I Ran the DHS Intelligence Unit. Its Reports on Journalists are Concerning.

The intelligence arm of the Department of Homeland Security—known as the Office of Intelligence and Analysis (DHS I&A)—has received extensive criticism recently, first for questionable intelligence support to law enforcement in Portland, Oregon, and then for its deeply problematic intelligence reports naming U.S. journalists reporting on I&A’s own actions. Reviews are now underway on what exactly I&A did, but the material that has become public so far is concerning.

I led I&A for two and a half years, from 2014 through January 2017. If the facts are confirmed, the office that took these actions is not the I&A I led—nor the one that has operated for nearly two decades.

Writing on Lawfare on July 20, Steve Vladeck and Benjamin Wittes suggested that I&A was justifying its intelligence operations in Portland, Oregon, through a new executive order on protection of statues and memorials. This is a significant expansion of the agency’s role in monitoring civil protest, and there are serious questions whether the order justifies I&A’s actions as a matter of law.

Of even greater concern, it came to light last week that I&A personnel had written and disseminated intelligence reports about journalists who reported on I&A actions. Even under the guise of cybersecurity or identifying leaks, this appears to be a clear misuse of intelligence authorities and a violation of I&A’s own guidelines, especially for journalists who enjoy substantial First Amendment protections.

These are troubling events, but some recent press coverage has missed the mark. Recent articles in the Washington Post called I&A “technically an element of the broader intelligence community” (there is nothing technical about it) and likened the agency and its personnel to a “team of junior-varsity athletes.”

While it is one of the smaller agencies in the U.S. intelligence community, DHS I&A has a vital mission. The Homeland Security Act of 2002 created the office primarily to gather and analyze information on threats to critical infrastructure, principally from terrorist activity. Over the past 18 years, it has focused on terrorism within the country (whether domestic or inspired externally) and the security of U.S. borders, transportation systems, critical infrastructure, cybersecurity and transnational crime across the southern border.

Though parts of that mission overlap with other agencies, I&A has differentiated itself by informing audiences not usually served by the intelligence community. The office exists to provide intelligence and analysis to DHS leadership, state and local government agencies, and the U.S. private sector. It does this by providing intelligence reports and daily briefings; embedding intelligence officers in state and local fusion centers; producing widely distributed unclassified analyses reaching thousands of police and emergency response agencies; and convening symposia for companies around the country to explain threats and security measures.

Like the FBI, the other intelligence agency with substantial U.S.-based operations, I&A operates under strict limitations and oversight. It collects information only overtly or when it is publicly available, and it is prohibited from engaging in clandestine physical surveillance of the public.

The DHS Office of Privacy and the Office for Civil Rights and Civil Liberties oversee I&A programs, helping to ensure that its intelligence activities do not encroach on the constitutional rights of all Americans. I&A’s official guidelines—approved by the director of national intelligence and attorney general—were formalized and published in the last days of the Obama administration. When I worked there, I&A personnel were trained and tested on these policies routinely.

While I&A’s operations are different from those of other spy agencies, its workforce is no less skilled. Many of I&A’s intelligence reports are written at the Secret or the Unclassified//For Official Use Only level—but its analysts review intelligence ranging from the most highly compartmented to information hiding in plain sight. Their articles appear in the President’s Daily Brief, and they contribute to National Intelligence Estimates, authoritative assessments of national security issues by the intelligence community. But I&A also produces timely and actionable information for cities, states and companies. Often, I&A serves its audiences by translating highly classified intelligence without including the highly classified information on how the information was learned—such as publishing information on terrorist tactics for local police or cyber threats for company chief security officers.

Likewise, I&A plays an important role in keeping federal, state and local leaders informed of threats that civil unrest may descend into widespread violence. In August 2017, I&A analysts and field operators worked with the Virginia Fusion Center to warn of the likelihood of violence at protests and counterprotests in Charlottesville. Analysts recognized the publicly available communications among white supremacists as unusual and concerning and sounded the alarm. While the intelligence was prescient, Virginia authorities tragically did not heed the warning.

Like any government agency—especially one in intelligence—I&A needs strong guidance and leadership. Unfortunately, the office has had nearly as many confirmed or acting heads as it has seen years in existence. Not only has that lack of stable leadership prevented the development of a strong organizational culture, but it has also led to regular reorganizations and new priorities. Making matters more difficult, the I&A under secretary wears a number of other hats for DHS, meaning the under secretary’s attention is necessarily divided among other priorities.

It certainly appears that DHS made mistakes concerning I&A’s support to law enforcement in Portland and its activity writing reports on journalists. The DHS inspector general and Congress are conducting reviews, as is appropriate. Investigators should focus not only on personnel on the ground, but—more importantly—on those who demanded that the intelligence agency depart from its guidelines.

But it is important to distinguish between the danger of I&A acting beyond its authority and the value that the office can provide when it works well. This agency is important to homeland security, and the U.S. needs its personnel to be successful in collecting, analyzing and sharing information on homeland threats in order to keep Americans protected.