Information Sharing Environment: Better Road Map Needed to Guide Implementation and Investments
Released: 2011-07-21T00:00:00

Letter

Background

Following the terrorist attacks of 2001, Congress and the executive branch took numerous actions aimed explicitly at establishing a range of new measures to strengthen the nation’s ability to identify, detect, and deter terrorism-related activities and protect national assets and infrastructure from attack. One theme common to nearly all these efforts was the need to share timely information on terrorism-related matters with a variety of agencies across all levels of government. The ability to share security-related information can unify the efforts of federal, state, and local government agencies in preventing or minimizing terrorist attacks.

History of the Information Sharing Environment

Section 1016 of the Intelligence Reform Act, as amended by the 9/11 Commission Act, required the President to take action to facilitate the sharing of terrorism-related information by creating an information sharing environment—what has become the ISE. Consistent with the Intelligence Reform Act, the Program Manager intends for the ISE to provide the means for sharing terrorism information in a manner that—to the greatest extent practicable—ensures a decentralized, distributed, and coordinated environment that builds upon existing systems and leverages ongoing efforts. Under the act, the President is to designate a Program Manager to, among other things, plan for, oversee implementation of, and manage the ISE. The act also established an Information Sharing Council to assist the President and the Program Manager in carrying out these duties. Furthermore, the act required the President, with the assistance of the Program Manager, to submit to Congress a report containing an implementation plan for the ISE not later than 1 year after the date of enactment (enacted December 17, 2004) and specified elements to be included in this plan. These elements include, among other things, a description of the function, capabilities, resources, and conceptual design of the ISE; budget estimates; metrics and performance measures; and delineation of ISE stakeholder roles. The act also required the submission of annual performance management reports, beginning not later than 2 years after enactment, and annually thereafter, on the state of the ISE and on information sharing across the federal government.

In April 2005, the President designated a Program Manager responsible for information sharing across the federal government, in accordance with the Intelligence Reform Act. In December 2005, the President issued a memorandum to implement measures consistent with establishing and supporting the ISE. The memorandum set forth information sharing guidelines, such as defining common standards for how information is to be acquired, accessed, shared, and used within the ISE and standardizing the procedures for handling sensitive but unclassified information. The memorandum also directed the heads of executive departments and agencies to actively work to promote a culture of information sharing within their respective agencies and reiterated the need to leverage ongoing information sharing efforts in the development of the ISE.

In November 2006, the Program Manager issued an ISE implementation plan to provide an initial structure and approach for ISE design and implementation. The plan incorporated the guidelines in the President’s December 2005 memorandum as well as elements spelled out in the Intelligence Reform Act. For example, the plan included steps toward developing standardized procedures for handling sensitive but unclassified information as well as protecting information privacy, as called for in the President’s information sharing guidelines. Under the plan, the ISE would consist of five “communities of interest”—homeland security, law enforcement, foreign affairs, defense, and intelligence. In addition, in August 2007, the Program Manager issued the initial version of an EAF, which is intended to support ISE implementation efforts.

In October 2007, the President issued the National Strategy for Information Sharing. The strategy focuses on improving the sharing of homeland security, terrorism, and law enforcement information related to terrorism within and among all levels of government and the private sector. The strategy notes that the ISE is intended to enable trusted partnerships among all levels of government in order to more effectively detect, prevent, disrupt, preempt, and mitigate the effects of terrorism against the United States. Further, according to the strategy, these partnerships should enable the trusted, secure, and appropriate exchange of terrorism-related information across the federal government; to and from state, local, and tribal governments, foreign allies, and the private sector; and at all levels of security classifications. The strategy reaffirmed that stakeholders at all levels of government, the private sector, and foreign allies play a role in the ISE. The strategy also outlined some responsibilities for ISE stakeholders at the state, local, and tribal government levels.

In July 2009, the administration established the Information Sharing and Access Interagency Policy Committee (ISA IPC) within the Executive Office of the President to, among other things, identify information sharing priorities going forward. The committee—with representation of participating ISE agencies and communities—is intended to provide oversight and guidance to the ISE. In June 2010, the President appointed the current Program Manager and the White House designated the White House Senior Director for Information Sharing Policy and the Program Manager co-chairs of the ISA IPC. The ISA IPC is responsible for advising the President and Program Manager in developing policies, procedures, guidelines, roles, and standards necessary to establish, implement, and maintain the ISE. Also, pursuant to the Intelligence Reform Act, the head of each department or agency that participates in the ISE is required to ensure compliance with information sharing policies, procedures, guidelines, rules, and standards. Further, OMB provides budgetary, programmatic, and architecture policy guidance to ISE agencies; prepares the President’s budget; and measures performance.

The ISE is not a traditional, dedicated information system, according to the Program Manager. Rather, it is an interrelated set of policies, processes, and systems intended to allow ISE agencies to access and share information in a decentralized, distributed, and coordinated environment that builds upon existing systems and leverages ongoing efforts. The Program Manager also noted that the ISE is not a program in the traditional sense with a finite set of requirements, deliverables, and milestones and an agreed-to budget and manpower resources. Nevertheless, it is an effort that receives government funding and can be reviewed using program and project management principles.

Our Previous Reports on ISE Efforts

In June 2008, we reported that the Program Manager and stakeholder agencies had completed a number of tasks outlined in the 2006 implementation plan, including, among other things, the development of proposed common terrorism information sharing standards—a set of standard operating procedures intended to govern how information is to be acquired, accessed, shared, and used within the ISE—and the development of procedures and markings for sensitive but unclassified information to facilitate the exchange of information among ISE participants. Departments and agencies are in the process of determining how they will implement this guidance (once implemented, this effort could help improve access to information and therefore improve information sharing).

Nevertheless, we reported that the action items in the Program Manager’s June 2006 implementation plan did not address all of the activities that must be completed to implement the ISE. For example, we noted that work remained in defining the ISE’s scope and in determining all terrorism-related information that should be part of the ISE. Moreover, we found that the desired results to be achieved by the ISE—that is, how information sharing is to be improved, the individual projects and initiatives to achieve these results, and specific milestones—had not yet been determined. Thus, as previously discussed, we recommended, among other things, that the Program Manager more fully define the scope and specific results to be achieved by the ISE along with the key milestones and individual projects or initiatives needed to achieve these results. The Program Manager and agencies have taken some steps to address this recommendation but have not yet fully addressed it, as we discuss later in this report.

The sharing of terrorism-related information remains on our high-risk list. Our work in this area has consistently focused on how well the federal government is sharing information among federal agencies as well as with state, local, tribal, private sector, and international partners. As such, our focus has been on progress the federal government has made in standing up the ISE. In February 2011, we reported that while the federal government has continued to make progress in sharing terrorism-related information among its many partners, it does not yet have a fully functioning ISE in place.

Program Manager and Agencies Have Advanced Key Information Sharing Activities but Have Not Yet Developed a Comprehensive Road Map to Effectively Implement the ISE

Since we issued our 2008 report, the Program Manager and agencies have established a discrete set of goals and undertaken activities to guide development and implementation of the ISE, but these actions do not fully address our recommendations or provide the comprehensive road map that we called for in our report. For example, the Program Manager and agencies have not yet fully defined what the ISE is expected to achieve and contain, identified the incremental costs necessary to implement the ISE, or fully developed procedures to show what work remains and related milestones to provide accountability for results. The administration has taken steps to strengthen the ISE governance structure to help guide the development and implementation of the ISE, but it is too early to gauge the structure’s effectiveness.

The Program Manager and Agencies Have Established a Discrete Set of Goals and Undertaken Activities under the ISE, but Work Remains in Developing and Implementing the ISE

In November 2006 and in accordance with the Intelligence Reform Act, the Program Manager submitted an ISE implementation plan to Congress that, according to the plan, was intended to help guide development of the ISE for a 3-year period. The plan addressed initial actions for defining the ISE as well as agency responsibilities and time frames. However, as we discussed in our 2008 report, the plan did not include some important elements needed to develop and implement the ISE. Work remained in, among other things, defining and communicating the scope and desired results to be achieved by the ISE, specific milestones to achieve the results, and the individual projects and execution sequence needed to achieve these results and implement the ISE.

