WIXLIB

UNCLASSIFIED//FOR OFFICIAL USE ONLYNOT FOR PUBLIC RELEASEKEY MISSION AREASNCTC performs five key missions in support of our Nation’s CT efforts. The Center is authorized to access all terrorism-relatedinformation held by the USG. With these unique authorities, NCTC staff can effectively bridge the divide between foreign anddomestic intelligence, thereby allowing the Center to bring a whole-of-government approach to each mission area.MISSION AREA I: THREAT ANALYSISUnder IRTPA, NCTC serves as the primary organization in theUSG for analyzing and integrating all intelligence possessedor acquired by the USG pertaining to terrorism and CT exceptintelligence pertaining exclusively to domestic terrorism. NCTChas a responsibility to inform its partners on all internationalterrorism issues, and unique authorities allow personnel toanalyze intelligence collected both inside and outside the U.S.MISSION AREA II: INFORMATION SHARINGIn addition to fulfilling its own analytic and planningresponsibilities, NCTC ensures that other agencies with CTmissions have access to and receive intelligence needed toaccomplish assigned activities. NCTC analysis is coordinatedthroughout the IC, supporting senior policymakers and othermembers of the policy, intelligence, law enforcement, defense,homeland security, and foreign affairs communities. NCTCproduces IC-coordinated assessments on critical issues,including terrorism safe havens, state sponsors of terrorism,CT cooperation worldwide, and regional terrorism issuesand groups. NCTC also provides the CT community with24/7 situational awareness, terrorism threat reporting, andincident information tracking.MISSION AREA III: IDENTITY MANAGEMENTNCTC has the statutory responsibility to serve as the centraland shared knowledge bank on known and suspected terroristsand international terror groups, as well as their goals, strategies,capabilities, and networks of contacts and support. To fulfillthis role, NCTC maintains the Terrorist Identities DatamartEnvironment (TIDE), the USG’s central classified repositoryfor all known or suspected international terrorists and theirnetworks. TIDE includes biographic information, to includenames and dates of birth; biometric information, such asphotos; and derogatory information explaining a subject’slink to terrorism. NCTC receives international terrorisminformation from law enforcement and intelligence partnersand consolidates it into TIDE, which is an analytic tool aswell as a database. NCTC uses the information in TIDE tosupport screening activities across the USG. NCTC screeningis part of a multilayered approach that has streamlinedoperations, removed stovepipes, and increased transparencyacross agencies.MISSION AREA IV: STRATEGIC OPERATIONAL PLANNINGNCTC also has the statutory responsibility to conduct strategicoperational planning for CT activities across the USG,integrating all instruments of national power—diplomatic,informational, military, and economic within and among theagencies. In this role, NCTC ensures unity of effort for the USG.Planning efforts include broad strategic plans as well as specificaction plans to maximize coordination on key issues. NCTC alsoleads interagency task forces designed to analyze, monitor, anddisrupt potential terrorist attacks.MISSION AREA V: NATIONAL INTELLIGENCE MANAGEMENTNCTC’s role as NIM-CT requires integrating the CT missionacross intelligence functions, disciplines, and activities toachieve unity of effort and effect. NCTC leads U.S. IC effortsto optimize CT community performance and capabilities, andadvocates on behalf of the CT community to ensure the U.S. ICis postured to support national strategy and policy objectives.NCTC ensures that collection activities for CT are responsiveto and inform analytic judgments and that analytic activitiesproduce intelligence judgments, identify intelligence gaps,and provide the basis for guidance to collectors. This includesinforming and aligning U.S. IC activities against the highestpriority terrorism threats.6 RELEASENOT FOR PUBLICUNCLASSIFIED//FOR OFFICIAL USE ONLY

