​This piece is Part III of Security Management's 9-11 Anniversary Special Focus. In this issue we examined the evolving terrorist threat and the progress made in understanding and countering it (Part I). In Part II, ASIS leadership recount how they dealt with events on that day; and in Part IV, we review the prospects for the newest attempt at a trusted traveler program.

The inspiration for suspicious activity reporting occurred in May 2007. I had just settled into my new office in downtown Los Angeles, recently promoted to commander in the Los Angeles Police Department’s (LAPD) Counter Terrorism Bureau, when I saw then Secretary of Homeland Security Michael Chertoff on the television describing the nation’s 750,000 police officers as “a cloak of security across America.”

“No they are not!” I shouted at the TV, knowing full well that my fellow officers did not have the knowledge or training to detect and disrupt terrorist attacks with any uniformity. The enormity of my new job hit me. I had been given the responsibility of protecting this sprawling community, encompassing 460 square miles, from an act of terrorism. Secretary Chertoff’s description of police officers was inaccurate at the time, but he clearly understood the potential. I thought there should be a way to harness that potential so that local law enforcement could play a significant homeland security role.

I began asking myself basic questions, bringing me back to the 9/11 Commission Report: How does information sharing between agencies really work? How do police officers share vital clues with each other as well as with federal law enforcement and vice versa?

My epiphany was that there was no means by which federal, state, and local law enforcement and community members could share information that might help uncover a terrorist plot, such as aspiring pilots who were not interested in knowing how to land an airplane. It was obvious police needed a standardized approach to sharing such information.

To fill that hole, I helped create the Suspicious Activity Reporting (SAR) program at the LAPD. Less than four years later, the Bureau of Justice Assistance (BJA) at the Department of Justice, in partnership with the Department of Homeland Security (DHS) and other federal partners, has taken the program national. This is the story of how the SAR program came to be, where it is today, and its revolutionary potential for detecting and disrupting terrorist conspiracies.

Paradigm Shift

The 9/11 Commission Report concluded that numerous indicators of an impending terrorist attack on American soil had been overlooked and ignored in part because information sharing among the nation’s various law enforcement and intelligence agencies was virtually nonexistent, resulting in lethal silos of information.

More importantly for the LAPD, the attacks also changed the way police officers were perceived. Their intimate knowledge of their communities and their keen observational skills were rightly seen as critical to counterterrorism, which led policymakers, law enforcement executives, and others to increasingly call for police to be redefined as proactive first preventers of terrorism, a change from their traditional role as reactive first responders. Tasking local law enforcement with the policing of traditional crime and the prevention of terror attacks in their local jurisdictions constituted a dramatic paradigm shift for the federal government and the local and state agencies.

Despite this change in police priorities, a critical gap still existed in the information-sharing cycle. Processes were lacking to empower police and integrate them into a domestic intelligence network.

The LAPD recognized that this needed to change and took the initiative. In 2007, we developed the SAR program to bridge the information-sharing gap and adapt the strengths and systems of local police to the threat of terrorism.

The underlying premise of the SAR program is simple: An officer’s observation and reporting of a suspicious event could be the vital nugget of information needed to focus attention in the right place or to connect seemingly unrelated dots that might help predict or prevent an act of terrorism.

Behavior Matters

To make SAR operational and to avoid treading on civil liberties, LAPD executives knew that we had to teach officers what suspicious activities could indicate terrorist planning. We also had to have a way to report what was important to our federal partners.

As a law enforcement executive, I wanted a policy that would not lead officers into confrontational interactions with innocent people engaged in innocent behaviors. I also did not want to inundate law enforcement agencies with useless information and names of innocent people. Finally, I did not want my officers making stops based on race, ethnicity, or religious beliefs. To ensure that these things didn’t happen, we focused officers’ attention on specific behaviors and activities that are known to be precursors to terrorist acts or signs of plots in the making.

After careful research by my team, 63 behaviors and activities historically linked to preoperational planning and preparation for terrorist attacks were identified. They include taking photos of critical infrastructure vulnerabilities or measurements, drawing diagrams, abandoning suspicious packages or vehicles, and testing security measures.

