Ohio Homeland Security & The Strategic Analysis and Information Center (SAIC)

1. Ohio Homeland Security & The Strategic Analysis and Information Center (SAIC) UNCLASSIFIED//FOR OFFICIAL USE ONLY

2. Division of Homeland Security-Established September 2003HB 95 (ORC 5502.03) • Coordinate all homeland security activities of all state agencies and be the liaison between state agencies and local entities for the purposes of communicating homeland security funding and policy initiatives; • Collect, analyze, maintain, and disseminate information to support local, state, and federal law enforcement agencies, other government agencies, and private organizations in detecting, deterring, preventing, preparing for, responding to, and recovering from threatened or actual terrorist events. This information is not a public record pursuant to section 149.43 of the Revised Code; • Coordinate efforts of state and local governments and private organizations to enhance the security and protection of critical infrastructure and key assets in this state; • Develop and coordinate policies, protocols, and strategies that may be used to prevent, detect, prepare for, respond to, and recover from terrorist acts or threats; • Develop, update, and coordinate the implementation of an Ohio homeland security strategic plan that will guide state and local governments in the achievement of homeland security in this state; UNCLASSIFIED//FOR OFFICIAL USE ONLY

3. Division of Homeland Security Ohio Homeland Security Executive Director Richard Baron Administration and Grants Strategic Analysis & Information Center Law Enforcement Operations Public & Private Sector Operations Grants Administration Strategic Planning Infrastructure Planning & Protection Unit Regional Coordination Unit Law Enforcement Partnerships Public & Private Sector Partnerships Analysis & Production Unit Security Liaison Officer UNCLASSIFIED//FOR OFFICIAL USE ONLY

4. What is a Fusion Center? • Fusion Center – a collaborative effort of two or more agencies that provide resources, expertise, and/or information to the Center with the goal of maximizing the ability to detect, prevent, apprehend and respond to criminal and terrorist activity. Evolving quickly to All Crimes, All Threat, All Hazards approach throughout Fusion Centers. • Functions • Compile, blend, analyze, and disseminate information of various types • Support efforts to anticipate, identify and prevent criminal or terrorist activity • Criminal intelligence • Threat assessment • Public safety • Law enforcement • Public health • Social service Safeguard the homeland and prevent criminal activity UNCLASSIFIED//FOR OFFICIAL USE ONLY

5. US Department of Homeland Security Fusion Orientation • “Fusion centers are the way not only to share information vertically … but also to share information horizontally at the local level.   If we do this right, information will flow seamlessly … on a horizontal basis at the federal level, but also seamless vertically and seamlessly among the state and local fusion centers. And that will maximize the chance … that we will connect the dots the next time before any attack on U.S. interests or U.S. persons.” • Representative Jane Harman, Chair, House Homeland Security Committee, Subcommittee on Intelligence, Information Sharing, and Terrorism Risk Assessment, 14 Mar 07 UNCLASSIFIED//FOR OFFICIAL USE ONLY

6. Foundation of Fusion Centers Global October 2003 Road map for criminal information and intelligence sharing Global/DOJ/DHS August 2006 Fusion Center Guidelines All crimes–all hazards National Strategy October 2007 Federal, state, and local roles/responsibilities to incorporate fusion centers into the ISE Global/DOJ/DHS September 2008 Baseline capabilities guidance for fusion centers UNCLASSIFIED//FOR OFFICIAL USE ONLY

7. Fusion Center Functionality • One of the roles of state and urban area fusion centers is to support local chiefs and sheriffs in the everyday challenges of providing safety in our communities, including the sharing of information such as suspicious activity reports • The National Strategy for Information Sharing specifiesSAR-related efforts: • Fusion centers will support the gathering of locally generated terrorism information, homeland security information, and law enforcement information related to terrorism • The Baseline Capabilities for State and Major Urban Area Fusion Centers include capabilities related to SARs: • Fusion centers are tasked with developing, implementing, and maintaining a plan to support the establishment of a suspicious activity and incident reporting process UNCLASSIFIED//FOR OFFICIAL USE ONLY

8. What is the Mission of the SAIC? The SAIC will facilitate effective terrorism related information and intelligence collection, analysis and sharing, working with and supporting local, state and federal governmental agencies, public and private sectors, and the citizens of Ohio, effectively addressing criminal threats and events. UNCLASSIFIED//FOR OFFICIAL USE ONLY

