The New Intelligence Community Information-Sharing Strategy

The spies have spoken. The Office of the Director of National Intelligence (ODNI) has published a new Intelligence Community Information Sharing Strategy.

Overall my impression is that the ideas are all in line - everyone is saying the right things - but the road map is rather nebulous. And time consuming. While the introduction sensibly argues that 9/11 imbued a sense of urgency into the effort to improve intelligence-sharing:

The need to share information became an imperative to protect our Nation in the aftermath of the 9/11 attacks on our homeland.

The implementation roadmap is described as:

...a long-term plan with a five year time horizon that will guide and synchronize implementation efforts.

So the argument is, in 2001 we received a shock that made it imperative to improve our intelligence-sharing. Six and a half years later, we are implementing a strategy to achieve this, and we will complete it in five years. That's almost 12 years after 9/11.

I recognize the complexity of the task - but it does seem that a long timeline is a primary feature of every effort to improve information-sharing. (Other examples: ITACG, ISE, HSIN). Call me impatient, I suppose.

Let's look at the strategy more closely. The introductory sections that explain the justification for the strategy are rather long on platitudes, but I thought this nugget was worth repeating:

A central principle is the recognition that information sharing is a behavior and not a technology. In the Intelligence Community, information sharing behavior is the act of exchanging intelligence information between collectors, analysts, and end users in order to improve national and homeland security. Information providers must make information accessible, available, and discoverable at the earliest point possible.

All too often we hear from officials at all levels that their information-sharing will improve because they've set up a new system. But the critical element in any system is people. People have to make it work.

Again, the intelligence community has good intentions. They're pledging to do all the right things:

Intelligence Community participants shall have access to all appropriate information that they are authorized to see—no matter where it is in the intelligence information life cycle—as well as the tools that they need to make use of the information.

Since the National Security Act was signed in 1947, the U.S. Intelligence Community has worked under a “need-to-know” mindset where protection of sources and methods was foremost. ... This new environment requires the Intelligence Community to move to a “responsibility to provide” culture to ensure all members of the Community can retrieve the information they need and effectively support intelligence customers. The “responsibility to provide” culture is predicated on managing risks associated with mission effectiveness and unauthorized disclosure of sensitive information.

None of this is new, of course. The 9/11 Commission Report argued for this change of focus in almost the same terms (see section 13.3 - "Unity of Effort in Sharing Information").

The document identifies five "strategic keystones" that are necessary to create the infrastructure for information-sharing.

Keystone #1: Intelligence Information Retrieval and Dissemination Moves Toward Maximizing Availability. Our strategy must support retrieval and dissemination from the point of initial collection through the resulting product. Maximizing access and dissemination must occur using a managed risk approach...

Keystone #2: All Intelligence is Discoverable, and All Intelligence is Accessible by Mission. The Intelligence Community collects information that is difficult to discover or access outside of collection stovepipes. Analysts “don’t know what they don’t know.” ... We need to move to a collaborative information environment, where all information is discoverable ... The key concept is that regardless of classification or compartment, intelligence analysts and collectors can be aware of the existence of all intelligence information.

Keystone #3: Sharing Requires Greater Trust and Understanding of Mission Imperatives. The key concepts are the need for consistent certification and accreditation practices, uniform information security standards, and uniformity across the Intelligence Community for accessing data to enable information sharing.

Keystone #4: Developing a Culture that Rewards Information Sharing is Central to Changing Behaviors. If Intelligence Community personnel perceive that their professional success is based in part on how well they share information, sharing will improve.

Keystone #5: Creating a Single Information Environment (SIE) Will Enable Improved
Information Sharing. The SIE will improve how the Intelligence Community manages transactions, information, and knowledge and will open the door for new collaboration opportunities and improved analytic practices.

If I were to put a gold star next to any of the above keystones, it would be #4. Participants in a system will not change their behavior unless the system rewards those who behave in the new, desired way.

The intelligence community does plan to integrate with other information-sharing efforts, but how they'll do so remains unclear - perhaps because so many of the other information-sharing plans and systems are still in the formative stage.

Through the Intelligence Community Information Sharing Steering Committee, the ODNI will integrate with these and other information sharing initiatives by leveraging the Information Sharing Environment to take into consideration efforts such as the DOJ Law Enforcement Information Sharing Program (LEISP) and the DHS Information Sharing Strategy, to ensure alignment to the overarching community-wide goals and objectives for information sharing.

They've got plans for the first 500 days, which are to:

• Update Policy Documents Clarifying and Aligning Intelligence Community Authorities
• Collaborate to Protect Privacy and Civil Liberties
• Harmonize Intelligence Community Policy on “US Person” Information
• Create a Single Information Environment
• Implement Attribute-Based Access and Discovery
• Establish a Single Community Classification Guide
• Improve the Information Technology Certification & Accreditation Process
• Create Collaborative Environment for All Analysts
• Provide Collaborative Information Technology to Federal Executive Department Agencies and Organizations

Some of those are pretty vague (e.g., "Collaborate to Protect Privacy and Civil Liberties," "Create Collaborative Environment for All Analysts"). Some of them are fraught with organizational and technological peril (e.g., "Establish a Single Community Classification Guide," "Provide Collaborative Information Technology to Federal Executive Department Agencies and Organizations")

How they'll go about accomplishing this remains unstated - probably in the absence of an implementation plan. And what happens beyond the first 500 days, the strategy doesn't specify. Maybe we'll find out as we go...