To Catch a Thief

He was the last one off the bus.

Customs Service senior inspector Virginia Rodriguez, standing just less than 5 feet tall, looked up at the bearded man in the aqua T-shirt and asked him, as she does thousands of others crossing the border into Texas, why he went to Mexico.

To visit friends, he answered. To visit friends? she asked. "Yeah, that's right, to visit friends," he replied.

It was 7:45 on the Saturday morning just before Labor Day, and this was Rodriguez's second bus. Normally she would check about a dozen El Expresso commercial buses, along with thousands of cars and pedestrians, during her eight-hour shift at the Gateway International Bridge, which spans the Rio Grande at Brownsville, Texas. The 10-year veteran of the Customs Service usually doesn't ask for identification.

But the way the guy answered, something in his tone, made Rodriguez notice this otherwise ordinary-looking American. "To me, it sounded like he was checking his answer," she said. So she asked for identification, and without hesitation, he handed over a North Carolina driver's license. She told him to put his green duffel bag on the table for inspection and then took the driver's license to senior inspector Ray Arzola.

A few moments later, as she was coming out of the bus after checking for stowaways, Rodriguez saw Arzola hitting his palm with his fist, which is a signal the inspectors used to indicate that they had a hit: a fugitive.

Arzola had entered the name Roger Dale Lawter into the FBI's National Crime Information Center (NCIC) computer database, which for 31 years has been the principal information source for law enforcement nationwide and a key weapon in the war on crime. Within seconds, the answer came back from Washington, D.C., alerting agents in Brownsville that the man in front of them was Philip Noel Johnson. Johnson was a disgruntled armored car guard who had pulled off the biggest heist in U.S. history, earning himself a place on the FBI's 10 Most Wanted List. Although Rodriguez didn't know it at the time, she had just caught a man who had stolen $18.8 million in cash. While Johnson was being searched, Rodriguez was trying to find the green duffel bag.

Johnson denied having such a bag, but just before the bus pulled away Rodriguez found it in the bus' baggage compartment. Inside was a raft of false IDs and wads of cash totaling more than $10,700. "I've never seen bills so new," Rodriguez recalled. "We had to count them many times because they were so stiff."

The bills were so new because five months earlier in Florida, Johnson handcuffed his co-workers, climbed behind the wheel of a Loomis, Fargo & Co. truck loaded with bags of $100, $50, $20 and $10 bills and drove away. Not long after Johnson's capture, authorities used his aliases to trace his steps and found all but $186,000 bagged in a North Carolina mini storage shed. In January, 34-year-old Johnson pleaded guilty to charges of kidnapping and money laundering as well as others. Sentencing is scheduled for May.

"I have to attribute [his arrest] to the computer; there's no way around it," said Rodriguez, noting that Johnson looked very different from his wanted poster. "Even if I'd had the poster right there, I wouldn't have recognized him. It was strictly NCIC."

Even as she praised NCIC, she made it clear that using the database to find a fugitive is "not such a big deal," a sentiment echoed by law enforcement officers throughout the country. NCIC is a tool they rely on daily.

"We use it as a matter of habit," said Detective Wayne Lipsey, a 26-year veteran of the Chicago Police Department. "The number of cases it's resolved, shortcutted and helped us do, I can't even begin to describe. It's unbelievable. It's so necessary."

NCIC is so much a habit that officers take it for granted. "Their jobs have been tailored to the fact that this information is there, it is up, and it is accurate," said Joseph Bonino, the Los Angeles Police Department's commanding officer of the Records and Identification Division. "It's like breathing. They don't have to think about it because it's there and it works."

Simply put, NCIC saves lives: the lives of everyday citizens and the lives of officers by helping catch criminals. "Officers couldn't do their jobs without it in this day and age," said Bonino, a 30-year law enforcement veteran who is chairman of an FBI advisory policy board on information matters. "Their very lives depend on it."

Granddaddy of Them All

The NCIC that went online in January 1967 had five files— wanted persons, stolen vehicles, stolen articles, stolen or recovered guns and stolen license plates— on twin IBM Corp. 360 mainframes. "With crime in Jet Age, mobile America steadily on the rise, many a criminal, able until now to evade local authorities, may soon find he can no longer outrun the law," said J. Edgar Hoover, the legendary FBI director, when unveiling the system.

NCIC is considered the granddaddy of all computerized law enforcement tools in use today. "It was one of the first real cooperative efforts at exchanging law enforcement information," said Roy Weise, an FBI unit chief and one of the programmers. "This was the first time we had a shared database."

