Why fbi vcf failed

Both sides blamed each other for the mismanagement. For the FBI, the head of the agency was the top person accountable for the project, and he designated several people to manage it more directly. Larry Depew, who was one of the first proponents of the project - although he had no IT project management experience - was named the VCF project manager. Sherry Higgins, a seasoned IT professional, was hired to create the Office of Programme Management, and was in charge of centralising IT management and overseeing "the FBI's most expensive, complex, and risky projects", as well as managing Trilogy.

Establishing and setting system requirements in this environment has been incredibly challenging. There were no monitoring guidelines or tracking indicators included in the project's plan at the outset, and the project was first tested and measured only a few years after inception, which was arguably too late to recover from the initial mistakes.

According to FBI IT and contract managers, the cost-plus-award-fee type of contract used for Trilogy did not specify key items to guide the implementation, which also led to some of the challenges mentioned. At the end of — well over two years into the project — the FBI hired a contractor to perform these project integration duties when it became apparent that a professional project integrator was needed to effectively complete the project. A lack of clarity regarding the project's specific objectives and timelines led to several disagreements between the FBI personnel leading the project and the contractors.

This eventually led to both parties blaming each other for the issues with the project. Initially, the FBI did not have a clear vision of what the FBI's Trilogy project should achieve or of specific design requirements, and the contractors were not held to a firm series of achievable milestones. Moreover, at the outset, the FBI and others did not provide consistent or effective management of Trilogy, leading to technical and scheduling problems.

A number of problems were blamed on the contractors but were also compounded by the FBI's "sloppy inventories" of existing networks and an underestimation of the difficulties of such a complex implementation. SAIC argued that many of these deficiencies were caused by requirements changes from the FBI team, so an arbitrator had to be called in.

Marchewka, , Northern Illinois University. Who Killed the Virtual Case File? This case study has been assessed using the Public Impact Fundamentals, a simple framework and practical too to help you assess your public policies and ensure the three fundamentals - Legitimacy, Policay and Action are embedded in them. Learn more about the Fundamentals and how you can use them to access your own policies and initiatives.

Home - Centre for public impact. Contact us Menu. Our Vision for Government Building on our previous research around shared power, legitimacy, and experimentation, we present an emerging vision for the future of government.

Innovation in the Face of Crisis Insights from European cities' rapid and creative reactions to the pandemic. The Shared Power Principle Think what could happen if governments shared power to create positive outcomes for people?

Finding Legitimacy Understanding what building and maintaining legitimacy means today. Trilogy itself then underwent a cyclic series of evaluations and funding requests until Congress finally learned that its third leg, VCF, might never materialize. For the foreseeable future, that leaves the FBI with its obsolete, mainframe-based ACS Automated Case Support system, which requires the user to traverse a dozen green screens to upload a single document.

Worse, according to the OIG's report, "the ACS only serves as a backup to the FBI's paper file system [and] information within that system cannot be changed or updated. By the year , aging infrastructure alone -- including based desktop PCs and year-old interoffice networks -- was hobbling the FBI. Two months later the project was divided into three parts and renamed Trilogy. The software portion was a different story.

The objective of UAC was simple: "Webify" five of the 42 mainframe applications employed by FBI agents in the course of investigations. On the face of it, this seems like a sensible first step toward modernization, but it can also be seen as the crucial error of the entire Trilogy project. Putting a pretty front end on green screens did nothing to change the underlying processes, in which paper records were primary.

Also, according to the OIG report, the choice of which applications to Webify was not based on objective research and evaluation. Only a few months after the ink was dry on these contracts, the Sept. No longer would the Bureau be concerned merely with law enforcement. Instead, to protect against terrorism on U. This shift turned the requirements for UAC inside out. Instead of beautifying old mainframe apps, the charter changed to replacing those applications with a new, collaborative environment for gathering, sharing, and analyzing evidence and intelligence data.

