​

The Colorado Information Analysis Center (CIAC), one of 77 fusion centers recognized by the Department of Homeland Security, resides in a nondescript brick building off a nondescript access road in Lakewood, Colorado. Its modest accommodations and locale belie its reputation as a national model of information sharing. It has earned that reputation by repeatedly getting information that helps its stakeholders—from local police to federal agents—combat terrorism and solve other associated crimes.

Among the factors contributing to CIAC’s success are its analysts, who spend their days working in anonymity in row after row of cubicles. Their efforts have paid off; they have played key intelligence roles in putting dangerous people behind bars before they could hurt innocent civilians in the United States and potentially overseas. Their accomplishments range from helping to stop an airport shuttle bus driver planning to conduct suicide bomb attacks against the New York subway system in 2009 to helping authorities nab a sexual predator fleeing the United States last year. Security Management visited the CIAC to see firsthand how it has achieved its impressive track record.

Transformation

The CIAC wasn’t always a model fusion center. Established in 2002 as part of a state legislative mandate to set up an intelligence apparatus to address post-9-11 threats, it wasn’t originally given sufficient resources or attention. It didn’t start to develop into its present form until 2005 when then Executive Director of the Colorado Department of Public Safety (CDPS) Joe Morales put the Colorado State Patrol in charge of CIAC’s day-to-day operation and decided to put some effort into properly resourcing the fusion center with funds and staff.

Within the state patrol, the architects of the CIAC’s transformation were Colonel James Wolfinbarger, the chief of the state patrol, and two of his officers to whom he gives the lion’s share of the credit: then State Patrol Sergeant Brenda Leffler and then State Trooper Steve Garcia. “The chief and the governor really took a risk on us and said, ‘Fusion centers are the wave of the future, and this is the direction Colorado wants to go,’” says Leffler, now a major and branch manager for the Patrol’s Strategic Analysis and Business Research Unit.

One of the first steps Garcia and Leffler took was to see how other fusion centers functioned. They did this by visiting other sites and inviting other sites in to see their operation and suggest improvements. They visited the state fusion centers in Illinois and New York, and they had personnel from the Arizona Counter Terrorism Information Center (ACTIC) in to see the CIAC.

At this time, fusion centers were in their infancy, explains Garcia, and there was no model for how they should be set up. Even DHS wasn’t sure what relationships and support it would give to these new state-based intelligence centers.

During their research, Garcia and Leffler found various degrees of success in each fusion center. They were particularly impressed by ACTIC. “We felt that the structure and the foundation that the Arizona fusion center was built upon was a model that could be achieved in Colorado,” says Garcia, now a major with the state patrol’s criminal investigations branch.

What they discovered and doubled-down on was the insight that trusted partnerships, good public relations, and transparency are the bricks and mortar of a solid fusion center. In other words, it was more about process than expensive equipment, a large staff, and a large budget.

That’s not to say they didn’t need some of each of those. CIAC has taken full advantage of federal funding opportunities, which is critical to keeping the CIAC running. In fiscal year 2012, the center’s budget is $1.8 million, two-thirds of which comes from federal grants. The CIAC’s staff has also grown from its original staff of three to 34, but that includes many people on loan from partner agencies, who aren’t paid out of the CIAC’s budget.

Partnerships

In the eastern region of the United States, state police departments typically own and operate fusion centers, whereas west of the Mississippi it’s more typical for state patrols to own and operate these centers. Jurisdiction is why this distinction matters. In Colorado, the state patrol’s jurisdiction is limited to mainly traffic enforcement, while state police departments generally are the lead law enforcement agency for all crimes.

“You’ve heard of the FBI coming in [and saying] ‘We’re in charge,’” explains Garcia. “That’s what the state police can do.”

State patrols don’t have that luxury so any law enforcement participation in the CIAC was going to have to be earned, particularly among Colorado’s 64 county sheriffs’ departments, because in Colorado, police authority rests largely at the county level.

The most powerful policemen in the state are sheriffs, and they guard their jurisdiction vigilantly, says Wolfinbarger. Therefore, CIAC wasn’t in a position to insist on sharing; it had to get sheriffs’ departments to want to work with the fusion center and to get them to see how they could benefit from its ability to take in grassroots intelligence, handle it responsibly, store it securely, and create helpful intelligence products.

Currently, about one-third of sheriffs actively receive and share information with the CIAC—a number Garcia is always trying to increase. Chris Olson, the new executive director of the County Sheriffs of Colorado, tells Security Management that the association encourages newly elected sheriffs across Colorado to partner with the CIAC. “It’s a valuable thing to do,” he says.