9. Privacy Protection • Maintain Privacy Policies • Privacy Policies for centers must meet DHS standards. • SAIC was one of the first to have a Privacy Policy in 2007. • In 2010 the SAIC updated its policy to include the NSI SAR Program and it to has been approved. • Designated Privacy Officer - DPS Atty Heather Reid-Frient UNCLASSIFIED//FOR OFFICIAL USE ONLY

10. Security Clearances • State of Ohio Security Officer Program • Designated Security Officer Point of Contact who manages all Ohio DHS-sponsored clearances, including perm-certs and courier cards • RICs are local law enforcement throughout the state who have been provided with clearances and training—also attend monthly classified briefings • Monthly Classified Briefing held for both Federal, State and Local Partners at the SAIC. This is often partnered with an outside agency as a guest speaker. • Average attendance for classified briefings is approximately 65 people • Weekly briefing for the State Homeland Security Advisor by the SAIC Analysis & Production Unit and DHS Senior Intelligence Officer. UNCLASSIFIED//FOR OFFICIAL USE ONLY

11. SAIC Partners and Programs (Public Private Sector) • Federal, State and Local Non Law Enforcement Organizations that are coordinated under the Deputy Chief for Public & Private Sector Operations. • Public Sector agencies include but are not limited to EMS, OFCA, ODA, ODOT, OEMA, ODH, Franklin County Health, etc. • Private Sector agencies include but are not limited to First Energy, AEP, CSX, Call Before Your Dig, Cardinal Health, etc. UNCLASSIFIED//FOR OFFICIAL USE ONLY

12. SAIC Partners and Programs LE • Federal, State and Local Law Enforcement coordinated under the Deputy Chief of Law Enforcement • Federal agencies such as DHS, FBI, IRS, USSS, etc. • Urban Area Security Initiative Fusion Centers and TEWG’s • Local agencies and their representation such as the BSSA and the OACP. • Terrorism Liaison Officer Program • State Law Enforcement Agencies (OSHP, OIU, ODNR, SFM, etc) • Northern Border Initiative UNCLASSIFIED//FOR OFFICIAL USE ONLY

13. Northern Border Initiative (NBI) Lake Erie International Border UNCLASSIFIED//FOR OFFICIAL USE ONLY

14. Northern Border Initiative (NBI) 10 NBI Counties/2 States 56 Total Agencies 4 State Agencies Ohio Homeland Security ODNR- Division of Watercraft Ohio State Highway Patrol Ohio National Guard Federal Partners CBP- Border Patrol Coast Guard ICE UNCLASSIFIED//FOR OFFICIAL USE ONLY

15. Northern Border Initiative (NBI) • Marine Patrols • Mission oriented patrols working with and in conjunction with USCG, ODNR & other existing patrols to work within mission guidelines of NBI providing border, coastline, and in-land connected waterways related marine patrol. • Awareness • Focused crime prevention style presentations scheduled in advance with groups. • Presentations to include TAP & See Something, Say Something • Land Based Patrols • Focused “interdiction style” patrols on marinas, dive shops, ports, bus & train stations, marine sales shops etc. • ***include agencies that have such locations within their jurisdictions. • Intelligence & Information Sharing • Each agency designated a Terrorism Liaison Officer (TLO) point of contact • Each Division designated a central point of contact TLO, with Secret Clearances from DHS, Monthly Briefings • Utilizing Automated Notification System and Conference Calls for project wide notification of immediate need to communicate information • Quarterly Committee Meetings with 3 Regional Monthly I&I Meetings UNCLASSIFIED//FOR OFFICIAL USE ONLY

16. 2 1 5 4 3 8 6 7 Homeland Security Planning Regions and Regional Coordinators John Butterworth – 1,4 Jack Kraft– 3,6 Jeffrey D’Annolfo – 2,5 Robert Schlicher – 7,8 UNCLASSIFIED//FOR OFFICIAL USE ONLY

