Boston Marathon shows good and bad of info sharing

The April 15 Boston Marathon bombings, which killed three and injured dozens more, highlight how far federal agencies have come in collaborating and sharing information in the past decade -- and how far they have yet to go.

Under standard operations, agencies face challenges in sharing data related to ownership and its often stovepiped nature, as well as obstacles in governance and policy, yet those challenges go out the window when incidents like the Boston bombings occur, said Donna Roy, executive director of the Department of Homeland Security's Information Sharing Environment (ISE).

"You go from cooperation to collaboration instantly," said Roy, speaking at the ACT-IAC Management of Change 2013 conference in Cambridge, Md.

Roy was a member of a panel that included information-sharing experts at the state and federal levels. The panelists frequently used the Boston bombings as an example of successes and failures in cross-agency sharing.

DHS assisted in the FBI-led investigation into the bombings, helping track, trace and use data that grew to 10 terabytes just 24 hours after the explosions occurred. For example, once it became clear that the explosions were intentional rather than accidental, agencies used available information to track the type of bomb, and technology tools helped them find out where information to make that type of bomb was publicly available.

At the same time, federal agencies teamed with local law enforcement officials to analyze cell phone call logs, text messages, social media data, video surveillance footage and mountains of photographs to identify suspects -- an effort Roy said highlighted the big-data techniques used by the FBI.

"We want to make information available as quickly as possible," Roy said. "In a threat situation, all those barriers come down because we really need to share information, but barriers creep back up when there is not an end threat."

Why can't information sharing between agencies always work as effectively as it can under duress?

Mike Howell, ISE deputy program manager, said technology limitations, legal issues, bureaucratic obstacles and data security are the biggest roadblocks.

The technology challenges, Howell said, are mostly "known and solvable and in many cases have been solved by someone," yet they require solutions scalable to the federal level.

That can take time, as can "stupid bureaucratic obstacles that prevent people from doing what they know how to do," Howell said. Bureaucracy can add months or years to information-sharing trivialities that would not cause any real slowdowns for a private company.

Security also remains a concern, Howell said, adding that a governmentwide solution to identity management is still in the works.

"One of the things that trips us up is [the question of] how do I secure information and share at the same time?" Howell said. "We're modeling information assets against identity and security controls. How can I find out from sensitive sources what less classified people need to know to act without divulging [information] they aren't allowed to know? It's a challenge."

Lastly, Howell said, policy issues, especially regarding privacy, will likely garner significant attention in the near future.

After the Boston bombings, suspicious social media behavior on the part of the suspects and their prior interactions with federal officials led many to believe the bombings should have been prevented.

Howell said the perceived failure within the intelligence community -- a criticism that was also lodged in the aftermath of the 2001 terrorist attacks -- is related in many ways to the barriers erected to protect individuals' privacy.

"There are barriers in place, with good intent, and legal structures restricting which parts of government can see and have certain kinds of information," Howell said. "As a citizen, I applaud that. I'm glad I'm protected from abuse by government. But as a member of the government, I know it can impede people's abilities. This is why you have to have structures in information sharing."