Subsequently, in part based on recommendations made in our 2008 report, the Program Manager worked with the five key agencies to create a new plan to guide development of the ISE, which they called an ISE “framework.” Specifically, the framework identified four goals for the ISE, which were to (1) create a culture of sharing; (2) reduce barriers to sharing; (3) improve information sharing practices with federal, state, local, tribal, and foreign partners; and (4) institutionalize sharing. The framework also identified 14 specific subgoals or activities agencies were to pursue. Some of these activities were intended to institutionalize information sharing practices into agency operations, such as establishing information sharing and incentive programs for federal employees. For example, DHS, DOJ, and DOD, as well as ODNI have made information sharing a factor in their incentives programs by offering employees awards based on their contributions to information sharing and collaboration practices. The framework also cataloged agencies’ ongoing information sharing initiatives to leverage their benefits across the government, consistent with the Intelligence Reform Act, including the following:  The Nationwide Suspicious Activity Reporting Initiative. This initiative builds on what state and local law enforcement and other agencies have been doing for years—gathering information regarding behaviors and incidents indicative of criminal activity that may be precursors to terrorism—and establishes a standardized process to share this information among agencies to help detect and prevent terrorism-related activity. In February 2010, DOJ became the lead agency for the initiative and established a program management office to support its development in cooperation and coordination with DHS and the Federal Bureau of Investigation.  The national network of fusion centers. This initiative is designed to leverage the fusion centers that all 50 states and some major urban areas have established to address gaps in terrorism-related information sharing that the federal government cannot address alone and provide a conduit for information sharing within each state, among other things. In 2010, federal, state, and local officials from across the country launched the first nationwide assessment of fusion center capabilities, with the goal of helping centers close gaps so they have a consistent baseline of information sharing capabilities. Information from this assessment is to be used to develop strategies and realign resources to close those gaps going forward.

ISE privacy and civil liberties. ISE stakeholders have made an effort to strengthen privacy, civil rights, and civil liberties across all sectors of the ISE. According to the July 2010 annual report, 9 of 15 ISE stakeholders had implemented ISE privacy policies. These policies are intended to ensure that privacy and other legal rights of Americans are protected in the development and use of the ISE.

For the subgoals in the framework, the Program Manager established a process to gauge and track agencies’ progress in implementing these subgoals and a related set of performance measures. The Program Manager included the framework in both the June 2009 and July 2010 annual progress reports to Congress. As discussed later in this report, the framework and annual reports to Congress did not specifically address what work remained in completing the initiatives or related milestones.

The ISE framework has served as a plan to guide development of the ISE and its discrete set of 14 subgoals. The framework includes a number of elements that our work has shown are important for developing and implementing broad, crosscutting initiatives like the ISE, such as defined goals, objectives, activities, and metrics. However, as discussed in more detail later in this report—in part because the framework is limited to these 14 subgoals and does not define what the fully functioning ISE is to achieve and include—it does not provide the comprehensive road map that is needed to further develop and implement the ISE going forward. In April 2010, the White House Senior Director for Information Sharing Policy acknowledged that the ISE framework is a set of 14 disparate activities that do not constitute a governmentwide initiative to share terrorism information, as envisioned by the Intelligence Reform Act. According to the Program Manager, the role of the current framework in guiding further development of the ISE and the extent to which other activities will be integrated into the framework have not yet been determined. Therefore, it is unclear how, if at all, the framework and its related goals and activities will be used to guide future development of the ISE.

More Fully Defining the ISE, Related Costs, and What Work Remains Could Help to Facilitate Implementation and Accountability for Results

More than 6 years after enactment of the Intelligence Reform Act and initial efforts to create the ISE, there is not a clear definition of what the ISE is intended to achieve and include. The Program Manager and ISE agencies have ongoing efforts to more fully define this “end state” vision, which is a key next step for ISE development, by the end of summer 2011. After this vision is defined, it will be important for the Program Manager and ISE agencies to ensure that all relevant agency initiatives are leveraged by the ISE to improve information sharing across all communities and to define the incremental costs related to implementing the ISE so agencies can determine how to fund future investments. The Program Manager has enhanced monitoring of ISE initiatives, but additional actions could help demonstrate progress and provide accountability for results. In addition to Intelligence Reform Act requirements, our prior work has found that these activities help to provide a road map for responsible parties in developing and implementing broad, crosscutting initiatives like the ISE. Such actions are also consistent with criteria we use to assess whether agencies have made progress to resolve past terrorism-related information sharing problems, thereby reducing the risk that these problems pose to homeland security.

A road map for the ISE should identify key next steps for ISE development and start with a clear definition of what the ISE is intended to achieve and include—or the “end state” vision. In 2008, we reported that while the Program Manager had completed a plan with an initial structure and approach for ISE design and implementation, he had not yet determined the desired results to be achieved by the ISE, and we recommended that he do so, among other things. The Program Manager has also acknowledged the importance of developing an end state vision for the ISE and noted that he is doing so as part of efforts to update the 2007 National Strategy for Information Sharing. The Program Manager said that this update will drive future ISE implementation efforts and will help individual agencies across all five communities adapt their information sharing policies, related business processes, architectures, standards, and systems to effectively operate with the ISE.

According to the Program Manager, the end state vision will define the current state of the ISE and the future vision to be achieved by agencies as they work to further develop and implement the ISE. DHS and DOJ officials we contacted also cited the importance of developing an end state vision to assist in guiding development and implementation of the ISE. For example, DOJ officials stated that a defined end state would facilitate development and implementation of common goals going forward.

The Program Manager has publicly acknowledged the need to accelerate ISE progress. To inform efforts to define an end state vision, the Program Manager has been soliciting ideas and input from ISE stakeholder agencies. According to the Program Manager, the updated National Strategy for Information Sharing and the ISE end state vision have not been finalized, and therefore it is premature to speculate on questions such as changes in program or investment priorities as well as information sharing gaps and challenges to be addressed. In June 2011, the Program Manager said that the national strategy will be updated in the near future, but he did not provide a specific date.

According to the Program Manager, the end state vision will be a snapshot at a point in time because as threats continue to evolve, the ISE will need to evolve as well. The Program Manager noted that after development of the end state vision is completed, supporting implementation plans will be needed to help guide achievement of the vision, including plans that define what activities and initiatives will be needed to achieve the end state and to guide development and implementation of the ISE. Such plans would be consistent with our call for a road map, if they contain key ingredients such as roles, responsibilities, and time frames for these activities, among other things. Further, as we discuss later in this report, the process of defining an EA for the ISE—and agencies’ associated segment architectures that support their individual ISE activities—could help the Program Manager and agencies in their efforts to define the current operational and technological capabilities within the ISE, the future capabilities needed, and a plan to transition between the two.

The September 11, 2001, terrorist attacks exposed that the five ISE communities—homeland security, law enforcement, foreign affairs, defense, and intelligence—were insulated from one another, which resulted in gaps in the sharing of information across all levels of government. Before the attacks, the overall management of information sharing activities among government agencies and between the public and private sectors lacked priority, proper organization, coordination, and facilitation. Consistent with the Intelligence Reform Act, the ISE is intended to provide the means for sharing terrorism information across the five communities in a manner that, among other things, builds upon existing systems and leverages ongoing efforts. To date, the ISE has primarily focused on the homeland security and law enforcement communities and related sharing between the federal government and state and local partners, in part to align with information sharing priorities.

OMB ISE programmatic guidance shows that ISE activities have been primarily focused on sharing within the homeland security and law enforcement communities and with domestic partners—such as state and local law enforcement agencies. This guidance—developed in collaboration with ISE leadership—outlines the White House’s priorities for the ISE and those that agencies are to focus on and align resources and investments to during a given fiscal year. For fiscal year 2012, OMB’s programmatic guidance identifies the following priorities, which are primarily focused on sharing information between the federal government and state and local partners:  building a national integrated network of fusion centers,  continuing implementation of the Nationwide Suspicious Activity Reporting Initiative,  establishing Sensitive but Unclassified/Controlled Unclassified Information network interoperability, improving governance of the Classified National Security Information Program, and  advancing the implementation of controlled unclassified information policy.

