Article critique

Chapter Title: Assessment of the Assignments and Arrangements of the Executive Agent Book Title: An Assessment of the Assignments and Arrangements of the Executive Agent for DoD Biometrics and Status Report on the DoD Biometrics Enterprise

Book Author(s): Douglas Shontz, Martin C. Libicki, Rena Rudavsky and Melissa A. Bradley

Published by: RAND Corporation

Stable URL: https://www.jstor.org/stable/10.7249/j.ctt3fh0n8.10

JSTOR is a not-for-profit service that helps scholars, researchers, and students discover, use, and build upon a wide range of content in a trusted digital archive. We use information technology and tools to increase productivity and facilitate new forms of scholarship. For more information about JSTOR, please contact [email protected]. Your use of the JSTOR archive indicates your acceptance of the Terms & Conditions of Use, available at https://about.jstor.org/terms

This content is licensed under a RAND Corporation License. To view a copy of this license, visit https://www.rand.org/pubs/permissions.html.

RAND Corporation is collaborating with JSTOR to digitize, preserve and extend access to An Assessment of the Assignments and Arrangements of the Executive Agent for DoD Biometrics and Status Report on the DoD Biometrics Enterprise

This content downloaded from �������������50.86.49.172 on Sun, 30 Jan 2022 00:58:22 UTC��������������

All use subject to https://about.jstor.org/terms

17

ChAptEr thrEE

Assessment of the Assignments and Arrangements of the Executive Agent

This chapter begins with a description of the EA organization, roles, and responsibilities. It then describes the biometric capabilities that fall under the purview of the EA. The third sec- tion assesses the assignments and arrangements of the EA and describes issues with each of the eight stages of the biometrics cycle and qualitatively assesses the risk that certain identified issues pose to the cycle.

The EA is supporting a functioning biometrics cycle that meets some level of warfighter needs and has had significant success identifying bad actors. Aspects of the EA’s assignments and arrangements show some deficiencies in managing biometrics responsibilities and pose risks to the biometrics cycle and ability to provide for user needs. However, this assessment examines ten years of activity and was conducted at a single point in time. Thus, it does not fully capture the recent efforts by the EA to improve operations, many of which were ongo- ing during our research. The EA has worked to increase automation, formalize activities, and develop metrics that demonstrate the impact of biometrics work. R AND expects that the required future annual assessments will track these continued changes and efforts to improve effectiveness and efficiency.

Assignments and Arrangements of the Executive Agent

The responsibilities and functions of SECARMY acting as the EA for DoD Biometrics are spelled out in DoDD 8521.01E, paragraph 5.12, a document released by DoD in 2008 to pro- mote a joint and coordinated organizational structure for a DoD-wide biometric capability. DoDD 8521.01E lists discrete tasks the EA must accomplish, but, in keeping with standard DoD practice, the directive does not dictate how the Army must specifically organize its vari- ous biometrics functions to carry out its responsibilities.

The Biometrics Cycle

However, before describing the specifics of the EA’s management and functions, it is useful to briefly summarize what the EA is currently executing. In general, the EA executes those func- tions needed to enable and support the biometrics cycle for red- and gray-force information.

This content downloaded from �������������50.86.49.172 on Sun, 30 Jan 2022 00:58:22 UTC��������������

All use subject to https://about.jstor.org/terms

18 An Assessment of the Executive Agent for DoD Biometrics

Figure 3.1 describes the biometrics cycle as derived from the PSA’s description, DoD documen- tation, and interviews.

The EA’s role in enabling and supporting the cycle includes developing, procuring, and fielding biometric collection, storage, and analytical technology, operating the authoritative database for red and gray forces, promulgating standards for biometric data, and collecting common biometric requirements.1

For most biometric records, the cycle currently operates as follows: An individual is “enrolled” by collecting (ideally) ten fingerprints, iris scans, a facial photograph, and biographic information (name, height, weight, etc.); the data are sent to the Automated Biometric Iden- tification System (ABIS) to determine if a biometric match can be made to existing records; a match/no match response is sent to a recipient who may or may not be the person who sub- mitted the request.2 Most fingerprint records submitted to ABIS can be resolved by automated analysis, but some (approximately 9.5 percent as of January 2012 according to BIMA) must be reviewed by a human forensic examiner. Submissions are prioritized based on urgency, with SOCOM inquiries receiving higher priority than detention center inquiries (as well as Navy maritime interdiction operations, and FBI Hostage Rescue Team operations). Results of bio- metric submissions are also analyzed in conjunction with other available information about the identified person. As of January 2012, ABIS contained 7.1 million records linked to 4.5 million unique identities, and ABIS was processing, on average, approximately 6,500 transac- tions per day.

In addition to this process, BIMA employs latent print examiners who try to match ABIS records to partial fingerprints collected from various sources, e.g., IEDs. Fingerprint records are also received from partner nations working in cooperation with the United States.

1 The EA is also responsible for blue-force biometric work, but the current level of activity is much lower as described later in this report. 2 One might suppose the cycle would terminate when a match/no match response is sent back to the field. It does not unless the match is to someone on the BEWL or the match request came from SOCOM. According to CENTCOM sources, the Project Manager for DoD Biometrics (PM-Biometrics) has had a requirement to implement a function in Bio- metrics Automated Toolkit (BAT) to be able to receive responses, but it has not been implemented.

Figure 3.1 The Biometrics Cycle

RAND TR1290/1-3.1

Task/Direct Collect Transmit Match

Decide/Act Analyze Share/Reference Store

This content downloaded from �������������50.86.49.172 on Sun, 30 Jan 2022 00:58:22 UTC��������������

All use subject to https://about.jstor.org/terms

Assessment of the Assignments and Arrangements of the Executive Agent 19

EA Roles and Responsibilities

Prior to describing the biometrics-specific functions of the EA listed in DoDD 8521.01E, it is useful to reference DoDD 5101.1, which defines the general role of an EA within DoD. Con- ceptually, an EA is designated to ensure proper coordination among DoD components, iden- tify requirements and resources, and monitor and report results of performance for capabilities not clearly within the purview of a single DoD component.3 DoDD 5101.1 explicitly describes the role of an EA:

• “5.2.1. Execute DoD Executive Agent responsibilities, consistent with applicable law, DoD Directive 5100.3 (reference (d)), DoD Directive 5100.73 (reference (e)), and this Directive.

• “5.2.2. Ensure proper coordination with the DoD Components for the responsibilities and activities assigned to provide continuous, sustainable, and global support as required by end-users. Ensure effective planning throughout operations by developing a coordi- nated process and support plans for transition from peacetime to wartime and/or contin- gency operations.

• “5.2.3. Identify requirements and resources, including force structure to the extent per- mitted by law, necessary to execute assigned responsibilities and functions. Submit these requirements to the cognizant Head of the DoD Component to be included in their respective budget documentation.

• “5.2.4. Monitor resources used in performing assigned responsibilities and functions. • “5.2.5. Develop, maintain, and report results of performance of DoD Executive Agent

responsibilities and functions, as may be required by law, Secretary of Defense decision, or other Congressional requirements.

• “5.2.6. Obtain reports and information, consistent with DoD Directive 8910.1 (reference (f )), as necessary, to carry out assigned DoD Executive Agent responsibilities, functions, and authorities.

• “5.2.7. Establish, maintain, and preserve information as records, consistent with DoD Directive 5015.2 (reference (g)), that document the transaction of business and mission of the DoD Executive Agent.

• “5.2.8. Designate a focal point to coordinate matters regarding assigned DoD Executive Agent responsibilities, functions, and authorities.”

DoDD 8521.01E specifies the role of the Biometrics EA in light of DoDD 5101.1 and the development and deployment of common biometric technology, operating the authoritative database, promulgation of data standards, and collection of requirements, among other things. In considering these duties, it is important to remember two things: First, the assignments and arrangements of an EA in general are meant to be monitored regularly for effectiveness in meeting end-user requirements. Second, DoDD 8521.01E preceded formalized strategy for a

3 DoD, “DoD Executive Agent,” DoD Directive 5101.1, May 9, 2003.

This content downloaded from �������������50.86.49.172 on Sun, 30 Jan 2022 00:58:22 UTC��������������

All use subject to https://about.jstor.org/terms

20 An Assessment of the Executive Agent for DoD Biometrics

coordinated DoD biometric capability and thus is merely an initial step. In light of these cave- ats, DoDD 8521.01E by itself does not (and cannot) serve as the basis for assessing the EA’s assignments and arrangements. Instead, the directive is a framework for the entire biometrics program, including the EA’s role, that is meant to be further specified by other implementation measures such as a DoD Instruction (DoDI). DoDD 8521.01E lists the explicit responsibilities of the Biometrics EA:

• “5.12.1. Execute responsibilities of the DoD EA for DoD Biometrics in accordance with Reference (w) and this Directive.

