1. Civil Information Awareness Program (CIAP) Linking Federal, State and Local Law Enforcement within a Total Information Awareness Grid

2. CIAP Overview Emphasis on Local level, all source information fusion center focused on deriving HLS related actionable knowledge Conduct Critical Infrastructure Vulnerability Analysis and Threat Assessments Track Indications and Early Warning of Threat Activities Provide on-going net-assessment and Threat Situation Awareness Collaboration Link between Federal & State Information Centers and local LEA Full Spectrum Analysis and Production *Vulnerabilities *Indications and Warning *Situation Awareness

3. Requirements “ Through joint planning, clear communication, comprehensive coordination, mutual aid at all levels and increased information sharing, America ’s first responders can be trained and equipped to save lives in the event of a terrorist attack. President Bush, Securing the Homeland, Strengthening the Nation, 2002 Intelligence sharing capability is the number one requirement of law enforcement agencies. NIJ Sponsored Survey of Law Enforcement Agencies …need an information sharing capability Association of Police Chiefs report to DoJ “the nation’s law enforcement community needs to be a team…focused on predictive intelligence.” Attorney General John Ashcroft Establishment of new DHS…has identified a requirement for local level intelligence fusion centers as part of national strategy Critical Infrastructure Vulnerability Assessment Local level Information Coordination and Dissemination Centers The Technology Needed to Share Information is Already Here

4. Emphasis on Local level, all source information fusion center focused on deriving HLS related actionable knowledge Convert nebulous data to knowledge and actionable options Data Open Source InformationKnowledge Products: Planning Tools Advisories Alerts Bulletins What’s happeningContextDecision Support All Source Reporting Local Operational Area Federal Info Products Citizen Field Ops CIAP Ops Center

5. Process: Conduct Critical Infrastructure Vulnerability Analysis and Threat Assessments Local Database of Potential Target and Likely Threats used to Derive an Indications and Warning Process Identify Potential Targets Site surveys Define the site’s characterizations Evaluate the site’s physical security posture Evaluate Threats and Prepare Threat Models Correlate Threat to Vulnerabilities Define Indications and Early Warning Criteria Prepare Rapid Response Reference Products

6. Process: Track Indications and Early Warning of Threat Activities Identify activities that provide evidence indicating the development of a potential incident Define Specific Information Requirements (SIR) Define Named Areas of Interest NAI Correlate SIR, NAI with Reporting Source Open Reporting Channels using Information Awareness (IA) Net Plot, Record, Correlate and Assess Incoming Reports employing IA Database and Geospatial Information System (GIS) Display NAI

7. Process: Provide on-going net-assessment and Threat Situation Awareness Response Personnel Constant Awareness of Threat Situation Conduct Detailed, Multi-Disciplined Assessment of Reports by comparing to Threat Models Actual Situation Assessment Compared to Predicted Events Identify Deviations and Update Assessment Disseminate Alerts, Advisories or Bulletins as Appropriate Update Rapid Response References as Appropriate Explosives Chem BIO RDD HAZMAT Cyber

8. Technologies CIAP Portal Applications Incident Management GIS Reporting Chat Video VTC Virtual EOC San Diego Enterprise Portal GIS Work Flow Engine Advanced Terabyte Search Engine San Diego State University Vis Lab CAL IT2 Infrastructure

9. End State: Collaboration Link between Federal & State Information Centers and local LEA IANetIANet National Information Awareness Grid that Emphasizes Local Requirements Federal Information Center Local CIAP State Information Centers Information Products Archive in Document Library Imagery Archive Collaboration Tools for Chat and VTC Surveillance Video over TCP/IP Voice over TCP/IP Incident Management Application Real-Time Reporting Report Forms and GIS Mapping

10. Proof of Concept Domestic Emergency Response Information Service (DERIS) March, 2002 Burning Man, August, 2002 Super Bowl XXXVII, January, 2003 Vulnerability Analysis and Threat Assessment Concept Active Citizen Program Indications and Warning/Situation Awareness Concept