That first year, NCIC received 2 million inquiries. Now the system gets up to 2 million inquiries a day, or a total of 684 million in 1997. That's up from 207 million a decade earlier. The database of 17 files has more than 10 million individual records, plus 27 million criminal histories in the Interstate Identification Index. More than 82,000 law enforcement and criminal justice agencies use the system.

Despite its advanced age, NCIC is fast. It averages 20 inquiries per second, but it can sustain 35, processing them in six one-

thousandths of a second. A typical inquiry works like this: A policeman in a cruiser or at a police station types in a search request, such as a license plate number; the request is sent over a network to a state agency that searches state databases; the request then is forwarded over the Federal Telecommunica-tions System to the NCIC system in Clarksburg, W.Va. Within two seconds of an inquiry, the police officer sees a text response that either says no record was found or shows a hit, along with matching information.

Those inquiries bring results. A 1992 FBI survey showed that by using NCIC, 81,750 wanted persons were found, 113,293 individuals were arrested, 39,268 missing juveniles and 8,549 missing adults were located, and 110,681 cars valued at more than $570 million were found.

"We're doing such a large volume of work on such a relatively small machine," said Bruce Brotman, the FBI special agent in charge of the section that operates NCIC. "The only reason we can do that is because of the incredible efficiency of the software."

The original FBI-designed software was meant to handle a maximum of 70,000 inquiries a day. Programmers such as Weise have made adjustments over the years to keep the antiquated system up and running. Some updates, such as speedier communications lines, were completed as part of the move from Washington, D.C., to the FBI's new facility in Clarksburg. But NCIC is due for a major overhaul. Called NCIC 2000, the FBI will replace all the software and hardware and will add new features to current functions. Delayed and over budget, the new system is set to come online in July 1999. It will be much more powerful and have a peak capacity of 78 transactions per second, or an average of 2.8 million a day. By 2010, it is expected to handle a peak of 133 transactions per second, or 4.7 million a day.

Nabbing Timothy McVeigh

Over the years, NCIC has been credited with catching many famous criminals. As early as 1968, NCIC was instrumental in identifying James Earl Ray, who was later convicted of killing Dr. Martin Luther King Jr. More recently, NCIC played a key role in the capture of Timothy McVeigh, who was convicted of the April 19, 1995, bombing of the Alfred P. Murrah Federal Building in Oklahoma City, where 168 people were killed.

About 90 minutes after the bombing, Oklahoma state trooper Charles Hanger stopped a yellow Mercury Marquis that was missing its rear license tag about 80 miles north of Oklahoma City. Because the driver had a gun, Hanger hauled the driver into the county jail for transporting a loaded firearm in a motor vehicle, among other charges. An NCIC check came up with nothing on the name Timothy McVeigh. Meanwhile, bombing investigators found the hotel where McVeigh had stayed and registered using his real name. Two days after the bombing, investigators asked FBI experts for an urgent NCIC check for past inquiries on the name. Hanger's request popped up immediately. The FBI got to McVeigh just before he was released from jail.

But captures don't have to be famous to be dramatic. Every law enforcement agency in the country can describe how NCIC— often in concert with state, local and regional databases— helped nab a criminal. "Pretty much, if you run suspects on the street in your career, you're going to get someone back who is wanted," said Capt. Michael Clancey of the Alexandria, Va., Police Department. "It is one of our basic tools. It would be like a hammer, screwdriver or saw to a carpenter."

In Chicago 15 years ago, witnesses to a murder pointed the finger at Julian Padron, a Cuban national. He had been arrested six times using false names, dates of birth and Social Security numbers, but he was released by the time his true identity was known through fingerprint identification. Chicago Police Sgt. Paul Carroll continued for months to punch Padron's name into NCIC. Finally, he got a hit: Padron had been arrested in Taunton, Mass., on a narcotics search warrant. Padron had been released a day earlier, but Massachusetts police still had his 25-caliber handgun. A bullet fired from that gun matched the bullet that had killed the Chicago man. "I had the right guy, and I had corroborating evidence," Carroll said. Continuing to track him on NCIC, Carroll soon discovered that Padron had received a driver's license in New Jersey. Arrested and extradited, Padron pleaded guilty and was sentenced to 68 years in prison.

"These are common stories with the system," said Carroll, a homicide detective with 30 years on the force. "It's really the most fantastic thing you can have."

In January Carroll solved a murder from 1979 using NCIC. A woman had been sexually assaulted, strangled and left dead and naked on a plastic sheet in an alley. Carroll had a suspect but not enough evidence to charge him. With today's DNA technology, Carroll could check the man's blood against the sperm left at the crime scene. Carroll used NCIC to find the suspect in Wisconsin. With a federal court order, authorities took a blood sample. It was a match.