• “5.12.9. Develop, publish, and update as appropriate a DoD Biometrics Security Clas- sification Guide.

• “5.12.8. Coordinate all component biometric requirements with DoD Component mem- bers of the DoD Biometrics EXCOM.

• “5.12.6. Program for and budget sufficient resources to support common enterprise requirements documentation, architecture development, materiel development, test and evaluation, lifecycle management, prototyping, exercises, records management, demon- strations, and evaluations to include efforts at maturing viable technologies and standards.

• “5.12.7. Program for and budget sufficient resources to support common biometric data management, training, operations, and lifecycle support.

• “5.12.3. Provide for, manage, and maintain a biometrics center of excellence. • “5.12.2. Appoint an Executive Manager for DoD Biometrics, who shall be a G/FO or

SES equivalent, with responsibilities as outlined in Enclosure 4. • “5.12.4. Appoint a single Program Management Office, under the authority of the

Army Acquisition Executive, responsible for the development, acquisition, and field- ing of common biometrics enterprise systems to support common, Service, and joint requirements.”4

We gathered additional information through interviews and document reviews to gain a more complete understanding of the EA’s activities.

First, the EA appoints the Executive Manager for DoD Biometrics, who is currently the Director of BIMA. The Executive Manager is responsible for biometrics standards and prom- ulgation, among other things. BIMA is an agency created by the Army responsible for carrying out the Executive Manager’s functions, including managing the “authoritative DoD reposito- ries of biometric samples on those individuals not issued a DoD credential.”5

Second, the EA provides for, manages, and maintains “a biometrics center of excellence.”6

4 DoD, 2008s. 5 DoD, 2008a, paragraph E4.11. 6 DoD, 2008a, paragraph 5.12.3.

This content downloaded from �������������50.86.49.172 on Sun, 30 Jan 2022 00:58:22 UTC��������������

All use subject to https://about.jstor.org/terms

Assessment of the Assignments and Arrangements of the Executive Agent 21

Third, the EA appoints “a single Program Management Office” for biometrics, cur- rently PM-Biometrics, which is “responsible for the development, acquisition, and fielding of common biometrics enterprise systems to support common, Service, and joint requirements.”7

Fourth, the EA, “when applicable … make[s] recommendations to [the Under Secretary of Defense for Acquisition, Technology and Logistics] USD(AT&L) concerning acquisition category and milestone decisions for all biometric acquisition programs.”8

Fifth, the EA is tasked with programming and budgeting resources to support common requirements. Currently, and over the last ten years, these resources have come overwhelmingly from OCO funding. This funding source relieved the Army of having to make trade-offs in its base budget between DoD-wide biometrics support and other Army needs. However, once OCO funding ends—a factor already starting to impinge on the FY13 program—biometrics will have to compete for funding and will therefore need a strong rationale in favor of surviving as an enduring DoD capability in some form. Furthermore, without OCO funding, biomet- rics requirements must be supported with formal PoRs created by the Army. As of this writ- ing, the Army has initiated this effort, but it has moved only through Army’s internal staffing process and must still complete joint staffing.

Sixth, the EA is responsible for programming and budgeting “sufficient resources to sup- port common biometric data management, training, operations, and lifecycle support.” Train- ing has been ad hoc so far because formal training cannot be developed without PoRs.

Seventh, the EA is responsible for coordinating “all component biometric requirements with DoD Component members” of the DoD Biometrics Executive Committee (EXCOM), and, by extension, using these requirements in developing its acquisitions.

Finally, the EA is responsible for developing, publishing, and updating “a DoD Biomet- rics Security Classification Guide.”

The EA has taken on and engaged in additional biometrics activities not specified in DoDD 8521.01E by virtue of additional OSD guidance, past practice, and the consequences of deployed systems. We identified these activities during the study and incorporated them into our understanding of the assignments and arrangements as appropriate.

The EA’s management structure described by DoDD 8521.01E, officially formed by the EA, guided by ADMs, and as carried out in practice, is shown in Figure 3.2. Beyond the DoDD-required Executive Manager (BIMA) and PM-Biometrics, the management structure includes requirements and (in the future) training functions formally assigned to U.S. Army TR ADOC, as well as BEI functions carried out by the National Ground Intelligence Center (NGIC). The EA components’ primary functions and responsibilities as identified during this study are summarized in Table 3.1. For purposes of this report, we assumed all other EA func- tions are retained by the EA.

As described by the DoDDs discussed above, a PSA—currently the Assistant Secretary of Defense for Research and Engineering—oversees the EA’s activities. For biometrics, the PSA

7 DoD, 2008a, paragraph 5.12.4. 8 DoD, 2008a, paragraph 5.12.5.

This content downloaded from �������������50.86.49.172 on Sun, 30 Jan 2022 00:58:22 UTC��������������

All use subject to https://about.jstor.org/terms

22 An Assessment of the Executive Agent for DoD Biometrics

accomplishes his oversight primarily by chairing the EXCOM, which is the coordinating body for DoD biometrics. The EA is represented at EXCOM meetings by the Executive Manager, and the EA components provide the PSA with updates on biometrics activities. Other DoD components also participate in the EXCOM as needed.

Shortly after the publication of DoDD 8521.01E in 2008, DoD released the Biometrics Enterprise Strategic Plan (BESP). This document firmly prioritizes support of military opera- tions for DoD biometrics, but, as discussed in Chapter Four, its goals are vague. As discussed in Chapter Two, when we tried to apply a logic model approach to track the program inputs to intended outcomes, we found the documents were inconsistent among themselves. This led us to use the approach that focuses on the biometrics cycle.

Assessment of EA Management Assignments and Arrangements

Several aspects of the EA’s assignments and arrangements for carrying out its biometrics respon- sibilities are stovepiped, unclear, and duplicative, which could contribute to reduced effective- ness and efficiency of biometrics capabilities for end-users. R AND identified three factors as the likely root causes of management deficiencies:

• EA responsibilities spread across Army in a somewhat nontraditional manner

Figure 3.2 Executive Agent Management Structure

RAND TR1290/1-3.2

Assistant Secretary of Defense (Research and Engineering

(PSA)

Organizations with known or designated key EA functions

Secretary of the Army (EA)

Deputy Chief of Staff for Intelligence

(G-2)

Deputy Chief of Staff for Operations and

Plans (G-3/5/7)

Training and Doctrine Command

(TRADOC)

National Ground Intelligence Center

PM-Biometrics

Intelligence and Security Command

BIMA (Executive Manager)

Capability Manager for Biometrics and

Forensics (TRADOC)

Assistant Secretary of the Army for

Acquisition, Logistics, and Technology

Program Executive Office—Enterprise

Information Systems

This content downloaded from �������������50.86.49.172 on Sun, 30 Jan 2022 00:58:22 UTC��������������

All use subject to https://about.jstor.org/terms

Assessment of the Assignments and Arrangements of the Executive Agent 23

• continued reliance on OCO funding and quick reaction capabilities (QRCs) • lack of objectives and metrics.

First, as noted above, the EA’s functions—both those formally assigned and others taken on—are spread across the Army and only meet organizationally at the EA himself, SECARMY. The management arrangement is mostly typical within the Army, with separate roles for col- lecting requirements, procuring technology, and operating systems. However, the complicat- ing factors in this case are the EA’s Executive Manager and the need for centralized operations. Normally, requirements are gathered, equipment is acquired and fielded, and Army units use the equipment independently. With biometrics, the equipment must be used in concert with a central database that supports all of DoD. The EA’s Executive Manager operates the database and has assumed some roles in technology development and requirements. Further, the EA’s Executive Manager only has authority over BIMA, with no ability to coordinate the EA’s func- tions and components.