11. Domestic Emergency Response Information Service (DERIS)  Demonstrated feasibility of portal based approach for LEA crisis response  Implements National Institute for Urban Search and Rescue standards for eXtreme Information Infrastructure (XII)  Prototype a common operational picture and provide real-time C2 for Joint Civil- Military Operations  LEA from Chicago, San Diego and Los Angeles utilized collaboration portal within context of a potential terrorist attack

12. Burning Man Event Burning Man Event held annually Spontaneous community of 25,000 people gathering to explore social phenomena CIAP involvement Established robust collaboration network in an austere environment Employed DERIS portal tools as primary means for receiving, archiving and disseminating emergency management essential elements of information Over four day period, implemented complex cultural analysis focused on the dynamics of an emergent community  Social Structure (caste, tribal, warlord)  Religion, Ethnic Groups  Evolving Economic Structure and Status  Political structure and stability  Language and Dialect  Reaction to intervening forces  Location and identification of key social facilities, etc  Implications Terrain and Weather Developed Reach-back technique to interface with San Diego State University Sociology Lab and San Diego Data Processing Center’s GIS applications Provided Situation Awareness Products describing community profile in real time Integrated products and tools within 3-D virtual Emergency Operations Center Employ advanced visualization techniques

13. Super Bowl XXXVII (Future) Phase I Exercise and Evaluation Support Special Event Readiness Level II San Diego Police requested support from Federal Office for Domestic Preparedness (ODP) CIAP participation…Review Local Vulnerability Analysis and Threat Assessments as basis for Tabletop and Functional Exercises Identify potential critical infrastructure targets and target systems Conduct site surveys, Define the site’s functional, physical and environmental characterizations, Evaluate the site’s physical security posture Define the most likely and most dangerous threat, and Develop threat attack models and correlate with potential target vulnerabilities Facilitate “Gaming” of Threat problem against Security Posture Provide recommendations for security, indications and warning, response and mitigation resources

14. Target Sites San Diego Target Site Surveys Target Folders Area Threat Assessment Target Folders Analysis San Diego Threat Evaluation Analysis Threat Integration Exercises and Gaming Situation Templates Site Specific Reports Anchored to DOD, ODP, SDNL Standards Threats Models Developed using DOD, ODP, SDNL Standards Graphic snapshots Of Potential Threat Elements Course of Action Related to Specific Sites Situation Templates Situation Templates Situation Templates Text based, but supported by amplifying images, plans, diagrams and maps Text based, but supported by amplifying images, plans, diagrams and maps Orientation Graphic Site Characteristics Graphics Site Findings Graphic Doctrinal templates Potential Threat Element Profile *Image *Description *Existence, Capability, History, Intentions matrix *Assessment -targets they may see attractive Graphics and terrain model based. Sit-Temp roughs for gaming Terrain Model Refined Sit Temp Quad Chart *Site Findings Graphic Extract *PTE image and description *Template of attack COA *Recommendations & I&W 1. 2. 3.

15. Site Survey Facility X Report Site Specific Reports Collect Data per Playbook Orientation graphic *Basic Site info Table *Working inward, identify KOCCOA elements *Potential Hazards *Amplifying data tables Site Characteristics graphics could take many forms but will illustrate Information collected on: * Operational Conditions, *Building Structure,*Intermodal links and Systemic Impact,*Procedures,*Equipment and Information *Historic Analysis,*Consequence and Severity Analysis *Security System Effectiveness Review Orientation and Characteristics Graphics and identify vulnerabilities. DOD, ODP and SDNL protocols and evaluation checklists are used in conjunction with these graphics to key in on main limitations and opportunities provided by the lay of the land. Site Findings Graphic will combine critical components of Orientation and Characteristic Graphics to Illustrate key analytical points that need to be brought to the customer’s attention. This will be a single graphic And will provide the basis for gaming during threat integration phase. Target Folder provides description of findings in narrative format DOD, ODP, SDNL Vulnerability Analysis Protocols Collect and Report Initial Production Vulnerability Analysis Playbook Analysis Final Production Information and Product Refinement Process 1 San Diego Target Site Surveys

