The new "need to know".

[ILLUSTRATION OMITTED]

PRESENTING THE 9/11 COMMISSION REPORT to the American people just over three years ago, Chairman Thomas Kean summarized its finding with now-historic poignancy. The attacks, he said, resulted from "above all, a failure of imagination." Following Kean, however, fellow Commissioner Bob Kerrey noted that while domestic law enforcement failed to see the looming threat, U.S. intelligence agencies had shared with them little of their knowledge about al Qaeda, or its leader, Osama bin Laden. "How, in God's name, are you supposed to imagine a threat if the facts are being withheld from you?" Kerrey asked.

Since then, officials have thwarted several alleged terrorist plots using good old-fashioned police work--specifically, confidential informants. Most recently there was New Jersey's so-called "Fort Dix Six," and a group authorities say planned to attack New York City's John F. Kennedy International Airport. But neither of these groups is alleged to have had ties to al Qaeda. They were homegrown, local efforts, making it more likely that local police could detect them, perhaps. Plots orchestrated by foreign actors, such as al Qaeda operatives, are of a different nature. Clues may exist in multiple jurisdictions, as was the case with 9-11. When the next such threat to the United States presents itself, it is information sharing that will stop it, according to William F. Flynn, who heads the U.S. Department of Homeland Security (DHS) public-private effort to protect critical infrastructure.

"I can't emphasize enough--information sharing will prevent the next attack," Flynn said at this year's ASIS International Annual Conference on Global Terrorism.

Since the 2001 attacks--and in earnest since enactment of the 2004 intelligence reform law that stemmed from the 9/11 Commission report--officials have worked to smash the cultural stovepipes that keep information within isolated government agencies and sectors. These efforts appear to be yielding results. Despite early pessimism, both the agents of change and observers say that all levels of government and the private sector are moving, albeit slowly, toward a new culture of information sharing.

The Framework

A central mandate of the Intelligence Reform and Terrorism Prevention Act of 2004 was the establishment of a national Information Sharing Environment, or ISE, that transcends barriers between federal agencies, all levels of government, the public and private sectors, and foreign allies. The office of the Director of National Intelligence (DNI), established by the law, is charged with its creation.

While the goal of an ISE is an intangible one, the DNI's six year, two phase implementation plan issued last November offers some measurable goals. First phase goals included identification of best practices and technologies, continued development of a national network of state intelligence fusion centers, and open-ended work to set performance metrics for the ISE itself.

[ILLUSTRATIONS OMITTED]

The deadline for completion of the plan's first phase was this June, and sources interviewed for this article say they see some indications that the goals are being met.

Classification conundrum. A critical Phase 1 goal is establishment of uniform standards for handling of information labeled "sensitive but unclassified" or SBU. The intent is to foster sharing.

The problem arises because while "secret" and "top secret" classifications are based in federal law and carry the same restrictions across agencies or jurisdictions, that is not the case for the SBU classification--which is defined differently depending on the authority making the designation.

Among federal agencies, the U.S. Government Accountability Office has found that there are 56 different SBU designations, with some agencies having multiple definitions. The Department of Energy, for example, uses at least 16 SBU designations like "Sensitive Nuclear Technology," while the EPA has "Sensitive Drinking Water Related Technology."

[ILLUSTRATION OMITTED]

Further, the designations are accompanied by 107 different document markings and 131 different handling guidelines, according to ISE Program Manager Thomas McNamara.

The designations generally set guidelines for handling of documents within agencies--such as requiring access control when not in use--and limit public release under Freedom of Information Act requests.

Vague designations and a lack of clear policies prevent dissemination of information among federal agencies and between the federal government and state and local law enforcement agencies, whose members could benefit from it.

Testifying recently before the House Homeland Security Committee, which has held a series of hearings on the issue, Acting Chief Cathy L. Lanier of the Washington, D.C., Metropolitan Police Department offered one example of the intelligence sharing potential. If a federal agency suspects individuals are selling black market cigarettes to raise money for terrorism, Lanier said, her officers need to know "so that trends can be identified early and mitigated quickly."

While Lanier and her peers have urged broader use of an existing designation--law enforcement sensitive--McNamara told lawmakers that his office has proposed an entirely new designation to eliminate confusion: Controlled Unclassified Information (CUI).