Consequently, the closest approximation to the true role of Executive Manager has been taken on more by the PSA’s representative, the Director of Defense Biometrics. However, as an

Table 3.1 Summary of Executive Agent Component Primary Functions and Responsibilities Identified in RAND Research

EA Component Functions Notes

BIMA – Executive Manager

• Vice chair of Biometrics EXCOM • Manage database for red and gray forces • technology “support” • Standards • Develop tools to facilitate interoperability • Coordinate on continuity of operations (COOp)

site

responsible for all Executive Manager responsibilities listed in DoDD 8521.01E

pM-Biometrics • Develop, acquire, and field biometrics systems • Database COOp site

reports to program Executive Office and Asst. Sec. Army on acquisition matters

trADOC • Gather biometrics requirements through tCM-B&F

• Develop Capability Development Documents (CDDs) for pors through tCM-B&F

• Develop and conduct training

NGIC • Operate BEwL • provide BEI through analysts funded by the

Military Intelligence program (MIp) and National Intelligence program (NIp)

• handle biometric data

BEwL and BEI functions directed to DIA in DoDD 8521.01E, but Army NGIC has been carrying them out

SOUrCE: DoD, 2008a; and interviews with U.S. government personnel.

This content downloaded from �������������50.86.49.172 on Sun, 30 Jan 2022 00:58:22 UTC��������������

All use subject to https://about.jstor.org/terms

24 An Assessment of the Executive Agent for DoD Biometrics

OSD office responsible for oversight and guidance, the PSA lacks directive authority over the EA’s components. According to BIMA, “The EA’s responsibilities in DoDD 8521.01E include additional items beyond what is included in DoDD 5101.1, thus distorting the perception of who has the responsibility to lead the DoD Biometrics Program. By allocating additional responsibilities to the PSA ... the EA focal point [in this case the Executive Manager] does not have the authority and responsibilities to adequately manage the DoD Biometrics Program.”9 We do not believe “additional” PSA responsibilities are hindering the Executive Manager, but the practical effect is that SECARMY, as the EA, remains the single point of management at a level in the Army that does not have the time to devote to the day-to-day minutiae of biomet- rics activities. The impact of this organizational positioning is shown in several instances. All non-Army personnel interviewed by R AND were unsure or unaware of which EA components are responsible for the EA’s functions, and in fact, several Army personnel were also unsure about roles within the EA.

Because of its limited organizational reach, BIMA is unable to properly promulgate and enforce standards for biometric technology. Under DoDD 8521.01E, the DoD components are responsible for complying with the standards, and BIMA stated that the Biometric Stan- dards Working Group, which BIMA chairs, has formally recommended standards to the DoD Information Technology Standards and Profile Registry (DISR) regularly since 2006. How- ever, BIMA has not enforced the data standards, and technology has been procured that does not meet the standards.

Because of unclear responsibilities or unclear management direction, BIMA and TCM- B&F both ran requirements working groups, despite this function normally residing with a TCM. BIMA attempts to differentiate its working group by stating that it focuses on “col- laboration among the services and federal partners,” but TCM also works to include the other military services in the course of validating requirements.10 Both TCM-B&F and G-3 said that having two groups operating in the requirements space is duplicative and inefficient. This duplication of effort—and potential lack of clarity about who was ultimately responsible—may have contributed to the approximately three years required to develop and complete the CDDs for BEC and Joint Personnel Identification version 2 (JPIv2), discussed in greater detail below.

A lack of collaboration between EA components has led to direct failures. PM-Biometrics and BIMA are both responsible for ABIS; BIMA for day-to-day management of operations and PM-Biometrics for fielding, upgrades, and maintenance. However, the organizations blamed each other for multiple failed ABIS upgrades—the most recent occurring in August 2011, with each group claiming the other failed to provide adequate information for the upgrade. Because of the stovepiped management structure, the conflict could only be resolved by the EA himself. Similarly, both PM-Biometrics and BIMA play a role in the COOP site for ABIS. DoD and

9 Comments from BIMA to R AND on the draft of this report, April 2012; DoDD 5101.1 lays out the general framework and scope of responsibilities for EAs, while DoDD 8521.01E provides the specific responsibilities and functions for the Bio- metrics EA. 10 Biometrics and Identity Management Agency comments to R AND, April 2012.

This content downloaded from �������������50.86.49.172 on Sun, 30 Jan 2022 00:58:22 UTC��������������

All use subject to https://about.jstor.org/terms

Assessment of the Assignments and Arrangements of the Executive Agent 25

Army policy require COOP contingencies, and the EA has had a standing request for an ABIS COOP site since approximately 2007. As of this report, the COOP site is scheduled to be run- ning in the first quarter of FY13, five years after the requirement was issued. At least one failed attempt to set up the COOP site has been made on the West Coast since 2007. PM-Biometrics stated, “It is the PM’s job to establish a COOP site, but the PM has been unable to accomplish this mission because of lack of concurrence from BIMA.”11

Second, most of the biometrics activities have been supported by OCO funding and have focused on procuring QRCs because of wartime environment demands. Much of the Army has been forced to respond to urgent operational needs from Iraq and Afghanistan, which resulted in tools and technology being rapidly developed and fielded without adhering to DoD standards, formal performance measures, and operational testing and evaluation requirements. This was seen as important for early fielding given the pressure of wartime. However, the biometrics enterprise continued operating under this paradigm, lacking firm deadlines and accountability measures, according to a G-3/5/7 interview. The absence of structure and stra- tegic planning contributed to the proliferation of devices that are not completely interoperable and to conflicts between end-users and EA components over which tasks were given priority. For example, PM-Biometrics was criticized by part of the Army for prioritizing work on the Biometric Identification System for Access (BISA) rather than the BAT, which was in greater use at the time. PM-Biometrics claimed the apparent difference in effort was due to BISA’s code having “greater maintainability and sustainability.”12

Third, the EA lacks metrics to determine the sufficiency and efficiency of its activities. When R AND first requested performance metrics from the EA components, the responses largely consisted of budget execution (i.e., spending) and staffing levels. BIMA-WV explained how it tracks ABIS daily transactions, number of matches, and downtime, but these are met- rics with mostly self-imposed (i.e., BIMA-imposed) thresholds and objectives and without a basis to determine sufficiency, i.e., whether warfighter needs are being adequately met.13 As discussed below, DoD as a whole lacks goals for using biometrics and implementing biometric technology, but the EA is still responsible for developing organizational goals and objectives to provide guidance and enforce accountability. BIMA identified the DoD BESP 2008-2015, issued August 27, 2008, as a source of goals and objectives. However, the strategic plan is vague and generally tracks DoD’s broad mission of supporting the warfighter. Also, the strategic plan was issued in 2008 while BIMA was still known as the BTF, U.S. troops were still present in Iraq, and no formal PoRs had been developed.

These root causes of management issues are inherently linked and manifest in different ways within the EA’s components. PM-Biometrics could take any approach it deemed appropriate— and as approved by its immediate superior, Program Executive Office for Enterprise Information

11 Comments from PM-Biometrics to R AND on the draft of this report, April 2012. 12 PM-Biometrics comments, April 2012. 13 BIMA comments, April 2012. BIMA noted that the threshold of the maximum time to respond to SOCOM inquiries was set by SOCOM.

This content downloaded from �������������50.86.49.172 on Sun, 30 Jan 2022 00:58:22 UTC��������������

All use subject to https://about.jstor.org/terms

26 An Assessment of the Executive Agent for DoD Biometrics

Systems (PEO-EIS)—to address the urgent operational needs and requests for changes in bio- metrics equipment. However, these decisions essentially were made in a vacuum because there were no programmatic goals or metrics and no links between OCO funding and programmatic output. Further, the organizational stovepipes meant PM-Biometrics did not have to collaborate with BIMA in making decisions. According to CENTCOM, more than 80 percent of validated requirements submitted from theater to PM-Biometrics were not completed.

Despite these issues, the biometrics capability maintained by the EA has helped make more than 900 matches to the High Value Individual Watch List and deny more than 80,000 attempts by people to gain employment, access, or training at U.S. or coalition facilities.14

It is important to note that beginning in 2008, GAO wrote multiple reports highlighting some of these problems with management.15 The EA also hired ANSER Analytic Services (and a team of study partners) to provide a series of reports.16

The EA is taking some initial steps to correct highlighted problems, such as imposing the structure and discipline of formal PoRs and moving ABIS operations from BIMA to another Army organization.17 However, the three root causes—stovepiped management, OCO fund- ing of QRCs, and a lack of objectives—remain essentially unchanged and therefore will likely continue causing difficulties. How the EA manages biometrics responsibilities through the various components is discussed in greater detail in the following section.

EA Management: BIMA and PM-Biometrics

BIMA (and predecessor organizations) and PM-Biometrics have played the most prominent roles for the EA because they have specifically designated roles and are collectively responsible for most of the biometrics technology and data.

