National Security Agency mismanages info technology

Introduction

The National Security Agency (NSA), the government agency responsible for collecting electronic data on threats to the United States, encountered major problems in managing its information systems and providing timely intelligence. A joint congressional inquiry found that the NSA apparently held relevant intercepts prior to the 9/11 attacks that were not processed until after the terrorists had already struck. In another case, the NSA failed to pass on Al Qaeda-related information gathered in 1998 to other intelligence agencies until 2002, due both to the agency’s missteps and its “deficiencies” in keeping up with modern communications. In the aftermath of 9/11, the NSA launched several secret initiatives to avoid such problems. One of these, called Trailblazer, became so plagued by problems that NSA expert Matthew Aid branded it potentially “the biggest boondoggle going on now in the intelligence community.”

Trailblazer was intended to capture and analyze intelligence data similar to the kind that went unnoticed before 9/11, but after spending $1.2 billion on research and development, there was little to show, according to The Baltimore Sun. A Sun Freedom of Information Act request yielded an audit which found “inadequate management and oversight” of the contractor, Science Applications International Corporation (SAIC). A second major initiative, a $500 million program dubbed Turbulence, is meant to sniff out threats in cyberspace, but it, too, has been hit by delays, cost-overruns, and technical problems. Another program, Groundbreaker, an effort to upgrade NSA’s massive computing complex, has at least doubled in cost to $4 billion. And despite the effort, the agency’s computers frequently crash, have trouble talking to each other, and are prone to losing or failing to track key intelligence, according to The Sun. Also problematic has been the agency’s $300 million Cryptologic Mission Management software program, which is designed to help the NSA manage its critical role as the nation’s prime keeper and breaker of codes.

Follow-up:
The NSA started a major overhaul of its Turbulence program and has consolidated its technology programs under a senior official, The Sun reported. The NSA press office did not respond to a request for comment, but Richard C. Schaeffer Jr., the agency’s information assurance director, told Congress in July 2006 that the NSA focused on the problems. “Among other things,” he said, “we’ve compiled and published security checklists that harden computers against a variety of threats; we’ve shaped and promoted standards that enable information about computer vulnerabilities to be more easily cataloged and exchanged and, ultimately, the vulnerabilities themselves to be automatically patched; and we’ve begun studying how to extend our joint vulnerability management efforts to directly support compliance programs such as those associated with the Federal Information Security Management Act.”