The following guide was released on October 18, 2013 by FEMA.
National Incident Management System: Intelligence/Investigations Function Guidance and Field Operations Guide
44 pages
October 2013
The National Incident Management System (NIMS) represents a core set of doctrine, concepts, principles, terminology, and organizational processes that enables effective, efficient, and collaborative incident management. The Incident Command System (ICS), as a component of NIMS, establishes a consistent operational framework that enables government, private sector, and nongovernmental organizations to work together to manage incidents, regardless of cause, size, location, or complexity. This consistency provides the foundation for the use of ICS for all incidents, ranging from daily occurrences to incidents requiring a coordinated Federal response.
Many domestic incidents, such as natural disasters or industrial accidents, have an obvious cause and origin. However, other domestic incidents, such as large-scale fires, public health emergencies, explosions, transportation incidents (e.g., train derailments, airplane crashes, bridge collapses), active shooters, terrorist attacks, or other incidents causing mass injuries or fatalities, require an intelligence or investigative component to determine the cause and origin of the incident and/or support incident/disaster operations.
The scalability and flexibility of NIMS allows the Intelligence/Investigations (I/I) Function to be seamlessly integrated with the other functions of ICS. The I/I Function within ICS provides a framework that allows for the integration of intelligence and information collection, analysis, and sharing, as well as investigations that identify the cause and origin of an incident regardless of source. If the incident is determined to be a criminal event, the I/I Function leads to the identification, apprehension, and prosecution of the perpetrator. The I/I Function can be used for planned events as well as incidents.
This document includes guidance on how various disciplines can use and integrate the I/I Function while adhering to NIMS concepts and principles. It includes information intended for the NIMS practitioner (including the Incident Commander/Unified Command [IC/UC]) that assists in the placement of the I/I Function within the command structure; provides guidance that may be used while implementing the I/I Function; and has an accompanying Intelligence/ Investigations Function Field Operations Guide (I/I FFOG). While this document provides an example of the I/I Function at the Section level, the IC/UC has the final determination of the scope and placement of the I/I Function within the command structure. The guidance provided in this document is applicable for both domestic incidents that use conventional unclassified information (e.g., open source information, criminal histories, medical records, or educational records) and terrorism incidents where information is often classified and requires the use of national intelligence capabilities.
For the purpose of this document, information and intelligence should be interpreted broadly to support user needs across all-threats and all-hazards environments to prevent, protect against, mitigate, respond to, and recover from the effects of incidents, regardless of cause, size, location, or complexity. The activities and information that are at the core of the I/I Function have historically been viewed as the primary responsibilities of “traditional” law enforcement departments and agencies at all levels of government. Although, in many cases, law enforcement departments/agencies fulfill intelligence/investigations duties, the I/I Function has aspects that cross disciplines and levels of government. “Nontraditional” forms of intelligence/investigations activities (i.e., non-law enforcement) might include:
Epidemiology
Mass fatality management
Fire, explosion, or arson cause and origin (regardless of likelihood of criminal activity)
Real-time research and analysis intended to protect against, respond, and/or recover from a specific incident (e.g., critical infrastructure vulnerability and consequence analysis; hurricane forecast regarding strength and estimated point of landfall; post-earthquake technical clearinghouse; or post-alert volcanic monitoring)
Transportation accidents.
This document can be used by jurisdictions and agencies when developing new plans for establishing the I/I Function or when incorporating the I/I Function into existing plans. Users of this document are encouraged to tailor its content, including the information and model in the I/I FFOG, to reflect jurisdiction authorities and/or incident needs.
This document contains a recommended organizational framework for executing the I/I Function. The I/I Guide provides neither legal authority nor direction and does not supersede applicable legal authorities and constraints at any jurisdictional level. Personnel managing and performing intelligence and investigations activities must always comply with applicable authorities, statutes, law, ordinances, regulations, and policies within and affecting their jurisdiction and/or agency. This document informs Command and General Staff personnel who are responsible for making strategic and operational decisions during an incident. The guidance provided in this document does not empower or authorize personnel to take on roles or responsibilities for which they are not authorized, trained, or certified, nor does it substitute for training in the proper tactics, techniques, and procedures related to performing intelligence- and investigations-related operations functions and activities. Users should consult their agency counsel to determine applicable authorities.
