Laws and Executive Orders Have Established Requirements to Improve Information Sharing since 2001

Since the information-sharing weaknesses of September 11, the President  and the Administration have called for a number of terrorism-related  information-sharing initiatives driven predominately by two statutory  mandates—The Homeland Security Act of 2002 and the Intelligence  Reform and Terrorism Prevention Act of 2004 (Intelligence Reform Act). Most recently in December 2005, the  President once again tried to better clarify the roles and responsibilities of  the ODNI program manager, Information Sharing Council, DHS, and other  agencies in support of the Information Sharing Environment (ISE). The  program manager is in the early stages of addressing the mandate and  issued an interim implementation plan to Congress in January 2006 that  lays out a number of steps and deadlines for deliverables. On January 26, 2006, the program manager  announced his resignation from his position. At the time of our review, a  new program manager had not yet been appointed. Once a new program  manager is named, it will be important for the DNI to monitor milestones  set in the interim implementation plan; identify any barriers to achieving  the milestones, such as insufficient resources; and recommend to the  oversight committees with jurisdiction any necessary changes to the  organizational structure or approach to the ISE. The Large Number of Sensitive but Unclassified Designations and the Lack of Consistent Policies and Procedures for Their Use Make Sharing Information More Difficult

Federal agencies report that they are using a total of 56 different  designations for information they determined is sensitive but  unclassified, and agencies that account for a large percentage of the  homeland security budget reported using most of these designations. There are no governmentwide policies or procedures that describe the  basis on which agencies should designate, mark, and handle this  information. In this absence, the agency determines what designations to  apply to its sensitive but unclassified information. Furthermore, most agencies do not determine  who and how many employees can make such designations, provide them  training on how to do so, or perform periodic reviews of how well their  practices are working, nor are there governmentwide policies that require  such internal control practices. By not providing guidance and monitoring,  there is a probability that the designation will be misapplied, potentially  restricting material unnecessarily or resulting in dissemination of  information that should be restricted. Some Agencies and End Users Reported Challenges in Sharing Sensitive but Unclassified Information

More than half of the agencies reported challenges in sharing sensitive but  unclassified information. Conclusions

In part because of the complexity of the task, shifting responsibilities, and  missed deadlines, more than 4 years after September 11 the federal  government still lacks comprehensive policies and processes to improve  the sharing of information that is critical to protecting our homeland. We will then send copies of this report to the Director, Office  of Management and Budget; the Director of National Intelligence; the  Secretaries and heads of the 26 departments and agencies in our review;  and interested congressional committees. Appendix I: Objectives, Scope, and Methodology

The objectives of our review were to (1) determine the status of efforts to  establish governmentwide policies and processes for sharing terrorism- related information between the federal government and its state, local,  and private sector partners and (2) identify the universe of different  sensitive but unclassified designations agencies apply to homeland  security and to other sensitive information and determine the extent to  which these agencies have policies and procedures in place to ensure their  consistent use. L. No. § 73- 21; Directive 12.6 (December 1999)   (policy revision in draft)  Definition: Safeguards Information means information, not otherwise classified as National Security Information or  Restricted Data that specifically identifies a licensee’s or applicant’s detailed  control and accounting procedures or security measures (including security plans, procedures, and  equipment) for the physical protection of special nuclear material, by whomever possessed, whether in transit  or at fixed sites, in quantities determined by the Commission to be significant to the public health and safety or  the common defense and security;  security measures (including security plans, procedures, and equipment) for the physical protection of source  material or byproduct material, by whomever possessed, whether in transit or at fixed sites, in quantities  determined by the Commission to be significant to the public health and safety or the common defense and  security; or  security measures (including security plans, procedures, and equipment) for the physical protection of and the  location of certain plant equipment vital to the safety of production or utilization facilities involving nuclear  materials covered by paragraphs (1) and (2) if the unauthorized disclosure of such information could  reasonably be expected to have a significant adverse effect on the health and safety of the public or the  common defense and security by significantly increasing the likelihood of theft, diversion, or sabotage of such  material or such facility.
Why GAO Did This Study

A number of initiatives to improve information sharing have been called for, including the Homeland Security Act of 2002 and in the Intelligence Reform and Terrorism Prevention Act of 2004. The 2002 act required the development of policies for sharing classified and sensitive but unclassified homeland security information. The 2004 act called for the development of an Information Sharing Environment for terrorism information. This report examines (1) the status of efforts to establish government-wide information sharing policies and processes and (2) the universe of sensitive but unclassified designations used by the 26 agencies that GAO surveyed and their related policies and procedures.

What GAO Found

More than 4 years after September 11, the nation still lacks governmentwide policies and processes to help agencies integrate the myriad of ongoing efforts, including the agency initiatives we identified, to improve the sharing of terrorism-related information that is critical to protecting our homeland. Responsibility for creating these policies and processes shifted initially from the White House to the Office of Management and Budget (OMB), and then to the Department of Homeland Security, but none has yet completed the task. Subsequently, the Intelligence Reform Act called for creation of an Information Sharing Environment, including governing policies and processes for sharing, and a program manager to oversee its development. In December 2005, the President clarified the roles and responsibilities of the program manager, now under the Director of National Intelligence, as well as the new Information Sharing Council and the other agencies in support of creating an Information Sharing Environment by December 2006. At the time of our review, the program manager was in the early stages of addressing this mandate. He issued an interim implementation report with specified tasks and milestones to Congress in January 2006, but soon after announced his resignation. This latest attempt to establish an overall information-sharing road map under the Director of National Intelligence, if it is to succeed once a new manager is appointed, will require the Director's continued vigilance in monitoring progress toward meeting key milestones, identifying any barriers to achieving them, and recommending any necessary changes to the oversight committees. The agencies that GAO reviewed are using 56 different sensitive but unclassified designations (16 of which belong to one agency) to protect information that they deem critical to their missions--for example, sensitive law or drug enforcement information or controlled nuclear information. For most designations there are no governmentwide policies or procedures that describe the basis on which an agency should assign a given designation and ensure that it will be used consistently from one agency to another. Without such policies, each agency determines what designations and associated policies to apply to the sensitive information it develops or shares. More than half the agencies reported challenges in sharing such information. Finally, most of the agencies GAO reviewed have no policies for determining who and how many employees should have authority to make sensitive but unclassified designations, providing them training on how to make these designations, or performing periodic reviews to determine how well their practices are working. The lack of such recommended internal controls increases the risk that the designations will be misapplied. This could result in either unnecessarily restricting materials that could be shared or inadvertently releasing materials that should be restricted.