16. Area Threat Assessment San Diego Threat Evaluation Threat Database *Image *Description *Existence, Capability, History, Intentions matrix *Assessment -targets they may see attractive Information and Product Refinement Process Collect and Report Initial Production Analysis Final Production Detail Research Interaction with LEA Report Threats Models Developed using DOD, ODP, SDNL Standards Threat Model Graphics –Doctrinal Templates Illustrate how PTE conducts attacks PTE Quad Charts provide a snapshot of PTE And the Potential targets attractive to the group Evaluate PTE using DOD, ODP, SDNL Standards Correlate PTE Models to Target Site Findings Graphic to determine which sites fit PTE profile 2 San Diego Threat Evaluation

17. Information and Product Refinement Process Initial Production Detailed Analysis Final Production *Site Finding Graphic Extract *PTE image and description *Template of attack COA *Recommendations & I&W Table Top Exercise Series to refine Situation Templates and Help Security Personnel identify gas in their resources and procedures Evaluate and refine Situation Templates based on results of Gaming. Evaluate gaming and define I&W Situation Templates are a graphic illustration of how a PTE would attack a specific target. Situation Templates are developed for each attack scenario for each target site. Initial Situation Templates illustrate R&S activity, C2 Activity, Infiltration Activity and Attack Activity. During Threat Integration’s initial production, Situation Templates are based on an analysis and need to be refined through exercises and gaming. Terrain Models facilitate exercises by providing true scale representation of target site. Situation Template Quad Charts illustrate ML and MD attack scenarios SME Evaluation 3 Threat Integration

18. Active Citizen Concept A Critical Component to CIAP Data Open Source InformationKnowledge Products: Planning Tools Advisories Alerts Bulletins What’s happeningContextDecision Support All Source Reporting Local Operational Area Federal Info Products Active Citizen Field Ops CIAP Ops Center

19. Active Citizen Program Active Citizen Program leverages the eyes and ears of the community to assist law enforcement Main Concept: Community based approach to empowering citizens as partners with law enforcement in the effort to protect their neighborhoods and communities. Issues: *Events of Sept 11 th and subsequent investigations reveal that the terrorists easily integrated into American communities. *Americans are not aware of what indicators to look for. *No program currently exists to educate the American public about things to look for in pre-attack environments *No processes or programs exist to motivate Americans to inform law enforcement officials of suspicious activity. *Most terrorists will infiltrate into ethnically-friendly lower/middle class economic communities. *Most ethnic communities are suspicious of or non- cooperative with law enforcement programs. *Existing community-based programs are not compatible with the terrorist modus operandi.

20. Active Citizen Program Active Citizen Program leverages the eyes and ears of the community to assist law enforcement Components: 1. Organizational and Operational Structure *ActCit Coordination Center *Cadre of trained citizen volunteers 2. Reporting Context *Provide citizens with specific information reporting requirements 3. Reporting Infrastructure *Internet based reporting portal *Hotline Phone Bank *Does not replace 911! 4. Information Fusion *Validate *Coalesce *Archive 5. Dissemination to Law Enforcement Neighborhood ActCit Teams ActCit Coordination Center Coordination Center is not a law enforcement entity

21. Active Citizen Program Pilot Implementation: Small Scale Sample Implementation During Pilot Establish Coordination Center *Space in County EOC or SDSU Viz lab *Broadband, Telephone and VTC Establish Cadre Sample for initial implementation *Link with SDPD COPS program *Link with Sheriffs Neighborhood Watch Reporting Architecture *PDA, Cell Phone, Wireless Service *Block marshal concept Train and Exercise Implement

22. Pulling the CIAP Pieces Together Vulnerability Analysis + Threat Assessment + Active Citizen Indications and Warning Situation Awareness

