The FBI's Challenge: Collaborate More, But Stay Secure

In his snoop-proof office, located down a long, locked corridor deep inside FBI headquarters, CIO Chad Fulgham signals me over to his desk. There, Fulgham demonstrates a new state-of-the-art desktop system that's being deployed to FBI field offices, featuring a unified e-mail in-box, voice over IP, videoconferencing, instant messaging, and presence technology, all displayed on a 24-inch flat-screen monitor and with access to both unclassified and classified networks.

The setup underscores the dual nature of the challenge facing Fulgham and his department as they modernize the FBI's outdated PCs, networks, and other IT infrastructure in an effort to transform the bureau, in the words of FBI Director Robert Mueller, into a "threat-informed, intelligence-driven agency." On one hand, the tools must improve collaboration and information sharing among the FBI's special agents and other employees. The May 1 bomb scare in New York's Times Square and the FBI's scramble to identify the people involved underscore the importance of putting the right tech tools into the hands of agents and intelligence analysts. On the other hand, the FBI's computer systems and software must be more secure than ever, amid increasingly sophisticated cyberthreats.

Fulgham set about overhauling the FBI's IT infrastructure shortly after arriving at the agency 18 months ago, following a career in the private sector at the likes of Lehman Brothers, IBM, and JPMorgan Chase. Fulgham is drawing on that business background in reorganizing the FBI's information and technology branch to make it more "business-aligned and services-oriented," hiring a chief marketing officer to evangelize the IT branch's applications and services, and assigning customer liaisons to work with other FBI departments.

In mid-May, Fulgham invited InformationWeek Government to FBI headquarters at the J. Edgar Hoover Building in Washington to provide an overview of the IT work that's under way. Fulgham's office is a "SCIF"--a Sensitive Compartmented Information Facility--where walls, ceilings, and corners are protected against eavesdropping and only preapproved devices are allowed. For this interview, Fulgham's first since taking the job, I'm allowed to use only pen and paper.

Coming from Wall Street, the FBI's CIO is somewhat of an unknown inside the beltway, and at 35, he's one of the youngest CIOs in the federal government. But Fulgham has public sector cred: He is a 1996 graduate of the U.S. Naval Academy and spent five years in the Navy, serving as an information security and network manager and communications officer. He also shared responsibility for the operational effectiveness of the USS Pioneer, an Avenger-class mine countermeasures ship.

Fulgham hasn't spoken before now about his department's work, he explains, because he wanted to wait until there was progress to report. That time has come. The IT branch recently completed a major network upgrade, and it's well along in deploying the workstation model that Fulgham has on his desk. His department has 17 major projects on its plate for fiscal 2011, including Sentinel, the high-profile case management system that recently hit a development snag (more on that later). "It's been a pretty interesting year and a half," says Fulgham.

Fulgham's background makes him well suited to the job of bringing contemporary IT tools and iron-clad security to the agency. At Lehman Brothers, where he was a senior VP, Fulgham's responsibilities included identity management, wireless, unified communications, information security architecture, IT business continuity, and Windows Server engineering and support. At IBM, he managed its Computer Emergency Response Team, and at JPMorgan Chase he led security engineering projects.

One of the first projects Fulgham tackled at the FBI was to revamp the agency's network backbone. That entailed replacing outdated ATM and frame relay gear with Cisco IP infrastructure that uses Multiprotocol Label Switching for higher performance. Dubbed the Next Generation Network, it serves as a backbone for three FBI networks--the unclassified UNet, classified FBINet, and top-secret Scion network--and extends to some 800 FBI locations. The network provides 45 times as much capacity as the one it replaced and doubles the access speed at endpoints.

The network overhaul was a necessary step before giving FBI agents and other personnel upgraded PCs. Dubbed the Next Generation Workspace (even though its core software is a few years old), the systems consist of Office 2007 and Outlook 2007 on Windows XP-based PCs with dual-core processors. Most of the machines are new Dell PCs, though in some places the FBI upgraded existing PCs with new memory and other components to save money. Employees who previously got by with basic e-mail, phone service, and productivity apps now have VoIP, IM, videoconferencing, and presence. The new workstations include 24-inch monitors, video cameras, speakers, headsets, and KVM switches for toggling between classified and unclassified networks.

