Establishing Effective Mechanisms for Sharing and Managing Terrorism-Related Information to Protect the Homeland

The federal government has made significant progress in promoting the sharing of information on terrorist threats, and has met all of our criteria for removal from the High-Risk List. The Program Manager and key departments and agencies met the leadership commitment and capacity criteria in 2015, and have subsequently sustained efforts in both these areas. For example, the Program Manager clearly articulated a vision for the ISE that reflects the government’s terrorism-related information sharing priorities. Key departments and agencies also continued to allocate resources to operations that improve information sharing, including developing better technical capabilities.

The Program Manager and key departments and agencies also developed, generally agreed upon, and executed the 2013 Strategic Implementation Plan (Implementation Plan), which includes the overall strategy and more specific planning steps to achieve the ISE.^[1] Further, they have demonstrated that various information sharing initiatives are being used across multiple agencies as well as state, local, and private sector stakeholders. For example, the Project Manager has developed a comprehensive framework for managing enterprise architecture to help share and integrate terrorism-related information among multiple stakeholders in the ISE.^[2] Specifically, the Project Interoperability initiative includes technical resources and other guidance that promote greater information system compatibility and performance.^[3] Furthermore, the key departments and agencies have applied the concepts of the Project Interoperability initiative to improve mission operations by better linking different law enforcement databases, and facilitating better geospatial analysis, among other things.

In addition, the Program Manager and key departments and agencies have continued to devise and implement ways to measure the effect of the ISE on information sharing to address terrorist and other threats to the homeland. They developed performance metrics for specific information-sharing initiatives (e.g., fusion centers) used by various stakeholders to receive and share information. The Program Manager and key departments and agencies have also documented mission-specific accomplishments (e.g., related to maritime domain awareness) where the Program Manager helped connect previously incompatible information systems. The Program Manager has also partnered with DHS to create an Information Sharing Measure Development Pilot that intends to better measure the effectiveness of information sharing across all levels of the ISE.

Further, the Program Manager and key departments and agencies have used the Implementation Plan to track progress, address challenges, and substantially achieve the objectives in the National Strategy for Information Sharing and Safeguarding. The Implementation Plan contains 16 priority objectives, and by the end of fiscal year 2016, 13 of the 16 priority objectives were completed. The Program Manager transferred the remaining 3 objectives, which were all underway, to other entities with the appropriate technical expertise to continue implementation through fiscal year 2019.

In our 2013 high-risk update, we listed nine action items that were critical for moving the ISE forward. In that report, we determined that two of those action items—demonstrating that the leadership structure has the needed authority to leverage participating departments, and updating the vision for the ISE—had been completed. In our 2015 update, we determined that the Program Manager and key departments had achieved four of the seven remaining action items—demonstrating that departments are defining incremental costs and funding; continuing to identify technological capabilities and services that can be shared collaboratively; demonstrating that initiatives within individual departments are, or will be, leveraged to benefit all stakeholders; and demonstrating that stakeholders generally agree with the strategy, plans, time frames, responsibilities, and activities for substantially achieving the ISE.

For the 2017 update, we determined that the remaining three action items have been completed: establishing an enterprise architecture management capability; demonstrating that the federal government can show, or is more fully developing a set of metrics to measure, the extent to which sharing has improved under the ISE; and demonstrating that established milestones and time frames are being used as baselines to track and monitor progress. Achieving all nine action items has, in effect, addressed our high-risk criteria.

While this demonstrates significant and important progress, sharing terrorism-related information remains a constantly evolving work in progress that requires continued effort and attention from the Program Manager, departments, and agencies. Although no longer a high-risk issue, sharing terrorism-related information remains an area with some risk and continues to be vitally important to homeland security, requiring ongoing oversight as well as continuous improvement to identify and respond to changing threats and technology. Table 11 summarizes the Program Manager’s and key departments’ and agencies’ progress in achieving the action items.

Table 11: Status of Action Items Required to Remove Terrorism-Related Information Sharing from GAO’s High-Risk List

Source: GAO analysis of Office of the Program Manager for the Information Sharing Environment and key department documents, interviews, and prior GAO reports. | GAO-17-317.

^aWe determined that these action items were complete in our 2013 high-risk update.
^bWe determined that these action items were complete in our 2015 high-risk update.

[1] Office of the Program Manager for the Information Sharing Environment, Strategic Implementation Plan for the National Strategy for Information Sharing and Safeguarding (Washington, D.C.: December 2013). In December 2012, the President signed the National Strategy for Information Sharing and Safeguarding, which provides guidance on implementing policies, standards, and technologies that promote secure and responsible national security information sharing. This document builds on the 2010 National Security Strategy and the 2007 National Strategy for Information Sharing. The December 2012 national strategy identifies priority objectives, which have been incorporated into the Implementation Plan.

[2] An enterprise architecture, or modernization blueprint, is intended to provide a clear and comprehensive picture of an entity, whether it is an organization (e.g., federal department or agency) or a functional or mission area that cuts across more than one organization (e.g., financial management). This picture consists of snapshots of the enterprise’s current and target operational and technological environments, and contains a road map for transitioning from the current to the target environment.

[3] Project Interoperability refers to a collection of policies and guidance related to information interoperability. Information interoperability is the ability to share and use information in a consistent, efficient way across multiple organizations and information technology (IT) systems to accomplish operational missions. From a technical perspective, interoperability refers to the capability of systems to communicate with one another and to exchange and use information and is achieved developed in part by using common technical standards and definitions to manage information.

Additional Details on What GAO Found are in the full report.