But the CIAC had to do more than create partnerships with state and local officials; it also had to establish top-down relationships with the federal government, especially the FBI and the then newly established Department of Homeland Security (DHS). It has done that successfully. As a result, today, CIAC boasts participation from representatives of 15 different organizations within the state and at the federal level, including DHS; the FBI; the Secret Service; and the Bureau of Alcohol, Tobacco, Firearms and Explosives.

One of the most important things that the CIAC did right was establish its credibility with the FBI’s Denver Field Office and its Joint Terrorism Task Force (JTTF), says Leffler. Like all fusion centers, the CIAC hands off any actionable intelligence immediately to the FBI, in its case, to the Denver JTTF for it to investigate further. After 9-11, the FBI became the lead law enforcement agency for terrorism investigations in the United States. “We had to prove our worth,” Leffler says, meaning the CIAC had to prove to the FBI that it wouldn’t harm its investigations by disclosing sensitive information or tipping off suspects that they were on law enforcement’s radar.

The relationship between the two groups is said to be very good. It didn’t hurt that when James H. Davis left the Denver FBI Field Office where he was special-agent-in-charge, he took the executive director job at CDPS. The most frequent complaint from fusion centers historically was that information sharing only went one way: from them to the federal government.

There’s progress but still some tension. Another fusion center official who did not want to be named told Security Management recently that FBI personnel still carry a sense of superiority about them, much like an ivy leaguer looks down on someone who attended state college.

FBI agents acknowledge the difficulty in bridging the cultural gap. “Typically for me, a fusion center success story may be, I go home happy that Bill and Steve didn’t punch each other in that meeting,” FBI Supervisory Special Agent Matthew Drake, deputy director of the Northern Virginia Regional Intelligence Center, told a fusion center conference last year. That context makes it all the more remarkable that such tensions don’t exist at the CIAC.

Another element of the CIAC that helped build trust among all its partners was its strict adherence to analysis only. The CIAC does not investigate crimes, says Wolfinbarger. That’s left to the law enforcement agency with the appropriate jurisdiction. And when it comes to terrorism-related crimes, “The JTTF is the operational arm of the CIAC,” he explains.

As a result of that policy, neither the FBI nor state law enforcement worries about CIAC personnel coming into their jurisdiction and working independently. “There is no mission creep,” says Garcia. The CIAC’s only role is to collect, vet, analyze, and disseminate intelligence to its customers so that they have the clearest intelligence picture possible when potentially serious situations arise.

Public Relations

The CIAC didn’t only have to forge bonds of trust with law enforcement, it also had to convince Coloradans that it wasn’t a Big Brother organization established to spy on ordinary people. “We’re not a secretive cloak and dagger type of operation,” says Wolfinbarger.

To earn the trust of the public, the CIAC, working with its state and federal partners, developed a marketing strategy to publicize itself and to clarify what it looked for in terms of “suspicious activity.” It was important to do this outreach before Denver held the Democratic National Convention in the summer of 2008.

The campaign was called “Recognizing the 8 Signs of Terrorism.” One part of that campaign was an 8-minute video narrated by former Denver Broncos quarterback and two-time Super Bowl winner John Elway. “Anytime you attach John Elway to anything in Colorado, it grabs people’s attention,” says Garcia.

The video and other educational materials were sent to first-responder partners and shown to local communities, becoming another fusion center best practice hailing from the CIAC. “If you go around the other states, you’ll see very similar posters,” says Garcia, noting DHS has borrowed elements of the CIAC’s marketing strategy for its own outreach efforts.

Transparency is also a big concern for the CIAC. CDPS Spokesman Lance Clem says he makes every effort to comply with journalist requests to see and report on the CIAC. “We’ll open [the fusion center] to anyone,” he says.

Respecting Liberties

The CIAC, like any fusion center that receives federal homeland security grant funds, must adhere to federal rules intended to protect civil liberties and privacy. Compliance is determined by a DHS review of a fusion center’s privacy policy, which the CIAC had approved in October 2010.

To maintain compliance, the center also has a privacy officer who ensures that any information collected about individuals is purged if it does not meet federal regulatory requirements for retention, noted Supervisor Sgt. Lloyd Smith. Those rules, codified in CFR 28 Part 23, state that such data should not be kept unless “information exists which establishes sufficient facts to give a trained law enforcement or criminal investigative agency officer, investigator, or employee a basis to believe that there is a reasonable possibility that an individual or organization is involved in a definable criminal activity or enterprise.”

The center and its personnel are very aware of citizen suspicion of fusion centers. Some of this stems from mistakes made by other fusion centers that spied on peaceful protesters and dissidents, who had committed no crimes. “Some fusion centers did things that the CIAC would never do,” says Clem.

The CIAC’s fidelity to civil liberty policies and principles were recently tested when the Occupy Movement set up camp at Denver’s Civic Center Park. The Denver Police Department asked the CIAC what information it knew about the protesters. “That was a crossroads that we came to,” says Garcia, “Can we even look at the Occupy Denver movement?” The CIAC decided it couldn’t because protesters were simply exercising their constitutional right to free speech and assembly.

