The National Strategy for Information Sharing

Recently the White House released the new National Strategy for Information Sharing, which tries to bring together many existing government efforts (e.g., the Information Sharing Environment, state and urban area fusion centers, etc.) under a strategic umbrella. I've had a chance to review the document in some detail and can provide some thoughts on it.

Much of the language in the strategy is relatively bland. You can't take issue with it, but neither do you get a strong sense of direction from it. For example, regarding information sharing at the federal level, the strategy says:

Today’s ISE consists of multiple sharing environments designed to serve five communities: intelligence, law enforcement, defense, homeland security, and foreign affairs.

Our objective is to establish a framework for Federal agencies in the fulfillment of their individual roles and responsibilities and forge a coordinated and trusted interagency partnership and process across all five communities. This collaborative approach at the Federal level will in turn drive the manner in which terrorism-related information is shared with non-Federal partners.

Well...yes. This is the sort of thing that everybody has been saying all along. It's a nice vision - and the correct one - but the test of this strategy will be in how well it achieves the vision, not whether it can correctly articulate the vision.

It's perhaps not too surprising, but a little disappointing, that the strategy so strongly emphasizes continuance of the status quo. The strategy introduces little that's new, but instead attempts to coalesce existing programs and projects into a coherent whole, as explained in the section titled "The Need for a National Strategy":

Memorializing the Strategy in a single document not only provides information to others about the Administration’s plans and outlook, but also guides our efforts as we continue to implement many programs and initiatives designed to advance and facilitate the sharing of terrorism-related information.

[W]hile this Strategy describes the vision that has guided the Administration for the past six years, it also sets forth our plan to build upon progress and establish a more integrated information sharing capability ...

The only section of the strategy that does bring some new ideas is the annex on fusion centers, which I'll give extended treatment in a future post.

In short, the creation of the new strategy has not involved asking, "Where are we?" and "Where do we need to go from here?" but has instead involved asking, "How can we strategically explain everything that's been done so far and extend it into the future?"

The underlying message is that we're confident that we're on the right track.

And I would agree that, at least on the big, sweeping ideas, we are on the right track. Everyone has the right intentions. We are very good at saying the right things. For instance, here are the core principles and understandings as enumerated by the new strategy:

Effective information sharing comes through strong partnerships among Federal, State local, and tribal authorities, private sector organizations, and our foreign partners and allies;

Information acquired for one purpose, or under one set of authorities, might provide unique insights when combined, in accordance with applicable law, with seemingly unrelated information from other sources, and therefore we must foster a culture of awareness in which people at all levels of government remain cognizant of the functions and needs of others and use knowledge and information from all sources to support counterterrorism efforts;

Information sharing must be woven into all aspects of counterterrorism activity, including preventive and protective actions, actionable responses, criminal and counterterrorism investigative activities, event preparedness, and response to and recovery from catastrophic events;

The procedures, processes, and systems that support information sharing must draw upon and integrate existing technical capabilities and must respect established authorities and responsibilities; and

State and major urban area fusion centers represent a valuable information sharing resource and should be incorporated into the national information sharing framework, which will require that fusion centers achieve a baseline level of capability to gather, process, share, and utilize information and operate in a manner that respects individuals’ privacy rights and other legal rights protected by U.S. laws.

Anybody want to take issue with that?

Importantly, the strategy acknowledges the importance of state, local, and tribal governments as parterns for sharing information:

[T]he nature of the global threat, as well as the emergence of homegrown extremists, require that State, local, and tribal governments incorporate counterterrorism activities as part of their daily efforts to provide emergency and non-emergency services to the public.

These partners are now a critical component of our Nation’s security capability as both “first preventers” and “first responders,” and their efforts have achieved concrete results within their communities, as the following examples illustrate:

• A narcotics investigation – conducted by Federal, State, and local law enforcement officials and resulting in multiple arrests – revealed that a Canadian-based organization supplying precursor chemicals to Mexican methamphetamine producers was in fact a Hezbollah support cell.
• A local police detective investigating a gas station robbery uncovered a homegrown jihadist cell planning a series of attacks.
• An investigation into cigarette smuggling initiated by a county sheriff’s department uncovered a Hezbollah support cell operating in several States.

One thing about the strategy that worries me a bit is its unstated assumption that the Information Sharing Environment - which is really just getting off the ground - is going to be a success.

The ISE Implementation Plan, among other things, delineates how the President’s guidelines and requirements will be implemented by drawing upon recommendations developed pursuant to those guidelines. It also incorporates the perspectives of representatives from State, local, and tribal governments who reviewed the ISE Implementation Plan Report during its development.

Since the Plan’s submission to the Congress, many of its action items have been implemented.

True enough, as we learned in this status report from the ISE Program Manager in September (also see my post). But at this point the development of the ISE is far too preliminary to assume that it will be a rousing success. My eyebrows always wrinkle whenever I hear language that implies, "If we say it, it must be so."

Now a few notes on the four major sections of the strategy, dealing with information-sharing with federal, state-local-tribal, private-sector, and international partners.