We also determined that we needed to create more detailed descriptions of places, classified as “premise” and “target” locations, which could be at risk of a terrorist attack. For example, if a package were left on a train, it would be crucial to identify whether the train in question was a freight train, passenger train, subway, or light rail. To create these distinctions, we developed 74 location descriptors, in addition to the standard ones—for example, critical infrastructure is the standard and sewage facilities or pipelines are the specific descriptors.

The key to the SAR program is that the 63 behaviors and activities and the 74 new premise/target locations are coded using the same type of numbering system that agencies already employ to track and analyze crime. By creating and assigning numerical codes to the behaviors and premises, terrorist activities could be tracked by date, day of the week, time, and location, just as other crimes were being tracked. This simple coding tool created a common language that mirrored the Uniform Crime Reporting system and enabled data to be shared both vertically and horizontally among local, state, and federal agencies.

SAR Goes Operational

In March 2008, former LAPD Chief William J. Bratton signed Special Order No. 11, officially launching the department’s SAR program.

The goal of the special order was to introduce the program in phases, beginning with the creation of a departmentwide policy mandating that front-line officers complete a SAR report when they become aware of any information with a possible nexus to terrorism. The SAR program was also accompanied by a comprehensive training curriculum. The new training program was designed to help instruct officers on the policy and the scope of their responsibilities.

An e-learning course introduced officers to SAR, providing them with a general overview of terrorism and detailing the behaviors and activities that they were responsible for reporting. Police officers were given notebook dividers that provided them with a quick reference to those 63 suspicious behaviors. The e-learning was followed by both in-service training and roll-call training, which helped ensure standardization of the process.

The LAPD’s SAR policy requires officers to follow strict guidelines, due to the sensitivity of the information, and to seek guidance from trained counterterrorism investigators when necessary. Reports are filed using the department’s existing investigative report, which now has three SAR-related modifications: A suspicious activity report check box, an involved-party box, and a routing check box to ensure that the report is processed correctly at the counterterrorism bureau.

In terms of process, the SAR policy requires that on-call counterterrorism personnel be notified immediately if the information is significant in nature, results in a suspect’s arrest, or needs an immediate follow-up investigation. This process rapidly engages trained and experienced investigators who can provide guidance or take quick action on real-time information. In recognition of the vital and sensitive nature of SARs, a processing policy ensures the expeditious delivery of the information to all the appropriate investigative entities.

Civil Liberties

From the inception of the SAR program, leadership stressed the importance of protecting civil liberties and an individual’s constitutional rights. Throughout the SAR development phase, the Los Angeles City Attorney’s Office was consulted to ensure that these rights were protected.

Specific roll-call training emphasizes that the SAR program gives an officer no additional or “special” powers. Thus, officers investigating a suspicious activity must abide by an individual’s right to be free from unreasonable search and seizure, and the “reasonable suspicion” standard must be met in order to detain someone. In the absence of reasonable suspicion, the officer can initiate a consensual encounter to investigate, but a person is free to leave if he or she chooses.

From the start, the focus of the SAR program has been on behavior. A SAR should never be made based on a person’s ethnicity, race, national origin, gender, or religion.

Results

Completion of a SAR report by officers, detectives, and specialized units ensures that potentially critical information is being gathered, coded, and entered into the central records management system. The nationwide application of this behavioral coding and uniform reporting and tracking method could provide the revolutionary basis for linking indicators and revealing emerging patterns for terrorist activity throughout the United States.

The system allows counterterrorism personnel to run specific queries based on a particular behavior, location, or time frame in order to identify emerging patterns. As one example of how SARs can reveal larger, more nefarious patterns, we had an emerging petty shoplifting problem in Los Angeles. An astute LAPD detective reviewing field-level investigative reports flagged them as suspicious and filed them as a SAR. Then our counterterrorism detectives determined the incidents were not isolated crimes. That shoplifting problem turned out to be a ring of individuals focusing their theft activity across city and state borders, with financing ties to overseas terrorists. This relatively common crime would not have served as the red flag that it did without the SAR program.