And by the way, we don't have any requirements for that yet, so we need you to work with us to help develop those requirements. It should take into account possible failures for certain steps and the redesign of the software if necessary.

Above all, it is impossible to anticipate all the requirements and specifications beforehand. Hence, the development process should be based on extensive prototyping and usability testing with real users. After all, these steps increase the chance of ultimately meeting the user requirements.

In the case of the VCF, the FBI failed to carry out such an application development process, causing delays and higher costs for the whole project. Both, the contract as well as program management suffered substantial shortcomings. First, the contract schedule lacked specifications, deliverables and commitment to checkpoints. Second, the high turnover rate of key FBI staff further increased the delay and costs of the project. These lacks of IT investment practices and management weaknesses altogether negatively impacted the development process of the VCF.

In order to pursue a successful IT implementation, the staff involved in the development process needs to have profound knowledge and skills in both, IT and project management.

But the FBI substantially lacked these human resources and skill base, hence leaving the project development in the hands of FBI personal with no formal training in computer science as managers or engineers. This was especially the case for experienced program and contract managers and a senior IT management team with good communication skills.

Furthermore, as mentioned above, the continuous turnover of key staff further slowed down the build up of the required knowledge and skills.

Although the organization had access to highly qualified personal by borrowing them from other government agencies or even from the private sector, the overall lack of these human resources and skills hindered the desired development and implementation of the VCF. Last but not least, the FBI was constrained by external factors that limited its management flexibility.

For example, in order to pursue the necessary redesigns mentioned above, the organization needed the explicit approval of the Congress. Thus, the organization was unable to react quickly enough to new requirements and challenges that arise throughout the development process.

Interim Conclusion As the four issue areas have shown, the implementation of the VCF was doomed to fail from the very beginning. The failure can be traced back to the lack of basic purpose of the project, as there was no clear outline of the desired final product. Furthermore, the system was not tested in an operational environment prior to its final implementation, thus leaving critical needs for redesigning and user friendliness uncovered.

This said, the VCF could have only been successfully implemented when these critical issues had been settled early enough see Fig. As the next chapter is going to show, the FBI has learned from some of its mistakes and changed its approach in the subsequent Sentinel Project.

Second Attempt: The Sentinel Project 4. It is in many ways the successor to the failed VCF Systems. Sentinel would also facilitate information sharing with law enforcement and Intelligence Community members.

The development of the Sentinel System by Lockheed Martin took nearly 6 years, but Sentinel finally went fully operational in July, According to data provided by the FBI, the indicators show that FBI employees routinely have been using Sentinel to perform their daily electronic workflow and investigative activities. The expanding set of requirements by the FBI led to substantial delays and ultimate failure of the system. This was one very important lesson that was learned and used in figuring out the framework and requirements for Sentinel.

The initial version in contained 1, requirements Interim Report, , p Instead of continuously adding to the requirements as in the case of the VCF, Sentinel saw an actual decline in the number of requirements to 1, The FBI stated that it was to clarify and simplify the requirements.

A crucial aspect to note in requirements is that the FBI narrowed the scope of Sentinel. Some of the deleted requirements were transferred to existing FBI systems. This reduced the complication of development for the Sentinel system.

For the FBI, the remaining requirements were the top of their priority list. The deleted requirements could then be later integrated into an already operational Sentinel. This process consisted of nine phases, seven control gates, and seven project level reviews. To move on to the next phase in development of IT projects the seven gates need to be satisfied. The seven gates are only satisfied by the seven project level reviews.

Instead, he spent a lot of time going through the requirements in his cubicle, segregated from his five colleagues and his boss. Patton regards himself as a straight shooter. But he quickly realized that SAIC didn't hire him for his opinions.

When he began expressing concerns that security was not a top priority on the project, even in the post-Hanssen era, he was told not to rock the boat. We should be in the thick of things. Patton recounted his experience purely from memory.

