"If we want to get to the point where we connect the dots, the dots have to be there," said Richard A. McFeely, special agent in charge of the FBI's Baltimore office.
In response to concerns that information in the database could be improperly used or released, FBI officials say anyone with access has been trained in privacy rules and the penalties for breaking them.
But not everyone is convinced. "It opens a door for all kinds of abuses," said Michael German, a former FBI agent who now leads the American Civil Liberties Union's campaign on national security and privacy matters. "How do we know there are enough controls?"
The government defines a suspicious activity as "observed behavior reasonably indicative of pre-operational planning related to terrorism or other criminal activity" related to terrorism.
State intelligence analysts and FBI investigators use the reports to determine whether a person is buying fertilizer to make a bomb or to plant tomatoes; whether she is plotting to poison a city's drinking water or studying for a metallurgy test; whether, as happened on a Sunday morning in late September, the man snapping a picture of a ferry in the Newport Beach harbor in Southern California simply liked the way it looked or was plotting to blow it up.
Suspicious Activity Report N03821 says a local law enforcement officer observed "a suspicious subject . . . taking photographs of the Orange County Sheriff Department Fire Boat and the Balboa Ferry with a cellular phone camera." The confidential report, marked "For Official Use Only," noted that the subject next made a phone call, walked to his car and returned five minutes later to take more pictures. He was then met by another person, both of whom stood and "observed the boat traffic in the harbor." Next another adult with two small children joined them, and then they all boarded the ferry and crossed the channel.
All of this information was forwarded to the Los Angeles fusion center for further investigation after the local officer ran information about the vehicle and its owner through several crime databases and found nothing.
Authorities would not say what happened to it from there, but there are several paths a suspicious activity report can take:
At the fusion center, an officer would decide to either dismiss the suspicious activity as harmless or forward the report to the nearest FBI terrorism unit for further investigation.
At that unit, it would immediately be entered into the Guardian database, at which point one of three things could happen:
The FBI could collect more information, find no connection to terrorism and mark the file closed, though leaving it in the database.
It could find a possible connection and turn it into a full-fledged case.
Or, as most often happens, it could make no specific determination, which would mean that Suspicious Activity Report N03821 would sit in limbo for as long as five years, during which time many other pieces of information about the man photographing a boat on a Sunday morning could be added to his file: employment, financial and residential histories; multiple phone numbers; audio files; video from the dashboard-mounted camera in the police cruiser at the harbor where he took pictures; and anything else in government or commercial databases "that adds value," as the FBI agent in charge of the database described it.
That could soon include biometric data, if it existed; the FBI is working on a way to attach such information to files. Meanwhile, the bureau will also soon have software that allows local agencies to map all suspicious incidents in their jurisdiction.
The Defense Department is also interested in the database. It recently transferred 100 reports of suspicious behavior into the Guardian system, and over time it expects to add thousands more as it connects 8,000 military law enforcement personnel to an FBI portal that will allow them to send and review reports about people suspected of casing U.S. bases or targeting American personnel.
And the DHS has created a separate way for state and local authorities, private citizens, and businesses to submit suspicious activity reports to the FBI and to the department for analysis.
As of December, there were 161,948 suspicious activity files in the classified Guardian database, mostly leads from FBI headquarters and state field offices. Two years ago, the bureau set up an unclassified section of the database so state and local agencies could send in suspicious incident reports and review those submitted by their counterparts in other states. Some 890 state and local agencies have sent in 7,197 reports so far.