Compliance reference · regulatory mapping

Eagle.report compliance reference.

For attorneys, compliance officers, and audit teams. The regulatory mapping behind Eagle's operating posture — how the platform aligns to 28 CFR Part 23, the governance SOP, audit-log architecture, and the categorical hard lines that bound the product. The plain-language version of this material is on the About page.

Version 1.0 Last reviewed 2026-05-16 Authoritative

Contents

§ 1 · 28 CFR Part 23 mapping

Full regulatory alignment for criminal-intelligence systems.

28 CFR Part 23 is the federal regulation governing criminal intelligence systems operating under federally-funded grants. Eagle.report does not claim to be a criminal intelligence system within the regulatory definition — but every component that touches pattern detection or aggregated case data treats Part 23 as the operational floor. The four functional areas of Part 23 (collection, dissemination, audit/review, governance) and how Eagle implements each:

Collection & retention

Information is retained only when reasonable suspicion exists that the subject is involved in criminal conduct relevant to a cargo-theft case. Single-incident touches do not generate retention.

§ 23.20(a)
Reasonable suspicion standard at retention. Pattern data on a named subject is retained only when articulable facts and circumstances warrant retention.
§ 23.20(b)
No collection on protected characteristics. Race, religion, sex, sexual orientation, association, or political views never serve as a basis for collection or retention.
§ 23.20(c)
Periodic validity review. 5-year automatic review cap mandated by Part 23. Eagle policy is tighter: 2-year case-linked retention for OSINT-derived pattern data, with auto-deletion at the boundary absent recurrence.
§ 23.20(d)
Source evaluation. Each information source is evaluated for reliability; reliability tag is propagated with any downstream referral.

Dissemination

Pattern output is referred only to LE personnel with right-to-know and need-to-know on a specific active case. No bulk disclosure, no resale, no commercial product built on pattern data.

§ 23.20(e)
Disclosure restricted to LE need-to-know. Recipient must be a credentialed law-enforcement person assigned to a specific active investigation that the disseminated information bears upon.
§ 23.20(f)
Source reliability notice. Each disseminated record carries the originating-source evaluation and reliability tag.
§ 23.20(g)
Recipient agreement. Recipients agree in writing (via verified-account terms of service) to abide by Part 23 dissemination restrictions on any further use or onward referral.

Audit & review

Every read, every write, every referral is logged. Audit trail designed to survive Brady and Daubert challenges three years after the fact.

§ 23.20(h)
Periodic information-validity review. Retained pattern data is reviewed for continuing validity at 6-month intervals; corrections propagate to all known prior recipients.
§ 23.20(i)
Inquiry logs maintained for inspection. Read access logs are available for federal or audit inspection upon authorized request.
Eagle SOP
Per-access field set. Badge number, timestamp, IP, user-agent on every read/write. See § 4 audit-log architecture.

Governance

Standing operating procedure document, drafted by a senior analyst hire and reviewed by transactional counsel with intelligence-handling experience. Available on request to FMCSA, NICB, RISS, and any LE partner.

SOP § 1
Analyst review precedes every LE referral. Three determinations possible: insufficient (close, dismiss flag), inconclusive (hold for more case data), sufficient (refer with full reasoning).
SOP § 2
Negative-case discipline. Insufficient findings are logged with reasoning. See § 5.
SOP § 3
OSINT vendor-licensing. No direct scraping; OSINT data is licensed via vendor relationship. Access is audit-logged at the application layer. See § 3.
SOP § 4
3-linkage threshold for referral. Pattern signals are not referred to LE until at least three independent case linkages exist, each meeting the reasonable-suspicion floor.
§ 2 · Governance SOP

How the analyst workflow is documented.

The Eagle governance SOP is a standing operational document, drafted by the senior intelligence advisor and reviewed by transactional counsel with intelligence-handling experience. It is filed as the controlling policy for every pattern-detection decision, every referral to law enforcement, and every retention determination.

SOP scope

The SOP governs every Eagle workflow that touches pattern data, case linkages, or any subject identifier (named individual, MC, DOT, address, phone). It does not govern intake-level workflows on a single active case (those are governed by the case-team visibility tier rules).

SOP § 1.1
Pattern-detector rule definitions, parameters, and trigger thresholds maintained in source control with audit trail on every change.
SOP § 1.2
Detector firing events logged with: detector ID, rule version, input case IDs, evaluated subject identifier, output classification.
SOP § 1.3
Senior analyst review precedes any LE referral; review log records analyst identifier, determination, and rationale.

Analyst determinations

Every pattern flag entering analyst review terminates in one of three determinations. The negative-case (insufficient) determinations are logged with the same rigor as positive referrals — see § 5.