BIMA and predecessor organizations have had significant successes in supporting war- fighter needs for biometrics matching, but they have struggled to define themselves over approxi- mately 12 years. Responsibilities were initially split between the BMO and BFC under G-6 in July 2000. The organizations were merged into the BTF under G-3/5/7 in June 2006, which was then changed to BIMA in March 2010.18 BIMA’s responsibilities are being reorganized again as of the end of our research effort, and BIMA’s functions will be made subordinate to the Office of the Provost Marshal General by the end of FY12. This instability of role and management has likely been at the root of some of BIMA’s (and predecessor organizations’) internal management deficiencies described here. BIMA has mostly self-imposed performance objectives for operating ABIS, its most important function, and no organizational metrics or goals that were shared with

14 BIMA comments, April 2012. 15 GAO, 2008a; GAO, 2008b; GAO, 2011; GAO, 2012. 16 See, e.g., Team ANSER, 2009a, 2009b, 2009c. 17 John M. McHugh, Secretary of the Army, “Future of the Biometrics Identity Management Agency,” memorandum, Washington, D.C., March 12, 2012. 18 At least one interviewee stated that G-2 had responsibility for part of the biometrics mission between G-6 and G-3/5/7. This was denied by BIMA but is a further indication of the lack of clarity about roles and responsibilities.

This content downloaded from �������������50.86.49.172 on Sun, 30 Jan 2022 00:58:22 UTC��������������

All use subject to https://about.jstor.org/terms

Assessment of the Assignments and Arrangements of the Executive Agent 27

RAND. BIMA notes that it has a threshold requirement of 8,000 transactions per day for ABIS and that actual performance recently increased to 18,500 per day. This self-imposed threshold is easily achieved, given current performance, and is not based on a DoD-wide (and potentially U.S. government-wide) understanding of the true need, which could be higher or lower. BIMA has spent millions of dollars on multiple pilot efforts without a transition plan for any technology it develops, and without any successful transition of technology to DoD users. Exact figures were unavailable, but in recent years, these efforts have averaged in excess of $3 million per year. As one BIMA staff member indicated, BIMA in recent years has self-initiated research efforts with- out a specific request or an obvious need from an end-user.19

BIMA’s inability to effectively promulgate and enforce standards (discussed in greater detail below) for biometric data collection contributed to the multiple devices procured across DoD that are not fully interoperable and, in the case of the Handheld Interagency Identity Detection Equipment (HIIDE), did not record data that meet the FBI’s fingerprint standard. BIMA has taken steps to improve procedures for ensuring that biometrics equipment conforms to standards by obtaining accreditation from the National Institute of Standards and Technol- ogy (NIST) under the National Voluntary Laboratory Accreditation Program. However, as highlighted by GAO, “the current DODD 8521.01E already requires such compliance testing for new biometrics acquisitions, but DOD noted and we [GAO] agree that the directive does not fully address quick reaction capabilities such as the Handheld Interagency Identity Detec- tion Equipment (HIIDE).”20 Thus, the first significant opportunities to prove the value of these efforts will not come until new equipment is under development through the new PoRs.

In contrast to BIMA, PM-Biometrics has a relatively clear set of responsibilities for pro- curing and developing biometrics technology, but the execution of these responsibilities lacks any measures of sufficiency or efficiency and has been criticized by biometrics users in the field, among others. The most frequent complaint about PM-Biometrics from interviewees was that it did not work on the top user priorities, focusing efforts instead on priorities of its own choos- ing. CENTCOM noted that PM-Biometrics has not completed the four JUONS submitted since 2009, with only the replacement for the HIIDE nearing completion. CENTCOM also stated that PM-Biometrics did not complete “89% of Army [Department of Army] DA G3 Validated Requirements in over 4[-plus] years.”21 Assertions about PM-Biometrics’s approach are further supported to some extent by the fact that the only performance metrics PM- Biometrics initially provided R AND were numbers of staff and funds expended.

PM-Biometrics’ response to this criticism, in part, was to point out that it does not have formal requirements. However, PM-Biometrics noted that its work priorities are captured in Configuration Change Boards. Also, as noted above, the lack of goals and objectives is a defi- ciency throughout the EA and all of DoD. This is highlighted by recent delays and changes in schedules and funding. Between December 2011 and January 2012, PM-Biometrics pushed

19 Interview with BIMA staff member, September 2011. 20 GAO-11-276, March 2011. 21 Comments from CENTCOM to R AND on the draft of this report, May 2012.

This content downloaded from �������������50.86.49.172 on Sun, 30 Jan 2022 00:58:22 UTC��������������

All use subject to https://about.jstor.org/terms

28 An Assessment of the Executive Agent for DoD Biometrics

back the estimated date to replace the HIIDE devices with Secure Electronic Enrollment Kit version II (SEEK II) devices by at least three months.22 PM-Biometrics explained that U.S. Forces Afghanistan (USFOR-A) had added a requirement that the new SEEK II needed to be able to communicate through the BAT infrastructure, which, according to PM-Biometrics, “is a step backwards for the SEEK as it perpetuates the BAT-[Army version 4]Av4 inefficient architecture.” However, PM-Biometrics’s original plan for the SEEK appeared to rely on BISA, which is being phased out. Further, between November 2011 and January 2012, BEC fund- ing for FY13 through FY16 was decreased from $35 million per year to $3 million per year.23 Without formal PoRs that impose deadlines and accountability measures, PM-Biometrics appears to some users to be setting its own priorities (with approval from PEO-EIS), while PM-Biometrics complains of being forced to maintain existing inefficient technology. Neither approach is based on true measures of performance and effectiveness.

Moreover, DoD lacks a process for prioritizing JUONS, so PM-Biometrics may be receiv- ing multiple requests that are competing for limited resources. According to G-3, the Army has put in place a process to track JUONS and the responses to them, but DoD as a whole lacks a process to prioritize JUONS. BIMA stated that “Part of the issue also resides with the [Joint Rapid Acquisition Cell] JR AC for approving and validating JUONS that were not feasible ([e.g.,] JUONS 0434), instead of requesting a capability and describing a problem the JUONS has [sic] approved as [a] wish list of solutions.”24 However, this only partly explains CENT- COM’s statement that PM-Biometrics has not completed the four validated JUONS submitted by CENTCOM since 2009.

EA Management: TRADOC and NGIC

To date, TR ADOC’s most important functions related to biometrics have been to assign TCM-B&F responsibility for gathering requirements and developing the CDDs for the BEC and JPIv2 PoRs. As noted above, the CDDs were approximately three years in the making (the delays attributed to various and conflicting reasons), but G-3/5/7 complimented TCM-B&F’s work and inclusiveness in collecting and documenting the requirements.

TR ADOC’s most notable deficiency is the fact that no formal biometrics training pro- gram can exist for equipment that did not originate from a PoR. Training remains ad hoc despite biometrics technology being fielded and used for almost ten years. TCM-B&F, which is not responsible for the eventual formal training program, has taken steps to develop bio- metrics training simulations, but even these are not being provided in sufficient quantity for pre-deployment training. However, BIMA claims TCM-B&F “continue to do development associated with BAT, [Multilingual Automated Response System] MARS, et al [sic] despite not having acquisition authority in biometrics.”25

22 PM-Biometrics comments, April 2012. 23 Comments from Army personnel to R AND on the draft of this report, January 2012. 24 BIMA comments, April 2012. 25 BIMA comments, April 2012.

This content downloaded from �������������50.86.49.172 on Sun, 30 Jan 2022 00:58:22 UTC��������������

All use subject to https://about.jstor.org/terms

Assessment of the Assignments and Arrangements of the Executive Agent 29

As noted above, NGIC is not formally called out as part of the EA, but it has assumed some EA functions as well as some of DIA’s assigned functions for biometrics. NGIC has been acting as an intermediary between the field and ABIS for matching requests and has provided BEI for all DoD components through MIP- and NIP-funded analysts and resources. In late 2011, Army announced it would no longer provide analytical support to non-land forces and potentially all non-Army organizations (as of February 2012, G-2 and DIA were staffing and discussing possible options). This uncertainty creates difficulty for non-Army component plan- ning. Moreover, Army is reluctant to relinquish control over the NIP-funded resources despite not having official control over them. These issues need to be resolved to ensure sufficient ana- lytical resources are available for non–Army-specific missions going forward.

Current Biometrics Capability Under EA Purview

The biometrics capabilities currently under the EA purview comprise a variety of technological solutions that arose by matching available technology to operational needs on a quick reaction basis. No structured, programmed capabilities existed prior to OCOs in Iraq and Afghanistan, and DoD biometrics priorities before that did not include tactical collection. The operational demands of two wars required the EA to begin providing tactical equipment, which diverged from the EA’s original assignments that were based on more hypothetical ambitions of DoD biometrics. This divergence was not fully resolved in DoDD 8521.01E. In an unintended fash- ion, the tactical collection devices—which were not part of any articulated vision or procure- ment strategy of the DoD biometrics community—have become the foundation of DoD’s biometrics collection capability.

