What Is 28 CFR Part 23 — and Why Most Software Gets It Wrong

Most law enforcement commanders who run a criminal intelligence program have heard of 28 CFR Part 23. Fewer can explain exactly what it requires. And almost none of the software they use to manage intelligence actually enforces it.

That gap is where agencies get into legal trouble.

What Is 28 CFR Part 23?

28 CFR Part 23 is a federal regulation that governs criminal intelligence systems operated by state and local law enforcement agencies that receive federal funding through the Omnibus Crime Control and Safe Streets Act. If your agency receives Edward Byrne Memorial Justice Assistance Grant (JAG) funding, HIDTA funding, or similar federal grants — and you maintain a criminal intelligence system — this regulation applies to you.

The regulation establishes the rules for what information can be collected, who can access it, how long it can be retained, and what must happen when it no longer meets the standard. It is not a best practice. It is a legal requirement. Violations can expose your agency to civil liability, result in grant funding being pulled, and in serious cases lead to federal oversight.

What the Regulation Actually Requires

The core of 28 CFR Part 23 comes down to five operational requirements:

Reasonable Suspicion Before Entry

No individual may be indexed in a criminal intelligence system unless there is reasonable suspicion that they are involved in criminal conduct or activity, and the information collected is relevant to that criminal conduct. This is the threshold requirement. It sounds simple. In practice, most agencies do not enforce it structurally — they enforce it by policy, which means they trust that individual investigators are applying the standard correctly before they hit submit. That is not enforcement. That is hope.