DHS Faces Rising Costs as Planned Biometrics Cloud Gets Pushed Back

The Homeland Security Department has been poised for three years to transition its aged biometrics program to a new, cloud-based system but has yet to make the jump, leading to cost overruns and limiting law enforcement’s access.

The department is in the process of moving all of its biometric databases and apps from the legacy Automated Biometric Identification System, or IDENT—originally developed in 1994—to the Homeland Advanced Recognition Technology, or HART, system, which will be hosted in a cloud environment managed by Amazon Web Services.

“The HART program is significantly behind schedule and has exceeded its most recent cost estimate,” according to a Government Accountability Office report. “Specifically, while DHS originally planned to implement the entire system by 2021, no increments of the program had been deployed as of April 2021.”

The transition was split into four “increments,” with Increment 1 originally expected to progress by the end of fiscal 2020, according to privacy documents published last year. As the COVID-19 pandemic hit last spring, a DHS spokesperson told Nextgov the schedule would likely be pushed out further.

Now, according to GAO, that migration is now expected to happen by the end of calendar 2021, three years from the initial planned deployment for HART.

“Currently estimated to cost $4.3 billion in total, DHS plans to deploy increment 1 of the program in December 2021 and expects to implement later increments in 2022 and 2024,” GAO wrote.

After that first phase is complete, DHS plans to retire IDENT and establish HART as the primary biometrics system for the entire department, as well as partner agencies like the Justice and State departments.

The new system is expected to function the same as IDENT, including the ability to match biometric indicators like face, iris and fingerprints to other forms of identity, like Social Security numbers and immigration registration numbers. However, with the new cloud-based architecture, the system will be “designed for scalability to address projected growth in identity and image data volumes and to accommodate any needs associated with larger files,” according to the 2020 privacy impact assessment.

The program is also already over budget, GAO reports.

DHS awarded a $95 million contract in 2017 to Northrop Grumman for the first two increments. Since that time, GAO notes the contract has been modified 12 times, increasing the cost to more than $143 million.

The cost of the entire program—all four increments—has also been a moving target. In 2019, program managers were able to lower the original estimate from $5.8 billion to around $3.9 billion “using a less expensive cloud-based solution, rather than DHS’s data centers,” the GAO report states.

“However, in May 2020, the HART program reported that it had breached the cost estimate,” auditors wrote, revising the projected lifecycle cost to $4.3 billion. That cost increase was, in part, a direct result of schedule overruns, DHS officials told GAO.

Further delays also prevent law enforcement from gaining access to the improved tools, GAO noted.

The Office of Biometric Identity Management’s “reliance on an overextended 27-year-old biometric identity management system to support national security, law enforcement, and immigration decisions, emphasizes the critical need for OBIM to ensure that further delays, cost overruns, and performance issues with the HART program are avoided,” the report states. “The delays and issues experienced by HART since 2017 have prolonged DHS’s and its partner agencies’ dependency on IDENT for at least an additional 3 years beyond the original plan.”

With so much money at stake and the timeline continuing to slip, the Office of the Chief Information Officer raised the project’s risk rating in May 2020 from low to high, triggering a TechStat review.

GAO auditors also noted the CIO added other risk management processes over the last year.

“Specifically, GAO found that HART had fully implemented four of seven risk management best practices and partially implemented the remaining three,” the report states. “For example, as of February 2021, the program had identified 49 active risks, including 15 related to cost and schedule and 17 related to technical issues.”

Officials only partially implemented three practices: creating and maintaining a risk management strategy, developing a risk mitigation plan and establishing a process for monitoring the status of each risk area on an ongoing basis.

Program managers also changed the structure of the rollout, combining Increments 3 and 4 into a single phase now called “future capabilities.”

GAO offered seven recommendations, “including that DHS update its policy to reflect the current IT program assessment process, and fully implement the risk management best practice related to monitoring the status of risks and mitigation plans.”

DHS officials agreed with all seven recommendations and offered timelines for meeting each.