"Where we'd like to go is not really where we can go."

So said Terrence Clark, chief of the violent crime intelligence division and acting director for the U.S. bomb data center at the Bureau of Alcohol, Tobacco, Firearms and Explosives. He was talking about information collection and sharing among US law enforcement and intelligence agencies, from the local to the state to the federal level.

Clark had gathered with other government officials in Bethesda, MD to discuss the FBI's data sharing network N-Dex, or national data exchange. For some time we have known that N-Dex allows local police to share intelligence and criminal information on suspects or persons of interest with the federal government, and vise versa. But we didn't know much else, and there's hardly any publicly available information about the program.

A DHS privacy impact assessment describes N-Dex in the following terms:

National Data Exchange (N-DEx):  N-DEx is a repository for information from contributing state, local, tribal, and federal law enforcement and criminal justice entities that provides the capability to make potential linkages between law enforcement information contained in crime incidents, criminal investigations, arrests, bookings, incarcerations, parole and/or probation reports in order to help solve, deter, and prevent crimes

The FBI, custodian of the program, describes it thusly:

The Law Enforcement National Data Exchange (N-DEx) is America’s premier information-sharing tool used by criminal justice professionals to put the right information into the right hands right now. N-DEx uses criminal justice data from local, state, tribal, and federal agencies across the nation to quickly “connect the dots” between data that may seem unrelated. It is a repository of criminal justice records, available in a secure online environment, managed by the FBI’s Criminal Justice Information Services (CJIS) Division.

 

N-DEx brings together data such as incident and case reports, arrest reports, computer-aided dispatch calls, traffic citations, narratives, photos, supplements, booking and incarceration data, and parole/probation information. Additionally, N-DEx automatically correlates and resolves data from open and closed reports to detect relationships between people, vehicles/property, locations, and/or crime characteristics. It also supports multi-jurisdictional task forces—enhancing national information sharing, links between regional and state systems, and virtual regional information sharing.

The program descriptions above make it seem like N-Dex holds and shares only criminal justice related information, but a recent article about the Bethesda law enforcement gathering makes it appear as if DHS and the FBI aren't saying everything they know about it. 

There's good and bad news with respect to N-Dex and data sharing.

First the good: if the people interviewed for the article are telling the truth, police and federal agents must give express consent before information in their possession is shared with another agency. If true, this means there is a check to ensure that the information is accurate and current, to the knowledge of the sharing party, before it spreads like wildfire throughout police departments and federal agencies nationwide. 

Jeff Lindsey, program manager and unit chief of N-Dex at the FBI, told Fierce Government IT, an online publication:

"[That rule] allows me to verify and validate that that information is current, before it goes into some kind of file. The other thing it does is it builds collaboration," presumably because the agencies need to actually engage on a personal level, instead of simply sharing information blindly through N-Dex.

The bad news is that the database contains far more data than we had previously assumed, holding not only criminal records but also commercial information that police and federal agencies buy from organizations like Lexus Nexus, credit rating agencies, and more. Jason Henry of DHS told Fierce Government IT that the privacy people don't like it when agents buy and store commercial data, but then seems to say that they do it anyway:

"From a privacy perspective, from an OMB perspective, there is a strong dislike for us purchasing and storing commercial data," said Henry. "We usually buy access to it…so we can do federated searches against it."

 

But it's challenging to run effective searches on data that is operated by another party, said Henry. When comparing hundreds of millions of law enforcement records and billions of commercial records in the commercial sphere, there's a need for disambiguation mechanisms, said Henry.

That's a lot of data. Strangely enough, the FBI's N-Dex page doesn't mention anything about harvesting open source data or buying commercial data. It says:

Investigative uses of N-DEx include the ability to:

 

• Conduct nationwide searches across jurisdictions, gathering information from various aspects of the criminal justice life cycle via a single access point;
• Search names, IDs, people, phone numbers, tattoos, associates, cars, boats, other property, etc.;
• Search by modus operandi; and
• Receive notifications and collaborate with others on similar investigations.

Funny that the agency leaves out the part about "billions of commercial records in the commercial sphere."

Meanwhile, Fairmont, West Virginia has just become the first local police department to begin submitting data to N-Dex electronically. 

Learn more about government data-sharing gone wild.