	Stakeholders Are Taking Steps to Improve Terrorism- Related Information Sharing, but Existing Gaps Present Challenges for Implementing the ISE and Measuring Its Progress

ISE stakeholders are taking steps to improve terrorism-related information  sharing, but work remains to define the scope of the ISE, roles and  responsibilities, the desired results to be achieved—that is, how  information sharing should be improved—and measures for assessing  progress, all elements in establishing a road map for meeting information  sharing needs and implementing the ISE. Phase 2,  that was to commence in July 2007, covers design as well as  implementation of the ISE. Second, the implementation plan did not clearly communicate and  distinguish the role and responsibilities of the Program Manager from  those of the key agencies in implementing the ISE and improving  information sharing. Since the issuance of the implementation plan, the Program Manager and  participating agencies have taken steps to assess progress and improve the  ISE’s road map by issuing two annual reports and defining annual goals  and performance measures, in part consistent with federal guidance for  program planning and performance measurement. These measures are  intended to improve reporting on progress in implementing the ISE and  represent an important first step in providing quantitative data for  assessing progress made in information sharing and in helping to inform  Congress and other stakeholders of specific information sharing  improvements. Therefore, to help ensure that  the ISE is on a measurable track to success, we recommended that the  Program Manager, with full participation of relevant stakeholders (e.g.,  agencies and departments on the ISE), (1) more fully define the scope and  specific results to be achieved by the ISE along with the key milestones  and individual projects or initiatives needed to achieve these results; and  (2) develop a set of performance measures that show the extent to which  the ISE has been implemented and sharing improved—including, at a  minimum, what has been and remains to be accomplished—so as to more  effectively account for and communicate progress and results. Fusion Centers Vary in Their Characteristics, and Federal Efforts Are Under Way That Address Many of the Challenges That Centers Reported Encountering

After September 2001, state and local governments began to establish  fusion centers to improve information sharing across levels of government  and varying disciplines and to prevent terrorism or other threats. As we  reported in October 2007, these centers varied in their level of maturity,  capability, and characteristics. Among  these challenges were managing the high volume of information and the  multiple systems and networks, obtaining specific and clear guidance and  training on operational issues, obtaining and retaining qualified personnel,  and securing federal grant or state and local funding for center operations  over the long term. The  National Strategy for Information Sharing stated that the federal  government will support the establishment of fusion centers and help  sustain them through grant funding, technical assistance, and training to  achieve a baseline level of capability. Legislation  introduced in May 2008, and reported by the House Committee on  Homeland Security July 10, 2008, seeks to clarify what constitutes  allowable costs under these grants. A New Policy Is Intended to Streamline Processes for Sharing Sensitive but Unclassified Information

In March 2006, we reported on a survey of 26 federal agencies that  showed they were using more than 50 different designations to protect  information that they deem critical to their missions—such as law  enforcement sensitive, for official use only, and unclassified controlled  nuclear information. In this absence, each agency  determined what designations to apply. We reported that such  inconsistency can lead to challenges in information sharing. In fact, more  than half of the agencies reported encountering challenges in sharing  sensitive but unclassified information. Consistent with our recommendations and the President’s December 2005  mandates calling for standardization of sensitive but unclassified  information designations, on May 9, 2008, the President issued a  memorandum that adopted CUI as the single categorical designation used  for sensitive but unclassified information throughout the executive  branch. Furthermore, the memo outlined a framework for designating, marking,  safeguarding, and disseminating information identified as CUI.
Why GAO Did This Study

In 2005, GAO placed the issue of information sharing for homeland security on its high-risk list of federal functions needing broad-based transformation and since then has monitored the government's progress in resolving barriers to sharing. This testimony discusses three key information sharing efforts: (1) the actions that have been taken to guide the design and implementation of the Information Sharing Environment (ISE) and to report on its progress, (2) the characteristics of state and local fusion centers and the extent to which federal efforts are helping to address some of the challenges centers reported, and (3) the progress made in developing streamlined policies and procedures for designating, marking, safeguarding, and disseminating sensitive but unclassified information. This testimony is based on GAO's products issued from March 2006 through July 2008 and selected updates conducted in July 2008.

What GAO Found

In a report being released today, GAO concludes that the ISE, under the leadership of a designated Program Manager, has had a measure of success, but lacks a road map for guiding the ISE, ensuring accountability, and assessing progress. The Program Manager's Office issued an implementation plan in November 2006 to guide the design of the ISE, has carried out a number of steps in that plan, and has leveraged existing efforts and resources agencies independently pursued for improving information sharing. However, this plan lacks important elements essential to effectively implement the ISE. Gaps exist in (1) defining the ISE's scope, such as determining all the terrorism-related information that should be part of the ISE; (2) clearly communicating and distinguishing the role of the Program Manager and other stakeholders; and (3) determining the results to be achieved by the ISE (that is, how information sharing is improved) along with associated milestones, performance measures, and the individual projects. Two annual reports on progress have been issued. Each identifies annual goals and individual ISE efforts, but neither reports on the extent to which the ISE has improved information sharing. GAO reported in October 2007 that fusion centers, established by states and localities to collaborate with federal agencies to improve information sharing, vary widely but face similar challenges--especially related to funding and sustaining operations--that the federal government is helping to address but are not yet resolved. While the centers varied in their level of maturity, capability, and characteristics, most fusion centers focused on processing information on crimes and hazards, as well as terrorism-related information. Fusion center officials reported facing challenges such as obtaining specific, clear guidance and training; obtaining and retaining qualified personnel; and securing funding for center operations over the long term. The Department of Homeland Security and the Federal Bureau of Investigation were helping to address these challenges by, for example, providing technical assistance and training, personnel, and grant funding. Also, legislation has been proposed to clarify how funding may be used to hire and retain intelligence analysts. Although the myriad of sensitive but unclassified designations has been a long-standing problem, progress has been made in establishing processes for designating, marking, safeguarding, and disseminating this information. In March 2006, GAO reported that each federal agency determined sometimes inconsistent designations to apply to its sensitive but unclassified information and this could lead to challenges in information sharing, such as confusion on how to protect the information. Thus, GAO recommended that the Directors of National Intelligence and the Office of Management and Budget issue a policy that consolidates sensitive but unclassified designations. In a May 2008 memorandum, the President adopted "controlled unclassified information" (CUI) to be the single categorical designation for sensitive but unclassified information throughout the executive branch and provided a framework for designating, marking, safeguarding, and disseminating CUI.