All fusion centers are guided by this federal regulation with respect to how they manage their multi-jurisdictional intelligence systems operating under Title I of the Omnibus Crime Control and Safe Street Act of 1968. 28 CFR, Part 23 requires all multi-jurisdictional law enforcement information management systems funded in part by federal grants to follow guidelines for the collection, storage, and purge of information.
28 CFR, Part 23 states that information stored in such a system must be "reviewed and validated for continuing compliance with system submission criteria before the expiration of its retention period, which in no event shall be longer than five (5) years." It is based on a "need to know" and "right to know," which are not explicitly defined terms. Rather, 28 CFR, Part 23, calls upon each project to establish their own written definitions.
Potential deficiencies Edit
In many ways, 28 CFR, Part 23, may be outdated and in need of evaluation against the backdrop of the current threat environment. 28 CFR, Part 23, is focused on traditional crime, not terrorism. As such, it has relatively short information retention periods which may not necessarily be consistent with known terrorist planning cycles and/or the need for historical data for terrorism threat assessment.
Furthermore, this federal regulation was written before many of the data storage and data-mining technologies were available. It is unclear whether some of the technological devices available today, like those that allow users to query disparate databases which are not directly connected, would fall under the jurisdiction of 28 CFR, Part 23. The regulations also promote a “need and right to know” standard, which has been judged as one of the factors contributing to the (real or perceived) “wall” between intelligence and law enforcement at the federal level that prevents effective information flow. Finally, it could be argued that 28 CFR, Part 23, is too vague in parts because it allows agencies to define their own terms, like "need to know," which could contribute to vastly different standards across jurisdictions and, ultimately, ineffective information sharing.
- ↑ Pub. L. No. 90-351.