In a demo of the desktop environment, Fulgham used Office Communicator's presence capability to find a couple of colleagues at their desks, then set up a three-way videoconference with a few clicks. The environment is being rolled out initially to the agency's 56 field offices. "My money goes to the field first," says Fulgham. That deployment began in December and is scheduled for completion this month. Fulgham has personally visited 17 FBI field offices, with plans to visit seven more by year's end.

Projects By The Dozen

The FBI spent $1.4 billion on IT in fiscal 2009, and the IT branch, with a focus on computers and communications systems, accounted for $488 million of that, or about 35%. Much of the remaining funding goes to the FBI's science and technology branch, which manages the bureau's automated fingerprint ID system, the national criminal background check system, and other major databases.

Among the other projects and upgrades the IT branch is tackling across FBI operations is a new identity management system based on Oracle's Identity Manager; deployment of systems management software from Hewlett-Packard and BigFix, replacing an assortment of management tools; and the introduction of Cisco NAC (Network Admission Control) in lieu of internally developed network security.

The IT branch's fiscal 2009 year in review report highlights a dozen other recently completed or ongoing IT initiatives. Among them:

>> Palantir, an application developed with the Central Intelligence Agency that supports role-based collaboration and information sharing among FBI agents and analysts. The app automatically alerts users when their work touches on an active investigation.

>> A highly secure mobile device, called the Secure Mobile Environment--Personal Electronic Device, that lets 90 or so FBI agents send and receive e-mail categorized as secret and voice calls categorized as top secret. The devices were pilot tested during the 2009 presidential inauguration before being expanded to field offices.

>> A repository called Enterprise Data Management for intelligence information from multiple agencies and other sources.

>> Upgrades to the FBI's financial management and HR systems.

Fulgham leans toward commercial software where possible. "We prefer the integration, ease of deployment, and automation we get with a commercial tool," he says. In a choice of stability over fancy features, the FBI is going with Windows XP and Office 2007 rather than the newer Windows 7 and Office 2010. But Fulgham isn't above being first in line for new software: He plans to use the just-released SharePoint 2010 for a social networking environment on FBINet.

A Flatter, Faster Organization

In parallel with all the infrastructure activity, Fulgham has reorganized the IT branch, and it wasn't just a tweaking--the changes required congressional approval. The new structure "flattens the organization and reduces the time needed to take action," Fulgham wrote in the FY 2009 year-in-review report.

The IT branch now comprises an IT management division of program and project managers that works closely with other agency departments; an IT engineering division that develops software and services; an IT services division that manages everything from 26,000 BlackBerrys to the agency's data centers; and an office of the chief knowledge officer. Support operations have been divvied into customer, enterprise, infrastructure, and system support, plus infrastructure engineering.

Along with those changes, the FBI has been filling key positions. In November, Jeffrey Johnson was promoted to CTO. Johnson is also assistant director of the IT branch's IT engineering division. Like Fulgham, he worked for Lehman Brothers, a technology innovator until the brokerage firm went bust in the 2008 financial crisis. Johnson is also a Naval Academy grad and Navy veteran.

Last August, the IT branch hired Stephanie Derrig as its chief marketing officer, charged with bringing a more common look and feel to its enterprise applications and facilitating uptake of those apps by agency employees. The IT branch has created an internal portal, based on SharePoint, with a page for every new product and service it offers. The idea is to make the department's services available in a more "professional way," Fulgham says.

Fulgham established a customer liaison office to improve service to FBI employees and channel departmental needs into the IT branch's development process. Liaisons are assigned to the FBI's operational branches--including national security; criminal, cyber, response, and security; and human resources--and to its finance division. Fulgham compares customer liaisons to account managers: They assess the business requirements of their assigned branches, recommend IT services, and help the branches with IT project management.

The IT branch even has a new logo that symbolizes its aspirations. At the center of the logo are an eagle and four stars, representing people, information, technology, and innovation. The FBI's motto--fidelity, bravery, integrity--is represented in binary format around the logo's edge.