Officials from all five communities generally agreed that ISE activities undertaken to date have been primarily focused on sharing within the homeland security and law enforcement communities—primarily domestic sharing between the federal government and state, local, and tribal partners. According to DOJ officials, this initial focus was appropriate and allowed the Program Manager to leverage agencies’ ongoing efforts to share terrorism-related information. The officials noted that by focusing on a select set of initiatives—such as the Nationwide Suspicious Activity Reporting Initiative and the national network of fusion centers—the Program Manager was able to make progress toward implementing ISE priorities. We recognize that recent homeland security incidents and the changing nature of domestic threats make continued progress in improving sharing between federal, state, and local partners critical. However, consistent with the Intelligence Reform Act, the ISE is intended to provide the means for sharing terrorism information across all five communities.

The Program Manager and ISE agencies have not yet ensured that initiatives within the foreign affairs, defense, and intelligence communities have been fully leveraged by the ISE to enhance information sharing within and across all communities. According to State officials, the department shares terrorism-related information with other agencies through a variety of efforts and initiatives related to national and homeland security. The officials noted that most of the initiatives are non- ISE efforts, meaning that they did not originate in the Program Manager’s office. The officials also noted that the department has only been asked to provide one kind of terrorism-related information as part of one ISE initiative related to Suspicious Activity Reporting and complied with this request. According to the Program Manager, State also possesses information about entrants to the country that could be valuable to the ISE. However, in April 2011, State officials said that the Office of the Program Manager has not contacted the department’s coordinator for the ISE to request information on programs or initiatives related to people entering the country. Therefore, the Program Manager and State have not determined if this information could be used to benefit other ISE communities. DOD officials also said that the department is undertaking activities outside of the ISE, such as efforts to develop interagency agreements between DOD and the Federal Bureau of Investigation for the purpose of sharing terrorism-related information. According to DOD officials, this effort could be part of the ISE if the information addressed within these agreements is consistent with the ISE’s established standards, among other things.

In addition, the December 25, 2009, attempted terrorist attack highlighted the importance of effective information sharing within the intelligence community and demonstrated the potential consequences if information is not shared in a manner that facilitates its use in analysis, investigations, and operations. The intelligence community’s efforts to better share classified information among intelligence agencies are highlighted in the 2010 annual report, but the report does not discuss the extent to which these initiatives are being coordinated within and among the five communities or how the ISE could leverage their benefits. For example, the report discusses an initiative that will allow intelligence community personnel to search for or discover information, including terrorism- related information, across all agencies within the community. According to the Program Manager, this ODNI initiative—while so far limited to the intelligence community—should be highlighted as a best practice across the ISE. However, the 2010 report does not discuss whether and how these technological advances could be used to benefit other communities or how they are implementing this best practice. Also, according to the Program Manager, the ISE has generally left the sharing of Top Secret and higher information to ODNI and intelligence community agencies since they manage most of this information. He said that this was unlikely to change significantly in the future. Ensuring that the intelligence community is fully involved in developing the ISE could help resolve the problems the September 11 attacks exposed—especially that critical information was contained in agencies’ individual stovepipes and not shared.

Further, in part because of the focus on domestic sharing with the homeland security and law enforcement communities, not all agencies have been similarly engaged in building the ISE or have had their initiatives leveraged as discussed above. Officials from the five key agencies said that they have actively participated in ISA IPC meetings and have had opportunities to provide feedback on emerging policy decisions. They also noted that when appropriate, they participate in the development and implementation of OMB priorities and initiatives set forth by the ISA IPC and Program Manager. However, State, DOD, and ODNI officials also reported that development of the ISE has had limited focus to date on information sharing within and among the foreign affairs, defense, and intelligence communities.

State officials said that the ISE priorities established to date generally do not engage State’s mission because the initiatives are primarily focused on sharing with state and local partners, while State’s mission focuses on building relationships within the foreign affairs community. Similarly, DOD officials said they have been engaged in some ISE priorities—such as implementing the Nationwide Suspicious Activity Reporting Initiative—but that DOD has not been tasked to lead any new terrorism-related information sharing initiatives. In addition, ODNI officials said that because many ISE activities are focused on efforts with state, local, tribal, and private sector partners, the intelligence community’s participation in those activities is limited as the intelligence community, by mission and statute, primarily focuses on foreign intelligence.

The Program Manager acknowledged that the most visible outcomes of the ISE have been in the law enforcement and homeland security communities. However, he noted that officials from the Office of the Program Manager have worked with State to standardize terrorism- related information sharing agreements with foreign governments; worked with DOJ and DOD to develop information technology standards that allow different agencies to exchange information; and worked with ODNI and the intelligence community to develop terrorism-related information products for state, local, and tribal governments. The Program Manager also noted that State, DOD, and ODNI are participants in the ISA IPC and have been afforded opportunities to help set ISE programmatic priorities and participate in discussions and decisions about where to strategically prioritize scarce resources. Nevertheless, the Program Manager has also recognized the need to enhance and extend partnerships across all five communities and said that significant outreach to ISE agencies has been under way since he became Program Manager in July 2010. In addition to his outreach efforts, the Program Manager has suggested that specific agencies—such as State, DOD, and ODNI—could also develop proposals for how their information sharing activities could be better integrated into the ISE.

Consistent with the Intelligence Reform Act, the ISE is intended to provide the means for sharing terrorism information across all five communities in a manner that builds upon existing systems and leverages ongoing efforts. After the end state vision is defined, taking actions to ensure that all relevant information sharing initiatives across the five communities are fully leveraged could help the Program Manager and ISE agencies enhance information sharing governmentwide and better enable the federal government to share information that could deter or prevent potential terrorist attacks.

Section 1016 of the Intelligence Reform Act required the President, with the assistance of the Program Manager, to include as part of the ISE’s implementation plan, a budget estimate that identified the incremental costs associated with designing, testing, integrating, deploying, and operating the ISE. In June 2008, we reported that the initial ISE Implementation Plan issued in 2006 did not provide a budget estimate that identified incremental costs in accordance with the act, but that the Program Manager indicated that steps to develop such an estimate would be taken in the future. At that time, a budget estimate that identified incremental costs had not been developed, in part, because the ISE was in such an early stage of development and it would have been difficult for agencies to know what to include in developing such a cost estimate. The Program Manager, in the 2009 ISE annual progress report, also identified the need to coordinate investments for terrorism-related initiatives as both a priority and a challenge, but noted that limited progress had been made in defining the resources needed to implement the ISE. The 2010 annual progress report noted that the Office of the Program Manager had developed a process that is intended to link ISE initiatives and performance measures to investment decisions. However, the Program Manager could not identify the level of investments that have been dedicated to the ISE to date. The Program Manager also could not identify the future incremental investments needed to develop and implement the ISE, in part because the Program Manager and key agencies had not yet determined what the ISE is to achieve and include.

Officials from the Office of the Program Manager said they had not prepared estimated costs for the ISE and that there has never been a stand-alone budget for the program. The officials said that because the ultimate goal of the ISE is to become an institutionalized practice among agencies, to separate or designate funding for ISE-related activities as part of agency budget processes would undermine this overarching goal. Further, OMB officials said that because information sharing is a core mission of all departments and agencies, they are to cover costs to implement information sharing initiatives from within their existing budgets. Nevertheless, while an estimate has not been prepared, the Program Manager said that progress has been made in collecting certain ISE-related costs. Specifically, OMB, in cooperation with the Office of the Program Manager, modified OMB Circular A-11 in 2010 to collect more information from agencies about planned ISE-related technology investments. This effort is intended to identify costs related to agencies’ information technology system investments, but it does not identify other types of incremental costs associated with implementing the ISE, such as those involving training and other administrative programs and activities. The Deputy Program Manager acknowledged the importance of identifying such incremental costs but noted that ISE agencies are best positioned to establish this cost and budget information.

Two of five agencies that we contacted noted that governmentwide initiatives, such as the ISE, are often difficult to implement without dedicated funding for mandated programs. For example, State officials noted that the department had challenges redirecting operational funds to achieve ISE program objectives during fiscal years 2008 and 2009. DOJ officials also acknowledged the challenges in implementing new governmentwide efforts without related funding, but noted that the use of “seed funding” in support of key terrorism-related information sharing initiatives—such as the Nationwide Suspicious Activity Reporting Initiative and fusion center programs—has been one of the major successes of the ISE.