23. Super Bowl XXXVII (Future) Phase II Establish CIAP Center is support of San Diego Multi-Agency Command (MAC) Stand up CIAP Center to provide real-time information reporting and all source fusion in support of indications and warning and situation awareness for Super Bowl security LEA DOC SD EOC MIL SD MAC SDPD DOC SDSO DOC LA TEW CATICOHS Super Bowl CIAP Center Reports CIAP Portal 18 Cities in SD County Full Service VTC CATIC-California Anti-Terrorism Information Center IANetIANet LEA DOC SD EOC MIL SD MAC SDPD DOC SDSO DOC 18 Cities in SD County IANetIANet Net Assessment Support And Production Dissemination FedState Real-Time Collaboration Tools ActCit

24. Event Concept of Operations for San Diego: X Y SD Sheriff DOC Military COCs County EOC MAC LA TEW CATIC OHS FBI SIOC FEMA CIAC SDPD DOC Z 1 Z 2 Field Indications and Warning I&W flow into CIAP via Incident Reports from Field And Supporting DOCs LA TEW Provides Net Assessment And Fusion Support National Advisories and I&W From Federal Agencies State Anti Terrorism Information Coordination Advisories ActCit Field Units

25. Event Concept of Operations for San Diego: Situation Awareness X Y SD Sheriff DOC Military COCs County EOC MAC LA TEW CATIC OHS FBI SIOC FEMA CIAC SDPD DOC Z 1 Z 2 Field Alerts, Advisories and Bulletins Disseminated for Common Operational Understanding ActCit Field Units

26. Implementation Establish the Information Awareness Grid SD Sheriff DOC Military COCs County EOC MAC LA TEW CATIC OHS FBI SIOC FEMA CIAC IANetIANet Virtual Information Analysis Round-Table Each Center requires only A username and password For each participant SBU over VPN National Capabilities In Direct Support of Local Event in Real-time Existing Technology NO new Boxes NO New Software NO Modifications to Architectures Portal Based Concept that uses “familiar” everyday type applications SDPD DOC Subject Matter Experts Facilitates Existing Procedures Event Information Real time access to online Vulnerability assessment Products and planning tools FAA

27. Implementation CIAP Functionality…Monitoring Events SD Sheriff DOC SD County EOC MAC CIAC IANetIANet Local Collaboration Coordinate Event Related Operations Ensure Readiness Posture SDPD DOC Information from the event site Disseminated using Incident Management Application allowing all sites to view significant Incident Reports Access to Planning Documents using Shared Document Library allows collaborative action planning Information Requests Managed using Request For Information (RFI) Application Collaboration Tools allow real-time interaction GIS Tracking Tools Coordination at Event Site ActCit

28. Implementation CIAP Functionality…Monitoring Events SD Sheriff DOC Military COCs SD County EOC MAC LA TEW CATIC OHS FBI SIOC FEMA CIAC IANetIANet Link to vast Federal, State and Regional Information Resource Support SDPD DOC Subject Matter Experts Information from the event site Disseminated using Incident Management Application allowing all sites to view significant Incident Reports Access to Planning Documents using Shared Document Library allows collaborative action planning Information Requests Managed using Request For Information (RFI) Application Collaboration Tools allow real-time interaction

29. Implementation CIAP Functionality…Alert and Notification SD County EOC MAC CIAC IANetIANet SDPD DOC Broadcast Alerts and activate EOC/DOC using Alert and Notification Application Shared Document Library Resource Lists Planning Docs Imagery Mapping Graphics GIS Plume Modeling Situation Templates for Action Planning Coordination at Event Site Cell Phone PDA Pager Email SD Sheriff DOC Voice and Text ActCit

30. Next Steps Law Enforcement Working Group Endorsement and sponsorship Federal, State and Local Agency participant endorsements Implement Active Citizen Coordination Implement CIAP operational components Implement CIAP architecture Pilot program in support of Super Bowl Develop Transition Concept