The ability to run queries is crucial to the successful analysis and synthesis of information and to the production of actionable intelligence. The information uncovered through the SAR program can also have a significant effect on the distribution of scarce resources. The added ability to fuse this capability with an “all crimes” picture can provide decision makers with statistical support that helps them allocate resources and personnel in a more strategic way. It can also assist leaders in selecting focus areas for training, investigation, enforcement, and protection efforts.

SAR Goes National

The SAR system is the foundation that law enforcement agencies have been seeking to help predict and prevent terrorism. Recognizing its potential from the beginning and supporting our efforts was the program manager of the federal Information Sharing Environment, who, along with the White House, paved the way for the Bureau of Justice Assistance (BJA) to implement the Nationwide SAR Initiative (NSI), based on the LAPD model. The program is now present in more than 35 major cities, with the goal of spreading it to the nation’s 72 fusion centers by the end of 2011.

Room for improvement. The partnership between the BJA, the NSI, and DHS is a committed and well-intentioned one. However, as the breadth and scope of the SAR project expands, certain pillars of the LAPD’s program have been omitted. Key among these is the need for public and front-line responder education to ensure that SARs are reported by the public and are processed properly by their law enforcement agencies and funneled to the appropriate fusion center.

In Los Angeles, we set up a Web site (iWATCHLA.org) with intrinsic analytic capabilities that the community could use to submit a nonemergency SAR. These are suspicious activities that do not warrant a 911 call but could be vital pieces to a larger puzzle. The iWatchLA Web site also has a built-in feedback loop so a citizen knows that the report was received. If there is an issue or if additional information is needed for clarification, investigators are able to follow up with the reporting party.

This has not happened in the federal government’s attempt to reach out to the American public. DHS has made an admirable attempt in laying a foundation for the nation with the department’s “See Something, Say Something” campaign, but it has not implemented the proper training of the nation’s first preventers. Thus, in many localities, a 911 operator or police officer who receives a SAR will not know how to process it, increasing the probability that the appropriate investigative agency—whether local, state, or federal—will miss out on a potentially vital lead to what could be an indicator of a terrorist plot.

To rectify this, front-line officers and 911 operators should be trained specifically on how to recognize, take, and file SAR reports. This takes local leadership. Bratton understood this and provided the executive leadership for SAR to be successful at LAPD.

More importantly, the federal government has not established a centralized place to which the public can report suspicions. DHS should support a national SAR toll-free number and Web site for community reporting to ensure that nonemergency SAR information is received and processed with a standardized methodology so that it can be processed, analyzed, and audited correctly.

Technology today can support the proper routing of community reporting to the local jurisdictions responsible, with the ability to push that information, once properly vetted, to the proper fusion centers around the country.

While certain civil liberties and privacy advocates may protest, this process actually ensures that the proper checks and balances are in place. A clear and comprehensive policy could also improve the public’s respect for the suspicious activity reporting process by demystifying what is considered a suspicious activity and giving the public an idea of what law enforcement does with the information it gathers from those reports.

SAR’s Future

The SAR program provides the standardized foundation for improving the information-sharing deficit and provides a mechanism for linking critical data on activities and behaviors occurring in our communities to federal intelligence counterparts. SAR data can potentially expose otherwise unknown vulnerabilities and tie suspicious activities and behaviors to identified or unidentified individuals and groups of interest.

One of the biggest obstacles that SAR originators had to overcome was the myth that SARs represented “noise,” or innocuous behavior or activities that had no value. Our federal counterparts didn’t trust local law enforcement to make the right judgment calls on these issues. As the program has proven its worth, these doubts are fading. 

Commander Joan T. McNamara (retired) is the former assistant commanding officer of the Counter Terrorism and Criminal Intelligence Bureau at the Los Angeles Police Department. In this post, she developed a system for intelligence-led policing known as Suspicious Activity Reporting, which has been recognized and implemented as a national model for terrorism reporting at the local law enforcement level. McNamara is currently a senior vice president of strategic initiatives at Abraxas Applications in Reston, Virginia.