We recognize that attaining accurate and reliable incremental cost estimates for the ISE is a difficult undertaking, complicated further by the fact that the Program Manager and agencies are still defining what the ISE is, is to include, and is to attain. However, new ISE requirements will need additional investments, regardless of whether they are funded through existing agency budgets, a separate program budget, or another mechanism. Our best practices on cost estimation note that the ability of agencies to generate reliable cost estimates is a critical function for effective program management. In addition, our prior work shows that cost information can help agencies allocate resources and investments according to priorities and constraints, track costs and performance, and shift such investments and resources as appropriate. After the ISE end state vision is defined and needed activities and initiatives are identified, developing incremental cost estimates would help agencies plan and budget for these activities and initiatives and allow Congress and other decision makers to prioritize future investments and demonstrate a continued commitment to supporting the ISE.

The Intelligence Reform Act requires the Program Manager to, among other things, monitor implementation of the ISE by federal departments and agencies to ensure that adequate progress is being made and regularly report the findings to Congress. In June 2008, we reported that the Office of the Program Manager was monitoring ISE implementation— as demonstrated through its September 2007 annual report to Congress—but that such monitoring did not include an overall assessment of progress in implementing the ISE and how much work remained. Thus, we recommended, among other things, that the Program Manager (1) develop a way to measure and demonstrate results to ensure that the ISE was on a measurable track to success and to show the extent to which the ISE had been implemented and what work remained and (2) more fully define the key milestones needed to achieve ISE results. The Program Manager generally agreed and has taken some steps to address these recommendations but has not yet fully addressed them. These practices are critical to an effective monitoring system and would help to provide an accurate accounting for progress to Congress and other stakeholders. Further, our prior work on high-risk issues shows that agencies must have a way to monitor and demonstrate progress against baseline requirements—in this case, the activities, milestones, and results to be achieved for the ISE.

The Program Manager has taken steps to address our recommendations by instituting a “maturity model” to monitor and track progress. For example, the maturity model tracks each of the 14 initiatives in the ISE framework from their early stages of development until they are considered to be institutionalized into agency operations. The model contains four levels:  Ad-hoc: Information sharing occurs among functions or groups with few repeatable processes.  Defined: Information sharing sources and products are identified and processes are followed.  Managed: Information sharing is well characterized and consistently performed across organizational boundaries. Institutionalized: Information sharing is quantitatively managed and business processes are aligned, seeking continuous improvement.

In the July 2010 annual report to Congress, the Program Manager noted that 9 of the 14 initiatives were at the second level and had been “defined,” and the remaining 5 were at level three and being “managed.” The maturity model and related reporting provide useful information on the status of ISE initiatives and provide a general indicator of the overall progress of the ISE. Nevertheless, these actions do not fully address our recommendations because the annual reports do not specifically address what work remains in completing the 14 initiatives or related milestones for completion, which are important elements in determining overall progress in implementing the ISE and establishing accountability for future efforts. The Program Manager’s ongoing efforts to define the ISE end state vision and implementing road map—to the extent that they include associated time frames and milestones for achieving both individual projects or activities as we recommended in June 2008 as well as the capabilities of a fully implemented ISE as envisioned—would help to provide a baseline for decision makers and investors to measure ISE progress. This baseline could be used to determine what work has been achieved and remains and whether additional efforts to accelerate progress are needed, among other things.

While the framework did not establish time frames or milestones, the Office of the Program Manager uses an annual performance questionnaire to collect information on the agencies’ progress in implementing 10 of the 14 initiatives to inform the maturity model. According to officials from the Office of the Program Manager, the survey does not include data on the other 4 initiatives—the Nationwide Suspicious Activity Reporting Initiative, fusion centers, efforts to standardize controlled unclassified information, and the Interagency Threat Assessment and Coordination Group. Instead, the officials said that each of the agencies with responsibility for leading these efforts monitors its own performance to ensure progress and provides a summary of progress highlights to the Office of the Program Manager, which is incorporated into the annual report. For example, the 2010 annual report highlighted the successful integration of a Federal Bureau of Investigation system into the Nationwide Suspicious Activity Reporting Initiative. These summaries provide information that shows what agencies are doing and demonstrate recent accomplishments, but they do not provide a gauge to measure progress achieved versus what work remains or milestones for completing remaining work regarding fully developing and implementing the ISE.

In January 2011, the ISA IPC and the Office of the Program Manager initiated an effort to make ISE priority programs and related goals more transparent and to better monitor progress. Specifically, according to the Deputy Program Manager, agencies that are responsible for implementing ISE priority programs are leading efforts to establish 3-, 6-, and 12-month goals for these programs. He noted that once the goal- setting process is established, information on progress made in reaching these goals may be included in future ISE annual reports. This process should help to provide accountability over ISE priority programs on a yearly basis.

The 2008, 2009, and 2010 annual reports to Congress include some performance measures, such as the number of departments and agencies that have conducted ISE-related awareness training or have developed and implemented ISE privacy policies. Including these measures in annual reports is an important step in providing accountability for results, but it does not fully address our recommendation because the measures generally focus on counting activities (i.e., output measures) accomplished rather than results achieved (i.e., outcome measures), such as how and to what extent sharing has been improved and ultimately, to the extent possible, what difference these improvements are making in helping to prevent terrorist attacks. The Deputy Program Manager stated that the Office of the Program Manager recognizes the need to develop performance measures that show how and to what extent sharing has been improved and that the goal-setting process should assist in transitioning from output to outcome-oriented performance measures.

We recognize and have reported that it is difficult to develop performance measures that show how certain information sharing efforts have affected homeland security. Nevertheless, we have recommended that agencies take steps toward establishing such measures to hold them accountable for the investments they make. We also recognize that agencies may need to evolve from relatively easier output measures—that for example count the number of agencies that have conducted ISE-related awareness training—to more meaningful measures that weigh agencies’ satisfaction with the timeliness, usefulness, and accuracy of information shared until the agencies can establish outcome measures that determine what difference the information made to federal, state, local, and other homeland security efforts. Thus, we continue to believe that our June 2008 recommendation to the Program Manager and key agencies to develop performance measures that show the extent to which the ISE has been implemented and sharing improved has merit and should be fully implemented.

The Administration Has Taken Steps to Strengthen the ISE Governance Structure, but It Is Too Early to Gauge the Structure’s Effectiveness

Our prior work on high-risk issues shows that a strong commitment from top leadership to addressing problems and barriers to sharing terrorism- related information is important to reducing related risks. In July 2009, the White House established the ISA IPC within the Executive Office of the President to subsume the role of its predecessor interagency body—the Information Sharing Council. The Assistant to the President for Homeland Security and Counterterrorism designated the White House Senior Director for Information Sharing Policy to chair the new committee. These changes were intended to bring high-level policy decision making and oversight to the development of the ISE.

The Intelligence Reform Act requires the Program Manager to plan for, manage, and oversee implementation of the ISE, including assisting in the development of policies to guide implementation and ensure progress. In a July 2009 testimony, the Program Manager at that time cited concerns about the Program Manager’s authority and provided recommendations intended to help strengthen the ISE effort. For example, among other things, he recommended having a presidential appointee serve as Program Manager and having the Program Manager co-chair the ISA IPC. Following this Program Manager’s resignation, an acting Program Manager assumed responsibility for implementing the ISE until June 2010, at which time the President appointed the current Program Manager. Also, in June 2010, the Assistant to the President for Homeland Security and Counterterrorism designated the Program Manager as a co-chair of the ISA IPC—along with the White House Senior Director for Information Sharing Policy—which was consistent with the prior Program Manager’s recommendations. According to the Office of the Program Manager, having the Program Manager for the ISE also co-chair the ISA IPC was intended to acknowledge that policies, business practices, architectures, standards, and systems developed for the ISE can be applicable to other types of national security information beyond terrorism and vice versa. In this role, the Program Manager is to ensure the close alignment of the ISE and broader national security information sharing activities.