The limitations of the technology currently under the EA purview are well known, particularly in the PoR requests for the BEC and JPIv2. The GAO reports about the DoD Biometrics Program also highlighted deficiencies in the enterprise.26 We do not attempt in this report to characterize specific root causes for technological constraints of each technology; instead, we offer two broad conclusions regarding the impact of utiliz- ing QRC acquisition for biometrics equipment. First, as noted by U.S. Joint Forces Com- mand, and GAO, “Without a formal program for biometrics, not all steps associated with safeguards in DoD’s acquisition process for new technological systems are occurring.”27 Second, QRCs force trade-offs between capabilities currently available on the market and long- term needs. In other words, DoD accepted capabilities with some limitations because they were readily available commercially and could be fielded quickly. This report does not suggest that using QRCs was inappropriate; in fact, it recognizes their benefit in providing the war- fighter with tactical collection devices whose need was unforeseen by strategic planning.

26 GAO, 2008a; GAO, 2011. 27 GAO, 2008a.

This content downloaded from �������������50.86.49.172 on Sun, 30 Jan 2022 00:58:22 UTC��������������

All use subject to https://about.jstor.org/terms

30 An Assessment of the Executive Agent for DoD Biometrics

We know efforts are under way to update and improve the current systems, which makes writing an assessment and status report more difficult. We also know the EA supported a wide range of other “pilot” studies and research projects, but the information we received did not reveal any instances of those projects being fielded or transitioned to operations. Further, GAO noted in a 2008 report the inability to definitively track programs through spending, particularly short-term OCO-funded pilot programs.28 Therefore, rather than writing about speculation or moving targets, we chose to discuss the systems that are currently fielded. It is worth noting that the EA is working on or supporting multiple pilot-scale efforts and studies, and these should be examined in subsequent annual assessments.

The technologies being used have three main functions: biometric data collection, data storage, and matching. The devices used by DoD include handheld collection devices, tabletop collection devices with local storage and matching capability, and the authoritative database for storing and matching data on red and gray forces.

As QRCs, the fielded systems do not have documented performance thresholds and objectives vetted by the Joint Requirements Oversight Council (JROC)—a process designed to ensure user requirements will be met. While we cannot comment on or report current device performance as measured against vetted user requirements, we can present current, fielded capability. While these capabilities may differ from those documented in evolving, draft CDDs and capability production documents (CPDs), we are providing an assessment and status report based on the biometrics program as it is, rather than as it is planned to be.

The EA is also developing two new PoRs: BEC Increment 1 for the authoritative database (replacing ABIS); and JPIv2 for mobile and handheld collection devices (replacing BAT, HIIDE, and SEEK II). The status and implications of the new PoRs are discussed later in this report.

Assessment of EA Assignments and Arrangements Supporting the Biometrics Cycle and End-User Needs

Apart from assessing the assignments and arrangements of the EA in terms of managing its responsibilities from a process perspective, it is also necessary to examine the assignments and arrangements in terms of support to warfighting needs. In other words, is the EA supporting a functioning process for collecting, transmitting, storing, matching, sharing, and analyzing biometrics?

The basic answer is yes. Biometrics information is being collected and has been used to identify individuals against prior encounters and forensic evidence. The authoritative database for red and gray forces is growing steadily, and the processes in the field are becoming increas- ingly routinized. In that sense, hard work and concerted efforts by many involved have pro- duced a functioning biometrics cycle that is helping identify bad actors and verify the identities of other personnel.

28 GAO, 2008a.

This content downloaded from �������������50.86.49.172 on Sun, 30 Jan 2022 00:58:22 UTC��������������

All use subject to https://about.jstor.org/terms

Assessment of the Assignments and Arrangements of the Executive Agent 31

A deeper examination, however, suggests risks and room for improvement. To explicate as much, we use a heuristic metric that assumes the perfect biometrics cycle is one in which warfighters can collect accurate biometrics, have them analyzed within the limits set by tech- nology (typically, in a few minutes), stored indefinitely and securely, and shared with others. Correspondingly, the actual biometrics cycle can be assessed in terms of risks to operation, actual impediments, and potential failure modes. Our analytical method, then, is to examine each stage of the cycle for potential impediments and risks. Some can be traced back to issues associated with the EA’s management approach, but some of them are issues that may be influ- enced but not determined by the EA.

In the sections that follow, we discuss our assessment of each segment of the biometrics cycle, with a focus on issues that reduce or potentially reduce cycle efficiency and effectiveness. The tables presented with each section summarize the issues with that portion of the cycle, implications, status of the issues, and the reasons.

We attempted to differentiate between our assessments of high- and medium-risk issues (shown by “H” and “M”). High-risk issues are those already creating a risk of failure, or highly likely to do so in the future. Medium-risk issues are those that could pose a risk of failure in the future.

The goal is to highlight only those areas we assessed as posing some risk to the cycle. The discussion and tables that follow cover potential faults in the cycle. The tables highlight the link between the potential fault, the implications if a fault occurs, and the reason for the poten- tial fault. We do not intend to portray the EA’s assignments and arrangements as all negative. Rather, in the absence of overarching goals and objectives, we focused on areas where the EA could make changes to potentially improve how the cycle functions. We acknowledge the dif- ference between “high” and “medium” risk is somewhat subjective, but we believe these are the issues posing the greatest risks to the biometrics cycle based on the data we collected.

Issues: Task/Direct

All biometrics work starts with a task or direction, either implicit or explicit, to collect the biometrics before transmitting or processing them. Hence the question: Under what circum- stances should biometrics be collected?

Ordinarily, like most military taskings, this would be a decision best left to the local com- mander who has an operation to conduct and a set of resources with which to conduct it. The decision to collect biometrics would seem to fall into the category of unquestioned local control; time is a valuable resource, and time spent collecting biometrics cannot be spent otherwise.

Upon re-examination, however, the answer is less straightforward. People move from place to place, even from theater to theater. Al Qaeda, for its part, has a global reach, and someone encountered in Iraq may be re-encountered in Afghanistan, in PACOM’s area of responsibility (AOR), or even attempting to enter the United States, and failure to collect bio- metrics in one location could prevent warfighters in another location from realizing that the person they are encountering has movements that may suggest problematic associations. The fact that information collected in one theater can influence operations in another suggests that

This content downloaded from �������������50.86.49.172 on Sun, 30 Jan 2022 00:58:22 UTC��������������

All use subject to https://about.jstor.org/terms

32 An Assessment of the Executive Agent for DoD Biometrics

some consistency in biometrics collection may be beneficial. (Whether it is beneficial enough to mandate a vigorous collection policy everywhere is another issue.)

Current red-force biometrics collection requirements are inconsistent across AORs. This is not the EA’s fault inasmuch as combatant commanders have the authority to set local prac- tices regarding such issues. However, it must be noted that the EA did not outline a clear direc- tion to govern the collection of biometrics, and correspondingly, did not impress upon theater commanders some de minimus level of performance.

A second potential risk in the task-and-direct component of the biometrics cycle is a dis- connect between the capabilities chosen for development and the capabilities that best reflect warfighter requirements. Our interviews indicated that although the EA is sensitive to Army requirements, it is less sensitive to requirements arising from the Marine Corps, Navy, CENT- COM, SOCOM, and the IC. The result has been that several of the communities, notably the Navy, have decided to look elsewhere to meet their needs.

A final risk is associated with the path biometric data takes from the war zone into the database. The Army has sent its material to NGIC and from there to the authoritative database ABIS, operated by BIMA-WV, where it then becomes available for others to use.29 But NGIC has announced that it may restrict its services to Army customers alone, once biometrics activi- ties are no longer funded under OCO accounts. Further, the flow of data has not been satis- factory to all users. CENTCOM “has had a requirement for four years to have an automatic guard in place to move biometrics records [from classified to unclassified systems for direct transmission to ABIS] with no success.”30 SOCOM has developed, and the Marines have pilot-tested, other pathways into ABIS. SOCOM’s procedure involves satellites and web-based portals with direct priority access to ABIS and the latent print examiners at BIMA-WV, which has the advantage of guaranteeing a rapid response to their urgent requests. But allowing the various biometrics-collection communities to use different paths to the same goal has to come at the cost of efficiency. It is difficult to avoid the impression that the EA’s priorities are tilted toward Army requirements even though the office holds a DoD-wide charter. Table 3.2 sum- marizes the issues with the Task/Direct portion of the cycle.

