Guide
Fusion centers: who shares your data?
A report made in one town may not stay in that town. Police, public bodies, and other partners can share data through a fusion center. The point is to connect clues that one office might miss. The risk is that weak or mistaken clues can travel, too.
That tension is why fusion centers matter to civil liberties. To judge one fairly, ask what it collects, who can see it, and how someone can challenge an error. A broad label like “public safety” does not answer those questions.
What are fusion centers?
Fusion centers are state and local hubs for gathering, checking, and sharing threat data. Analysts draw on reports from several partners to help spot patterns. They may support work on terrorism, crime, or other public safety threats.
The Department of Homeland Security describes their role as linking local knowledge with data from a wider network. State and local authorities own and run the centers. Federal support does not turn every center into a federal agency.
There is no single public database that explains all fusion centers. Each has a host agency, an area it serves, and its own policies. Some cover an entire state. Others focus on major urban areas. The name alone tells you little about a center's daily work.
How the national network of fusion centers fits together
The national network links centers with local police and state and federal agencies. Tribal governments may take part, too. Some centers also work with emergency staff and private sector partners. Who joins depends on the center and its work.
A primary fusion center is usually the main hub for a state or territory. A recognized fusion center often serves a large city or region. These labels tell you a center's role. They do not mean all centers have the same staff or tools.
DHS can supply staff, training, and access to systems. The FBI and other federal partners may take part, too. The federal government helps with information sharing. But state and local bodies still run their own centers.
The National Fusion Center Association supports the network. It does not run each public center. For questions about records or privacy, start with the agency that runs your center.
What data moves through fusion centers?
The fusion process brings facts from different sources together. An analyst may check a local report against a threat notice. They may look for a pattern seen elsewhere. The result could be a new report, an alert, or help with a case.
| Type of data | Question worth asking |
|---|---|
| Reports from local police | Was the data checked before it was shared? |
| Suspicious activity reports | What conduct met the reporting standard? |
| Data from private sector partners | Where did it come from, and what limits apply? |
| Analyst reports and alerts | Who gets them, and how are errors fixed? |
Not every tip becomes a finished intelligence report. Staff must judge whether each claim is sound and useful. They should state how sure they are. A weak claim does not become stronger merely because several offices repeat it.
Private companies can play a role in threat reporting and critical infrastructure work. That makes the source of data key. Ask whether a center uses commercial data, which providers it uses, and what rules apply. Do not assume every center buys the same records or has access to every database.
Suspicious activity is not the same as peaceful dissent
A suspicious activity report is meant to describe conduct that may relate to a threat. A person's beliefs, faith, or lawful political speech are not, by themselves, proof of criminal and terrorist activity.
The hard question is how that distinction works in practice. A vague description can give a normal act a darker meaning. A photo taken at a public event might lack the context needed to explain why someone was there.
For civil rights groups, the concern is not only whether a person is charged. It is also whether lawful activity enters intelligence systems and affects later decisions. People may stop attending meetings if they think doing so puts them under suspicion.
Ask for the center's written standards for gathering and sharing reports. Look for clear limits on recording protected activity, a review process, and a way to correct false data. A general promise to respect civil liberties is less useful than a policy someone can inspect.
What the 2012 Senate report found
A 2012 Senate inquiry raised serious concerns about federal support for fusion centers. It looked at reports from April 2009 through April 2010. It also checked spending and how the work was tracked.
The reviewers found reports that were late, of little use, or raised privacy concerns. They found no case where the reports they reviewed helped stop an active terrorist plot. They also criticized gaps in how spending and results were tracked.
That is a finding about the material and period examined. It does not prove that no fusion center has ever helped an inquiry. Nor should a later success erase the need to address documented failures.
The useful lesson is to ask for evidence that matches the claim. If a center says it improves public safety, what outcome does it measure? Does it count reports sent, or harm prevented? Those are not the same thing.
Civil liberties need rules that can be checked
Fusion centers should be judged by what their safeguards do, not just whether a policy exists. The federal privacy and civil liberties policy template gives a framework for topics such as access, review, storage time, and ways to fix errors.
Start with storage time: how long is data kept, and what triggers deletion? Then ask about access. Which staff and outside partners can read it? Does the center keep a record of who opened or shared it?
Next, ask about mistakes. If a report names the wrong person, who can correct it? If that report has already been shared, does the fix travel to the same partners? A fix in one file may not repair copies elsewhere.
Finally, look at who checks the work. Who makes sure staff follow the rules? Are findings made public? Can an outside body inspect a complaint? Excessive secrecy makes it hard to test claims, even when some details of ongoing inquiries must remain private.
How to find your local fusion center
Use the DHS directory to find the center that serves your area. Check its own site for the current host agency, privacy policy, and records contact. Names and contact details can change.
Do not assume the nearest office is the right one. Some states have several centers with different areas to serve. The Virginia Fusion Center, for example, is a state-level name; an urban center elsewhere may serve a smaller area.
A records request should go to the body that holds the records. Federal FOIA is not a universal route to every state or local file. The correct process may be a state public-records law, and exemptions and fees vary. Check the agency's current instructions before sending a request.
Keep the first request narrow. Ask for an existing document, a clear time range, and a subject. A request for the current privacy policy is easier to process than a demand for every record the center has ever held.
Five useful questions for a public meeting
- Which written rules limit the collection of lawful speech and association?
- Which public bodies and private entities get data?
- How long are unverified reports kept?
- How can someone ask to fix an error, and who reviews that request?
- What public report shows spending, outcomes, and privacy complaints?
Write down the answer and the document named. If staff cannot answer at the meeting, ask for the office that can. A clear follow-up is more useful than an argument over what the word “surveillance” means.
These questions also help separate policy from practice. A center may have a sound rule on paper yet struggle with training, staffing, or review. Ask how staff use the rule and who checks their work.
Where personal privacy tools help, and where they do not
A private messaging app can protect the content of a chat as it travels. It cannot erase public records or stop another member from sharing what they get. Our Signal vs Telegram comparison explains that boundary.
A data-removal service addresses another source of exposure: profiles sold by people-search sites. It does not delete government records or guarantee that a public body cannot obtain data. Read Optery vs DeleteMe if your urgent concern is an exposed home address.
Protecting accounts is still worthwhile. A unique password and a second sign-in step can reduce the risk of a stolen login. Our password manager comparison covers two ways to do that.
None of those tools replaces public oversight. Personal privacy and accountable government are related tasks, but they need different kinds of work.
A better test than reassurance or alarm
Fusion centers bring data together. That can help people see a threat they would otherwise miss. It can also spread an error or give lawful activity a misleading frame.
Ask for the policy, the evidence, and the way to fix errors. Follow the answer to the agency responsible. That turns a broad debate about homeland security into a clear question. The public can then check the answer.