Unlike Higgins, who meticulously inserted internal FBI e-mails about Trilogy into her scrapbooks alongside photos of her kids visiting her in D. The only existing artifact of his experience is a copy of the 26 October Internet posting that essentially got him kicked off the VCF project. Patton's descriptions of the plus pages of requirements show the project careening off the rails right from the beginning.

For starters, this bloated document violated the first rule of software planning: keep it simple. According to experts, a requirements document should describe at a high level what functions the program should perform. The developers then decide how those functions should be implemented.

Instead, we had things like 'there will be a page with a button that says e-mail on it. We want a logo on the front page that looks like x. We want certain things on the left-hand side of the page. Originally brought on as a consultant to Mueller that November, Azmi had worked with the director when Mueller was U. Azmi saw the Virtual Case File through its final death throes. In an hour-long interview in his office at the Hoover Building, Azmi also traced the VCF's demise to flawed requirements and emphasized that his office is taking pains to make sure it doesn't happen again.

The overly specific nature of the requirements focused developers on their tiny piece of the puzzle. They were writing code, Patton said, with no idea of how their piece fit with the others.

This presaged the integration problems that would later plague the project. This included an e-mail-like system that at least one team, to his knowledge, was writing, even though the FBI was already using an off-the-shelf software package, Novell's GroupWise, for e-mail. I'm not saying that the guys were technically incompetent. But bugs happen, and not all programmers are great. Without naming the VCF specifically, he mentioned that he was working on Trilogy's case management system and complained that no one was taking security issues seriously.

He pointed to some security measures the FBI already had in place that might make the case management system more secure. These included PKI, or public-key infrastructure, a system of digital certificates and independent authorities that verify and authenticate the validity of each party involved in an Internet transaction.

He also mentioned Bedford, Mass. Somebody did. Instead of bringing his concerns up the ladder, he chose to post them on the Internet. In response to Higgins's concerns, FBI agents questioned Patton about whether he had disclosed national security information and breached his top-secret DOD clearance.

After the interview, the FBI decided not to grant Patton top-secret clearance, making it impossible for him to continue working on the VCF. SAIC did invite him to find another position within the company, but it didn't have anything for him in Chicago, to which he was relocating for personal reasons.

Meanwhile, SAIC programmers were cranking out code. The company had settled on a spiral development methodology, an iterative approach to writing software. Basically, SAIC programmers would write and compile a block of code that performed a particular function, then run it to show Depew's agents what it would do.

If there was some dispute as to whether the change could or should be made, the agents sent an official request to the change control board, composed of SAIC engineers and FBI personnel, for review.

It wasn't long before the change requests started rolling in—roughly from December to December , according to SAIC.

Instead, SAIC engineers were like a construction crew working from a set of constantly changing blueprints. Some of the changes were cosmetic—move a button from one part of the screen to another, for instance. Others required the programmers to add a new function to a part of the program, such as the graphical user interface, common to all eight development threads.

This new capability not only added more complexity, the SAIC engineers said, but delayed development because completed threads had to be retrofitted with the new feature. Once SAIC engineers agreed on how the page crumbs would work, one of the development teams created a set of page-crumb-equipped screens for the other seven teams to use as a model.

The design model and supporting documentation were updated, the teams made the change—and the schedule slipped again. And there was a lot of inconsistency between their development teams. Higgins was aware that tensions were mounting inside the VCF project over the course of the winter and spring of Sometimes Depew's team had only two days to review a batch of code.

Sometimes, she acknowledged, these evaluations would include changes to the requirements—functions that the agents had decided that they needed once they saw what they were going to get.

Other times the FBI team would find bugs that needed to be fixed. In March , Computer Sciences Corp. In August, October became December. And in October, December became April The problem wasn't the PCs, which had been trickling in since , but changing the e-mail system from Novell's GroupWise to Microsoft Outlook and, according to the inspector general's audit, obtaining the components needed to connect the field offices to the wide area network.

Higgins added that the delays were compounded by the FBI's own sloppy inventories of existing networks and its underestimation of how taxing the network traffic would be once all 22 users came online using their new PCs.