But that route won't yield quick results. Even though ISE Senior Advisor John Cohen told Security Management that the CUI plan was under review by the White House, McNamara told Congress that even after a plan is approved, implementation may take a long time. That's be cause it requires considerable policy development among federal agencies and their state, local, and tribal counterparts.

A related sticking point yet to be fully resolved is that intelligence agencies have not always recognized as valid the high level clearances held by personnel in sister agencies; such clearances are supposed to give those personnel the right to view information classified as secret or top-secret. For example, some officials holding DHS-issued clearances soon after the agency's establishment in 2002 found that their FBI counterparts would not honor those clearances--and would not share highly classified information with those DHS officials.

A directive from President Bush has ad dressed the conflict, but Cohen says full procedures have still not been finalized.

Privacy officers. Another Phase 1 goal was the appointment of an ISE privacy officer in each of the included 17 federal agencies to ensure compliance with privacy laws and standards, Cohen says. That goal, far easier than the reworking of classification protocols, was met by the June 1 deadline.

Metrics. McNamara's office, together with the White House's Office of Manage merit and Budget, is tackling the question of how to measure the success of a largely intangible initiative.

While White House officials will not speculate on possible performance metrics, a 2006 congressional staff report prepared for Rep. Bennie Thompson (D MS), now chairman of the House Homeland Security Committee, recommended measurement of information sharing through bench mark surveys of stakeholders.

Lawmakers like Thompson are closely scrutinizing the ISE's development, and are somewhat satisfied, so they have no immediate plans to draft legislation that would amend the current approach, aides say.

Analysis and Dissemination

A key element in the effort to smash the silos separating federal agencies is the National Counterterrorism Center (NCTC), formerly the Terrorist Threat Integration Center (TTIC). The center serves as a real-time clearinghouse for the receipt, analysis, and dissemination--as appropriate--of intelligence gathered by all of the agencies in the intelligence community.

In addition to bringing together analysts from the various intelligence community agencies, including the CIA, the FBI, and the Department of Defense, to work side by side, the office also operates NCTC Online, a single portal through which more than 7,500 cleared federal analysts can access up to eight million pieces of terrorism-related data, says Russ Travers, NCTC's director for information sharing and knowledge development. One shortcoming: State and local law enforcement have not so far had direct access to NCTC or its online information.

States and localities. The NCTC's primary intelligence offering for states and localities has come in updates to the Department of Justice's (DOJ) Terrorist Screening Center (TSC), which maintains the federal government's consolidated national terrorist watch list, but the information passed on through this medium is fairly limited.

NCTC analysts maintain a "nonexclusive" database of all individuals suspected of terrorist activity. From that database, NCTC updates names and related personal data daily for inclusion in the TSC. The TSC watch list is, in turn, accessible to nearly every cop on the beat who can, when conducting a routine database search during a traffic stop, check it along with the FBI's National Criminal Information Center (NCIC) database.

State and local officials want more actionable intelligence and have urged federal agencies to adopt an information sharing approach they call a "tear-line" methodology, which simply means that the sources and methods of collection are figuratively "torn off" and only the action able intelligence is sent on to state and local partners, according to congressional testimony from Col. Bart Johnson of the New York State Police.

As Johnson explained, state and local law enforcement personnel understand the federal intelligence agencies' need to protect sources and their methods of gathering intelligence, and they aren't interested in that information. In addition to names already provided by NCTC, they simply want "be on the lookout" advisories describing, say, vehicles types or suspicious activity.

Seat at the table. Soon, state and local law enforcement community leaders will be able to voice their needs firsthand at the NCTC through the Interagency Threat and Coordination Group (I TAG), Cohen says.

The I-TAG model mirrors Great Britain's approach to integrating local law enforcement into national counterterrorism efforts, according to a 2006 House Homeland Security Committee report. Immediately after 9/11, Britain's Association of Chief Police Officers established the Police International Counter Terrorism Unit (PICTU) as a direct liaison to MI5, the country's domestic intelligence service.

Two years later, MI5 and the British Government established its Joint Terrorism Analysis Centre (JTAC), which, like NCTC, is a clearinghouse for domestic and international terrorism intelligence. Britain's JTAC works with PICTU to provide actionable information to local police in a way that fits their needs.