UNCLASSIFIED//FOR OFFICIAL USE ONLYNOT FOR PUBLIC RELEASEORGANIZATIONAL STRUCTURENCTC is aligned under the Office of the Director of National Intelligence (ODNI). The NCTC Director is appointed by the Presidentand confirmed by the Senate. D/NCTC reports to the Director of National Intelligence (DNI) as the National Intelligence Manager forCounterterrorism and serves as the DNI’s principal adviser on intelligence operations relating to CT. D/NCTC reports directly to thePresident for CT strategic operational planning activities.NCTC has four primary directorates—Directorate of Intelligence, Directorate of Terrorist Identities, Directorate of OperationsSupport, and Directorate of Strategic Operational Planning—and nine offices that provide critical functions that include intelligencemanagement and acquisition of innovative data to which NCTC has unique access.DIRECTOROFFICE OF NATIONALINTELLIGENCE MANAGEMENTDEPUTY DIRECTOREXECUTIVE DIRECTOROFFICE OF WEAPONS OF MASSDESTRUCTION-COUNTERTERRORISMOFFICE OF MISSION SYSTEMSENTERPRISE MANAGEMENT RATEOF STRATEGICOPERATIONALPLANNINGOFFICE OF DATA STRATEGY & INNOVATIONOFFICE OF STRATEGIC COMMUNICATIONSOFFICE OF LEGAL COUNSELNCTC LEGISLATIVE LIAISONCIVIL LIBERTIES & PRIVACY OFFICEToday, more than a decade after its creation, NCTC has set a new standard for information sharing and analysisby combining unprecedented access and data integration with a diverse workforce made up of experts fromacross the Federal government and state and local first responders. When NCTC alumni serving under a jointduty assignment (JDA) return to their home agencies, they carry with them NCTC’s culture of informationsharing, further unifying previously disparate efforts.7 RELEASENOT FOR PUBLICUNCLASSIFIED//FOR OFFICIAL USE ONLY

UNCLASSIFIED//FOR OFFICIAL USE ONLYNOT FOR PUBLIC RELEASEDIRECTORATESAND OFFICES8 RELEASENOT FOR PUBLICUNCLASSIFIED//FOR OFFICIAL USE ONLY

UNCLASSIFIED//FOR OFFICIAL USE ONLYNOT FOR PUBLIC RELEASEDIRECTORATE OF INTELLIGENCE (DI)The DI originated from EO 13354 and the IRTPA of 2004, which states that NCTCwill establish and maintain a Directorate of Intelligence that will be the primaryorganization in the USG for analyzing and integrating all sources of intelligencepertaining to terrorism and CT, except relating exclusively to domestic terrorism anddomestic CT. In 2006, the DI played a leading role in monitoring the U.S./U.K. aviationplot by setting up an IC task force to provide timely and coordinated information andassessments to U.S. and U.K. officials. This collective and community effort ultimatelyhelped thwart the most significant al-Qa ida threat to the U.S. since 9/11 andestablished the DI’s unique role within the IC. By 2008, the DI was made up of groupsprimarily focused on terrorist organizations, radicalization, extremist messaging, andtactics. Following the 2009 Christmas Day airliner plot, D/NCTC established thePursuit Group within the DI to develop tactical leads and track nonobvious terrorismlinkages to address this type of threat. As the terrorism landscape began to evolve, theDI anticipated an uptick in regional threats and reorganized in 2013 by expanding tomeet this more complex threat environment.The DI’s MISSION is to lead ourNation’s analytic effort to combatterrorism at home and abroad.The DI’s VISION is to be theNation’s indispensable source forrigorous, sophisticated, and timelyCT analysis; lead the CT communityby setting the standard for expertiseand collaboration; and attract andretain the best talent.DI analysts produce a wide range of sophisticated and comprehensive finished intelligence products and briefing points in supportof U.S. foreign policy, national security objectives, operational priorities, and senior leaders. Working with colleagues from acrossthe USG as well as foreign partners, DI analysts have played an integral role in every major threat stream since NCTC was createdin 2004.AREAS OF RESPONSIBILITYThe DI supports CT policy, intelligence, military, law enforcement, and homeland security communities through strategic analysisand warning products. The DI also provides tactical analysis to discover unknown terrorism linkages to help U.S. operational unitsdisrupt terrorist plans and activities in the Homeland and against U.S. interests abroad. Specifically, the DI: Works closely with IC and lawenforcement partners to trackthreats to the Homeland and to U.S.interests abroad. Houses the Interagency IntelligenceCommittee on Terrorism (IICT)Executive Secretariat, which managesthe IC’s production of coordinatedIC products that provide warning ofterrorist threats.9 RELEASENOT FOR PUBLICUNCLASSIFIED//FOR OFFICIAL USE ONLY Uses unique data access toprovide added value on topics ofspecial customer interest, includingdedicated efforts to track foreignfighters and produce assessments onCT hostage cases.