The new Program Manager stated that he would have one of four levels of involvement in implementing the specific activities listed in the 2010 annual progress report to Congress:  Monitoring: For certain information sharing activities that agencies are generally implementing on their own initiative, the Office of the Program Manager is to stay informed of ongoing developments to determine whether the activity might be a potential best practice that is applicable to other ISE mission partners. The Program Manager also monitors activities to stay abreast of issues that might eventually surface through the ISE process. For example, the Program Manager said he monitors the intelligence community’s efforts to better share classified information among intelligence agencies.  Advising: For some agency initiatives, the Program Manager said that the Office of the Program Manager may be called on to provide specialized information sharing expertise, even though the office is not responsible for actual implementation. For example, the Program Manager said his office has an advisory role in supporting the Nationwide Suspicious Activity Reporting Initiative.  Supporting: For selected activities with significant implications for the ISE, the Program Manager said that the Office of the Program Manager is to play a more active support role, that this support could take many forms, and that it may include co-investment of seed capital in the early stages of specific high-priority efforts. For example, the Program Manager said the office supports agencies’ efforts to designate and share controlled unclassified information.  Leading: The Program Manager also said there are several activities for the ISE as a whole where the Office of the Program Manager is to take the lead role, providing the financial and personnel resources necessary to carry them out. For example, the Program Manager said the office has the lead role in providing communications and outreach related to the ISE.

The Program Manager also noted that his role could evolve as activities mature, as it did for the Nationwide Suspicious Activity Reporting Initiative.

The administration’s steps to strengthen the ISE governance structure address concerns the prior Program Manager identified and our criteria for committed leadership. However, it is too early to tell how the new structure will affect the continued development and implementation of the ISE and if the Program Manager’s new role will provide him sufficient leverage and authority to ensure that agencies consistently implement information sharing improvements governmentwide.

The Enterprise Architecture Management Foundation for Supporting ISE Implementation Could Be Improved

The Program Manager’s 2010 annual report to Congress states that the office’s architecture program for the ISE describes the rules and practices needed for planning and operating ISE systems consistent with EA best practices. According to relevant guidance, an EA, or modernization blueprint, should include descriptions (i.e., “architecture views”) of an enterprise’s current and future environment for business processes, data and information, applications and services, technology, and security in meaningful models, diagrams, and narrative. In addition, our Enterprise Architecture Management Maturity Framework (EAMMF) recognizes that various approaches for structuring an EA exist and can be applied to the extent that they are relevant and appropriate for a given enterprise. These approaches generally provide for breaking down an enterprise into its logical parts and allowing various components of an enterprise (e.g., ISE mission partners) to develop their respective parts of the EA in relation to enterprisewide needs and the inherent relationships and dependencies that exist among the parts. Accordingly, our EAMMF provides flexibility for how such an EA should be developed and does not prescribe a specific approach by which organizations should develop EA content. In addition to providing descriptions of an enterprise’s current and future environment, relevant guidance states that an EA should include an enterprise sequencing plan for transitioning from the current environment to the future environment. Specifically, the enterprise sequencing plan should describe an incremental strategy that includes scheduling multiple, concurrent, interdependent activities and incremental implementation to evolve the enterprise.

We have previously reported that successfully managing the development and implementation of an EA depends in large part on the extent to which effective management controls (e.g., policies, structures, processes, and practices) are employed. Our EAMMF provides a benchmark against which to measure the extent to which a given enterprise is effectively managing its architecture program. It defines various stages of maturity for an EA and the management controls expected to be in place for each stage. Stages 1 and 2 of this framework can be viewed as providing for the institutional leadership and foundational management capabilities for the later stages to build upon and thereby achieve program success. For example, in stage 1 an enterprise commits to developing an EA and defines the purpose of its EA, and in stage 2 it defines the methodology and plans by which EA products are to be developed and maintained. An EA program that has not satisfied key stage 1 and 2 core elements can be considered ad hoc, unstructured, and unlikely to succeed. It is important to note that the EAMMF should not be viewed as either a rigidly applied checklist or as the only relevant benchmark for managing and assessing an EA program. Instead, it is intended to be applied flexibly with discretion in light of each enterprise’s unique facts and circumstances.

The Program Manager has developed architecture guidance to assist in the implementation of the ISE. For example, in August 2007, Version 1.0 of the ISE EAF was released and in September 2008 it was revised. The framework is to provide strategic guidance to enable long-term business and technology standardization and information systems planning, investing, and integration in the ISE by documenting and organizing the ISE mission business goals and processes, services, data, and technologies and other operational capabilities necessary to facilitate information sharing. In addition, in May 2008 the Office of the Program Manager issued its Profile and Architecture Implementation Strategy (PAIS) to augment its ISE EAF and in June 2009 it was revised. Among other things, the PAIS describes a series of steps that the ISE agencies are to follow when developing their information sharing segment architectures to support the implementation of ISE capability. These steps are generally consistent with federal guidance, such as the federal Chief Information Officers Council’s Federal Segment Architecture Methodology.

The Program Manager and ISE agencies have also begun to develop products that describe several components of an ISE EA. For example, the Program Manager has worked with ISE agencies to establish cross- agency ISE segment architectures, such as the ISE Suspicious Activity Reporting evaluation environment segment architecture, which is intended to assess selected architectural concepts supporting the business processes, procedures, and policies associated with a nationwide Suspicious Activity Reporting capability, among other things. In addition, as described subsequently in this report, three ISE agencies have developed information sharing segment architectures, which are intended to identify common ISE services, standards, and other ISE tools to allow for opportunities to reuse and leverage services among ISE departments and agencies.

Although the ISE architectural guidance and products provide some information to guide information sharing activities at the five key ISE implementing agencies, they do not fully describe the ISE’s current and future environment for business processes, data and information, applications and services, technology, and security consistent with relevant guidance. For example, the EAF identifies 24 current ISE business processes and describes activities and information flows for 3 current business processes. However, it does not describe business activities and information flows for the remaining 21 current business processes, such as the business process that supports responding to a terrorism-related threat. These information flows are important for identifying specific terrorism data needed to be shared among the ISE business processes and establishing mutually understood data definitions and structures to facilitate data integration across the ISE. Without such common definitions and structures, ISE agencies risk needing to invest significant time and resources to interpret and restructure data received from multiple systems supporting different ISE business processes.

Moreover, the ISE EAF describes some aspects of the future technology environment, such as a set of technical standards that has been identified for use in planning, implementing, and deploying ISE information technology infrastructure, but it does not describe the ISE’s current technology environment (e.g., the existing databases and communications networks that support the Alerts, Warnings, and Notifications business process). In addition, an ISE enterprise sequencing plan that describes the interdependent activities to be undertaken by the Program Manager and ISE agencies to incrementally achieve the target ISE does not exist. As a result, ISE agencies and the Program Manager risk not synchronizing or integrating their interdependent ISE activities to inform timely initiation of ISE projects or development of ISE policies and procedures. Appendix III provides a detailed analysis and descriptions of the ISE architectural content reflected in the EAF and associated architectural documents.

If managed properly, an EA program can help simplify, streamline, and clarify the interdependencies and relationships among an enterprise’s diverse mission and mission-support operations and information needs, including its associated information technology environment. However, the Office of the Program Manager’s approach to managing ISE architecture-related activities does not fully satisfy the core elements described in our EAMMF for establishing institutional commitment and creating the EA management foundation. Of the 13 core elements spanning these two stages that we reviewed, 1 was fully satisfied, 9 were partially satisfied, and 3 were not satisfied. (See app. IV for a detailed description of each core element and our analysis of the extent to which each has been satisfied.) For example, in consultation with the ISA IPC, proactive steps have been taken to address EA-related cultural barriers, such as parochialism and cultural resistance among ISE agencies. However, an EA program management plan that, among other things, reflects ISE EA program work activities, events, and time frames and defines accountability mechanisms does not exist. As a result, ISE agencies risk not budgeting and allocating adequate resources for ISE work activities, and risk delaying the start or completion of their ISE work activities because of a lack of information about the activities and events associated with the ISE EA program. Regardless of the architectural approach used for the ISE, establishing the EA management foundation is important for guiding the development of ISE architecture products to effectively support ISE implementation efforts.

