LEO Playbook · how it works

The inter-agency process for finding stolen freight.

Nine stages — from the first report at a local department through nationwide notification, corridor sighting, recovery, and prosecution. Eagle.report sits inside this flow as the coordination layer between the originating agency and every downstream LEO that can help. We feed NCIC; we never replace it.

9 stages 3 decision points SLA: 5 / 15 / 30 / 60 / 90 min FBI UCR Cargo Theft Manual · CHP HPM 81.1 Ch.12 · 18 U.S.C. § 659

Report arrives

Originating LEA · carrier, broker, shipper, citizen, ELD ping, or Eagle.report
Truck/trailer/cargo last contact lapsed. Caller hits the local PD or sheriff with jurisdiction over where the load was last seen — pickup, last-known driver location, or where the report happened to land. Intake captures: VIN/plates, MC#/DOT#, BOL, commodity, declared value, driver name, last ping. eagle.report intake
SLA · acknowledged in 5 min
Triage
Is this a criminal cargo theft?
no → brokerage dispute / civil delay → release out of LE channel
yes → continue ↓

Open case at originating agency

Originating LEA · detective, dispatcher, or watch commander
Local agency generates case#, tags ORI, classifies as cargo theft (not buried as "burglary"). Per FBI UCR rules, the agency with investigative jurisdiction reports the offense; if multiple agencies are involved they must agree on the Jurisdictional Lead. eagle.report case object
SLA · BOLO drafted in 15 min

Stand-up: three things fire simultaneously

Originating LEA + state task force + Eagle.report
(a) NCIC entry — stolen vehicle file (truck/trailer VIN + plates), stolen article file (cargo serials > $500). Once entered, any LE nationwide that runs a query gets the hit. (b) State cargo task force notified — CHP CTIP, TBI Cargo Crimes, TxDPS CVE, NJSP CTU, FL Major Cargo Theft, GA Tag/Title. (c) Eagle.report ISO push — the corridor fanout begins (see right rail →). eagle.report fanout
SLA · LE-of-jurisdiction notified in 30 min
Escalation gate
Federal trigger met?
no — state task force keeps lead
yes — interstate, organized ring, or value > $50k → federal

Federal escalation (when triggered)

FBI Major Theft Program · HSI Cargo Theft Task Force
Federal partners absorb the lead — or join as a parallel investigation under MOU. FBI's Major Theft Program runs the cross-state pattern work; HSI Cargo Theft Task Forces (Memphis, Miami, NY/NJ, LA, Dallas, Houston, etc.) coordinate on organized rings with import/export angles. Originating agency stays on the case team. eagle.report case-team access

Sighting comes in

Any LEO · ALPR · weigh station · citizen · recovery agent
Patrol officer runs the plate at a traffic stop — NCIC returns the stolen hit. Or LPR camera fires. Or driver pings a truck stop. Or a recovery agent locates the asset off a private parking lot. The hit immediately routes back to the Jurisdictional Lead and every agency tagged on the case in Eagle.report. eagle.report sighting fan-in
Officer safety posture
Cold recovery or hot recovery?
cold — vehicle parked, no suspect → document, tow, hold
hot — driver / suspect on scene → backup, felony stop, arrest

Recovery + chain of custody

Recovering agency · seizing officer + supervisor
Officer secures the asset. Tractor / trailer photographed, VIN verified, seal numbers documented, cargo manifest pulled, evidence chain logged. Per FBI UCR rule: recovery is reported only by the LEA that first reported the theft — the originating agency owns the property record, regardless of who physically recovered it.
SLA · recovery options confirmed in 60 min

Handoff to originating agency / carrier

Recovering agency → Originating agency → Carrier
Originating agency (or carrier under LE escort) collects the asset. If the case has shifted out of the originating jurisdiction's reach, the Jurisdictional Lead field transfers with a logged handoff — the new lead can now close the case, modify victim contact, and release sealed details. Other agencies stay on the case team in observer status. eagle.report jurisdiction transfer
SLA · incident report ready in 90 min

Prosecution chain

County DA → State AG → U.S. Attorney
County DA picks up charges where the theft occurred. State AG steps in for multi-county / cross-jurisdiction prosecution. If federal triggers were met (interstate transport, organized ring, > $50k threshold under 18 U.S.C. § 659), the U.S. Attorney's office for the federal judicial district takes lead. U.S. Marshals handle any fugitive component.