UNCLASSIFIED//FOR OFFICIAL USE ONLYNOT FOR PUBLIC RELEASEDI GROUPSThe DI is made up of groups that analyze terrorist organizations, the methods and tactics that terrorists use to work toward theirgoals, and foreign countries’ CT efforts. For example, the Pursuit Group identifies and analyzes leads that could become terroristthreats to the Homeland and our interests abroad, pursues unresolved and nonobvious connections between terrorism actors, andinforms appropriate USG entities for action. The DI also houses a production group that processes the analysis generated by therest of the directorate and disseminates it to customers.EXAMPLES OF DI KEY PRODUCTSTERRORISM INTELLIGENCEBRIEF (TIB), formerly known asthe National Terrorism Bulletin(NTB), is the primary vehicle forthe CT community to alert andadvise Cabinet-level principalsand other senior officials withCT responsibilities of currentthreats and other terrorismrelated analysis. It containshighly sensitive operational andinvestigative information, includingnon-disseminated intelligence.The TIB is coordinated acrossthe IC, and IC CT componentseither agree on the key judgmentsor clearly articulate andsupport alternate perspectives.Distribution of the TIB iscontrolled by the D/NCTC.The DI’s targeting mission isthe responsibility of the PursuitGroup, which operationalizesleads pieced together frommultiple sources of reportingand data in NCTC holdings.These OPERATIONAL LEADSARE DISSEMINATED AS NCTCPURSUIT LEAD CABLES torelevant USG agencies for action.CURRENT ARTICLES are postedSPOTLIGHTS address topicson the NCTC CURRENT websitefor a broad audience withinthe intelligence, military, lawenforcement, and homelandsecurity communities. Thewebsite consists of originalarticles and stand-alonegraphics, as well as TIBproducts repurposed for widerdissemination. CURRENTarticles are also coordinatedacross the IC.that are too complex to explainfully in a TIB or CURRENTarticle. Spotlights followthe same coordination anddissemination process as otherCURRENT products.The DI manages the activitiesof the Interagency IntelligenceCommittee on Terrorism (IICT),a mechanism for USG-widecollaboration on terroristthreat reporting and CTprograms. The IICT publishesa series of products, includingThe DI, in collaboration withFBI and DHS, produce anUnclassified, For OfficialUse Only biannual magazineon terrorism themes calledIICT ALERTS, ADVISORIES,STANDING ADVISORIES,AND ASSESSMENTS.ALLIANCE: PARTNERSHIPS INDOMESTIC COUNTERTERRORISMfor state, local, tribal, andterritorial first responders.10 RELEASENOT FOR PUBLICUNCLASSIFIED//FOR OFFICIAL USE ONLYSPECIAL ANALYSIS REPORTS(SAR) take a longer term,strategic look at a particulartopic and are the DI’s primaryvehicle for disseminatingin-depth research. SARsfollow the same review anddissemination process as otherCURRENT products.The DI, in collaboration withthe Directorate of OperationsSupport, produces theTHE BEACON, an unclassifiedproduct that contextualizesterrorists’ use of the internetfor technology companies,specifically social media platformand media owners.