"These cases would lie unsolved forever before NCIC," Carroll said. "If they fled the jurisdiction, we couldn't do anything.''

NCIC is used routinely in the field to get immediate information that can affect how officers handle suspects. "Because the computer tells you that [the suspects] are wanted, you don't approach the car. You draw your gun and have them get out of the car slowly with their hands in view and get down on the ground. You put handcuffs on them and then talk to them," said Sgt. Brenda Collins, an Ohio state trooper with 10 years experience on the road. "You have the edge. The criminal doesn't have the edge."

Random license plate searches also bring results. In January a Washington, D.C., police officer was checking license plates and got an NCIC hit on a black 1992 Nissan. Just hours earlier, Alexandria police had entered the car as a felony vehicle because the owner was wanted for a series of robberies at area banks, restaurants and condominium offices.

"His fingerprints were on the scene, and people identified him from photo arrays," said Detective Thomas Durkin, an Alexandria Police Department robbery investigator. The car's owner was arrested and charged.

Taking NCIC to the Streets

More and more police departments are installing mobile data terminals or laptops in police cruisers for access to NCIC and other law enforcement databases. The Manassas, Va., Police Department installed mobile data terminals in its 54 cars in November 1996 and, within four hours of operation, caught a felon. Officer Steve Olson wasn't even going to write a ticket for this minor traffic infraction. On a busy Friday night, he usually wouldn't have asked the radio dispatcher for a computer check because it could take up to 10 minutes for a response and verification. But because the new terminal was in the cruiser, Olson went ahead and ran the name. In 12 seconds, Olson knew the driver was wanted for a felony. A habitual offender, the man wasn't supposed to be driving the car.

"We empower people in the field," said Lt. William Spencer, director of communications for the Manassas Police Department, noting that inquiries to computer databases have doubled, and hits are up 10 percent. The terminals have "improved our efficiency."

Police cruisers will need computers to take advantage of the new NCIC 2000 system. Officers will be able to download mugshots, signatures and other images, such as scars and tattoos. Name searches will be easier because the new system allows for a range of birth dates and spelling variations.

Perhaps the most anticipated feature is the ability to scan a fingerprint at the crime scene. Officers will be able to place a suspect's right index finger on a live-scan device and get an identification in 35 seconds— with 92 percent accuracy— against a database of wanted and missing persons. Today it takes 70 days to get a fingerprint ID because searches are conducted manually through the FBI's 34 million, 10-print criminal fingerprint cards. Separate from NCIC, that system is being computerized, and when it goes online in 1999, it will be able to give a 100 percent identification within two hours. Officers then will be able to use the NCIC fingerprint check on the street to establish probable cause and take the suspect to the station for positive 10-print identification.

"We don't know how many criminals walk today because they have a decent false ID," said Eugene O'Leary, the FBI section chief of information resources in charge of NCIC 2000.

The FBI has been criticized for its handling of NCIC 2000. The budget now stands at $183 million, up from $73 million, with completion set for July 1999— four years later than first promised. It could be much longer before most street cops have the new technology in hand. States will have up to three years to make their computer systems fully compatible with NCIC 2000, and local agencies will update as they get funding.

In Brownsville, Inspector Rodriguez is looking forward to the new capabilities. Ironically, Philip Johnson isn't the criminal she is most proud of catching. That was a man wanted for sexually molesting a 13-year-old, and Rodriguez almost had to let the suspect go because she couldn't get a positive ID. A Texas sheriff's department faxed a driver's license photo and a fingerprint, but it was too hard to make a match. Finally, a sheriff had to go to Brownsville to make the ID. "It was an all-day affair," Rodriguez said.

With NCIC 2000, the child molester's identity could be confirmed in seconds. "You don't want to let a child molester go free," Rodriguez said. "But you don't want to arrest an innocent person either."

-- Shepard is a free-lance writer based in Washington, D.C.

* * * * *

NCIC Components

Hardware: Amdahl Computer Corp. mainframes in Washington, D.C., and Clarksburg, W.Va.; a Computer Communications Inc. Model 85 front end in Washington; an IBM RISC/System 6000 Model 50 front end in Clarksburg; an IBM RAYMAC 9393 Virtual Array Storage

Software: FBI-developed

Communications: Sprint provides 9,600 bits/sec links in Washington and 56,000 bits/sec links in Clarksburg.

* * * * *

NCIC 2000 Funding

Congressional Appropriations

1991: $17.0 million

1992: $22.0 million

1993: $21.0 million

1994: $17.82 million

1995: $0

1996: $66.50 million

1997: $38.93 million

Total: $183.25 million

* * * * *

NCIC Data History

File/Set Up In.../Active Records as of Jan. 2*/Description

Vehicles/1967/1.5 million/Stolen vehicles and vehicles known to have been used in a crime, including aircraft, trailers and vehicle parts. Includes a Canada-maintained index of 311,034 Canadian vehicles, boats, license plates, and vehicle or boat parts.