Additionally, intelligence and investigations practitioners must protect constitutional, victim, and privacy rights, civil rights, and civil liberties; restrict the dissemination of sensitive/classified information; and honor legally imposed restrictions on investigative behavior that affect the admissibility of evidence and the credibility of witnesses.
…
Intelligence/Investigations Function
The mission of the I/I Function is to ensure that all intelligence/investigations operations and activities are properly managed, coordinated, and directed in order to:
Prevent/Deter potential unlawful activity, incidents, and/or attacks
Collect, process, analyze, secure, and appropriately disseminate information and intelligence
Identify, document, process, collect, create a chain of custody for, safeguard, examine, analyze, and store probative evidence
Conduct a thorough and comprehensive investigation that leads to the identification, apprehension, and prosecution of the perpetrators
Serve as a conduit to provide situational awareness (local and national) pertaining to an incident
Inform and support life safety operations, including the safety and security of all response personnel.
To accomplish the mission of the I/I Function, the IC/UC will determine the incident objectives and strategies and then prioritize them. These priorities may shift as an incident changes. Ultimately, life safety operations are the highest priority, with intelligence/investigations operations being initiated concurrently. The IC/UC ensures that provisions are made for the safety, health, and security of responders and that intelligence/investigations operations contribute toward a safer, healthier, and more secure life safety operation.
In today’s multi-hazard and threat environment, response personnel should consider all potential causes of an incident (e.g., accidental, criminal, or natural) and take the necessary steps to preserve potential evidence and/or crime scenes while protecting life safety. To efficiently and effectively develop and use intelligence/investigations information, the I/I Function is integrated into the ICS structure. The ICS allows for scalability and the IC/UC has the flexibility to establish the I/I Function within the incident management organizational structure based upon the nature and type of incident.
The I/I Function should be established as a General Staff Section when a criminal or terrorist act is involved. As the configuration of the ICS organization is flexible, the IC/UC may choose to combine these functions or create teams to perform these functions and may establish task force operations for crime scene processing. The nature and specifics of an incident, in addition to legal constraints, could restrict the type and scope of information that may be readily shared. When that information affects or threatens life safety of the responders and/or the public, the information can and should be shared with appropriate Command and General Staff.
Life safety is always the primary incident objective. The establishment of the I/I Function as a General Staff Section does not diminish or alter this primary objective in any way. It enhances the primacy of the life safety incident objective. For example, evidence recovered from the incident scene and the information produced from the intelligence/investigations activities may prevent a subsequent criminal or terrorist act from occurring at the incident site or at other locations.
…
Mass Fatality Management Group
The Mass Fatality Management Group will direct intelligence/investigations activities involving mass fatality management operations. This includes the intelligence/investigations-related Family Assistance Center activities involving decedents and unidentified persons.
The Mass Fatality Management Group is responsible for ensuring that:
Mass fatality management operations and activities are implemented
Decedent information reporting, documentation, security, assessment, categorization, consolidation, tracking, storage, dissemination, etc., activities are implemented
When necessary, Disaster Mortuary Operational Response Teams or other similar resources are requested
When necessary, debris sifting operations are implemented
All of the decedents are identified; related required notifications are made in an appropriate and timely manner to the appropriate persons; and the required information is documented in an appropriate manner
Mass fatality-related public health hazards are mitigated
The medical examiner/coroner expeditiously determines the cause and manner of death of each of the decedents and the final disposition of each of the decedents
The appropriate authority expeditiously issues a death certificate regarding each of the decedents
Required information, data, records, images, DNA reference samples, investigative evidence, forensic evidence, digital/multimedia evidence, and non-evidence property regarding decedents are obtained at one or more Family Assistance Centers and/or appropriate facilities/areas.