Federal Information Sharing

The section on Federal information sharing is remarkably brief. Its basic message is, "Stay the course, implement the ISE, go through the National Counterterrorism Center (NCTC)." The focus on NCTC is almost single-minded:

NCTC has the primary responsibility within the Federal Government for analysis of all intelligence and information pertaining to terrorism, and supports the Department of Justice (DOJ), DHS, and other appropriate agencies in the fulfillment of their responsibilities to disseminate terrorism-related information.

All Federal departments and agencies that possess or acquire terrorism-related intelligence and information provide access to such information to NCTC for analysis and integration unless prohibited by law or otherwise directed by the President. As the “Federal Fusion Center” responsible “for analyzing and integrating all intelligence pertaining to terrorism and counterterrorism,” NCTC works with appropriate Federal departments and agencies to enable the development of “federally coordinated,” terrorism-related information products tailored to the needs of Federal entities.

All this attention to the NCTC begs the question, however, of whether information-sharing is relevant to all-hazards, or only to counterterrorism. How do we share information on the risk of and/or preparedness for, say, earthquakes or pandemic flu? Surely the NCTC doesn't want this information - nor should they.

And what if a state or local government, through its all-hazards fusion center, provides such information to a federal agency or agencies? What then? It's not clear to me.

State, Local, and Tribal Information Sharing

By contrast to the concise, one-page section on federal information sharing, the state-local-tribal section is positively expansive, rolling along for 4 pages. Which is nice to see, as it reflects the idea that state, local, and tribal partners are important partners for information sharing.

The strategy accurately describes the needs at the SLT level:

The informational needs of State, local, and tribal entities continue to grow as they incorporate counterterrorism and homeland security activities into their day-to-day missions. Specifically, they require access to timely, credible, and actionable information and intelligence about individuals and groups intending to carry out attacks within the United States, their organizations and their financing, potential targets, pre-attack indicators, and major events or circumstances that might influence State, local, and tribal preventive and protective postures.

In the above quote, the words "access to" bother me a bit, as they seem to imply that the information exists somewhere outside the state, local, or tribal government - and the SLT entity needs to be able to reach it. In fact, much valuable information exists within these entities, and it needs to be pushed out.

So I'd add one more critical need: State, local and tribal agencies need reliable systems for sharing information with one another and with federal agencies. So it's good to see the strategy acknowledging this.

Authorities at all levels of our federal system must share a common understanding of the information needed to prevent, deter, and respond to terrorist attacks. The common understanding will be achieved through a framework that enables:

• Federal entities to work together to provide information in ways that better meet the needs of State, local, and tribal partners; and
• Information gathered at the State and local level to be processed, analyzed, disseminated, and integrated with information gathered at the Federal level.

We will have an integrated approach that allows Federal agencies to work together to produce and disseminate a federally-validated perspective on available threat information and relies on the efforts of consolidated fusion environments at the State and regional levels.

That last bit bothers me. Is information valid only after it has been run through the NCTC?

And again, what about all-hazards information? Many fusion centers have an all-hazards focus (a concept I support). Do they share this information? How? Surely we can understand that many potential natural disasters and accidents - especially catastrophic ones - can have regional or even national impacts.

Here are a few of the things SLT governments are supposed to do. These are good and reasonable, but again there is a terrorism-centric aspect to the plan:

To implement recommendations developed pursuant to Guideline 2 of the President’s Guidelines, and as key participants in the information sharing mission, State, local, and tribal entities are encouraged to undertake the following activities, in appropriate consultation and coordination with Federal departments and agencies:

• Foster a culture that recognizes the importance of fusing information regarding all crimes with national security implications, with other security-related information (e.g., criminal investigations, terrorism, public health and safety, and natural hazard emergency response);
• Support efforts to detect and prevent terrorist attacks by maintaining situational awareness of threats, alerts, and warnings, and develop critical infrastructure protection plans to ensure the security and resilience of infrastructure operations (e.g., electric power, transportation, telecommunications) within a region, State, or locality; and
• Develop training, awareness, and exercise programs to ensure that State, local, and tribal personnel are prepared to deal with terrorist strategies, tactics, capabilities, and intentions, and to test plans for preventing, preparing for, mitigating the effects of, and responding to events.

On the federal side, the NCTC's Interagency Threat Assessment and Coordination Group (ITACG) is critical to the information-sharing effort with SLT entities:

Specifically, the group [ITACG] will coordinate the production and timely issuance of the following interagency products intended for distribution to State, local, and tribal officials, the private sector, as well as the general public when appropriate:

• Alerts, warnings, and notifications of time-sensitive terrorism threats to locations within the United States;
• Situational awareness reporting regarding significant events or activities occurring at the international, national, State, or local levels; and
• Strategic assessments of terrorist risks and threats to the United States.

As will be discussed in more detail in a future post, fusion centers continue to be a major emphasis in information-sharing. It has become virtually impossible to find a significant government information-sharing initiative that does not involve fusion centers. Accordingly, the strategy says:

State and major urban area fusion centers are vital assets critical to sharing information related to terrorism. They will serve as the primary focal points within the State and local environment for the receipt and sharing of terrorism-related information.

