The FBI is the primary investigative agency within the Department of Justice. Its missions include investigating serious federal crimes, protecting the nation from foreign intelligence and terrorist threats, and assisting other law enforcement agencies. Approximately 12,000 special agents and 16,000 mission support personnel are located in the bureau’s Washington, D.C., headquarters and in more than 450 offices in the United States and 45 offices in foreign countries. Mission responsibilities at the bureau are divided among the following five major organizational components. Criminal Investigations: investigates serious federal crimes and probes federal statutory violations involving exploitation of the Internet and computer systems. Law Enforcement Services: provides law enforcement information and forensic services to federal, state, local, and international agencies. Counterterrorism and Counterintelligence: identifies, assesses, investigates, and responds to national security threats. Intelligence: collects, analyzes, and disseminates information on evolving threats to the United States. Administration: manages the bureau’s personnel programs, budgetary and financial services, records, information resources, and information security. Each component is headed by an executive assistant director who reports to the Deputy Director, who, in turn, reports to the Director. The components are further organized into subcomponents, such as divisions, offices, and other groups (hereafter referred to as “divisions”). Table 1 lists the components and briefly describes their respective divisions. Supporting the divisions are various staff offices, including the Office of the CIO. The CIO’s responsibilities include, for example, development of the bureau’s IT strategic plan and operating budget; development of IT investment management policies, processes, and procedures; and development and maintenance of the bureau’s enterprise architecture. The CIO reports directly to the Director. Figure 1 shows a simplified organizational chart of the components, divisions, Office of the CIO, and respective reporting relationships. To execute its mission responsibilities, the FBI relies extensively on IT. For example, the Criminal Justice Information Services (CJIS) division uses the National Crime Information Center 2000 to process approximately 4 million criminal identification inquiries and other related transactions for civilian, homeland security, and law enforcement agencies each day. Similarly, the Laboratory division stores records of known criminals on the Combined DNA Index System to compare with DNA evidence submitted by federal, state, and local law enforcement agencies. The FBI reports that it collectively manages hundreds of systems, networks, databases, applications, and associated IT tools at an average annual cost of about $800 million. As we have previously reported, the FBI’s IT environment is composed of outdated, nonintegrated systems that do not optimally support mission operations. To address its strategic IT needs, the bureau began modernizing its systems environment in the mid-1990s. Currently, the FBI reports that eight divisions will spend approximately $1 billion on 18 major IT modernization initiatives between fiscal years 2003 and 2005. These initiatives, such as Trilogy and the Investigative Data Warehouse, are to introduce new systems infrastructure and applications. For example, Trilogy is to establish an enterprise network to enable communications among hundreds of domestic and foreign FBI locations. According to the FBI, the first two segments of the project—the Transportation Network Component and the Information Presentation Component—were implemented as of April 2004. The third segment—the User Applications Component, commonly called the Virtual Case File—has been delayed and a new schedule is being determined. In addition, the Investigative Data Warehouse initiative is to provide the capability to search and share counterterrorism and criminal investigative information across the bureau; the FBI reports it is in the process of acquiring the warehouse and has plans for full deployment by the end of fiscal year 2004. Some divisions—such as CJIS, Cyber, and Investigative Technology—plan to spend over $70 million each on IT modernization in fiscal year 2005 alone. For instance, the Investigative Technology Division plans to spend approximately $83 million in fiscal year 2005 on three major IT initiatives: Digital Collection, Electronic Surveillance Data Management System, and the Computer Analysis Response Team. Table 2 shows, by FBI division, the major initiatives and their anticipated modernization spending. A description of each initiative is provided in appendix II. Integrated planning across related IT projects and effective policies and procedures for managing IT human capital, systems acquisitions, and investment activities are recognized hallmarks of successful public and private organizations, and they are essential ingredients for effectively managing large modernization efforts. Our research and experience with federal agencies has shown that executing modernization projects without these and other IT management controls increases the chances of implementing systems that are not well integrated and do not provide promised capabilities on time and within budget. The Congress and the Office of Management and Budget (OMB) have recognized the importance of these and other IT management controls. The Clinger-Cohen Act, for example, provides a framework for effective IT management that includes systems integration planning, human capital management, acquisition management, and investment selection and control. In addition, OMB has issued guidance on integrated IT