Issues: Collect

We identified several problems that may hobble the collection part of the biometrics cycle. Although none is a show-stopper individually, collectively they degrade the efficiency and effectiveness of the overall effort.

The first problem is that the various instruments currently in the field for collection—the HIIDE, BAT, and BISA—all produce non-standard data. SEEK II is expected to produce standard data, but as of this writing, none of these units has been fielded (except for SEEK

29 CENTCOM, however, has not been satisfied with this arrangement. In 2008 it submitted a requirement to put an auto- mated cross-domain solution (a classified-to-unclassified “automated guard”) put in place to move biometrics—but with little success to date. 30 CENTCOM comments, May 2012.

This content downloaded from �������������50.86.49.172 on Sun, 30 Jan 2022 00:58:22 UTC��������������

All use subject to https://about.jstor.org/terms

Assessment of the Assignments and Arrangements of the Executive Agent 33

devices procured separately by SOCOM).31 There are two implications of collection devices not meeting standards: First, the data files’ quality fail to meet minimum levels; and second, the data are not in the right format. In the first case, data could not be used everywhere. With fingerprints, the usual problem is that while the center of each finger is recorded (as it would be in flat or “slap” prints), the side of the finger is not (as it would be in rolled prints), and thus its usefulness for forensic investigation is substantially reduced. In the second case, data could not be interchanged between devices, or images produced by one device could not be used with the matching algorithm associated with the authoritative database. That noted, in practice, there have been few complaints about the inability to match individuals. However, it is possible that crimes and attacks (e.g., using IEDs) cannot be ascribed to an individual because the finger- prints left at the scene do not include enough of the finger.

The world of biometrics—which, among other tasks, converts observations of the real world into zeroes and ones—is consequently ringed with standards, and adhering to them is important in making the enterprise run smoothly. Standards, as a rule, cover two broad areas: performance and conformance. A performance standard for biometrics, for instance, is one that says that an acceptable fingerprint image provides at least 500 pixels to the inch; an image that boasts a sharper resolution would also meet standards.32 A conformance standard speci- fies how something is expressed. The Electronic Biometric Transmission Specification (EBTS) suite of standards delineates how the information required to transfer biometric information is

31 That noted, there are multiple software configurations and proprietary standards associated with processing data from different SEEK vendors. 32 U.S. Department of Commerce, National Institute of Standards and Technology, NIST Special Publication 500–271: Information Technology: American National Standards for Information Systems—Data Format for the Interchange of Finger- print, Facial, & Other Biometric Information – Part 1, ANSI/NIST-ITL 1-2007, Gaithersburg, Md.: Information Access Division, Information Technology Laboratory, National Institute of Standards and Technology, May 2007.

Table 3.2 Issues Associated with the Task/Direct Portion of the Biometrics Cycle

Cycle Issues Implications Risk Reason

Inconsistent collection across AOrs both in terms of whom to collect on and what data to collect (Collection plans are not an EA responsibility)

Bad actors detected in one theater may not be detected in another

M DoD has not outlined clear guidance for collection in terms of targets and data to be collected

Capability development does not meet warfighter priorities relevant to circumstances

Devices not available for full range of potential missions

h Lack of inter-military service requirements prioritization for QrCs

product development funding in pM’s control, and pM priorities appear to differ from warfighter’sa

a pM-Biometrics comments, April 2012. pM-Biometrics stated that “its priorities are completely in synch with the warfighters’ ... what the warfighter fails to understand is that it is the pM’s responsibility to provide the best solution to the problem and not just to provide what the warfighter requests.”

This content downloaded from �������������50.86.49.172 on Sun, 30 Jan 2022 00:58:22 UTC��������������

All use subject to https://about.jstor.org/terms

34 An Assessment of the Executive Agent for DoD Biometrics

to be encoded (in Extensible Markup Language [XML]). A nonstandard encoding would be one in which the wrong words were used or the categories associated with a specific description (e.g., meaningful error conditions) are not identical with those of the standard (e.g., a term used in the submission overlaps in definition with parts of two terms in the standard). Here, the point is not to exceed the standard but to line up with it. But even conformance standards can have some performance issues; for example, a substandard record could be one in which information was not provided for required fields.

The EBTS standards in DoD have been a source of confusion and frustration. In December 2009, BIMA brought the issue of retiring DoD EBTS 1.2 before its Biometrics Standards Work- ing Group (BSWG), which voted to mandate EBTS 2.0 and retire EBTS 1.2 in the DISR. The change technically became effective in March 2010. However, none of the fielded systems were EBTS 2.0 compliant, and other work was already in progress based on EBTS 1.2. After learning of the potential change to EBTS 2.0, the Navy requested implementation guidance in November 2009 for its IDS program, which was working toward a design review for March 2010. BIMA responded to that request in April 2010 by granting a waiver to EBTS 2.0, allowing the Navy to continue based on EBTS 1.2. Similarly, in May 2010, PM-Biometrics requested a waiver because the ABIS upgrade would not be able to accommodate EBTS 2.0 while the data being received from collection devices were still conforming with EBTS 1.2. According to the Navy, EBTS 2.0 implementation guidance had not been provided as of May 2012.

Deficiency in the collection devices also originates with the QRC process. QRCs are intended to prioritize equipment that can be rapidly fielded over the so-called 100 percent solution.33 For example, the HIIDE procured as a QRC had limited capability to ensure speedy deployment. It was known at the time of acquisition that the HIIDE did not meet agreed-to EBTS interagency fingerprint-sharing standards, but the technology was the best that was commercially available and could be fielded quickly. The problem, our interviews found, was that the HIIDE continued to be purchased and fielded even after improved commercial off-the-shelf technology became available—namely the SEEK II, which meets interagency data-sharing standards.  We are still unclear why the HIIDE QRC was retained with its substandard fingerprint component when an improved device could have been fielded sooner within the same QRC framework.34

A problem of greater consequence is that soldiers are not very proficient at data collection or entry, resulting in some number of biometrics records not meeting quality standards.35 In some cases, the captured biometrics are not easily readable. In other cases, elementary mistakes are made and not caught, e.g., identifying the left hand’s fingerprints as the right hand’s and vice versa. While OCO funding was available, soldiers’ shortcomings could be overcome by paying for contractors to take biometrics in the field, but this expedient did not create a legacy

33 U.S. Army, Army Regulation 71-9: Warfighting Capabilities Determination, Washington, D.C.: U.S. Army, December 2009. 34 Repeated JUONS indicated issues with HIIDE, including poor test performance. PM-Biometrics argues that it was able to purchase HIIDEs and not SEEKs because it had sole-source purchasing authority for one but not the other. 35 BIMA maintains that there is no biometric image quality requirement for DoD collections.

This content downloaded from �������������50.86.49.172 on Sun, 30 Jan 2022 00:58:22 UTC��������������

All use subject to https://about.jstor.org/terms

Assessment of the Assignments and Arrangements of the Executive Agent 35

base of knowledge to build upon, and, now that the Army has to fund biometrics from its own budget, is unlikely to be tomorrow’s solution.

A cause of such shortcomings is the lack of biometrics education in the DoD schoolhouses. This was explained by the fact that Army doctrine does not permit formal training programs on devices that are not products of PoRs. Presumably, as the Army is rolling out the products of the PoRs (circa FY15), such gaps will be addressed. Nevertheless, the problem of inadequate train- ing and education will continue, and as noted by GAO, “biometrics training for leaders does not provide detailed instructions on how to effectively use and manage biometrics collection tools.”36 The Army will require substantial time to fund, develop, and actually implement new training modules. Table 3.3 summarizes the issues with the “Collect” portion of the cycle.

Issues: Transmit

Neither Afghanistan nor Iraq (at least when U.S. forces were operating there) can be described as places with good wired or wireless infrastructure. Thus, transmitting information from the field to ABIS—something that would be easy in this country—instead became another risk in the cycle. Those who collect biometrics often must wait until the data captured in the hand- held devices are transferred to BAT terminals wired to the SIPRNet. Such a delay is measured in hours, sometimes days, partly because the HIIDE cannot transmit data directly and partly because of the sparse wireless network and available bandwidth in theater. In theory, the BAT terminal can match data locally to avoid the need for ABIS-based responses for all inquiries, but according to PM-Biometrics, this can only happen for high-quality fingerprints compared

36 GAO, 2012.

Table 3.3 Issues Associated with the Collect Portion of the Biometrics Cycle

Cycle Issues Implications Risk Reason

hIIDE, BAt, and BISA produce nonstandard data

Inefficient sharing of data among mainstays of DoD biometrics collection and interagency partners

M Standards not enforced with QrCs

Excessive retention of legacy QrCs

hIIDE does not meet collection standards

SEEKs, which meet more standards, planned for fielding in FY12

Uncertainty/failure-to-match rate greater than best practice and limits sharing with interagency partnersa

M Indefinite retention of legacy QrCs

training is ad hoc

Soldiers not proficient at data collection or entry

Inconsistent, inaccurate and unusable data

h No por with corresponding training programs

a BIMA comments, April 2012. BIMA maintains that there are no defined best practices in regards to failure-to- match rates for handheld devices.

