priority for the USMS in FY 2007 and again in 2008. One outstanding tool that will help us with our mission was the development and construction of a TMC at our Headquarters which was officially opened on September 14, 2007, by the Deputy Attorney General and several members of the Judiciary.
In response to the six recommendations from your office we have the following comments:
1) Develop a formal plan that defines objectives, tasks, milestones and resources for the new threat assessment process.
Concur: OPI has developed a new threat assessment process that relies more on the behavior of the subject and interaction with the TMC and Circuit Teams. A memorandum was issued on this subject by Assistant Director Finan to the districts, dated September 10, 2007. The TMC will provide guidance, oversight, and recommendations in the behavior based approach for protective investigations, and will conduct record checks and other analysis for the districts. The 3 or 7-day requirement will be eliminated on October 1, 2007. The TMC analysis will be provided verbally and the district will be given a written response of the analysis and records checks in one business day. After the interaction with the TMC, the case will be forwarded to the Investigations Branch, to the appropriate Circuit Team, for further analysis and coordination with the district.
The districts will be notified of elimination of the 3 and 7-day standard by memorandum before the end of September and this change is also contained in the draft of Policy Directive 10.3, which should be updated by October. An OPI staff person will be assigned to develop a formal plan for the new threat assessment process.
2) Create a workload tracking system for threat assessments.
Concur: We note that this recommendation is not specifically discussed in the OIG report other than as a recommendation. OPI contacted the OIG and received guidance on September 13, 2007.
A manual tracking system for analysis of reported protective investigations does exist and is being utilized within OPI. JDIS has the capability of producing reports by date. OPI managers have this report produced weekly (Mondays before noon). This report is studied and analyzed by OPI’s Investigations Branch Assistant Chief and is distributed up the chain-of-command and to each OPI employee. The Investigations Branch Assistant Chief identifies any peculiarities and meets with his staff members to discuss the status of the investigation, research and analysis, and any national or regional trends. In addition, the case is logged in upon receipt in an Excel spreadsheet which is maintained on the shared drive (accessible to all OPI employees) and each case is detailed the next business day in the Daily Brief. The Daily Brief and the Weekly Report are also disseminated outside JSD.
The Investigations Branch also prepares monthly status reports from Justice Detainee Information System (JDIS). These reports detail the date the case was received in OPI and what cases are still active investigations. The Investigations Branch Circuit Teams correspond with the District Threat Investigators and Judicial Security Inspectors of each district via a standard e-mail message and attach a copy of the JDIS report. This correspondence serves as a workload reminder for the field and to OPI management. These e-mails also serve as a request for each case to be updated in JDIS with current investigative activity or to articulate why the potential threat has been mitigated and the case is then closed. Whenever a Circuit Team sees little or no progress beyond the 30day review requirement, the Investigations Branch Assistant Chief then communicates with the respective district supervisor to determine if there is further assistance OPI can provide to the district to assist the investigation and ultimately mitigate the threat completely, or to an acceptable level of risk.
On the reverse end of the workload tracking systems, the Investigations Branch of OPI already has a manual system in place for ensuring that case analysis is complete within the 3 and 7-day prescribed time-frames allotted by USMS policy. The Investigations Branch Assistant Chief maintains a copy of the weekly report and determines the date the analysis is due in order to stay within compliance. If on either the third or seventh business day (Expedite or Standard), the Assistant Chief has not seen the analysis for his review and signature, he communicates with the respective circuit team to determine if there are issues causing the delay. The process of what analyses are conducted will change on October 1, 2007.
The Investigations Branch Assistant Chief utilizes specific JDIS reports to conduct periodic reviews of the workload distribution internal to OPI. Such reviews are utilized to assist in making decisions about future work assignments. The most recent review was conducted in August 2007, which led to a complete realignment of circuit distribution to be implemented on October 1, 2007. An OPI staff person will be assigned to develop a formal plan for the new workload tracking system.
3) Develop a formal plan that defines objectives, tasks, milestones, and resources for implementing a protective intelligence function to identify potential threats.