The DNI, along with state and local leaders, hopes to duplicate the success of this model. That office has agreed on an operational framework for I-TAG; nominations of state and local representatives are being solicited; and a limited staff is already on hand at the NCTC, Cohen says.

Fusion Centers

One approach that offers hope for demolishing institutional barriers is the state intelligence fusion center, where state, local, and federal intelligence and law enforcement officials work together to coordinate intelligence analysis. Though they have not always lived up to expectations, they still offer a reasonable approach to the problem.

As of mid-year, multiagency, multijurisdictional fusion centers have opened in at least 42 states--more than 30 of them over the past two years--while four more states have plans to open centers. In addition, some major metropolitan areas, including New York and Los Angeles, have centers that function like their state counterparts.

While the centers are commonly viewed in the context of homeland security, the ones that are considered models take an "all crimes" approach, helping states and municipalities "connect the dots" between both traditional crimes and activities that might be related to terrorism. They also help states spot public-safety trends, and they assist in law enforcement efforts to locate missing or abducted children.

Testifying at a congressional hearing on fusion centers, Chief R. Gil Kerlikowske of the Seattle Police Department offered both caution and high praise.

On the cautionary side, Kerlikowske warned against having fusion centers adopt a law enforcement emphasis. In many states that have fusion centers, information handling is still guided by the finite, prosecution-driven approach used by regional Joint Terrorism Task Forces, he says. But Kerlikowske praised select state fusion centers that were not making that mistake, namely those in Arizona and Massachusetts, and Los Angeles-Los Angeles County.

Similarly, Illinois' Statewide Terrorism Intelligence Center (STIC) has been cited as a national model by the National Governors Association (NGA). It is co-located with the state's Emergency Management Agency and incorporates both counter terrorism and emergency management officials and law enforcement officials specializing in narcotics, violent crime, sex offenses, and motor vehicle theft.

STIC's analytical staff, called its Threat Integration Group, meets daily to distill information collected over the prior 24 hours. The distilled data is then distributed to law enforcement officers in the field and to statewide officials. STIC is intended to serve as a single point of contact for public safety agencies throughout the state that need information about crimes or emergencies.

STIC seats on-duty analysts at workstations arranged in a circular pattern, surrounded with additional workstations housing state law enforcement specialists, and representatives from other state agencies. Video screens offer live data from open sources, from virtual links to other data portals, or from operations centers; federal, state, and local.

While some states have mastered this model, others struggle with implementation. Perhaps the biggest problem is getting the right personnel. Many states and regions trying to apply the fusion center concept properly have difficulty finding, hiring, and retaining skilled intelligence analysts to synthesize incoming data, says Chris Logan of the National Governor's Association's (NGA) Center for Best Practices.

"This is certainly a challenge. There are not a lot of people who can do this sort of thing, and those who can are expensive," Logan says.

DHS allows state and local jurisdictions to use Urban Area Security Initiative (UASI) and Law Enforcement Terrorism Prevention Program (LETPP) grant money to hire and train fusion center analysts for their first two years. After that, however, it falls to states or cities to fund the positions.

That prohibition on operational funding creates a problem. Kerlikowske also chided DHS's prohibition on hiring sworn law enforcement personnel with UASI funding should states or cities want to use the money to staff fusion centers.

For its part, DHS has staffed 11 fusion centers with trained intelligence analysts that it employs, with plans to send analysts to 24 more by 2008, says agency spokesman Kirk Whitworth.

The Private Sector

As many Security Management readers know firsthand, efforts by the business community to maintain situational awareness of threats by sector--and share information between them--began long before the 9-11 attacks and the push to establish an ISE.

After the breakup of the Bell System, or "Ma Bell" in 1984, industry established the National Coordinating Center for Telecommunications. The systemwide entity was tasked with monitoring the functionality of the nation's networks, first and foremost to ensure continuity in the interest of national security.

Then in 1998, President Bill Clinton issued a directive for government plans to protect traditional critical infrastructure and emerging technology and provide resilience in the event of an attack. Engagement with the private sector, which owns or operates at least 85 percent of the country's critical infrastructure, resulted in the establishment of sector based information sharing and analysis centers, or ISACs.

Other industries joined the traditional telecommunications industry to form ISACs, representing the financial services, information technology, public utility, transportation, and emergency management sectors. (@ See online links to past Security Management pieces on how some of these have been working.)

