National Operations Center

Overview

The National Operations Center (NOC) (previously the HSOC) replaced the situational awareness mission of DHS' Homeland Security Operations Center, and incorporated the operational mission of the National Response Coordination Center (NRCC), and the role of the Interagency Incident Management Group. It was officially established on May 25, 2006. Its mission is to facilitate information sharing and operational coordination with other federal, state, local, tribal, non-governmental, and senior DHS and White House leadership. The NOC accomplishes its mission through a network of coordination elements that provide domestic situational awareness, a Common Operating Picture, information fusion, information sharing, communications, and coordination pertaining to domestic incident management and the prevention of terrorism.

The NOC operates 24 hours a day, 7 days a week, 365 days a year, and it collects and fuses information from more than 35 federal, state, local, tribal, non-governmental, and private sector agencies. It is composed of five elements — Watch, Intelligence Watch and Warning, NRCC, the National Infrastructure Coordinating Center (NICC), and the Planning Element. Although the NRCC, NICC, and Intelligence Watch and Warning are elements of the NOC, they remain independent entities under the tactical, operational, and program management control of their DHS components, the Federal Emergency Management Agency, the National Protection and Programs Directorate, and the Office of Intelligence and Analysis (I&A), respectively.

NOC Structure

The NOC represents over 35 agencies ranging from state and local law enforcement to federal intelligence agencies. Information is shared and fused on a daily basis by the two halves of the NOC that are referred to as the “Intelligence Side” and the “Operations Side.” Each half is identical and functions in tandem with the other but requires a different level of clearance to access information.

• The “Intelligence Side” focuses on classified intelligence and uses that information in support of emergency management and law enforcement activities.
• The “Operations Side” tracks emergency management and law enforcement activities across the country that may affect national security.

The two pieces fused together create a real-time snapshot of the nation’s threat environment at any moment.

NOC Information-sharing tools

• The NOC communicates in real-time to its partners by utilizing the Homeland Security Information Network’s (HSIN) internet-based counterterrorism communications tool, supplying information to all 50 states, Washington, D.C., and more than 50 major urban areas.

• Threat information is exchanged with state and local partners at the Sensitive-but-Unclassified level (SBU). Future program expansion will include linking additional cities and counties, communication capabilities at the classified SECRET level, and increasing the involvement and integration of the private sector.
• The system is encrypted using a secure network that includes a suite of applications including mapping and imaging capabilities.
• System participants include governors, mayors, Homeland Security Advisors, state National Guard offices, Emergency Operations Centers, First responders and Public Safety departments, and other key homeland security partners. Each receives training to participate in the information sharing network to combat terrorism and increase anti-terrorism situational awareness.

• The "HSIN-Critical Infrastructure" ("HSIN-CI") (now renamed the United States Public-Private Partnership (USP3) was specially designed to communicate real-time information to critical infrastructure owners and operators — 80% of whom are part of the private sector. HSIN–CI had the capacity to send alerts and notifications to the private sector at a rate of:

• 10,000 simultaneous outbound voice calls per minute
• 30,000 inbound simultaneous calls (hot-line scenario)
• 3,000 outbound simultaneous faxes
• 5,000 outbound simultaneous Internet e-mails
• Immediate Internet website content changes made.

Dissemination capabilities

The NOC regularly disseminates domestic terrorism-related information generated by the Information Analysis and Infrastructure Protection Directorate, known as “products” to federal, state, and local governments, as well as private-sector organizations and international partners. Threat products come in two forms:

• Homeland Security Threat Advisories are the result of information analysis and contain actionable information about an incident involving, or a threat targeting, critical national networks, critical infrastructures, or key assets. They often relay newly developed procedures that, when implemented, significantly improve security and protection. Advisories also often suggest a change in readiness posture, protective actions, or response.
• Homeland Security Information Bulletins are infrastructure protection products that communicate information of interest to the nation’s critical infrastructures that do not meet the timeliness, specificity, or significance thresholds of warning messages. Such information may include statistical reports, periodic summaries, incident response or reporting guidelines, common vulnerabilities and patches, and configuration standards or tools.

As part of the Common Operating Picture, NOC officials can post valuable information, such as situation reports and technical data regarding unfolding events or recovery efforts. NOC products such as NOC Notes and Situation Reports provide detailed real-time information to NOC partners. By using these products, interested parties can access reports and other detailed information such as statistics and interactive maps.

NOC operational capabilities

Vulnerability situational awareness

The NOC monitors vulnerabilities and compares them against threats, providing a centralized, real-time flow of information between homeland security partners. This data collected from across the country is then fused into a master template which allows the NOC to provide a visual picture of the nation’s current threat status. The NOC has the capability to:

• Perform initial (first phase) assessment of the information to gauge the terrorist nexus
• Track operational actions taking place across the country in response to the intelligence information, and
• Disseminate notifications and alerts about the information and any decisions made.

Imagery capability

As information is shared across agencies, NOC staff can apply imagery capability by cross-referencing informational data against geospatial data that can then pinpoint an image down to an exact location. Satellite technology is able to transmit pictures of the site in question directly into the NOC. This type of geographic data can then be stored to create a library of images that can be mapped against future threats and shared with our state and local partners.

• The “current operational picture” can be viewed using the geographical and mapping capabilities of 16 flat panel fifty-inch screens to monitor threat environment in real time
• Access to a significant portion of the District of Columbia’s traffic cameras for real-time view of various transportation hubs.

Senior level communication

The NOC is in constant communication with the White House, acting as the situational awareness conduit for the White House Situation Room by providing information needed to make decisions and define courses of action.