UNCLASSIFIED//FOR OFFICIAL USE ONLYNOT FOR PUBLIC RELEASEDIRECTORATE OF TERRORIST IDENTITIES (DTI)DTI’s mission stems from EO 13354 and the IRTPA of 2004, which directed NCTCto develop a central and shared knowledge bank of known and suspected terrorists(KSTs) and international terror groups on behalf of the USG. DTI’s predecessor, theInformation Sharing and Knowledge Development Directorate, maintained TIDEduring the Christmas Day 2009 airliner plot. The investigation revealed that multipleagencies had not provided available identifying information on the attempted suicidebomber as part of the watchlisting process, which led to the creation of DTI. Given thisevent, one of DTI’s key priorities is to work closely with nominating agencies—CIA,DHS, DIA, FBI, NSA and the Department of State—to propose additions, deletions,and modifications to enhance TIDE records. Each day, DTI receives and processesthousands of pieces of derogatory information and identifiers sent through astandardized nomination process from each agency’s terrorism watchlisting cell.Besides standard nominations, DTI receives reports from law enforcement andencounters with KSTs from screening officers. DTI’s workforce produces intelligencereports and obtains biographic, biometric, and derogatory information from analysts’research data across the intelligence and law enforcement communities. DTI workswith data owners to correlate and enhance TIDE data against USG datasets in bulkand sends watchlisting information to the Terrorist Screening Center, which maintainsthe USG’s consolidated terrorist watchlist—the Terrorist Screening Database. DTIregularly meets with existing and potential partners to increase their understanding ofDTI’s mission and capabilities and explore opportunities.DTI’s MISSION is to discover,enhance, and share identityintelligence that advances the mostcomplete and accurate identitypicture to our partners and supportterrorism analysts and successfulscreening activities that ultimatelyprevent terrorism plans andoperations against U.S. interests.DTI’s VISION is to continuouslyrefine the way we fulfill our missionby providing timely record creationand performing pro-active,analysis-based research andenhancements of quality terroristidentities intelligence.Under the direction of the National Security Council (NSC), NCTC in 2008 beganto administer NCTC’s Kingfisher Program to support the screening of U.S.-boundtravelers and immigration benefits applications for links to terrorism as well as todetect terrorists using non-watchlisted aliases. The expanded program, known asKingfisher Expansion, was folded into DTI in 2013.AREAS OF RESPONSIBILITYDTI provides screening support to our watchlisting partners, and isolates leads on previously undetected terrorist links.Specifically, DTI: Maintains TIDE, grants accessto other agencies, and sharesthis information for watchlisting,screening, and analytic purposes.TIDE’s KST information is sharedthrough various products andservices, intelligence products relatedto current threats or in response toterrorist incidents. Administers NCTC’s KingfisherExpansion Program to support thescreening of U.S.-bound travelersand immigration-benefits applicants,including refugees, for links toterrorism and to detect terrorists usingnon-watchlisted aliases.11 RELEASENOT FOR PUBLICUNCLASSIFIED//FOR OFFICIAL USE ONLY Provides biometric services,such as facial recognition andcomparative analysis.

UNCLASSIFIED//FOR OFFICIAL USE ONLYNOT FOR PUBLIC RELEASEDTI GROUPSDTI consists of groups that focus on nominating, maintaining, and enhancing TIDE, as well as sustaining and developing internaland external partners. These groups receive watchlist nominations from the IC and law enforcement partners, which analysts useto create or enhance records in TIDE with biographic and biometric data from all-source analysis. DTI also conducts all-sourceresearch and analysis, resolves unknown identities from emerging threat information, and enhances TIDE with encounters data.Additionally, the groups generate leads regarding previously undetected links between U.S.-bound travelers andimmigration-benefits applicants.EXAMPLES OF DTI KEY PRODUCTSPROCESS GRAPHICS provide senior USGKINGFISHER INTELLIGENCE REPORTSofficials with explanations of policies,processes, and advancements in watchlistingand screening.provide leads to watchlisting and screeningagencies on U.S.-bound travelers andimmigration-benefits applicants, includingrefugees, assessed to have terrorism links.NCTC QUICK LOOKS are biographical profilesTIDE TIMELINES provide a graphicalon known or suspected terrorists andtheir associations.overview of the watchlisting history ofidentities associated with high-profileterrorist attacks.12 RELEASENOT FOR PUBLICUNCLASSIFIED//FOR OFFICIAL USE ONLYFACIAL COMPARISON REPORTS (FCR) ANDFACIAL MATCH REPORTS (FMR) providebiometric identity resolution to customersand partners.

