Initial Steps to Define a Structure and Approach to Implement the ISE Have Been Taken, but Work Remains to Define What the ISE Is to Include, to Design How It Will Operate, and to Outline Measurable Steps and Time Frames to Achieve Implementation and Desired Results

To guide the design and implementation of the ISE, the Program Manager  has issued an implementation plan, completed a number of tasks  contained in it, and other independent and ongoing information-sharing  initiatives have been integrated into the ISE, but the plan does not include  some important elements needed to implement the ISE. The plan provides  an initial structure and approach for ISE design and implementation, as  well as describes a two-phased approach for implementing the ISE by June  2009. Completed activities include, among other things, development of  proposed common terrorism information sharing standards (CTISS) for  sharing terrorism-related information. In addition, other federal, state, and  local initiatives to enhance information sharing across the government  have been or are being incorporated into the ISE. However, the action items do not address all the  activities that must be completed to implement the ISE, according to  officials at the Office of the Program Manager, and several activities  identified in the implementation plan will not be implemented as identified  in the plan. Although they were created primarily to improve information  sharing within the state or local area, the implementation plan identifies  the creation of an integrated national network of fusion centers to  promote two-way sharing with the federal government, as discussed  earlier. However, work  remains in, among other things, defining and communicating the scope  and desired results to be achieved by the ISE, the specific milestones to be  attained, and the individual projects—or initiatives—and execution  sequence needed to achieve these results and implement the ISE. Fundamentally, the Program Manager and stakeholders are still trying to  fully define the scope and design of the ISE, and a more complete set of  activities needed to achieve it than those that were included in the  implementation plan, including, for example    all of the terrorism-related information that should be a part of the ISE;    what types of terrorism-related information ISE participants have and  where such information resides;   how the information can be put into a “shared space” so that a cross- sector of users can easily access and study information from different  agencies;   how this access can be provided while still protecting sensitive  information and privacy interests;   what information systems and networks will be integrated as part of the  ISE and how; and   methods for motivating agencies to invest in the ISE, be held accountable  for ensuring that all relevant information is made available to ISE  stakeholders, and identifying and implementing the specific projects  needed to ensure the ISE runs effectively. Without such a road map, the Program Manager and  stakeholders risk not being able to effectively manage and implement the  ISE. The Program Manager Has Issued the First Annual Report and Is Developing Initial Performance Measures, but Neither Can Yet Be Used to Determine How Much Progress Has Been Made and What Remains

To describe progress in implementing the ISE to date, the Program  Manager issued an annual report—in response to the Intelligence Reform  Act’s requirement for a yearly performance management report—in  September 2007 that highlighted individual accomplishments and included  annual performance goals and has since developed some performance  measures, but neither effort shows how much measurable progress has  been made toward implementing the ISE and how much remains to be  done. In keeping with federal guidance, our work, and the work of others  in strategic planning, performance measurement, and program  management, the annual report contained four performance goals for  2008. While not reflected in the first annual report, the Program Manager and  agencies have begun to develop performance measures to improve future  reporting on progress in implementing the ISE and information sharing  overall, but these measures focus on counting activities accomplished  rather than results achieved to show the extent of ISE implementation and  attaining the ISE’s strategic goals. The performance measures include, for example, the  number of ISE organizations with a procedure in place for acquiring and  processing reports on suspicious activities potentially related to terrorism,  but not how the reports are used and what difference they are making in  sharing to help prevent terrorist attacks. We acknowledge that creating such measures  is difficult, particularly since the program is still being designed, but until  these measures are refined to account for and communicate progress and  results, future attempts to measure and report on progress will be  hampered.
Why GAO Did This Study

The attacks on 9/11 underscored the federal government's need to facilitate terrorism-related information sharing among government, private sector, and foreign stakeholders. In response, the Intelligence Reform and Terrorism Prevention Act of 2004 mandated the creation of the Information Sharing Environment (ISE), which is described as an approach for the sharing of terrorism-related information. A presidentially appointed Program Manager oversees ISE development with assistance from the Information Sharing Council (ISC), a forum for 16 information sharing officials from federal agencies and departments. GAO was asked to report on (1) what actions have been taken to guide the design and implementation of the ISE and (2) what efforts have been made to report on progress in implementing the ISE. To perform this work, GAO reviewed related laws, directives, guidance, and ISE planning and reporting documents and interviewed officials from the Program Manager's office and key agencies who serve on the ISC.

What GAO Found

To guide ISE design and implementation, the Program Manager has issued an implementation plan, completed a number of tasks therein, and included other information sharing initiatives in the ISE, but the plan does not include some important elements to implement the ISE. The plan provides an initial structure and approach for ISE design and implementation. For example, the plan includes steps toward protecting information privacy and describes a two-phased approach for implementing the ISE by June 2009 consisting of 89 action items. Completed activities include, among others, development of proposed common terrorism information sharing standards. In addition, other federal, state, and local initiatives to enhance information sharing across the government are being incorporated in the ISE. These initiatives include partnering with state and local area fusion centers--created primarily to improve information sharing within a state or local area--to develop a national network of these centers. Nevertheless, Office of the Program Manager officials said that the 89 action items do not address all the activities that must be completed to implement the ISE. Work remains, including defining and communicating the ISE's scope, such as determining all terrorism-related information that should be part of the ISE, and communicating that information to stakeholders involved in the development of the ISE. In addition, the desired results to be achieved by the ISE, that is, how information sharing is to be improved, the specific milestones, and the individual projects--or initiatives--to achieve these results have not yet been determined. Defining the scope of a program, desired results, milestones, and projects are essential in providing a road map to effectively implement a program. Without such a road map, the Program Manager and stakeholders risk not being able to effectively manage implementation of the ISE. To report on progress in implementing the ISE, the Program Manager issued an annual report in September 2007, which highlighted individual accomplishments and included several annual performance goals, and has since begun to develop performance measures, but neither effort provides for an assessment of overall progress in ISE implementation and of how much work remains. Some individual accomplishments contributing to the ISE occurred under the implementation plan; others, prior to and separate from ISE creation efforts. In keeping with federal guidance, GAO's work, and the work of others in strategic planning, performance measurement, and program management, the implementation plan contained six strategic goals and the annual report four performance goals for 2008. Also, the Program Manager has begun to develop some performance measures, but they focus on counting activities accomplished rather than results achieved. For example, the measures include the number of ISE organizations with a procedure in place for suspicious activity reports, but not how the reports are used and what difference they are making in sharing to help prevent terrorist attacks. GAO acknowledges that creating such measures is difficult, particularly since the program is still being designed, but until these measures are refined, future attempts to measure and report on progress will be hampered.