17. Terrorism Liaison Officer Program Terrorism Liaison Officer Program was developed to establish a baseline intelligence capability throughout the state, utilizing existing law enforcement resources. There is at least one TLO in each of Ohio’s 88 counties. In addition, one officer was identified from each of the eight Homeland Security planning regions to serve as a Regional Intelligence Coordinator (RIC). Each TLO and RIC is required to attend a training course designed for the TLO program, and to obtain continuing education (provided by OHS). The five trainings provided thus far were began in September 2008 and have been run each fall and spring since. Instruction was in the following areas: • Terrorism – Domestic, International, and Virtual • Multicultural Awareness/History of the Middle East • Response to Terrorist Attacks • Radicalization Awareness and Threat • Intelligence Cycle • 28 CFR training and Privacy/Civil Rights & Civil Liberties Protections • Reporting and Information Sharing • Infrastructure Protection Approximately 308 officers have been trained to date. UNCLASSIFIED//FOR OFFICIAL USE ONLY

18. Terrorism Liaison Officer Program • The TLO is a sworn officer who has a good understanding of intelligence requirements, the intelligence cycle and current terrorist techniques and tactics. • Serves as a liaison to all other Law Enforcement, Fire and EMS in providing information and guidance to local officials and acts as the Point of Contact (POC) within the TLO’s County for Homeland Security information and suspicious activity reporting. • Collects evaluates critical and timely criminal, terrorist, and suspicious activity related information from the field by interacting with patrol officers, investigators, first responders and others, and forwards findings to the Regional Intelligence Coordinator for the TLO’s respective Homeland Security Planning Region • Maintains open communication and contact with their RIC UNCLASSIFIED//FOR OFFICIAL USE ONLY

19. Analysis & Production Unit • Comprised of a Supervisory Intelligence Analyst and five Homeland Security Analysts • The Supervisory Intelligence Analyst handles the majority of the briefings, approves products, provides training, and tracks performance measures • The Homeland Security Analysts are assigned to the following AORs: transnational, domestic, gangs (STG, OMG), critical infrastructure/key resources, cyber, fire/WMD, finance and health security • Each analyst has a role in conducting briefings, developing products, and engaging in research and analysis. UNCLASSIFIED//FOR OFFICIAL USE ONLY

20. Intelligence Cycle UNCLASSIFIED//FOR OFFICIAL USE ONLY

21. Incident Maps • Produced on a daily basis and briefed during the SAIC 9A briefing • Covers only open source information—available to all CIMS users • Contains links to the actual open source articles UNCLASSIFIED//FOR OFFICIAL USE ONLY

22. Situational Awareness Products • Developed on an as-needed basis • Can be requested by any individual or agency UNCLASSIFIED//FOR OFFICIAL USE ONLY

23. Incident Reports/Incident Driven Products • Created and disseminated as real-time as possible • Is produced from first line information (reliability/validity) UNCLASSIFIED//FOR OFFICIAL USE ONLY

24. Officer Safety Products • Developed on an as-needed basis • Provided for awareness regarding a group, individual, or event that may pose a danger to officers or has a criminal nexus UNCLASSIFIED//FOR OFFICIAL USE ONLY

25. Joint Products • Developed on an as-needed basis • Capitalizes on multiple agencies experience and expertise to provide the most complete report possible. • The example here shows collaboration with DHS/ICE, the Ohio Board of Regents and the SAIC. UNCLASSIFIED//FOR OFFICIAL USE ONLY

26. Sector Assessments • Developed as-needed or as requested UNCLASSIFIED//FOR OFFICIAL USE ONLY

27. Threat Assessment • Annual basis (first in 2009) • Designed to act as a resource for terrorism-based information in Ohio • Covers international terrorism trends, domestic terrorism trends, gangs (street, outlaw motorcycle, prison/STG), critical infrastructure, and mitigating factors • Threat/Risk Assessments are also conducted for special events and venues such as the Ohio State Fair, the Muirfield Golf Tournament and more recently, the Tenth Anniversary of September 11th. UNCLASSIFIED//FOR OFFICIAL USE ONLY

28. How does the SAIC support the Homeland Security Mission? • The SAIC has filled over 460 separate requests for information (calls from outside agencies) since the beginning of 2011 to assist agencies across the United States. • The SAIC has provided 6 Homeland Intelligence Reports (HIRs) for 2011. These are raw intelligence reports are submitted to a national level. • For 2011, the SAIC has completed 97 products which were disseminated throughout Ohio. This includes bulletins, situational awareness reports, alerts, threat/risk assessments and joint seal products. • The SAIC has handled nearly 300 pieces of reporting (tips & leads, suspicious activity reporting, etc.) which are shared with the appropriate agencies. • This is part of the mission of fusion centers. UNCLASSIFIED//FOR OFFICIAL USE ONLY