This content downloaded from �������������50.86.49.172 on Sun, 30 Jan 2022 00:58:22 UTC��������������

All use subject to https://about.jstor.org/terms

36 An Assessment of the Executive Agent for DoD Biometrics

against equally high-quality fingerprints already stored with the subset of data on the BAT, referred to as “lights out” matches by PM-Biometrics staff.37 In practice, if biometrics are loaded into a BAT device, sufficient SIPRNet bandwidth is available to conduct a matching inquiry through ABIS in West Virginia.

As noted, there are three entry points for biometrics: BISA, BAT (including data collected by the portable HIIDE device used by conventional forces), and the portable SEEK device used by SOCOM. If the biometrics are acquired by conventional forces in connected locations (such as detention centers), the prints are sent to NGIC to strip out biographical and contextual data on the individuals whose biometrics have been captured. Once such data are stripped, the unclas- sified biometric data are transferred from SIPRNet to NIPRNet by means of a dedicated cross- domain tool (also known as a network guard) and forwarded to ABIS for a biometrics match.

SOCOM’s frustration with this process prompted it to acquire a capability to communi- cate from the field through a satellite link to a web-based portal that is accessed by BIMA on the other end, which allows SOCOM’s match requests to get high priority.38 The result seems to have satisfied SOCOM’s requirements, despite the added cost of using satellite instead of landline bandwidth, as long as examiners at BIMA-WV remain available to give SOCOM top priority.

In late 2011, consistent with the Army’s evolving approach to its joint requirements, NGIC announced that, as of March 1, 2012, it would phase out its services to all warfighting components apart from the Army’s. Army has since begun considering a range of options for potentially supporting non-Army requirements. Whether this will create major delays for bio- metrics collected by the Marines and the Navy rests on how successfully and quickly ABIS can get its own SIPR-to-NIPR cross-domain solution operating. In November 2011, their expected go-live date was December 2011, but it slipped to April 2012. This remains a high warfighter priority, and the technology has existed for decades.

The EA acknowledged both its role in communications architecture and the limits of its ability to influence the field, which is mainly outside the EA’s purview. The EA (through BIMA) provided approximately half the funding for the pilot study of the Last Tactical Mile (LTM), a CENTCOM-initiated JUONS to send biometric data to ABIS from a handheld device via mobile wireless communication vehicles, fixed towers, and a CENTCOM-operated server.39 Table 3.4 summarizes the issues with the Transmit portion of the cycle.

37 Interview with PM-Biometrics personnel, 2011. There is a cost of somewhat fewer matches because ABIS has three times as many stored files as the BAT system does. 38 Records from SIPRNet are manually stepped down to NIPRNet so they can be fed into ABIS for matching. 39 GAO, 2012. CENTCOM “was responsible for conducting the Last Tactical Mile pilot project during 2011 to provide the warfighter with a rapid response time on biometrics data submissions. In the pilot project, matching is initially against a biometrically enabled watch list stored on the warfighter’s handheld device before searching against data stored in a stand- alone computer server in Afghanistan prior to transmission to ABIS—the authoritative database. The Last Tactical Mile project originated as a joint urgent operational need to utilize wireless infrastructure to transmit biometrics enrollments from a handheld biometrics collection device to a wireless communications tower ... Army officials told us that expanding the Last Tactical Mile pilot project across all of Afghanistan would cost approximately $300 million, in large part due to the number of wireless communications towers that would be necessary to provide connectivity ... DOD has not completed its evaluation of the Last Tactical Mile pilot project at the time of our review.”

This content downloaded from �������������50.86.49.172 on Sun, 30 Jan 2022 00:58:22 UTC��������������

All use subject to https://about.jstor.org/terms

Assessment of the Assignments and Arrangements of the Executive Agent 37

Issues: Match

When we began the study, ABIS was reaching its throughput capacity for ingesting data and conducting match inquiries. An inability to handle matching requirements would either mean that biometrics are queued for processing—meaning the average biometric record has to wait longer (and what took minutes may take hours or days)—or given a lower priority to keep the rest of the inquiries flowing, with the hope that those biometrics will just be processed much later. However, the EA increased ABIS transaction capability from a peak of about 8,000 transactions per day to about 18,500 per day during our study, and plans call for fur- ther increases. Further, DoD’s matching requirements are likely dropping: Mass enrollment is ending in Afghanistan and already ended in Iraq. Future large additions of data will likely arise from processing international partners’ data, such as 800,000 fingerprint cards received from the Philippines, which will not be time-sensitive transactions. Nevertheless, the true impact of ABIS’s limited throughput capacity is reflected in the inability to share robustly with inter- agency partners (see Share/Reference below).

Another factor lowering the efficiency of the matching process has been the prevalence of non-standard data, primarily from field devices (e.g., the HIIDE) that connect to the BAT. Non-standard data increase the work involved in the matching process and can lead to a failure to match when comparing individuals’ fingerprints with latent ones collected from artifacts,

Table 3.4 Issues Associated with the Transmit Portion of the Biometrics Cycle

Cycle Issues Implications Risk Reason

Field matches against ABIS subset replicated to each device.a

Only SOCOM and BISA have satellite communication-enabled field access to BIMA for matching against ABIS records

Field matches against dated database

Large expense to manually replicate data to BAt

Inability to match against interagency data

M hIIDE and BAt developed as QrCs without process to ensure interoperability with other systems and requiring adherence to standards

Architecture will be modified with expected FY13 deployment of BAt- Av5 and will fully change JpIv2 fielded in FY16.

No high capacity direct link between field & ABIS

Cross-domain solution only serves BAt portion of architecture

Uncoordinated activity as military services seek alternative to NGIC

Marines tested SOCOM’s web-based portal

Inhibited ability to share with interagency partners

h Non-BAt cross-domain solution not developed despite being warfighter priority

a CENtCOM comments, May 2012. CENtCOM states they submitted a JUONS to address the BAt data replication architecture that was never completed by pM-Biometrics.

This content downloaded from �������������50.86.49.172 on Sun, 30 Jan 2022 00:58:22 UTC��������������

All use subject to https://about.jstor.org/terms

38 An Assessment of the Executive Agent for DoD Biometrics

Table 3.5 Issues Associated with the Match Portion of the Biometrics Cycle

Cycle Issues Implications Risk Reason

Non-standard data sent for matches Significant inefficiencies in the matching process and potential missed matching opportunities

M Standards not enforced for QrC acquisition

proprietary and incompatible matching algorithms for irises and faces

Significant inefficiencies in the matching process

M Capability developed as QrC without process to address proprietary software issue

such as recovered components of an IED. The EA has had time to revisit the QRCs in light of the longer-term future of the biometrics enterprise, but has not done so.

A third issue, which originated outside the EA’s immediate control, is that matching algorithms for irises and faces are proprietary. In an era when, as BIMA officials note, irises are becoming more important as a matching tool among biometrics, the failure to develop a stan- dard matching process that can be applied across the U.S. government may result in signifi- cant inefficiencies and potential errors in identifying individuals. This issue could be addressed by ensuring both DoD-wide licenses for algorithms and that all data created by devices meet DoD EBTS standards. Table 3.5 summarizes the issues with the Match portion of the cycle.