More recently, the Food Marketing Institute established the Food ISAC, while last year the four major shipping sectors--air, sea, trucking, and rail--formed the Supply Chain ISAC.

Industries enjoy leeway in how they model their 13 different ISACs. While most maintain a physical 24/7 operations center, the Electricity Sector ISAC, for example, is entirely virtual, accessible to cleared members via a secure portal, says Stan Johnson, head of situational awareness and infrastructure security for the North American Electric Reliability Corp., which runs the ISAC.

The Electricity ISAC brings together power providers and the independent system operators (ISOs) that run and monitor regional grids, serving as a conduit among them and DHS, the Department of Energy, and the Federal Energy Regulatory Commission.

The electric sector ISAC provides its industry and the government with real-time situational awareness in major crises, such as during the August 14, 2003, Northeast blackout, as well as during smaller incidents, such as in April, when an intruder entered the California ISO's control room.

The Supply Chain ISAC, while still young, already has 260 member companies, which range from manufacturers to retailers. In addition, about 100 members of the law enforcement community participate in the group, says Jack Smith, CPP, executive director of the Supply Chain ISAC.

ISACs offer participants more than updates in an emergency. The Supply Chain ISAC, for example, follows weather events that affect transportation, and in the criminal sphere, it closely monitors cargo thefts and trends, offering members general bulletins twice a week and immediate alerts as needed, Smith says.

Their ultimate value, however, is in the extent to which they can enhance information sharing across companies and among businesses and government. DHS's National Infrastructure Protection Plan (NIPP), issued last year and amended in May with detailed plans for each of the country's 17 critical infrastructures, incorporated ISACs as "an effective information and analysis mechanism," alongside critical infrastructure sector coordinating councils (SCCs). The NIPP, however, notes that sectors without ISACs can use existing "operationally oriented" groups for information sharing purposes.

The ISAC Council has issued a draft framework of common terms and role definitions for ISACs, based on NIPP guidelines, says chairman John Sabo, director of global government relations for IT firm CA, Inc.

States, Localities, and Industry

Addressing this year's terrorism conference, ASIS International 2007 President Steve D. Chupa, CPP, director of worldwide security for Johnson & Johnson, said state and local public safety officials could be "even better" partners than their federal counterparts, given their proximity, availability, and familiarity with a company's environs.

But Seattle Chief Kerlikowske told lawmakers that public-private collaborations in information sharing have not yet been institutionalized at the state and local level, and are, therefore, limited in many cases to existing personal relationships.

Here as well, Illinois has led the way, establishing the state's Infrastructure Security Awareness (ISA) program three years ago. Larry Trent, Director of the Illinois State Police, helped conceive it in 2003.

"I knew we were missing an important component. In the law enforcement community, we certainly share information, but there's information the private sector can use, and conversely, I knew there was a wealth of information they could pro vide," Trent says.

Now, ISA participants are cleared and can access information made available by STIC through a secure Web-based portal. More than 100 private sector officials have joined, says ISA Program Manager Edie Casella.

Michael A. Crane, CPP, executive vice president and general counsel with Illinois-based mall management firm IPC International and co-chairman of the Illinois Terrorism Task Force's private sector committee, said his connection to the state's fusion center via ISA has made it possible for him to have access to important information that he might otherwise not have received, such as intelligence that DHS gives states--and that is now forwarded on to Crane and other ISA members.

Similarly, Crane recalled that when traveling on business he received a general alert from the state fusion center alerting him to a phony bomb threat that had been called in against an entire national restaurant chain--one that operated locations in Illinois malls managed by IPC. Crane was immediately able to alert IPC staff and, in turn, security personnel at their malls.

"Here's a program Illinois has put together that has given me real time information about things happening worldwide," Crane says.

Building the Network

One of DHS's successes in broad-based information sharing is its Web portal for sharing best practices and lessons learned, which was launched in 2004. ([] Link to it online via www.securitymanagement. com). As of this year, the Web site, open to cleared professionals in the public, private, and academic sectors, boasts 9,000 documents accessible to 34,000 registered users, says Deputy Program Manager William Moore.