Many of the changes had to be to made by all eight of SAIC's development teams. Arnold Punaro, SAIC executive vice president and general manager, admitted in a posting on the company's Web site that in the rush to get the program finished by December, SAIC didn't ensure that all of its programmers were making the changes the same way. That inconsistency occasionally meant that different modules of the VCF handled data in different ways.

Consequently, when one module needed to communicate with another, errors sometimes occurred. Through the summer of , frustration between the agents and the engineers mounted. One Sunday in late September, the agents and the engineers gathered to hash out their differences.

Higgins listened in by phone to the first part of the day-long meeting. Also in September, the U. Hite, who worked on the report. And so it required a continuous redefinition of requirements that had a cascading effect on what had already been designed and produced. But the abundantly funded VCF juggernaut was already hurtling toward delivery. SAIC began testing the program in the fall of , and according to Higgins, problems started cropping up, some of which the agents had warned SAIC about over the previous summer.

They informed her that they would deliver a version of the VCF to be in technical compliance with the terms of the contract and that the FBI should feel free to make changes to it afterward. As an April report from a U. House of Representatives committee pointed out, there were big deficiencies and small ones.

One of the big ones was not providing the ability to search for individuals by specialty and job title. An arbitrator was called in. Of the 59 issues and subissues derived from the original 17 deficiencies, the arbitrator found that 19 were requirements changes—the FBI's fault; the other 40 were SAIC's errors.

While SAIC fixed bugs, Azmi, with the help of Depew's team, created investigation scenarios that would take different cases from opening to closing and tested them on the VCF.

Those tests revealed an additional deficiencies. The director had scant reason to be so optimistic. True, Computer Sciences Corp. By April, 22 computer workstations, printers, scanners, servers, and new local and wide area networks would all be up and running, 22 months later than the accelerated schedule called for.

Azmi was promoted from interim to permanent CIO on 6 May The report made two major recommendations. The flash cutover that would start up the VCF and shut down ACS all at once must not happen, as a potential failure would be catastrophic for the bureau. The same committee had made both of these recommendations in September , and according to McGroddy, both suggestions had been ignored until Azmi took charge. Azmi told the gathering that he had already contracted BearingPoint, where Robert Chiaradio was a managing director and lead advisor on homeland security, to construct the current and future versions of the enterprise architecture by September And he abandoned the flash cutover idea.

The objectives for the new project were clear: test-drive the VCF's electronic workflow; see how people reacted to the graphical user interface; create a way to translate the output from the VCF forms, which was in the eXtensible Markup Language, into the ACS system; check out network performance; and develop a training program. The IOC was the perfect guinea pig for Azmi's rigorous approach to software development and project management, which he called the Life Cycle Management Directive.

The project also needed different managers. SAIC declined repeated requests to interview them. Depew, like other FBI officials, had only good things to say about Kanewske. He had been Kanewske's project manager counterpart for a portion of the Investigative Data Warehouse project, the newest, shiniest tool at the disposal of FBI agents and intelligence analysts.

Successfully deployed in January , the warehouse translates and stores data from several FBI databases, including parts of ACS, into a common form and structure for analysis. When interviewed this past spring, he was overseeing the lab's daily operations and construction of a new wing.

He was also anticipating retirement after 31 years of public service and thinking of pursuing job opportunities in the private sector.

She now consults and teaches project management courses for the International Institute for Learning Inc. And I just felt like it would be better for me and for Zal for me to leave. Azmi handpicked his IOC project manager. At a meeting this past May at the Hoover Building, the IOC project manager, whom the bureau made available on condition of anonymity, let me read through an internal FBI report on the IOC and explained the development process in detail.

The FBI and SAIC agreed to keep to a strict development schedule, define acceptance criteria, and institute a series of control gates—milestones SAIC would have to meet before the project could continue. All through the second half of , he met with his project manager every morning at Every night before 10 p.