UNCLASSIFIED//FOR OFFICIAL USE ONLYNOT FOR PUBLIC RELEASEDIRECTORATE OF OPERATIONS SUPPORT (DOS)The earliest vision for NCTC included providing the IC with comprehensive CTsituational awareness. In late 2003, certain threats made it necessary to createa “watch function” to cover extended hours, evolving in late 2004 into today’sOperations Center (Ops Center). When NCTC transferred to the Liberty Crossinglocation in June 2004, CIA and FBI joined NCTC to create a single open floor24/7 Ops Center. DOS manages this unique Ops Center, which ensures that all threeorganizations have immediate access to breaking information. Besides maintainingsituational awareness through the Ops Center, DOS provides terrorism informationto state, local, tribal, territorial, and private (SLTTP) sector customers in partnershipwith DHS and FBI; integrates and unifies the IC’s efforts that support securityarrangements for major international events; and promotes CT readiness for NCTC,Homeland and international partners through exercises and continuity planning.DOS chairs classified video teleconferences seven days a week for all key Federal CTelements to compare information, highlight new threats, and discredit those deemednon-credible. DOS produces daily Situation Reports and periodic Spot Reportsthat highlight high-interest terrorism events as they occur. DOS also publishes thedaily Threat Matrix, a comprehensive detailed listing of all terrorism threat reportingfrom the previous 24 hours that is used as a common threat reference across theCT community. DOS produces intelligence ranging from UNCLASSIFIED throughTOP SECRET.AREAS OF RESPONSIBILITYDOS provides intelligence and administrative support to internal and externalcustomers on terrorism and CT issues pertaining to the Homeland and the rest of theworld. Specifically, DOS: Provides 24/7 awareness ofworldwide terrorism threats. Produces summaries andmatrices of intelligence reports forwider distribution. Enhances partner CT readinessthrough a full range of real-world,event-driven exercises. Oversees NCTC’s Crisis ManagementProgram and Continuityof Operations. Administers the Terrorism AnalysisSupport System (TASS) website,which is the USG’s largest repositoryof domestic and foreign threatreporting that includes informationon high-profile, imminent, andlong-range terrorist threats to theU.S. and its interests worldwide.TASS is used to produce the NCTCThreat Matrix.The Joint Counterterrorism Assessment Team (JCAT) in DOS supports SLTTPconsumers with terrorism-related products at lower classification levels. JCAT isco-staffed by DHS and FBI representatives and incorporates police officers, firefighters, and emergency managers from across the U.S.13 RELEASENOT FOR PUBLICUNCLASSIFIED//FOR OFFICIAL USE ONLYDOS’ MISSION is to provideand sustain CT awareness andmission readiness for NCTC andthe CT community by promotingshared situational awarenessthrough information sharing,mission assurance, and readinessenhancements to reduce uncertaintyand ensure operational continuity.DOS’ VISION is to be ahigh-performing, integrated,and entrepreneurial organizationthat produces indispensableCT intelligence products andservices and has a workforcethat is well led, well trained, andappropriately recognized.

UNCLASSIFIED//FOR OFFICIAL USE ONLYNOT FOR PUBLIC RELEASEEXAMPLES OF DOS KEY PRODUCTSFOR FEDERAL CONSUMERS: SituationFOR SLTTP CONSUMERS: CT Weekly, CTReports, Spot Reports, Terrorism Summary,Ops Center Advisory, Daily Special Topics,Blue Note, Director’s Note, Principal’

this will lead to better CT analysis for stakeholders, more effective collaboration with our partners, better options for policymakers, and, ultimately, more optimal CT outcomes. By developing our workforce and training the next generation of CT analysts, we will ensure that NCTC continues to tackle our nation's CT challenges with expertise,