Insufficient
No referral. Pattern flag dismissed. Reasoning logged. Subject identifier removed from active monitoring queue.
Inconclusive
No referral at this time. Pattern held for additional case-linkage development. Subject identifier remains in active monitoring for 90 days, reviewed at boundary.
Sufficient
Referral to a specific lead investigator on a specific active case. Referral includes: rule fired, source reliability, case linkages, and analyst reasoning.
§ 3 · OSINT vendor-licensing posture

Vendor-licensed data, not scraped.

Eagle's open-source intelligence ingest is mediated through licensed vendor relationships (e.g., social-graph providers, public-records aggregators). Direct scraping is prohibited. This posture is structural: it shifts terms-of-service compliance to the vendor and provides a contractual audit chain.

Vendor-licensing requirements

OSINT § 1
Licensed access only. No direct platform scraping. All OSINT data is acquired through commercial vendor APIs under signed terms.
OSINT § 2
Application-layer audit. Every vendor API call is logged at the Eagle application layer with caller identity, query parameters, and response hash. Vendor-side logs are independent and audit-comparable.
OSINT § 3
Vendor evaluation. Vendor SOC 2 Type II or equivalent attestation required; data-handling addendum signed.
OSINT § 4
Retention isolation. Vendor-derived data is retained on a separate retention schedule and is not commingled with case-team-generated content.
§ 4 · Audit-log architecture

Every read, every write, every referral.

The audit log is the load-bearing technical artifact for Eagle's compliance posture. It is designed to survive hostile defense review under Brady disclosure and Daubert reliability challenges three years after the fact.

Field
Captured on every access event
timestamp
ISO 8601 UTC, second precision, monotonic clock source. Backfilled via NTP discipline.
actor_id
Authenticated user ID. For verified-LEO accounts, includes agency ORI + role.
badge_number_hash
SHA-256 hash of badge number (never stored plain). Salt and pepper rotated annually.
agency_id
FBI ORI of the actor's home agency. Cross-checked against verified-account record on every read.
action
read · write · referral · export · case-team-grant · case-team-revoke
resource_id
Case ID + sub-resource (visibility tier, field accessed)
visibility_tier
public · carrier_network · le_network · case_team_only — the tier the actor accessed
ip_address
Source IP, with proxy chain when present
user_agent
Client identifier
request_hash
SHA-256 of the full request payload — supports tamper-evidence verification
response_hash
SHA-256 of the response — supports replay-protection

Logs are append-only, write-once-read-many (WORM) storage with cryptographic chain-of-custody. Periodic Merkle-root attestation against a third-party witness service provides external tamper-evidence. Log retention exceeds the longest applicable statute of limitations for the case types Eagle touches.

§ 5 · Negative-case discipline log

Logging what we did not escalate.

The negative-case discipline log records pattern flags that were reviewed and dismissed. This is a load-bearing 28 CFR Part 23 practice: it prevents drift into permanent watch lists, documents analyst judgment, and proves the analyst layer is not a rubber stamp.

What gets logged

NCL § 1
Every analyst determination of "insufficient" is logged with reasoning sufficient for after-the-fact review.
NCL § 2
Subject identifier on which the pattern fired is removed from active monitoring at insufficient determination.
NCL § 3
Pattern detector rule version is recorded so re-evaluation under a new rule can be detected and re-reviewed.
NCL § 4
The 28 CFR Part 23 § 23.20(h) periodic-review process scans the NCL for re-emergence of dismissed subjects under new linkages.

Why this matters

Without negative-case discipline, an "investigative lead worth attention" can quietly accrete into a de facto watch list — the failure mode most likely to trigger 42 U.S.C. § 1983 exposure and 28 CFR Part 23 audit findings. The NCL is the structural prevention.

§ 6 · Categorical exclusions

Six hard lines, with statutory anchors.

Plain-language version of this material is on the About page. The statutory anchors below are the legal floor.

01
Replace NCIC. FBI CJIS owns the federal stolen-property registry. Eagle pre-fills entry templates and routes notifications. It does not substitute for the official record.
28 U.S.C. § 534 · 28 CFR Part 20 · CJIS Security Policy
02
Query NCIC, NLETS, or state CHRI on an officer's credentials. Eagle personnel do not log into credentialed LE systems on an agency's behalf, under any circumstance.
28 CFR Part 20 · NLETS User Agreement
03
Take case ownership from the originating LEA. The Jurisdictional Lead is always an LE agency. Eagle holds the coordination, not the case.
FBI UCR Cargo Theft Manual § 1.3 · FBI UCR § 2.2
04
Pay active-duty officers for outcomes. No case-outcome payments, no informant networks paid by Eagle, no honoraria-for-results. Donations to departments, retired-investigator hires (W-2 with disclosure), and published-rate training stipends are the only authorized channels.
18 U.S.C. § 201 (federal bribery)
05
Publish "persons of interest" lists. Pattern output is always an investigative lead referred to a specific lead investigator on a specific active case — never a published watchlist, never a commercial product, never marketed.
28 CFR Part 23 · 42 U.S.C. § 1983 (defamation per se / false light)
06
Work with gray-market recovery contacts. Every recovery agent is PI-licensed, bonded, insured (E&O minimum $1M), background-checked. No physical contact with stolen property without LE notified beforehand.
Eagle Network MSA · state PI licensing statutes
§ 7 · Brady / Daubert survivability

Designed to survive hostile defense review.