The CIAC’s good track record doesn’t mean rights violations couldn’t happen in the future. “We’re not immune to it,” says Wolfinbarger. What matters, he says, is that the CIAC remains transparent and accountable when mistakes are made.

One indicator that the CIAC has earned the trust and support of many Coloradans is the number of cases reported by the public that met CFR 28 Part 23 standards. In 2010, 95 cases came from the public, or 34 percent of all the cases retained that year.

TLOs

At the heart of CIAC is the Terrorism Liaison Officer (TLO) program, says Garcia. The TLO is the local first responder within each stakeholder organization—whether law enforcement, public safety, or private sector—who is identified as “responsible for coordinating suspicious activity or criminal activity back to the fusion center,” he says . “They should also be that champion for the information-sharing network in their community.” Having that liaison within each partner organization helps to create the level of trust needed to have a true two-way information pipeline.

Garcia and Leffler took the TLO concept from the Arizona fusion center, but they added their own innovations. For example, they opened eligibility to all state first responders. “We were one of the few centers...that said we were going to incorporate non-law enforcement entities into the center. So from the beginning, we said that firefighters, emergency services workers, critical infrastructure sector owners—all have a role in homeland security, and we have to do this together,” says Leffler.

She adds that information relayed from a non-law-enforcement TLO is given the same regard as information from law enforcement. Indeed, the CIAC strives to release as many reports as possible under the For Official Use Only (FOUO) designation, which is less strict than the Law Enforcement Sensitive (LES) designation. This, according to its 2010 Annual Report, “ensure[s] that the passage of intelligence is not limited to only law enforcement personnel or those holding a security clearance.”

Today the CIAC relies on a network of 614 CIAC-trained TLOs statewide to help the center receive and push out terrorism- and criminal-related intelligence. About two-thirds of those TLOs are in law enforcement; the rest come from (in descending order) fire/EMT personnel, emergency managers, and security directors from large infrastructure businesses, like Xcel and Qwest, explains Garcia.

Those serving as TLOs have to go through training. CIAC TLO training is more robust than similar programs in other states: three 8-hour days, compared to one in many other states.

CIAC’s TLOs are trained in situational recognition, information analysis and dissemination, threat vulnerabilities, domestic and international terrorism, civil rights and civil liberties, and privacy policies. The instruction includes specifics about when it is appropriate to add information to a police database.

Davis, the former FBI special-agent-in-charge in Denver, considers CIAC TLOs some of the best trained in the country. “They’re a little more dialed in now than your normal first responders as to what the warning signs of terrorism are,” he says. He adds that Colorado residents may be more likely to report suspicious activity to the CIAC TLOs than directly to the FBI through the FBI’s tripwire program (see the February 2012 issue of Security Management). That’s because locals may already know the people serving as TLOs. “In my opinion, it’s going to be much more likely to get a call to a local TLO than to have somebody in remote Colorado call the FBI.”

Successes.

TLOs have played critical roles in many CIAC success stories. The most notable came in September 2009 when the FBI learned from the U.S. intelligence community that Denver airport shuttle driver Najibullah Zazi, a legal permanent resident from Afghanistan, was planning to attack the New York City subway system around the anniversary of 9-11. During the Zazi investigation, the FBI had the CIAC use its TLOs to reach out to beauty supply stores all across the state to see if Zazi or possibly unknown accomplices purchased large quantities of hydrogen peroxide. At that time, the FBI’s resources were focused on Zazi and making sure he didn’t go operational ahead of schedule. The FBI was relying on the TLOs to ferret out any co-conspirators. “From the FBI’s perspective during Zazi, [TLOs] could support our investigation by doing things in remote areas of the state that we were unable to get to in short order,” says Davis. “It’s a tremendous force multiplier.”

Two additional but less well-known incidents that occurred more recently in Colorado demonstrate the reach and power of the TLO program, according to CIAC and CDPS staff.

In June of last year, a string of bombings occurred in the CIAC’s hometown of Lakewood as well as just across its boundary line with Denver. One attack targeted a local Borders bookstore just a few miles from the CIAC. The perpetrator broke into the store and left three homemade bombs that failed to detonate. Surveillance cameras, however, caught the attacker’s truck leaving the scene of the crime, which proved to be his undoing. While the video only caught a distorted image of the truck’s license plate, analysts were able to identify the make and model of the truck. With just that information, the CIAC created a “be on the look out,” or BOLO, report that they sent to their network of TLOs. It immediately paid off.

“A TLO, who happened to be a state trooper, read the report, and he’s like, ‘Wow, the guy I arrested for DUI, who crashed his vehicle several hours ago, was driving that exact truck,” explains Garcia. “That broke the entire case. We were able to grab him within a matter of hours and the case was solved due to the network.”

