Comment Submitted by Lisa Palmieri, Int'l Law Enforcement Intelligence Analysts

This document is focusing on several important but distinct issues which are under different command and control entities and may muddy the waters in the event of an incident. Investigations, information sharing, intelligence production, communications and provision of acommon operating picture will be difficult to guide with this one document. It is difficult to follow the way it’s written, and mixes such disparate issues such as terrorist incidents, public health crises, and other types of disasters. “Investigations” is confusing in this context as a function, particularly when combined with “intelligence”. Does it mean criminal investigations in response to an incident? Does it reflect tasked collection to support the intelligence and information sharing effort pre, during and post incident? The two are very different, and it should also be noted that many criminal investigations cannot necessarily feed the information sharing effort. The definition of this Investigations/Intelligence function in relation to an incident is also confusing, and doesn’t appear to be assigned to any one entity or unit to support the incident commander. State and local fusion centers would be the ideal “center of gravity” for information sharing and intelligence production, but that is left very vague in this guide. If this function is not assigned pre-incident (and consistently informing the would-be responders pre-incident), it will be difficult to stand up and function in a crisis. There is mention of the FBI JOC directly linked to provide information sharing. The FBI has an operational role in the event of an incident, and may not be able to support this information sharing role at the state and local level. Spreading this responsibility among the FBI, fusion centers, RISS centers and NCTC is not helpful in the chaos of an incident. All of these entities could report into the fusion centers, the responsibility of which is to ensure information is vetted and shared in a timely manner, and when possible, produce and share intelligence using information gathered locally. Where technical expertise is needed to support the commander, it can still be sent through a fusion center to ensure all parties in need of the information are informed in a timely manner. The different scenarios make the point that individuals/entities should not be assigned to this role on an ad-hoc basis. Assigning the function would help with deconfliction as well. This document does not provide any methodology regarding communication and coordination where this function is involved. This is a weakness, and should be addressed. Intelligence is noted as a clear part of this function, and yet there is no mandate for trained and certified intelligence analysts (although “certification of personnel” is mentioned in passing). This is a weakness in the guidance. The use of the word “intelligence” is also confusing. Information collected for intelligence (or, knowledge for decision making) purposes should be referred to as “information”. Intelligence is produced, not collected. The intelligence and investigative functions, while symbiotic, do not have to be co- located. Ideally, collectors will be on site of an incident or at least in the field; analysts should be somewhere where they can assess the information, analyze it, and communicate it effectively to decision makers. The most crucial issue here is communications, which is too large to address as a component of this one function but is vital to manage in this context.