In law enforcement, TLO stands for Terrorism Liaison Officer, sometimes called Threat Liaison Officer depending on the region. It refers to a trained, certified member of a police department, fire service, EMS agency, military unit, or other public safety organization who acts as the designated link between that agency and the broader intelligence community. Officers also use “TLO” informally to mean TLOxp, a TransUnion investigative database used for skip tracing and background research. The liaison officer role is the formal designation; the database is the day-to-day shorthand.
Terrorism Liaison Officer: The Formal Meaning
The Joint Regional Intelligence Center defines a TLO as a member of a qualifying agency who is “in good standing and properly certified by the appropriate Regional Fusion Center.”1Joint Regional Intelligence Center. Threat Liaison Officer Program You don’t self-appoint. An agency nominates you, you complete an accredited course, and only then do you carry the designation.
The naming varies. California and much of the western United States use “Threat Liaison Officer,” which widens the scope beyond terrorism to include organized crime and targeted violence. The FBI has historically used “Terror Liaison Officer.” The function is the same either way: moving ground-level information into the national intelligence picture and moving federal alerts back down to the officers who need them.
The program traces to California around 2005 and 2006, developed through the state’s Commission on Peace Officer Standards and Training. The intelligence-sharing failures exposed after September 11 were the obvious catalyst. The structure has since expanded well beyond California and now operates through fusion centers across the country.
What a TLO Actually Does
A TLO sits between local fieldwork and intelligence analysis. The core job is noticing things that look minor in isolation but might matter when combined with reporting from elsewhere. A patrol officer sees someone photographing a water treatment facility. On its own that could be nothing. If a TLO routes it into the network and it matches similar observations from three other cities, the picture changes.
The work breaks down into a few areas:
- Collecting tips, field observations, and unusual-activity reports from officers in the agency and from community partners.
- Assessing whether a report meets the threshold for formal escalation or connects to known threat patterns.
- Passing qualifying information up to the regional fusion center and, when appropriate, to federal partners, and pushing bulletins from those partners back down to the department.
- Maintaining working contacts with other agencies, private-sector security teams at critical infrastructure sites, and community organizations, so that when something happens the channels already exist.
How TLOs Fit Into Fusion Centers
Fusion centers are the organizational backbone of the TLO system. They are state or regionally operated intelligence hubs where analysts from local, state, and federal agencies work alongside each other to assess threats. The Department of Homeland Security supports a national network of these centers, and they are the primary recipients of what TLOs collect in the field.2Department of Homeland Security. National Network of Fusion Centers Fact Sheet
Information flows both ways. A TLO at a local department sends a report up; analysts cross-reference it against other jurisdictions and federal databases; finished intelligence products come back out to TLOs across the region. That loop is what the TLO concept was built to create, replacing the siloed reporting that existed before 2001.
Suspicious Activity Reports
The main product of the TLO role is the suspicious activity report. The Bureau of Justice Assistance defines a SAR as “official documentation of observed behavior reasonably indicative of preoperational planning related to terrorism or other criminal activity.”3Bureau of Justice Assistance. Nationwide Suspicious Activity Reporting Initiative Surveillance on a government building, security probing at an airport, unusual purchases of precursor chemicals — these are the kinds of behaviors a TLO documents.
One point of confusion worth clearing up: these behavioral SARs are not the same as the financial SARs that banks file under the Bank Secrecy Act for suspected money laundering.4Federal Financial Institutions Examination Council. FFIEC BSA/AML Manual – Suspicious Activity Reporting Same acronym, different systems, different people, different legal framework. TLOs work the behavioral side.
The Nationwide Suspicious Activity Reporting Initiative, managed through DHS, standardizes how behavioral reports get collected, vetted, and shared, with built-in privacy protections meant to keep legitimate activity out of the system.5Department of Homeland Security. Nationwide SAR Initiative (NSI) A tip has to meet specific behavioral criteria before a TLO can enter it into a federal repository such as the FBI’s eGuardian platform.
Who Can Become a TLO
The role is deliberately open beyond sworn police officers. Firefighters, paramedics, federal agents, military investigators, and civilians in public safety or homeland security positions can all qualify.1Joint Regional Intelligence Center. Threat Liaison Officer Program A firefighter inside a building sees things a patrol officer does not. A paramedic responding to a call reaches places neither of the others does. More trained observers feeding the network means a more complete picture.
Certification runs through regional fusion centers. In California, the basic course is an eight-hour POST-certified class covering the intelligence mission, threat recognition, and where the TLO fits in the homeland security framework.1Joint Regional Intelligence Center. Threat Liaison Officer Program Finishing that course is the prerequisite for the designation.6NCRIC. Training Course Descriptions Advanced tracks exist for TLOs who want to specialize, including behavioral threat assessment work focused on targeted violence prevention.
TLOxp: The Other Meaning Officers Use
The other TLO officers mention daily is TLOxp, an investigative research platform now owned by TransUnion. It was originally built by TLO LLC before TransUnion acquired it. The platform pulls from more than 10,000 public and proprietary databases, and investigators use it to locate people, map relationships, review assets, and pull criminal and driving records.7TransUnion. Investigations Powered by TLOxp When a detective says “run them through TLO,” this is the tool.
TLOxp and the Terrorism Liaison Officer role share nothing beyond the three letters. Context tells you which one is meant. Conversations about fusion centers, intelligence sharing, or suspicious activity are about the liaison officer. Conversations about finding a last known address or confirming an identity are about the database.
Civil Liberties Guardrails
A program built around reporting suspicious behavior invites obvious questions, and the framework has rules on paper. Under the Nationwide SAR Initiative, reported activity must match defined behavioral indicators before entering the system; race, religion, or political beliefs alone cannot be the basis for a report.5Department of Homeland Security. Nationwide SAR Initiative (NSI) Federal regulation 28 CFR Part 23 governs criminal intelligence systems that receive federal funding, setting rules on what can be collected, how long it can be retained, and who can access it. Fusion centers operating under that regulation have to purge records that no longer meet reasonable suspicion standards and keep audit trails of who looked at what.
Most tips the system handles turn out to be innocent activity, and the vetting step by a TLO or fusion center analyst is meant to be the filter. Reports that fail the threshold are supposed to be discarded rather than stored. Whether that happens consistently has been debated by civil liberties groups, but the standard the regulations set is clear.