Delays And Cost Overruns

No question, the FBI still has some major technology challenges on its plate, not the least of which is its Sentinel case management system, a $425 million project to replace the agency's outdated Automated Case Support (ACS) case management system with a new digital platform that incorporates technologies from Adobe, EMC, IBM, Microsoft, and Oracle.

Planned capabilities for Sentinel include a case management "work box" for an agent's workload, and a database, called the Universal Index, of people and other information related to a case. Sentinel will transition the bureau from paper documents to electronic records and workflows. Fulgham compares Sentinel to an airline ticketing or banking application in design and ease of use.

The Sentinel project was launched in 2006 under the watch of Fulgham's predecessor, former CIO Zalmai Azmi, following the highly publicized failure of a project to develop an ACS replacement, called the Virtual Case File system. The FBI pulled the plug on that effort after wasting $170 million on development, so Sentinel is being monitored closely. Fulgham knows that his office will be judged on whether it keeps Sentinel on time and on budget, and already there are signs of trouble.

In March, the Inspector General for the Department of Justice released a report warning that Sentinel, originally due for completion in 2009 and already behind schedule, was at risk of further delays and cost overruns. The IG pointed to "significant issues" with the usability, performance, and quality of Sentinel's Phase 2 deliverables from contractor Lockheed Martin, issues that forced the FBI to issue a stop-work order on portions of Phase 3 (development of a case management database) and all of Phase 4 (full implementation and retirement of ACS). "After more than three years and $334 million expended on the development and maintenance of Sentinel, the cost to Sentinel is rising, the completion of Sentinel has been repeatedly delayed, and the FBI does not have a current schedule or cost estimate for completing the project," the IG concluded.

The FBI, in a response to that report, said a new schedule for completing the four-phase project would be forthcoming. FBI Director Mueller, in testimony to a congressional subcommittee, characterized the delays to Sentinel as minor and said he was "cautiously optimistic" that Phase 2, covering introduction of electronic workflows and a security framework, would be completed this summer. Mueller acknowledged that Sentinel's completion date had been pushed back to 2011.

The FBI has yet to issue a revised timeline for Sentinel's next two phases, but Fulgham says the agency's Critical Incident Response Group has begun pilot testing Sentinel's current capabilities, which automate about a third of the paperwork and processes associated with the FBI's current case management system. In addition, Sentinel pilot testing was recently extended to FBI field offices in Richmond, Va., and Tampa, Fla.

Fulgham remains steadfast in his support of Sentinel. "It will fundamentally change how we do business," he says. Already, 8,800 employees use Sentinel's Phase 1 capabilities each month to query the FBI's existing ACS system, giving them a contemporary user experience within the FBI's old mainframe system. Still, the Sentinel project is only half done, and its completion date remains uncertain.

Five-Year Plan

In presenting the FBI's fiscal 2011 budget to Congress in April, Mueller outlined the many threats that occupy the bureau: terrorism, computer intrusions and cyberthreats, weapons of mass destruction, foreign intelligence, gang violence, and white-collar crime. As part of its $8.3 billion budget request, the FBI seeks funding to add new positions in counterterrorism and counterintelligence and specialists in computer intrusions.

As part of its long-term planning, the agency's IT branch has developed a strategic plan for 2010 to 2015, which is outlined in its FY 2009 year in review. Guiding principles include taking an "enterprise approach" to integrating processes and technologies, promoting collaboration and information sharing, and complying with federal mandates.

The FBI will also undertake a major data center consolidation. In February, the Office of Management and Budget introduced a plan to reduce the federal government's data center footprint and related energy consumption. "We're completely in line" with the OMB directive, Fulgham says.

Along the way, Fulgham and team must walk a fine line between openness and the kind of circumspection required of an agency in the center of national security. When InformationWeek first published details of the FBI's IT plans in May, some readers criticized the FBI for its choice of Windows XP over Windows 7--while dinging Fulgham for being too forthcoming.

Of course, the CIO's job isn't a popularity contest. Fulgham will be judged on how well equipped FBI employees are for the important work at hand. And on that, he's already making progress.

Write to John Foley at [email protected].