Concur: OPI collects, analyzes and shares information to identify potential threats in the following manner. To systematically identify potential threats from the districts, OPI keeps track of threats and inappropriate communications and prepares weekly and monthly statistics. The Circuit Teams communicate with the districts, and among themselves, to identify subjects that send mass mailing letters and who are active in multiple districts. The Circuit Teams routinely make notifications to other districts that subjects could potentially become active in their district. OPI frequently issues Information Bulletins and Alert Notices on these subjects. The TMC will continue to do this in addition to the Circuit Teams. From this process, the Circuit Teams and OPI management can identify national or regional trends. A check with other agencies that conduct protective investigations reveals that they use the same process to identify potential threats.
OPI has issued guidance on the type of judicial security information to be reported by the districts. This was covered in the six PITP classes in FY 2006 and FY 2007 that 280 DUSMs and Inspectors attended. They received instruction in reporting requirements for threats and ICs, but also for suspicious activity, demonstrations, arrests, mental health commitments and any and all incidents that affect the judiciary. This has been added to the curriculum for new GS–1811 Criminal Investigators and Advanced Deputy classes.
With regard to collecting information from other federal, state, and local law enforcement agencies, the districts interact with other law enforcement agencies on a daily basis. Most districts interact daily with their local sheriff’s office and share information. In addition, OPI receives information and has a good working relationship with the Virginia, Maryland, and Washington, D.C. fusion centers.
OPI also shares information with state and local agencies by participating with the USMS Eastern District of Virginia in a Pilot Project with Virginia’s State Police, Sheriff’s Association and State Police Association to catalog cases originally brought in state or local courts which were then raised in the federal courts. A survey is in the process of being sent to Virginia law enforcement agencies to query them as to their agency responsibilities in investigating threats, inappropriate communications, and their interest in participating in a database regarding these cases.
The USMS is initiating the National Center for Judicial Security (NCJS). The NCJS was established to serve as the national subject matter expert for matters pertaining to the security of courthouses and the protection of judicial officials. The operational component, called the National Support Division, will be responsible for the information sharing initiatives such as the Virginia Pilot Project. In addition, the USMS has affirmed its relationship with the National Sheriff’s Association (NSA) to improve information sharing for this project.
OPI also participates in the Targeted Violence Information Sharing System (TAVISS) where other agencies contribute the names and identifiers of known threateners into TAVISS. It is a requirement for all USMS subjects to be checked in TAVISS. OPI frequently receives calls from other agencies inquiring about USMS subjects in TAVISS.
OPI’s representatives at the National JTTF, DHS, BOP Sacramento Intelligence Unit and liaison to U.S. Capitol Police, U.S. Supreme Court Police and Metropolitan Police also collect and analyze information from other agencies every day. Participation in the JTTFs also maximizes information sharing on a daily basis for the USMS with other federal, state, and local agencies. These positions network with other agencies to exchange and collect information and pass it on to OPI for analysis.
To collect and analyze information from the federal courts, OPI routinely accesses the public PACER database through LexisNexis CourtLink. CourtLink provides all the electronic dockets made available from PACER since the early 1990s. In addition, the districts are in the courthouse and routinely deal with the Clerk’s office for this type of information and provide the latest information to OPI. OPI has identified the need for proactive analysis of court records and has identified certain types of cases as significant. The Circuit Teams and OPI management focus more attention on these cases.
OPI has met with the AOUSC regarding access to PACER information. In March 2007, members of OPI attended a presentation by the AOUSC on PACER and the Case Management/Electronic Case Filing (CM/ECF) program. OPI will continue to pursue training and proactive analysis of PACER with the AOUSC. OPI has engaged the AOUSC in discussions on the possibility of an information technology project involving PACER and the CM/ECF to identify potential threateners. This data will then be compared to USMS databases. However, this project will require extensive funding and staffing requirements.
4) Modify USMS databases to support the new threat assessment process and protective intelligence function to identify potential threats.
Concur: The USMS has been in the process of modifying USMS databases to identify potential threats. These initiatives will take place in two phases, short-term and long-term.