Finally, agency-specific information sharing segment architectures, which according to ISE guidance are to be developed to identify common ISE services, standards, and other ISE tools to allow for opportunities to reuse and leverage services among ISE departments and agencies, have not been fully defined. According to the Program Manager’s July 2010 annual report to Congress, ODNI and State have not developed such segment architectures. In its technical comments on a draft of this report, ODNI acknowledged that it does not have an information sharing segment architecture, and is working to make data sharable through Intelligence Community policies. For example, Intelligence Community Directive 501 states that all information collected and analysis produced by a member of the intelligence community shall be made available for automated discovery by authorized Intelligence Community personnel, consistent with applicable law and in a manner that protects fully the privacy rights and civil liberties of all U.S. persons. Also according to the Program Manager’s July 2010 annual report to Congress, DOJ, DHS, and DOD have taken steps to develop their respective segment architectures. However, the DOJ, DHS, and DOD information sharing segment architectures are all missing important content. For example, none of these three departments has fully defined the needed business and information requirements. (The extent to which these three departments have developed their information sharing segment architectures is described in app. V.) As a result, there may be an insufficient basis for identifying opportunities to avoid duplication of effort and launch initiatives to establish and implement common, reusable, and interoperable solutions and services across the ISE to achieve cost savings.

The ISE EAF is intended to establish a strategic road map that enables ISE departments and agencies to further develop their respective EAs in order to implement information sharing capabilities. However, as we have previously reported, high-level EA frameworks and guidance, such as OMB’s federal EA, do not necessarily provide sufficient content for guiding the implementation of systems. The ISE EAF and associated architectural documentation also do not (1) provide sufficient architectural content (e.g., descriptions of ISE business processes and interagency information exchange requirements) necessary for ISE agencies to develop their information sharing architectures or (2) include an ISE enterprise sequencing plan that would serve as an effective road map for ISE departments and agencies. In addition, officials from the key ISE implementing agencies indicated that the lack of detailed and implementable ISE guidance was one limiting factor in developing agency information sharing segment architectures. Improved ISE architecture content and an ISE enterprise sequencing plan could enable better planning for the distributed ISE and allow for implementation of ISE capabilities in manageable pieces.

The Program Manager stated that his office and OMB are using a standardized EA framework and method for the ISE to identify critical business processes and interfaces, establish standards for data formats, identity management and credentialing, and exchange protocols for information sharing between enterprises in a manner that permits each department and agency to satisfy ISE requirements while also optimizing its own EAs for its specific missions. The Program Manager added that this approach is based on (1) OMB decisions to establish a standardized EA framework that departments and agencies that own their respective information systems and architectures could use to develop, modify, and integrate those systems into the ISE; (2) the Office of the Program Manager’s interpretation of the Intelligence Reform Act; and (3) the Office of the Program Manager’s understanding that a full EA must be organization based and tied to budget authority.

Nevertheless, the Intelligence Reform Act calls for the Program Manager to plan for and oversee the implementation of the ISE and to assist in the development of policies, as appropriate, to foster the development and proper operation of the ISE. It further calls for the Program Manager to issue governmentwide procedures, guidelines, instructions, and functional standards, as appropriate, for the management, development, and operation of the ISE, consistent with the direction and policies issued by the President, the Director of National Intelligence, and the Director of OMB. In addition, the Chief Information Officers Council has previously reported that a well-defined EA can promote better planning and facilitate management of an extensive, complex environment. Moreover, as described previously in this report, our EAMMF recognizes that EAs can be developed in a distributed manner and accordingly does not prescribe a specific approach by which organizations should develop needed EA content. By not ensuring that an improved EA management foundation for the ISE exists, the federal government, as a whole, is not well positioned to realize the significant benefits that well-defined ISE EA guidance and products can provide. Such benefits include better planning for ISE implementation; improved decision making regarding capability enhancement and resource allocation across the ISE enterprise; increased collaboration on interdependent ISE work activities; and effective sharing of critical terrorism information among appropriate ISE agencies and state, local, and tribal governments and private sector entities.

Conclusions

The ISE is to fulfill a critical purpose in a time when acts of terrorism on U.S. soil have recently been attempted or planned. The Program Manager and key agencies have taken actions to define and implement the ISE, such as developing a framework to advance an initial set of goals, activities, and metrics. However, they also recognize that these actions do not yet go far enough to define and implement a fully functioning ISE and that there is more work to do. In addition, our work has identified actions that are needed after the end state vision for the ISE is defined, such as ensuring that all relevant information sharing initiatives across the five communities are fully leveraged by the ISE, consistent with the Intelligence Reform Act. This could help to ensure that all critical information with a possible nexus to terrorism is being shared as needed, and that relevant agency initiatives are considered to determine how they could be leveraged by the ISE for the benefit of all stakeholders, thereby helping to improve information sharing governmentwide. Also, to the extent possible, defining incremental costs necessary to implement the ISE, consistent with the Intelligence Reform Act, could help decision makers plan for and prioritize future investments. Further, while the Program Manager has taken steps to measure and demonstrate results of ISE efforts, additional actions are needed to address our prior recommendations to ensure that the ISE is on a measurable track to success and to show the extent to which the ISE has been implemented, what work remains, and milestones for completing remaining work.

The Program Manager and ISE agencies have developed architecture guidance and products—such as the EAF—to assist in implementing the ISE, but crucial work remains. The guidance and products provide some foundational information about the ISE, but they do not fully define the suite of ISE architecture products that describe the ISE current and future operational and technical environment to support ISE implementation. Further, ISE EA management practices do not fully address the core elements described in our EAMMF, such as establishing an EA program management plan that, among other things, reflects ISE EA program work activities, events, and time frames and defines accountability mechanisms. Moreover, it is unclear when, how, and by whom these core elements will be satisfied and missing architecture content—such as business activities and information flows, the ISE technology environment, and an enterprise sequencing plan—will be developed. Establishing an improved EA management foundation, including well- defined EA guidance for the ISE, would better position the government to realize significant benefits, such as better planning for implementation, improved decision making, and ultimately more effective sharing of critical terrorism-related information among all ISE agencies.

Recommendations for Executive Action

To help ensure effective implementation of the ISE, we recommend that the Program Manager, with full participation from relevant stakeholders, take the following three actions.

To support future progress in developing and implementing the ISE, we recommend that after the end state is defined, the Program Manager in consultation with the ISA IPC and key ISE agencies, determine to what extent relevant agency initiatives across all five communities could be better leveraged by the ISE so that their benefits can be realized governmentwide and in coordination with the ISA IPC and OMB, task the key ISE agencies to define, to the extent possible, the incremental costs needed to help ensure successful implementation of the ISE and prioritize investments.

To better define ISE EA guidance and effectively manage EA activities to support ISE implementation efforts, we recommend that the Program Manager, in consultation with the ISA IPC and key ISE agencies, establish an ISE EA program management plan that (1) reflects ISE EA program work activities, events, and time frames for improving ISE EA management practices and addressing missing architecture content and (2) defines accountability mechanisms to help ensure that this program management plan is implemented.

Agency Comments and Our Evaluation

We provided a draft of this report for comment to the Program Manager for the ISE, OMB, DHS, DOJ, State, DOD, and ODNI. Based on subsequent discussions with officials from the Office of the Program Manager, we revised portions of the draft that discuss the ISE EA and the related recommendation to clarify that our focus is primarily on architectural management practices and that various approaches can be used for structuring an EA. We received written responses from the Program Manager and DHS, which are summarized below and reprinted in appendix VI and appendix VII, respectively. Also, on June 17, 2011, the Federal Chief Enterprise Architect and other OMB officials provided oral comments. The Program Manager and Federal Chief Enterprise Architect generally agreed with the three recommendations in this report, while DHS did not address them. The Program Manager, DHS, DOJ, and ODNI provided technical comments, which we have incorporated in this report where appropriate. State and DOD informed us that they had no comments.

Program Manager’s Comments

The Program Manager’s written comments did not specifically mention whether he agreed with the three recommendations in this report, but the Office of the Program Manager subsequently confirmed via e-mail on July 7, 2011, that the Program Manager generally agreed with all of them, with elaboration as follows.