The online library includes 400 after-action reports and 1,200 emergency plans from offices and agencies in all areas of government. The site's 600 original documents, written in-house, include "best practices," which summarize national topic-specific surveys conducted by staff; "lessons learned," which consist of shorter documents highlighting explicit positive or negative experiences that companies reported; "good stories," which highlight exemplary, but not universally applied, programs; and "practice notes," which briefly summarize minor, "on-the-fly" innovations.

The federal government's effort to establish a national operational Web-based data sharing portal, however, has been less successful, due in part to duplicate efforts that pulled members of the public safety and homeland security communities in different directions, according to the GAO.

Prior to 9-11, federal, state, and local law enforcement personnel shared information using one of six Regional Information Sharing Systems (RISS), all based on federal guidelines but independently administered.

Following DHS's establishment in 2002, the agency worked with the private sector to develop the pilot program Homeland Security Information Network-Critical Infrastructure (HSIN-CI). Then the DOJ launched the short lived Joint Regional Information Exchange System (JRIES) in 2003.

Simultaneously, law enforcement in Washington State, working with the Navy, developed the Law Enforcement Information Exchange (LInX) network, which expanded to other states with heavy Navy presence, including Georgia, Texas, Hawaii, and Virginia.

JRIES gave way in 2004 to HSIN's cur rent incarnation as DHS's official, secure, Web-based national information-sharing portal, targeting state and local users. HSIN includes the Common Operating Picture (COP) database, a real-time Web-accessible situational awareness tool created following the Hurricane Katrina response debacle. (@ See "Putting Two Million First Responders on One Page," April 2007.)

HSIN has weathered criticism from congressional overseers and DHS's own inspector general for low rates of use up until this year. Of roughly two million first responders nationwide, HSIN claims 16,000 registered users, Whitworth says.

While DHS has successfully implemented HSIN as the primary data portal for successful state fusion centers in Florida, Illinois, Tennessee, and other states, there are states that remain committed to older, more familiar RISS systems.

Captain William Harris of the Delaware State Police, commander of the state's intelligence fusion center, told the House Homeland Security Committee that his agency has evaluated the different portals, and RISS is "by far" the best. He said RISS is "robust, user friendly, and contains more relevant, reliable, and timely law enforcement and homeland security information."

Harris explains to Security Management that RISS, developed and refined over three decades, is tailor made to the all crimes approach to intelligence fusion and to information sharing as sought by local authorities. RISS's secure section features "RISS leads," which contains actionable data made available to all regional jurisdictions.

A separate section of RISS, the Auto mated Trusted Information Exchange (ATIX), provides SBU information to private-sector stakeholders.

Harris further points out that vetting and registration for HSIN currently takes as long as four weeks, while sworn law enforcement personnel and private sector leaders already use RISS on a large scale.

Delaware's fusion center uses both RISS and HSIN, Harris says.

Wayne Parent, DHS's top official in charge of HSIN, speaking at the same hearing, stated the agency's commitment to the program. But DHS acknowledges that there may be value in other systems. The agency plans to fully inventory existing federal, state, and municipal information-sharing systems, and integrate as many as possible, while eliminating redundancy, according to the GAO.

Meanwhile, this year the U.S. Public Private Partnership (USP3), an industry-funded nonprofit organization, plans to launch its own situational awareness Web- and message system based on HSIN CI and the FBI's Emergency Response Network (FBI ERN).

USP3 already claims roughly 30,000 members in both the public and private sectors, who receive daily DHS open-source bulletins via e mail. The group's planned system would be administered by Abraxas Corp. of Reston, Virginia, and operated in conjunction with private sector leaders and the FBI.

The USP3 system, developed with guidance from ASIS International, would distribute messages to members via several methods including voice, text, or e-mail. Anticipating network and bandwidth demands during a major incident or disaster, the system would offer capacity for 5,000 simultaneous outgoing e-mails and text messages, and 10,000 voice messages, according USP3 spokesman Joe Munoz.

USP3 plans to offer tiered subscriptions based on region, sector or jurisdiction, and seniority. Member-level USP3 subscribers, for example, would receive only alert messages, Munoz says. Program, division, and national members would also be able to distribute messages to predetermined segments of USP3 membership.

Changing Culture

Experts gave varied assessments of progress when asked to evaluate the rate of shift to a culture of information sharing in the federal government.

David Cid, a former member of the FBI's intelligence division, a terrorism consultant to the Army, and State Department, and now a deputy director of the Memorial Institute for the Prevention of Terrorism, says that those left holding the ball after 911--specifically members of the FBI and CIA--feel its lessons "acutely" every day.