Close and feed the network

Originating LEA + Eagle.report
Originating agency clears NCIC stolen file (vehicle and articles). Case marked resolved in Eagle.report. Pattern data (suspect names, MOs, lanes, address-shell hits, FMCSA-change-history triggers) feed back into the detection layer so next time the same actor surfaces on a new ISO, the system already knows them. Tier-2 internal-recurrence detector picks them up automatically. eagle.report learning loop

Symbols

1
Standard stage
A discrete LE action with a clear actor and SLA. Numbered in order of execution.
3
Parallel stand-up
Multiple notifications fire at the same time — see the right rail for the fanout.
4
Escalation stage
Triggered only when the federal threshold is met. Adds FBI / HSI / U.S. Attorney to the case team.
9
Terminal / learning stage
Case closes. Pattern signal is fed back into the network for the next ISO.
Decision point
A branching question that routes the case down a specific path.
Primary case flow
The case object moves through the numbered stages in order.
Notification / fanout
Information radiates to other agencies and platforms but doesn't reroute the case itself.

Where Eagle.report fits

Eagle.report is the coordination layer — not a replacement for any existing system. The local agency still files the case. NCIC still owns the federal registry. The U.S. Attorney still prosecutes. What Eagle.report adds:

Interoperability posture

We feed the systems that already work. We do not replace them.

Every federal, state, and regional system below is load-bearing for cargo theft investigations. Eagle.report's job is to compress the friction between them — not to substitute for any one of them.

What Eagle.report feeds

Inputs into existing LE infrastructure.

  • →
    NCIC stolen vehicle & article files Pre-populated entry templates for credentialed LE; FBI CJIS owns the federal registry.
  • →
    N-DEx Incident records flow to the FBI N-DEx cross-jurisdiction sharing layer when the originating agency is a contributor.
  • →
    RISS & ROCIC Regional intelligence centers receive corridor-pattern handoffs through standing analyst relationships.
  • →
    State cargo task forces CHP CTIP · TBI · NJSP CTU · TxDPS CVE · FL Major Cargo · GA Tag/Title — first call after local.
  • →
    NLETS Inter-state plate / license queries — Eagle pushes context, never queries on an agency's credential.
  • →
    NICB · CargoNet · SC-ITAP Insurance-side intel and theft registries receive cross-flag and aggregate pattern feeds.
What Eagle.report does not do

The hard lines.

  • ×
    Replace NCIC. FBI CJIS is the federal registry. We pre-fill, route, and notify — we never substitute.
  • ×
    Run queries on an officer's credentials. Eagle staff never log into NCIC / NLETS / state CHRI systems on an agency's behalf. 28 CFR Part 20.
  • ×
    Take case ownership from the originating LEA. The Jurisdictional Lead is always an LE agency. Eagle holds the coordination, not the case.
  • ×
    Pay active-duty officers for outcomes. No case-outcome payments, no informant networks, no honoraria-for-results. 18 U.S.C. § 201.
  • ×
    Publish "persons of interest" lists. Investigative lead, never suspect. 28 CFR Part 23. 3+ independent case linkages required for any referral.
  • ×
    Work with gray-market recovery contacts. Licensed, bonded, insured recovery agents only. LE notified before any physical contact with the asset.
Visibility tiers

One case object. Four layers of access.

Every case carries a single canonical record. The fields a public BOLO viewer sees, a partner carrier sees, a verified LEO sees, and the case team sees are governed by tier — enforced at the database row level, audit-logged on every read and write.

01
Public

Releasable BOLO

  • Commodity category
  • Origin / destination lane
  • Equipment description
  • Redacted carrier identifier
  • Sighting hotline
Anyone
02
Carrier network

Verified industry

  • Full equipment + VINs
  • MC of record
  • Last-known location
  • Booking + dispatch history
  • Recovery options
IsoFreight verified
03
LE network

Verified LEO

  • Suspect descriptions
  • Active leads
  • Victim contact info
  • Evidence chain
  • Cross-case linkages
Verified LEO
04
Case team only

Sealed file

  • Investigative theories
  • Witness statements
  • Confidential informant data
  • Sealed evidence pointers
  • Prosecutorial strategy
Jurisdictional Lead
Every read and write is audit-logged. Badge number, timestamp, IP, user-agent. Designed for Brady / Daubert survivability — every analyst decision could face hostile defense review three years later.

Ready to put Eagle in the corridor?

Eagle.report is free. Sign in to save lookups, pin agencies, and keep your jurisdiction's calls one click away.

Sign in → Try lane lookup