The Program Manager generally agreed with the first recommendation related to the need to determine to what extent relevant agency initiatives across all five communities are being leveraged by the ISE. He noted that the Program Manager and the ISA IPC have already leveraged a great number of initiatives that support the realization of the ISE and that they will continue to identify and leverage agency initiatives to improve information sharing. The Program Manager provided numerous examples of activities that he said have been leveraged by the ISE and referred us to the annual reports to Congress for more examples. We recognize that the examples provided illustrate agency initiatives to share information and several of them are discussed in this report. In general, however, the Program Manger has not demonstrated how these initiatives are being leveraged by the ISE for the benefit of all stakeholders and to help improve information sharing governmentwide. The Program Manager expects the updated National Strategy for Information Sharing— complemented by follow-on implementation policy, programmatic and budgetary guidance, and performance metrics—to address this recommendation. The updated strategy and follow-on guidance and metrics could address the intent of the recommendation if they appropriately discuss how initiatives are being leveraged by the ISE.

The Program Manager generally agreed with the second recommendation related to the need to define incremental costs for the ISE. However, he noted that OMB has the role of providing programmatic guidance and collecting budgetary requirements, and ensuring that they are integrated into the budget for each federal department and agency. The Program Manager also said that it is critical to note that federal departments and agencies own, plan for, and manage their programs, systems, and architectures, while the Office of the Program Manager provides the integrating guidance through the ISA IPC. Further, he noted that the individual departments and agencies are responsible for identifying costs over and above their program baselines to extend the benefits of information sharing throughout the ISE. We recognize that OMB and agencies play key roles in defining incremental costs for the ISE. Nevertheless, the Program Manager is responsible for leading and coordinating these efforts, as envisioned by the Intelligence Reform Act. Thus, we believe that the Program Manager is the appropriate party to task key ISE agencies to define, to the extent possible, the incremental costs needed to help ensure successful implementation of the ISE. The Program Manager expects the updated National Strategy for Information Sharing and other activities—including programmatic and budgetary guidance—to address this recommendation. The updated strategy and follow-on guidance could address the intent of the recommendation if they support defining incremental costs needed to help ensure successful implementation of the ISE.

The Program Manager generally agreed with the third recommendation related to the need to more fully define ISE EA plans. He stated that the ISE needs an integrated plan with an established vision, goals, policy framework, performance management framework, and guidelines. From a planning perspective, the Program Manager noted that the National Strategy on Information Sharing—to be updated in the near future— followed by an integrated suite of implementation guidance and practices (e.g., the ISE EAF and the PAIS) provide the tools to effectively manage the ISE. He added that through these and other documents, the Office of the Program Manager will establish the vision, a program management plan, and an executable road map for the ISE. Further, he noted that the office will work with ISE departments and agencies to identify and prioritize their projects in support of the ISE. These actions could address the intent of the recommendation if the strategy and suite of implementation guidance and practices establish an ISE EA program management plan that (1) reflects ISE EA program work activities, events, and time frames for improving ISE EA management practices and addressing missing architecture content and (2) defines accountability mechanisms to help ensure that this program management plan is implemented.

The Program Manager also provided comments indicating that much of this report treats the ISE as a centrally designed and defined information system enterprise and stated that our analysis looks for the tools and processes applicable to such an enterprise. This report and the EAMMF that comprises the basis for much of our analysis recognize that various approaches for structuring an EA exist and can be applied to the extent that they are relevant and appropriate for a given enterprise. As stated in this report and our EAMMF, these approaches generally provide for breaking down an enterprise into its logical parts and allowing various components of an enterprise (e.g., ISE mission partners) to develop their respective parts of the EA in relation to enterprisewide needs and the inherent relationships and dependencies that exist among the parts. For example, this report acknowledges agency-developed information sharing segment architectures—which can represent a portion of an ISE EA—and states that improved ISE architecture content and an ISE enterprise sequencing plan could enable better planning for the distributed ISE.

In addition, the Program Manager stated that he consulted with the key ISE agencies and they agreed that they do not need or want the Program Manager to establish additional ISE EA guidance or an ISE EA. As we previously noted, various approaches can be used for structuring an EA. However, our work showed that agency information sharing architectures were either not developed or incomplete, and that pertinent officials from ISE agencies cited the lack of detailed and implementable ISE guidance as one factor limiting their efforts to develop agency information sharing architectures. Thus, we believe that an ISE EA program management plan is needed that (1) reflects ISE EA program work activities, events, and time frames for improving ISE EA management practices and addressing missing architecture content and (2) defines accountability mechanisms to help ensure that this program management plan is implemented.

In addition to providing comments on each of the three recommendations, the Program Manager noted that the draft report did not fully address the roles and responsibilities of OMB and the departments and agencies that support the ISE, and that recognizing the key roles played by these entities is pivotal to assessing progress in the ISE. He explained that OMB plays a key role in the planning, budgeting, and oversight of the federal agencies and their contributions to the ISE. He also noted that it is primarily through the partnership between OMB and the Office of the Program Manger that program direction, funding, and performance measurement can be effectively achieved. He added that departments and agencies (1) are responsible for developing, deploying, modifying, and maintaining their respective information system investments and associated EAs and (2) play an active role in determining the policies, priorities, and direction of the ISE—originally through the Information Sharing Council—and are now an integral part of the ISA IPC. Further, the Program Manager noted that the information they share and the tools used to share it are by their nature a part of the ISE, regardless of whether the process is identified by the Program Manager. We recognize that OMB and agencies play important roles in defining and building the ISE. Nevertheless, the Program Manager is responsible for leading and coordinating these efforts, in accordance with the Intelligence Reform Act. Thus, we directed the recommendations to him, in consultation with the ISA IPC, key ISE agencies, and OMB as appropriate.

Other Agencies’ Comments

In oral comments provided on June 17, 2011, the Federal Chief Enterprise Architect and other OMB officials generally agreed with all three recommendations in this report. Regarding the first recommendation to ensure that agency initiatives are leveraged, the Federal Chief Enterprise Architect noted that all five ISE primary areas of focus (homeland security, law enforcement, foreign affairs, defense, and intelligence) are important and that the Program Manager should continue to ensure effective coordination of these communities. He added that such coordination should occur in consultation with OMB and appropriate agencies at the federal, state, local, and tribal levels. Regarding the second recommendation to identify incremental costs, the Federal Chief Enterprise Architect noted that the Program Manager should work in collaboration with OMB and federal agencies to identify investments that are related to the ISE, and ensure that waste and duplication are not occurring and that the execution of the program is consistent with legal mandates and administration policies and priorities. Regarding the third recommendation to more fully define ISE EA plans, the Federal Chief Enterprise Architect agreed that our EAMMF was appropriate for evaluating the ISE EA and that the Office of the Program Manager should issue an EA program management plan that contains milestones, time frames, and accountability mechanisms. He noted that the Program Manager and ISE agencies each have a role in developing ISE architecture products.

In its written comments, DHS noted that the department remains committed to continuing its work with the Program Manager and relevant stakeholders to further define and implement a fully functioning ISE. DHS added that the department is engaged with the Program Manager on a number of key initiatives at the ISA IPC to ensure the realization of information sharing benefits governmentwide.

We are sending copies of this report to the Program Manager for the Information Sharing Environment; the Director of National Intelligence; the Director of the Office of Management and Budget; the Secretaries of the Departments of Defense, Homeland Security, Justice, and State; and appropriate congressional committees. This report also is available at no charge on the GAO Web site at http://www.gao.gov.

Should you or your staff have any questions about this report, please contact Eileen R. Larence at (202) 512-6510 or larencee@gao.gov or David A. Powner at (202) 512-9286 or pownerd@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are acknowledged in appendix VIII.

Appendix I: Objectives, Scope, and Methodology

Our reporting objectives were to review to what extent the Program Manager for the Information Sharing Environment (ISE) and key stakeholder agencies have (1) made progress in developing and implementing the ISE, and what work remains, and (2) defined an enterprise architecture (EA) to support ISE implementation efforts. The stakeholder agencies we reviewed are the five agencies that the Program Manager identified as critical to developing and implementing the ISE— the Departments of Homeland Security (DHS), Justice (DOJ), State (State), and Defense (DOD) as well as the Office of the Director of National Intelligence (ODNI). These agencies represent five information sharing communities identified that collect the homeland security, law enforcement, foreign affairs, defense, and intelligence information deemed critical for sharing in order to provide for homeland security.