Cargo-theft cases that go to federal prosecution will face defense motions on the reliability of any pattern-derived evidence. Eagle's audit architecture is designed to produce, under subpoena, the complete record of what was decided, by whom, on what basis, and with what reasoning.

Brady (exculpatory evidence disclosure)

Eagle's negative-case discipline log is the load-bearing artifact for Brady compliance. If a pattern detector was evaluated on a defendant and produced an "insufficient" determination, that determination is logged and producible.

Brady § 1
All analyst determinations on a defendant are preserved through the prosecution-window retention horizon (case statute of limitations + appellate windows).
Brady § 2
Pattern-detector rule versions and parameters at the time of evaluation are preserved alongside the determination — so the exact rule that fired can be reproduced.

Daubert (expert testimony reliability)

If a federal magistrate evaluates the reliability of Eagle-derived pattern evidence under Daubert, the audit log + governance SOP + 28 CFR Part 23 procedural compliance documentation are designed to constitute the reliability showing.

Daubert § 1
Pattern-detector rules are documented in source-control with a peer-review trail; rule changes are versioned and auditable.
Daubert § 2
Detector firing rates, false-positive rates, and analyst-disposition statistics are published quarterly to support the "known or potential rate of error" prong.
Daubert § 3
Methodology has been reviewed by transactional counsel with intelligence-handling experience; review documentation available on request to verified LE partners.
§ 8 · Citations index

Every statute referenced in this document.

Cross-reference of all federal statutes, regulations, and agency policy documents Eagle's compliance posture is anchored to.

Federal statutes & regulations

18 U.S.C. § 201
Federal bribery and graft. The statute under which any payment to an active-duty officer in exchange for case-outcome would be prosecuted.
18 U.S.C. § 659
Theft from interstate shipments. Primary federal statute for interstate cargo theft.
18 U.S.C. § 1201
Federal kidnapping (relevant when driver hijackings cross state lines).
18 U.S.C. § 1962
RICO substantive offense — enterprise cargo-theft cases.
18 U.S.C. § 1028 / § 1028A
Identity theft + aggravated identity theft (FMCSA authority hijack predicate).
18 U.S.C. § 1343
Wire fraud — broker impersonation, fictitious-carrier fraud.
18 U.S.C. § 2314
Interstate transportation of stolen property (ITSP).
21 U.S.C. § 841
Controlled substance distribution — relevant when pharma cargo is diverted.
28 U.S.C. § 534
Authority for FBI CJIS Division and NCIC operation.
42 U.S.C. § 1983
Civil rights cause of action — relevant exposure for "persons of interest" misclassification.
28 CFR Part 20
FBI CJIS Security Policy — governs use of credentialed CHRI/NCIC access.
28 CFR Part 23
Criminal Intelligence Systems Operating Policies — the controlling federal regulation on retention, dissemination, audit, and review of criminal intelligence systems.

Agency policy & standards

FBI UCR § 1.3 / § 1.4 / § 2.2
FBI Uniform Crime Reporting — Cargo Theft Manual. Governs which agency reports the offense, transfer rules, and recovery reporting.
CJIS Security Policy
FBI Criminal Justice Information Services security and access policy.
NLETS User Agreement
Inter-state plate / license query restrictions.
CHP HPM 81.1 Ch. 12
California Highway Patrol Highway Patrol Manual — cargo theft response procedures.
Eagle Network MSA
Master Services Agreement governing recovery-agent network participation. Available to verified LE partners on request via liaison@eagle.report.
Eagle Operating Standard
Internal operating standard governing analyst workflows, audit-log architecture, and negative-case discipline. Reviewed by transactional counsel; available on request.

Audit, partner, or counsel question?

For verified law-enforcement partners, prosecutorial offices, and counsel reviewing the Eagle.report compliance posture: the full governance SOP, audit-log schema, and OSINT vendor-licensing terms are available on request.

Contact liaison@eagle.report with your agency, role, and the specific compliance area you'd like to review. Typical turnaround: 24 hours for verified-partner requests.

Back to the plain-language version.

The About page covers the same material in the form a working LEO would prefer.

About Eagle.report → How it works