The suspect, David Lawless, has since pled not guilty to federal charges of arson and using a destructive device during a crime of violence. He is awaiting trial.

In February 2011, an aware TLO and the CIAC helped put a sexual predator in jail even after he was en route to London’s Heathrow Airport. After investigating a rape in Glendale, a suburb of Denver, Officer Crystal Johnson, who was also a TLO, reached out to the CIAC for help in alerting DHS that 37-year-old Ali Ahmed Abooebdella had boarded a flight for London in hopes of fleeing to Libya, his home country. Before fleeing the United States, Abooebdella savagely beat and tried to sexually assault his neighbor after she invited him into her apartment.

Using the CIAC’s DHS partners, the center confirmed with the TSA that the offender had boarded his flight. Upon arrival at Heathrow, FBI agents met Abooebdella at the gate, arrested him, and extradited him back to Colorado to face charges. He pled guilty to second-degree assault and attempted sexual contact with force in October and was sentenced to 12 years in prison last December.

“Historically law enforcement departments would have to go through lots of red tape to have access to the resources of the federal government,” says Garcia.

These successes and others, say Garcia and Leffler, would have been unthinkable prior to 9-11. That “never would have happened [in such a short time span],” says Garcia. And in the case of Abooebdella, any hesitation would have meant his successful escape to Libya.

These successes haven’t gone unnoticed. DHS named the CIAC the fusion center of the year for 2009. The CIAC also regularly shares its concept of operations plans, privacy policy, and other procedural documents with newly established fusion centers. “We share everything,” says Leffler.

In 2010, the CIAC hosted the Texas Fusion Center, the San Diego Regional Terrorism Threat Assessment Center, and the North Florida Fusion Center Exchange to share its expertise, develop stronger relationships, and learn about other fusion center processes. It’s that sense of solidarity that makes the CIAC such a valued member of the fusion center community.

“The CIAC has demonstrated exemplary capabilities that support the fusion process, not only in Colorado but in working with their partners across the National Network of Fusion Centers,” says Scott F. McAllister, director of the State and Local Program Office within the DHS Office of Intelligence and Analysis. “We are especially appreciative that the CIAC has shared its best practices and lessons learned with fusion centers across the country.”

Next Steps

With the threat of terrorism sliding from people’s consciousness and the budget crunch threatening many government services, Coloradans began to question the necessity of the CIAC. In response, the CIAC had to prove it wasn’t simply a counterterrorism resource. “Local chiefs and sheriffs wanted us to move toward an all-crimes focus,” explains Garcia.

But rather than bite off more than the CIAC could chew, the fusion center was determined to choose a particular problem it could bring its analytical expertise and value to. “We needed to find a crime to develop the foundations, the way we did with the TLO program, to move towards this all-crimes [focus],” Garcia says. “The crime we picked was auto-theft because there was a funding mechanism in place for it.”

Immediately the CIAC discovered that there were various auto-theft task forces doing the same thing without sharing intelligence and coordinating with each other. In an effort to create an information-sharing network to link all auto-theft investigators across the state, the CIAC created the Auto Theft Intelligence Coordination Center (ATICC). CIAC leadership believed auto theft was the appropriate crime to begin the center’s analytical expansion because it’s a “cascading,” or gateway, crime, according to Garcia. “Of the nearly 31,000 auto-theft cases in Colorado in the past five years, 75 percent involved another crime including murder, robbery, assault, and sexual assault,” notes DHS.

Since its establishment in February 2010, the ATICC has helped Colorado law enforcement continue its successful campaign against auto theft. In 2010, reported auto thefts fell 9 percent.

Another key success is data centralization: all auto-theft-related information for the state now flows through the fusion center. “The ATICC has become the regional hub for Colorado law enforcement to obtain the daily, weekly, and monthly information regarding the stolen vehicles in all of Colorado,” says Garcia. “Previously, law enforcement had to utilize several resources to obtain this information.”

The center’s success has already made it a national model as it establishes information-sharing partnerships with the DEA and DHS to share license plate information on the border. “Unfortunately, a lot of the vehicles stolen here make their way to Mexico for their value or [are] being used to smuggle drugs back across the border,” says Garcia. The partnership will eventually allow all agencies involved to cross reference vehicles stolen in Colorado with the license plates of cars crossing back and forth over the border that are captured by license plate readers.

With successful information-sharing partnerships established around terrorism and auto thefts, the CIAC is looking for its next crime to tackle. Currently, a leading contender is arson. But expansion will only occur if success is possible. “Pick one crime, do it well,” says Garcia. If not, warns Leffler, “You’ve lost your credibility, you’ve lost trust, and you failed before you really even started.”