modernization planning and effective IT human capital, acquisition, and investment management. Further, organizations such as Carnegie Mellon University’s Software Engineering Institute have also issued guidance on effective acquisition management practices for areas such as configuration management, project management, quality assurance, requirements development and management, and risk management. Over the past several years, reviews of the FBI’s efforts to leverage IT to support transformation efforts have identified management weaknesses. In particular, a December 2001 report initiated by the Department of Justice identified weaknesses with, for example, the bureau’s systems acquisition and human capital management processes. The weaknesses included not having (1) a policy that ensures consistent implementation of configuration management activities, (2) processes to ensure adequate definition of system requirements, and (3) an agencywide systems life cycle methodology. The report also noted that the FBI had not assessed the current skills of its employees on an ongoing basis, and it did not have a systematic approach for identifying the skills and abilities needed for the future. In December 2002, Justice’s Office of the Inspector General reported that the FBI was not effectively managing its IT investments. Specifically, the Inspector General reported that the bureau did not have a complete process for selecting new IT investments and was not following a disciplined process for controlling ongoing projects. To address this, the Inspector General made a series of recommendations aimed at implementing the processes and practices defined in our IT investment management framework. In a January 2004 follow-on report, the Inspector General stated that, while the bureau had developed plans to address these recommendations, full development and implementation of the plans—and thus the establishment of effective investment management processes—remained to be completed. More recently, between September 2003 and March 2004, we reported on the challenges the FBI faced in establishing effective IT modernization management. For example, we reported in September 2003 (and again in November) that the bureau had not yet developed a modernization blueprint—commonly referred to as an enterprise architecture—to guide and constrain modernization efforts. Accordingly, we made recommendations to help the bureau establish the architecture management capabilities needed to develop, implement, and maintain an enterprise architecture. The FBI agreed with our recommendations and is in the process of implementing them. In addition, in March 2004, we reported that the FBI has not benefited from having sustained IT management leadership with bureauwide authority. Specifically, the bureau’s key leadership and management positions, including the position of the CIO, had experienced frequent turnover, and the position of the CIO lacked bureauwide authority over IT. We found that historically much of the responsibility and authority for managing IT—including modernization planning, human capital management, systems acquisition management, and investment selection and control—was dispersed among the bureau’s divisions. We did not make recommendations in these areas at that time because our work to fully evaluate these areas had not yet been completed. Reviews of the bureau’s centerpiece systems modernization project, Trilogy, have identified management weaknesses as the cause for cost, schedule, and performance shortfalls that have been experienced by the project. For example, over the past several years, the Justice Inspector General issued several reports on the FBI’s management of Trilogy. According to the Inspector General’s September 2003 report, Trilogy funding grew from an original estimate of $379.8 million to $596 million, due in part to the lack of integration planning for one of the three components of Trilogy. In addition, the Inspector General reported that the original delivery date for Trilogy’s first two components (Transportation Network Component and Information Presentation Component) slipped 8 months, in part due to inadequately defined requirements. In March 2004, the Inspector General testified that the continued series of missed completion estimates and associated cost growth were due to, among other things, poorly defined requirements, project management deficiencies, frequent turnover of FBI IT managers, and the FBI’s focus on its other important law enforcement challenges. In addition, in September 2003, we reported that the bureau lacked an enterprise architecture—a key component in developing and modernizing systems. We found that the absence of the architecture contributed to unnecessary rework to integrate several modernization initiatives, including Trilogy. In March 2004, we testified that the bureau’s weaknesses in IT management controls, such as investment management and enterprise architecture, contributed to Trilogy schedule delays of at least 21 months and cost increases of about $120 million. Moreover, the National Research Council reported in May 2004 that the bureau was experiencing significant challenges in developing and implementing Trilogy. For example, the council found that the bureau did not have a permanent CIO with the technical knowledge to provide the strong direction needed for the Trilogy program. In addition, it found that modernization initiatives, such as Trilogy, were not closely linked to a coherent view of the bureau’s mission and operational needs. Based on its findings, the council concluded that the bureau was not on the path to success in its IT modernization program. In a follow-on letter, the council cited substantial progress on these fronts.