Issues: Store

A potential risk arises if the demand for record storage exceeds actual capacity. Although the capacity of ABIS was increased from approximately eight million to approximately 12 million records during our study, BIMA would have to face unpleasant options if plans to increase capac- ity in the future are delayed. One is that new biometrics will not enter the database or would be delayed indefinitely, e.g., cards from overseas partners being queued for entry. Another is that records currently in the database would have to be removed, at least temporarily. A third is that the information present in each biometric would have to be systematically truncated, leading to lower resolution matches (e.g., fewer fingerprint minutiae), or a reduced capacity for certain types of matches (e.g., against latent fingerprints). EA component staff members appear confident that sufficient funding will to be available for future ABIS storage capacity increases.40

A more serious issue is that the EA has made inadequate provisions for a COOP site, or “hot” backup. ABIS currently has a “warm” backup, which can come online in the event of expected downtime (e.g., a software upgrade), as long as the database managers have at least six hours’ notice (which they may not necessarily have if the upgrade is forced upon managers as a result of a security breach). Plans are under way to establish a true COOP site following an initial requirement established in approximately 2007, but the go-live date continues to recede

40 ABIS stores all submissions as separate records regardless of whether there are multiple submissions for the same person. Questions were raised outside the EA about whether ABIS could be operated more efficiently if records were consolidated in a way that still preserved all data, but the EA believes efficiency would suffer.

This content downloaded from �������������50.86.49.172 on Sun, 30 Jan 2022 00:58:22 UTC��������������

All use subject to https://about.jstor.org/terms

Assessment of the Assignments and Arrangements of the Executive Agent 39

following multiple proposals and at least one failed attempt. Table 3.6 summarizes the issues with the Store portion of the cycle.

Issues: Share/Reference

Although ABIS operates well with FBI databases, it has problems with its counterparts in DHS and within the IC. In the case of DHS, the problems include not only deficient throughput and storage capacity (at least for the time being), but also communications and protocol issues. The latter are being worked out through DoD-DHS interoperability meetings. Data that DHS collects are not directly matched against ABIS outside of regular exchanges of the BEWL and some pilot efforts of DHS components to transmit requests to ABIS. DHS’s biometrics require- ments have risen sharply with the introduction of the US-VISIT program wherein all foreign visitors entering on a visa are required to have their fingerprints checked against DHS’s database, the Automated Biometric Identification System (known as “IDENT”). Consequently, the EA is under pressure to increase ABIS capacity specifically to meet DHS’s needs, but the small inter- section between fingerprints collected by DoD (other than those in the BEWL) and those col- lected by DHS has somewhat attenuated the need. The large price tag to increase ABIS’s transac- tion capacity has also given EA components pause. Nevertheless, in its Functional Requirements Document, DHS said it needs to be able to send more than 100,000 biometrics inquiries per day to ABIS by early 2013.41 DoD and DHS are working to address the interoperability problem between ABIS and IDENT and increase ABIS’s capacity enough to allow two-way inquiries, but in the meantime, DHS only has access to a subset of DoD’s data. This means unwanted individu- als can conceivably slip through the cracks at U.S. ports of entry, if DHS sees them but does not know they have been previously identified by DoD (or by states that provide biometrics to the United States, such as the Philippines or the Dominican Republic).

Interoperation with classified biometrics data is a more difficult problem, since it cannot be solved simply by increasing throughput or capacity. ABIS is an unclassified system, fed by unclassified lines, and stored in unclassified spaces. Individuals who work on the final steps of the matching process are not always cleared to the highest level. Adding a cross-domain solution (also known as an automated “trusted guard”) between the classified and unclassified

41 BIMA comments, May 2012. BIMA observed that this 100,000 figure is at variance with the requirement of 14,000 in DHS’s Systems Requirements Specification.

Table 3.6 Issues Associated with the Store Portion of the Biometrics Cycle

Cycle Issues Implications Risk Reason

ABIS is reaching its storage capacity Biometric data could fail to reach the authoritative database

M Database upgrade failures and delays

ABIS has no “hot” backup

A “warm” backup exists with a six- hour changeover

possible loss of database access h Not prioritized by the EA, and lack of coordination

This content downloaded from �������������50.86.49.172 on Sun, 30 Jan 2022 00:58:22 UTC��������������

All use subject to https://about.jstor.org/terms

40 An Assessment of the Executive Agent for DoD Biometrics

Table 3.7 Issues Associated with the Share/Reference Portion of the Biometrics Cycle

Cycle Issues Implications Risk Reason

ABIS not interoperable with DhS’s IDENt

DoD and DhS are engaged in an ongoing interoperability effort to resolve this issue

Fewer matches, weaker analysis h poor or lack of interagency coordination

ABIS cannot handle DhS processing load Fewer matches, weaker analysis h Limited processing performance

Classified biometric files cannot be matched against ABIS records

Fewer matches, weaker analysis h ABIS cannot handle classified data; no provision has been made to mirror ABIS data into classified systems

networks (as BIMA is doing to exploit SIPRNet connectivity) would not solve the problem. Thus, highly classified biometrics cannot be sent to or stored by ABIS and may not necessarily be examined by BIMA personnel.

Although both the classified databases and ABIS have access to the BEWL (which has only a subset of ABIS’s data), neither has access to one another. This means records in the unclassified or classified databases could be incomplete and/or potentially fail to produce matches. Feeding ABIS’s data into classified networks would provide a more complete picture for the IC, particularly with respect to people appearing in multiple geographic areas, which could ultimately inform strategic collection efforts. However, DoD has not taken any steps to replicate ABIS’s data in the classified realm. The possibility of placing ABIS on the classified network exclusively was raised during our interviews, but this would inhibit ABIS sharing data with interagency partners because FBI’s Integrated Automated Fingerprint Identification System (IAFIS) and DHS’s IDENT both operate on unclassified networks. Table 3.7 summa- rizes the issues with the Share/Reference portion of the cycle.

Issues: Analyze and Decide/Act

Finally, there appears to be an organizational and conceptual mismatch between the biomet- rics activities and all-source intelligence activities. The EA, for instance, controls analyst billets even though BEI analysis is not a designated EA responsibility. The BEWL has also been man- aged by the EA even though it is not a designated EA responsibility, and there is little planning for the evolution of BEWL management, maintenance, and development. DIA is designated as responsible for the BEWL in DoDD 8521.01E but has only recently begun considering options for carrying out that function.

The seriousness of this problem is strongly related to what one thinks the role of the biomet- rics community should be. The biometrics enterprise could be simply a supplier of services to the IC (in the same sense that parcel delivery is a service to e-commerce), in which case its role is to convert disparate contacts into a person’s unified history by indicating where ostensibly different individuals are really the same person under different aliases. The biometrics enterprise essentially

This content downloaded from �������������50.86.49.172 on Sun, 30 Jan 2022 00:58:22 UTC��������������

All use subject to https://about.jstor.org/terms

Assessment of the Assignments and Arrangements of the Executive Agent 41

provides a bit of information, i.e., these two individuals are or are not the same person. If so, the biometrics and intelligence communities do not have to be tightly coupled.

Alternatively, one could envision the biometrics enterprise as an enabler of intelligence on people. If identity could only be established through physical contact (e.g., taking fingerprints, photographing irises at short range) then the amount of “new” information available on any individual is likely to be small. If, however, identity could be established at a distance, then the number of potential contacts would be much larger, and changes in intelligence collection such as automated surveillance would enable a richer set of information to be analyzed. In the latter case, integrated planning between the biometrics enterprise and the IC (or at least that part interested in unofficial individuals) would be compelling because changes in biometric technology could drive new or expanded strategic collections for the IC. The biometrics com- munity should then understand the evolution of intelligence requirements, and the intelligence analysts should be aware of opportunities provided by advances in biometrics.

So the biometrics community is a service and nothing more, or it is an enabler and thereby needs to evolve concurrently with the IC. But the current posture that the biometrics community is an enabler that essentially evolves independently of the IC is inefficient and could degrade effectiveness over time. Further, the lack of integration of available biometric data into intelligence functions limits the ability of biometrics to inform decision-makers. Table 3.8 summarizes the issues with the Analyze and Decide/Act portions of the cycle.

Table 3.8 Issues Associated with the Analyze and Decide/Act Portions of the Biometrics Cycle

Cycle Issues Implications Risk Reason

EA assignments do not encompass the full end-to-end biometric capability

(EA controls preponderance of biometric analyst billets, even though BEI analysis is not a specifically designated EA responsibility)

COCOM BEI analytical needs may not be met

weakened analysis and underutilization of biometric data

M Lack of requirements and coordination

Lack of institutionalized BEI training

No plan for future BEwL management, maintenance, and development

(BEwL has been managed by EA even though it is not a designated EA responsibility)

Decide/Act weakened M DIA has not assumed responsibility per DoDD 8521.01E

This content downloaded from �������������50.86.49.172 on Sun, 30 Jan 2022 00:58:22 UTC��������������

All use subject to https://about.jstor.org/terms

This content downloaded from �������������50.86.49.172 on Sun, 30 Jan 2022 00:58:22 UTC��������������

All use subject to https://about.jstor.org/terms