Articles/1967/2.0 million/Unrecovered stolen articles

Guns/1967/2.3 million/Stolen, recovered or lost weapons with serial numbers

License Plates/1967/791,000/All license plates reported stolen

Wanted Persons/1967/458,000/Records of individuals with outstanding warrants

Securities/1968/2.5 million/Any numbered securities that have been stolen, embezzled, counterfeited or used as ransom or bait money

Boats/1969/34,000/Any unrecovered stolen boat that has an identifying number

Missing Persons/1975/98,700/Reported missing persons; may include people with disabilities and people believed to be endangered as well as juveniles and kidnapping and catastrophe victims.

Interstate Identification Index/1983/27.2 million/Criminal histories for federal offenders; also pointers to criminal records maintained by the states

U.S. Secret Service Protective/1983/41/Records of individuals believed to pose a threat to the president and others who are afforded Secret Service protection

Unidentified Persons/1983/3,700/Deceased or living persons, or catastrophe victims, who are not identified, including body parts

Originating Agency Identifier/1985/82,000/Internal service file that identifies law enforcement and criminal justice agencies authorized to use NCIC

Foreign Fugitives + Canadian Warrants/1987/1,000/Includes Canadian warrants entered and maintained by the Royal Canadian Mounted Police, and Interpol entries for fugitives wanted in other countries

Violent Felon/1992/900/Records on subjects with three or more previous convictions who are considered dangerous; maintained by the Bureau of Alcohol, Tobacco and Firearms

Gang and Terrorist/1996/6,300/Records containing reference information on known gangs and terrorist groups as well as records of known members of those groups

Deported Felons/1996/5,900/Records of foreign criminals who have previously been banned from the U.S.; maintained by Immigration and Naturalization Service

Protection Order File/1997/15,400/Records of individuals who should be prevented from violent or threatening acts; harassment against, contact or communication with; or physical proximity to another person

*Record figures are rounded.

* * * * *

NCIC 2000 Capabilities

Enhanced Name Search: The New York State Identification and Intelligence System algorithm will permit greater flexibility in name searches, allowing permutations in name spelling and a range for date of birth.

Fingerprint Searches: This allows storing and searching of fingerprints using the right index fingerprint only. In this way, the user can submit one fingerprint to be compared with all fingerprints on file for people who are wanted, missing, convicted, or on probation and parole.

Probation/Parole: This includes records of individuals who are under supervised release. Notifications are issued to the probation officer or supervisor when a hit is made on a record in this file.

Online Manuals: Manuals are available to users online.

Improved Data Quality: This offers clearer error messages, fewer abbreviations in responses and expanded fields to allow users more room for explanations.

Information Linking: This allows users to connect records so that one inquiry will retrieve related records.

Mugshots: As part of the imaging capability, one mugshot per person's record may be entered and maintained as well as one fingerprint, one signature and up to 10 other identifying images (scars, marks, tattoos).

Other Images: One identifying image can be stores for each entry in the article file, vehicle file, boat file, and vehicle and boat parts file, plus generic images for reference.

National Sexual Offender Registry: This includes records of individuals who are convicted sex offenders who have been released from prison, paroled or placed on supervised release, including a warning message for sexually violent predators.

Access to Sentry Database: The Federal Bureau of Prisons will provide records of those incarcerated in federal prisons.

Delayed Inquiry: Every inquiry is logged and kept for five days, providing users with a response if any other agency inquires on the subject.

Online Ad Hoc Inquiry: This processes special requests; it is used in investigations because of its great flexibility.

_________________________

System Specifications

NCIC 2000, scheduled to be operating as of July 1999

System Throughput Capacity

* 1999: 78 transactions per second (peak); 2.8 million transactions per day

* 2010: System expandable to handle projected growth to 133 transactions per second (peak); 4.7 million transactions per day

**

Hardware

Processors

* Three IBM 9672-R54 central processor complexes

* 15 CPUs, each at 45 million instructions per second, linked by two IBM 9674-CO2 coupling facilities

* Memory: 12G

* Mass Storage: RAMAC III (360G) and 103G of other direct-access storage devices

**

Software

* Vendor: Harris Corp.

* Operating System: MVS/ESA with Parallel SYSPlex

* Transaction Processor: CICSPlex/ESA

* Database Management System: IBM DB2

* Communications: Sprint Network; 56 kilobytes/sec