USMS Information Technology Section (ITS) is working on modifications to JDIS to make it more user friendly to store and search for incidents, demonstrations, and suspicious activity information. This system was created for threats and inappropriate communications and will accept other types of information, but needs improvement for better entry and search capability. OPI transferred funds to ITS in FY 2006 for this project and will transfer more funds by the end of FY 2007. In the interim, JSD presently collects and analyzes suspicious activities at and around federal courthouses based on reporting from the districts and the information is entered in JDIS. OPI receives this information from the districts and JSD Judicial Services.
ITS is working on moving the Court Security Information System (CSIS) Suspicious Activity Reporting (SAR) module into JDIS to capture incidents, demonstrations and suspicious activity information. This system is used by JSD Judicial Services.
OPI, in coordination with a dedicated ITS contractor, has obtained an analytical tool for link analysis, information sharing and data mining. This link analysis, or search engine, will be used to search JDIS and other USMS databases, as well as other agency databases. Implementation will begin over the next two months and will enhance our process of identifying potential threats.
OPI is researching a new, more versatile threat management database to assist in analyzing protective intelligence information. The DOJ Justice Management Division moved forward a request to OMB from the USMS for $1.1 million for a new threat management database for OPI for FY 2009. OPI will require the threat management database to have capability to analyze suspicious activity reporting (SAR). This will be used in conjunction with a counter-surveillance or surveillance detection program to collect SAR information. Previous information in JDIS will be merged into the new system.
Interface PACER and the Case Management/Electronic Case Filing (CM/ECF) information on potential threateners into JDIS. (See number 3 above)
5) Require the home alarm contractor to notify the USMS of alarm events after notifying the local law enforcement agency.
Disagree: The USMS Off-Site Judicial Security Program Office has evaluated this subject through extensive consultation with senior USMS management and the national security vendor. The home alarm contractor follows USMS and industry established and approved protocol for alarm events. The USMS will be contacted by local law enforcement if the event occurring warrants USMS participation. The USMS believes this is a reasonable and appropriate program management decision to ensure judicial safety is given the highest priority while remaining cognizant of the agency’s limited resources. We believe the current program policies for USMS notification of alarm events at judicial residences are prudent.
6) Issue operational guidance for requesting and deploying Technical Operations Group resources and Rapid Deployment Teams.
Concur: It should be noted that the current processes for requesting and deploying these resources are effective. The Chief of Technical Operations and all Technical Operation Group (TOG) personnel work to support the requests as they arise from districts. The TOG management coordinates and communicates effectively with JSD management, ensuring that appropriate resources are deployed in support of judicial security missions. We have provided training to 150 protective operations personnel and district threat investigators to ensure they are aware of the available technologies.
Likewise, the leadership of JSD has a clear understanding and drive to provide the resources necessary in case of a major incident. It should be noted that this report contains references to a Rapid Deployment Team response that is well within the new JSD everyday manner of doing business, and is not accurate. The Rapid Deployment Teams will be used for major events exceeding the capacity and resources of a USMS district. Currently, when a protective detail is activated, the Office of Protective Operations and the Office of Protective Intelligence respond in an extremely coordinated fashion to ensure the resources needed are placed quickly in the field, or moved to the location to support the mission. The Rapid Deployment Team will be utilized when an event exceeds that normal course. The USMS conducts protective details frequently, and often without the need for additional resources. In these cases, JSD, in partnership with the Investigative Services Division, ensures that all possible angles and techniques are understood and being utilized to combat a threat. These policies will be issued in the first quarter of FY 2008.
We appreciate the courtesy of your professional staff and any further questions or additional information required, please contact Isabel Howell, USMS Liaison Audit Liaison on (202) 307-9744. Prompt resolution to these audit recommendations remains a high priority for the USMS.
It should be noted that the liaison positions are being used due to the lack of increased staffing through the budget process which would allow the USMS to increase actual positions at the JTTFs. Over the past three years, the USMS operational staffing has only seen an aggregate increase of 30 positions. This is due in part to the Joint Resolution for FY 2007, wherein no additional positions were received. As noted in the response to the 2004 audit, in order for the USMS to increase full-time positions assigned to the JTTFs, additional operational positions are needed. Absent that, it would be difficult to increase the USMS presence on the JTTFs without reducing the overall manpower at the courts, where the primary protection of the judiciary occurs.