To determine the extent to which the Program Manager and stakeholder agencies have made progress in developing and implementing the ISE, we reviewed key statutes and policies, including the Intelligence Reform and Terrorism Prevention Act of 2004 (Intelligence Reform Act) and the Implementing Recommendations of the 9/11 Commission Act of 2007. We also reviewed our prior reports and best practices identifying effective program management, federal coordination, and cost estimation.

Through our review of these laws, guidance, and reports, we identified standards and best practices for program and project management and used them to inform our assessment of efforts to develop and implement the ISE and related efforts. We used semistructured interviews to gather information from the key agencies and facilitate analysis of their perspectives on the development of and remaining challenges impeding implementation of the ISE. We also used interviews to obtain information from these agencies on the status of key activities the Program Manager identified as accomplishments in the 2009 and 2010 ISE annual reports to Congress, among other things. In addition, we reviewed and analyzed agency documentation on guidance and plans and conducted interviews with agency officials to assess actions taken by the Program Manager to address recommendations in our 2008 report related to defining the purpose and scope of the ISE and the results to be achieved.

To determine to what extent the Program Manager for the ISE and key stakeholder agencies have defined an EA to support ISE implementation efforts, we examined the extent to which (1) key current, or “as-is,” and future, or “to-be,” EA content and a plan for transitioning from the current to the future environment have been established; (2) the Office of the Program Manager has established a structure for effectively managing ISE architecture development and implementation; and (3) key federal agencies have defined their information sharing segment architectures (ISSA) to support ISE implementation.

To determine the extent to which key current and future EA content, and a plan for transitioning from the current to the future environment has been established, we compared ISE architecture guidance, such as the ISE Enterprise Architecture Framework (EAF) and associated documents, to relevant EA content guidance. We also interviewed officials from the Office of the Program Manager, including the Program Manager and the Executive for Programs and Technology, as well as officials from the key federal agencies, to determine, among other things, their perspectives on ISE architecture content. In addition, we met with Office of the Program Manager officials to discuss variances between ISE EA content reflected in the ISE EAF and associated documents and EA content expectations established in relevant federal guidance.

To determine the extent to which the Office of the Program Manager has established a structure for effectively managing ISE architecture development and implementation, we used our Enterprise Architecture Management Maturity Framework (EAMMF), and determined the extent to which the Office of the Program Manager has satisfied key elements associated with providing institutional leadership and foundational management capabilities. To make this determination, we reviewed relevant ISE documentation, including Executive Order 13,388 (October 25, 2005); the December 16, 2005, presidential memorandum regarding Guidelines and Requirements in Support of the Information Sharing Environment; the Intelligence Reform Act; Program Manager guidance; and Chief Architects Roundtable and Common Information Sharing Standards working groups’ meeting minutes. We also interviewed officials from the Office of the Program Manager and compared documentation collected and information provided during interviews to determine the extent to which the office and the Information Sharing and Access Interagency Policy Committee addressed EAMMF elements associated with establishing institutional commitment and direction and creating the management foundation for EA development and use. We did not evaluate the extent to which the ISE architecture program had adequate staff and budget resources because of the lack of a stand-alone budget for the ISE program and the classified nature of the ODNI budget.

To determine the extent to which key federal agencies have defined their ISSAs to support ISE implementation, we determined the extent to which agency-developed ISSAs have addressed ISE architecture guidance established by the Office of the Program Manager. Specifically, we determined key ISSA development steps defined in the Program Manager’s Profile and Architecture Implementation Strategy that are consistent with best practices documented in the Federal Segment Architecture Methodology. We then reviewed the agency-developed ISSAs and relevant supporting documentation, such as information sharing strategies and information sharing implementation plans, against these key ISSA development steps. We also interviewed officials from DOD (the Office of the Assistant Secretary for Defense, Networks and Information Integration/DOD Chief Information Officer (CIO)), DHS (Office of the CIO), DOJ (Justice Management Division/Office of the CIO), and State (Office of Management Policy, Rightsizing, and Innovation) to understand the reasons why the agency-developed ISSAs have yet to fully address the key ISSA development steps.

We conducted this performance audit from October 2009 through July 2011 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: ISE Framework Goals and Subgoal Activities

To better define and manage ISE implementation, the Program Manager adopted the ISE framework to guide development of the ISE going forward. Specifically, the framework identified four goals and 14 specific subgoals or activities agencies were to pursue. The goals and subgoals follow.

Subgoal 1.1: Information sharing is exhibited across departments and agencies as a routine part of doing business and recognized as an imperative to success.

Subgoal 1.2: All personnel charged with sharing terrorism-related information are trained to carry out information sharing responsibilities.

Subgoal 1.3: Employees are routinely recognized and rewarded for effective information sharing, as well as expertise and competency development.

Subgoal 2.1: Federal departments and agencies practice security reciprocity among federal, state, local, and private sector entities, including people, facilities, and systems.

Subgoal 2.2: Consistent marking and handling of controlled unclassified information is practiced across the U.S. government; practices are also adopted by state, local, tribal, and private sector entities.

Subgoal 2.3: ISE participants build trusted distributed infrastructure for sharing information with all other participants, and are able to leverage repeatable processes from each others’ architecture programs to maximize availability of common ISE shared services.

Subgoal 2.4: ISE departments and agencies; state, local, and tribal governments; and the private sector protect privacy in a consistent manner.

Subgoal 3.1: All federal, state, local, tribal, and law enforcement entities operating domestically participate in a standardized, integrated approach to gathering, documenting, processing, analyzing, and sharing terrorism- related suspicious activity information.

Subgoal 3.2: A national, integrated network of state and major urban area fusion centers that enables federal, state, local, tribal, and private sector organizations to gather, document, process, analyze, and share relevant information in order to protect our communities.

Subgoal 3.3: Federal agencies produce, share, and disseminate both time-sensitive and strategic information and intelligence products that meet state, local, tribal, and private sector needs.

Subgoal 3.4: Federal departments and agencies have implemented appropriate policies and processes to coordinate and facilitate the sharing of information with foreign governments and allies.

Subgoal 4.1: Integrated performance and investment processes monitor progress toward performance goals and successfully use investments to support activities that maintain or enhance information sharing.

Subgoal 4.2: ISE participants sustain their investments in information systems that support a trusted, distributed infrastructure for sharing information.

Subgoal 4.3: ISE participants use common practices and policies for producing, handling, and using information.

Appendix III: Analysis of ISE Architecture Content

According to relevant guidance, an enterprise architecture (EA) should describe architectural views of the business processes, data, applications and services, technology, and security for the enterprise’s current and future environments. An EA should also include a sequencing plan for transitioning from the current environment to the future environment. Table 1 describes the extent to which the Information Sharing Environment (ISE) architecture documents address such relevant EA guidance.

Appendix IV: ISE’s Satisfaction of Selected EA Institutional Leadership and Management Controls

Table 2 describes the Information Sharing Environment’s (ISE) satisfaction of selected core elements in stages 1 and 2 of our Enterprise Architecture Management Maturity Framework (EAMMF).

Appendix V: Analysis of Information Sharing Segment Architectures

Tables 3, 4, and 5 provide a summary of Department of Defense (DOD), Department of Homeland Security (DHS), and Department of Justice (DOJ) efforts to address the key segment architecture development steps.

Appendix VI: Comments from the Program Manager for the Information Sharing Environment

Appendix VII: Comments from the Department of Homeland Security

Appendix VIII: GAO Contacts and Staff Acknowledgments

GAO Contacts

Staff Acknowledgments

In addition to the contacts named above, Eric Erdman, Assistant Director; Anh Le, Assistant Director; David Alexander; Justin Booth; R.E. Canjar; Katherine Davis; R. Denton Herring; Michael Holland; Ashfaq Huda; Thomas Lombardi; Linda Miller; Victoria Miller; Krzysztof Pasternak; Karl Seifert; Adam Vodraska; and Michelle Woods made key contributions to this report.