29. Information Sharing Flow UNCLASSIFIED DHS FBI National Intel Products SAIC Suspicious Activity Reports/ Intelligence/Criminal Reports Facilitated by OHS Regional Coordinators TEWG, Regional Fusion Center, Regional Intelligence Coordinator Regional Info Sharing/CIMS Terrorism Liaison Officers First Responder, Individual, Industrial Ohio Department of Public Safety Division of Homeland Security UNCLASSIFIED//FOR OFFICIAL USE ONLY

30. See Something, Say Something Campaign Ohio Homeland Security has partnered with law enforcement across Ohio in this campaign. The program aims to educate Ohioans on the possible signs of terrorism and encourages the public to report any suspicious activity to local law enforcement and Ohio Homeland Security Persons can report suspicious activity by the following means: • To their local law enforcement agency • Via the internet at www.homelandsecurity.ohio.gov • Via toll-free tip-line at 1-877-OHS-INTEL • The tip-line is maintained 24 hours a day and is answered by SAIC personnel during normal operating hours and by the Critical Incident Command Center outside normal operating hours. UNCLASSIFIED//FOR OFFICIAL USE ONLY

31. 7 Signs of Terrorism • Surveillance: Someone recording or monitoring activities. This may include the use of cameras (either still or video), note taking, drawing diagrams, annotating on maps, or using binoculars or other vision-enhancing devices. • Elicitation: People or organizations attempting to gain information about military operations, capabilities, or people. Elicitation attempts may be made by mail, fax, telephone, or in person. • Tests of security: Any attempts to measure reaction times to security breaches or to penetrate physical security barriers or procedures in order to assess strengths and weaknesses. • Acquiring supplies: Purchasing or stealing explosives, weapons, ammunition, etc. Also includes acquiring military uniforms, decals, flight manuals, passes or badges (or the equipment to manufacture such items) or any other controlled items. • Suspicious persons out of place: People who don't seem to belong in the workplace, neighborhood, business establishment, or anywhere else. Includes suspicious border crossings and stowaways aboard ship or people jumping ship in port. • Dry run/Trial run: Putting people into position and moving them around according to their plan without actually committing the terrorist act. This is especially true when planning a kidnapping, but it can also pertain to bombings. An element of this activity could also include mapping out routes and determining the timing of traffic lights and flow. • Deploying assets: People and supplies getting into position to commit the act. This is a person's last chance to alert authorities before the terrorist act occurs UNCLASSIFIED//FOR OFFICIAL USE ONLY

32. CIMS is OHS’s primary online system of communicating threat, prevention, and protection information to our partners including: • Bulletins • Current Alerts • Grant Information • General Information • Training Information • Video Broadcasts via the Virtual Communication Network • 2010 Stats • 7,000 plus users • 626 new users • 28 new LE agencies (total 788) • 82 Firefighters • 920 Products Posted • 390 Alert Level Documents • 400 Bulletin Documents • 140 General Content https://www.dps.state.oh.us/cims/ Ohio Department of Public Safety Division of Homeland Security UNCLASSIFIED//FOR OFFICIAL USE ONLY

33. Contacts and Information Management System (CIMS) • The SAIC’s main avenue for information and intelligence dissemination, including: • Local and State Products • Federal Assessments and Products • All SAIC Products • https://www.dps.state.oh.us/cims/ • Other user options: • Submit suspicious activity information • Obtain contact information for the SAIC and Terrorism Early Warning Groups (TEWGs) statewide • Link to OHLEG and HSIN-Intelligence (HS-SLIC) • Homeland Secure Data Network (Classified) • Homeland Security Information Network (Unclassified) • LEO Online (FBI- Unclassified) UNCLASSIFIED//FOR OFFICIAL USE ONLY

34. Questions?Contact Information:Captain Richard BaronExecutive Director – Ohio Homeland SecurityChief of Operations – Ohio SAICOffice: (614) 644-1000Email: rbaron@dps.state.oh.usSAIC Tip Line: (877) 647-4683 UNCLASSIFIED//FOR OFFICIAL USE ONLY