As a part of this Strategy, the Federal Government is promoting that State and major urban area fusion centers achieve a baseline level of capability and become interconnected with the Federal government and each other, thereby creating a national, integrated, network of fusion centers to enable the effective sharing of terrorism-related information.

Federal departments and agencies will provide terrorism-related information to State, local, and tribal authorities primarily through these fusion centers. Unless specifically prohibited by law, or subject to security classification restrictions, these fusion centers may further customize such information for dissemination to satisfy intra- or inter-State needs.

Fusion centers will enable the effective communication of locally generated terrorism-related information to the Federal Government and other fusion centers through the ISE. Locally generated information that is not threat- or incident-related will be gathered, processed, analyzed, and interpreted by those same fusion centers—in coordination with locally based Federal officials—and disseminated to the national level via the DoD, DHS, FBI, or other appropriate Federal agency channels.

A couple of thoughts:

1. Again, the single-minded focus on terrorism.

2. It's good to see the emphasis on networking the fusion centers. Regional partnerships can really be a strength. But it's a bit concerning that the flow of information - even information that's not relevant to threats or incidents - has to flow through the federal government before it can be shared with others. Given this, it's not clear how the fusion centers will be "networked" together. Is state-to-state sharing really possible? (See the "federally-validated" comment above.)

One weakness of this approach - if it in fact is the approach - is that someone at the federal level has to recognize the information as important before it can be shared with other states. But can't we imagine a situation where state officials in a given region understand their own risks better than federal agencies and are in a better position to decide what information ought to be shared with their counterparts in other states?

I recognize the balance that must be struck here. You can't assume that all information is important, and share everything; because if everything is important, nothing is. But at the same time, you don't want to create bottlenecks where one gatekeeper gets to decide what's important and what isn't.

I hope these concerns are unfounded. It may be that interagency collaboration may be able to allay some of these concerns - that is, if many agencies have a voice in deciding what gets shared, in a truly collaborative environment, there's a better chance that important information will go through.

But on the other hand, I was surprised to find the following sentence in the strategy. It had earlier appeared in the SE Program Manager's status report in September 2007, and it bugged me then, as evidenced in my post on the status report:

Where practical, Federal organizations will assign personnel to fusion centers and, to the extent practicable, will strive to integrate and collocate resources.

If you're really intending to create a collaborative environment, you don't agree to integrate and collocate "where practical" and "to the extent practicable." You make a commitment to do it, and you do it. This is an important concern, if we remember that the CRS recently reported, "In general, fusion centers collocated with a federal agency reported favorable relationships with that agency. This was often in stark contrast to the views of other fusion centers not collocated with a federal agency(s)."

Private Sector Information Sharing

Like the "Federal" section of the Strategy, the "Private Sector" section can be roughly paraphrased as, "We'll keep doing what we're doing to try to share information with the private sector, and we'll get even better."

[A]s we improve efforts to share terrorism-related information with the private sector we must continue to:

• Build a trusted relationship between Federal, State, local, and tribal officials and private sector representatives to facilitate information sharing;
• Ensure that Federal, State, local, and tribal authorities have policies in place that ensure the protection of private sector information that is shared with government entities;

Etc. Etc. Etc.

International Information Sharing

This section is sort of out of the bounds of my interests, but on international sharing the emphasis is on laying the diplomatic groundwork to develop solid relationships with other countries, to ensure that any information that's shared is safeguarded and handled correctly.

In summary, strong partnerships and trusted collaboration with foreign governments are essential components of the war on terror. Effective and substantial cooperation with our foreign partners requires sustained liaison efforts, timeliness, flexibility, and the mutually beneficial exchange of many forms of terrorism-related information.

Protecting Privacy and Other Legal Rights

The strategy also discusses the necessity to protect privacy. I won't go into this much, except to say that respecting privacy is essential to effective information gathering and sharing. As citizens we must have confidence that our rights are respected and that any information that is gathered and shared has been done so legally and with appropriate oversight. The strategy says:

At the direction of the President, the Attorney General and the Director of National Intelligence developed a set of Privacy Guidelines to ensure the information privacy and other legal rights of Americans are protected in the development and use of the ISE. The Privacy Guidelines provide a consistent framework for identifying information that is subject to privacy protection, assessing applicable privacy rules, implementing appropriate protections, and ensuring compliance.

Looking back on this post, it's already pretty long. I'll cover the Appendix on fusion centers in another post, which it really deserves anyway.

Overall, my thoughts on the new strategy are that it's good at sounding good; but it generally just codifies the status quo. There's a lot of assumptions here: That the ISE will work, that Fusion Centers are the best means for sharing information with state and local entities, that federal, state and local agencies will trust one another to share information without getting bogged down in turf battles, etc.

Information sharing is always a delicate process, and the stakes are high. I thought one passage from the strategy eloquently - if unwittingly - expressed both the risks we face from terrorism and from trying to develop a reliable, trustworthy system of sharing information:

[T]he Untied States will continue to face ideologically committed extremists determined to attack our interests at home and abroad.

Untied States? Let's hope not.