"They want to make absolutely sure they don't do something or make a mistake that leaves us vulnerable," Cid says. Attitudes toward information sharing, he says, have shifted from "is this something we need to give them" to "is this something they can use."

Cultural changes have also been fostered through administrative and personnel policy changes at the various federal intelligence and law enforcement agencies, facilitated in part by the USA Patriot Act, which allowed--for the first time--substantive collaboration between the FBI and CIA.

Now some FBI agents are posted to CIA headquarters and some CIA agents work in FBI headquarters. Similarly, FBI agents who once worked almost exclusively in the U.S. are deployed to foreign countries including Iraq, Afghanistan, and the Philippines as legal attaches, forging ties with foreign counterparts in order to share experiences and intelligence, which the U.S. agents forward on to the NCTC, Cid says.

J. Michael Harris, CPP, director of security, for government contractor RDR Inc., and member of the ASIS International Council on Defense and Intelligence, sees less progress, especially among the agencies brought together in DHS, and at the Department of Defense (DoD).

"My observation is that post-9-11 there was a lot of talk, a lot of excitement about change and improvement in information sharing. But I think some of the information sharing hasn't gone as quickly as I would like to have seen," Harris says.

Harris says creating a culture of information sharing may take the longest at the Pentagon, because of a desire within branches and offices to protect both their own information and their respective missions.

"In the long run, it's better that it takes a long time, because everyone's interests are being considered," Harris said of the Pentagon.

Council Vice Chair Richard Williams, CPP, a retired DoD security executive and president of the consulting firm Three Worlds, agreed that information sharing runs contrary to the historical "need to know" culture of the Pentagon.

And those who genuinely want to share information must then consider the security of the systems they use to do so, Williams says, pointing to the June breach of the Office of the Secretary of Defense's unclassified e-mail system, which forced a shut-down of 1,500 users.

Williams expresses guarded optimism about a long-term shift to information sharing, arguing that decision makers must weigh the risks of sharing information against the risks of not doing so. Confidence, both in professional peers and in information systems, can only come with time, he says.

James Jay Carafano, a defense and homeland security expert with the Heritage Foundation sees measured progress overall.

"I do think agencies take a different attitude towards information sharing than they did before 911, and while things are far from perfect, they are light years better," says Carafano. "The real issue now is follow through and while it's too soon to tell, I think we are moving in the right direction," he adds.

"The next step, I think, is fully funding and following through on the DNI plan and for the long term, focusing more on the software inside people's brains than the hardware," explains Carafano. "We need to start educating leaders about how to work together to understand each other's capabilities, work together, and share information with trust and confidence.... That's a generational challenge."

SYNOPSIS

The lack of information sharing among intelligence collection agencies was a major shortcoming identified by the 9/11 Commission. In its sweeping 2004 intelligence reform law, Congress tried to address the problem by mandating what it called an Information Sharing Environment (ISE) across different agencies and levels of government. Three years later, experts see modest, yet encouraging progress toward that goal.

Most dramatic is the proliferation of state and regional intelligence fusion centers, where officials from all corners of government apply an all-hazards and all-crimes approach to real time situational awareness. In the private sector, more industries are establishing information sharing and analysis centers (ISACs), essentially their own fusion centers for coordination both within industry and with public counterparts.

Two major goals of the ISE remain works in progress: establishment of performance metrics to gauge success and creation of a uniform policy governing sensitive but unclassified (SBU) information. Scores of designations and policies across federal agencies stifle sharing.

Another result of the 2004 legislation was the establishment of the National Counter Terrorism Center (NCTC). A newer iteration within NCTC is the Interagency Threat and Coordination Group (I-TAG), which will allow state and local representatives to participate in the NCTC and help their federal counterparts craft actionable bulletins.

Critics say that the U.S. Department of Homeland Security (DHS), meanwhile, has wasted critical time in developing a Web-based situational awareness portal by failing to incorporate existing assets, like law enforcement's popular Regional Information Sharing System (RISS).

Overall, experts see increased information sharing among the law enforcement and intelligence sectors, but lingering cultural barriers in other bureaucracies, especially the military.

Joseph Straw is an assistant editor at Security Management.