Suspicious Activity Reports (SARs) intake, triage, and outcomes

Jeff Gruenewald , Noah Turner , Seamus Hughes

Sar
April 2026

Table of Contents

This brief describes the characteristics of SARs in terms of intake, triage, and outcome

Executive Summary

The Nationwide Suspicious Activity Reporting Initiative (NSI) established a national infrastructure for sharing information related to terrorist activity. Fusion centers facilitate the receipt, investigation, documentation, and sharing of suspicious activity reports, or SARs. Eighty fusion centers currently operate across the United States, but research into how these centers process SARs is limited. Using closed-source data on SARs from two fusion centers, this brief describes the characteristics of SARs in terms of intake, triage, and outcome.

The purpose of this brief is to help policymakers involved in the NSI program understand key patterns in suspicious activity reports (SARs), including how they are identified, reported, reviewed, and acted on by fusion centers.

Key Takeaways

Most SAR reports are not connected to terrorism but are often connected to threats of serious violence like school violence, mass violence, or other targeted attacks.
Most SARs involve expressed or implied threats, often observed in person or on social media and reported by bystanders or law enforcement.
SARs most often involve private citizens, businesses, and government entities as targets.
About half of SARs are assigned to investigators, and over one-third are referred to other agencies.
Less than 20% of SARs result in a subject being charged for a crime.