Who Killed the Virtual Case File Written by

Who Killed the Virtual Case File? Written by: Harry Goldstein Published: IEEE Spectrum, September 2005 1

Overview: • September 2000: FBI IT begins Upgrade Project o Virtual Case File (VCF) planned to replace the Automated Case Support (ACS) system • April 2005: Project failed spectacularly, and was cancelled. FBI scrapped $105 million worth of unusable code 2

FBI background - why was the VCF so important? • As of 2004, the FBI had 40 -50 different investigative databases and applications • So, of course there were a lot of duplicate information and functions • The FBI’s work environment is paper-based • Agents document every step and build case files • Each form goes through approval chain 3

Automated Case Support (ACS) • Most heavily used investigative application • Stores forms related to investigations • Debuted in 1995, and was considered antique even then • Cumbersome, inefficient, limited capabilities • Complicated menus • Allows basic searches 4

The Trilogy (1) September 2000: FBI Upgrade Project approved by Congress Project consisted of 3 parts: • Information Presentation: provide new Pentium PCs, scanners, printers and servers • Transportation Network: provide secure local and wide networks • User Application: identify a way to replace the FBI’s 40 -something investigative software applications • 3 rd component ultimately became the VCF 5

The Trilogy (2) • June 2001: Applications International Corp. (SAIC) awarded contract for software part • Trilogy supposed to be delivered by the middle of 2004 • But in 11/9 the inability if the FBI to share information became public knowledge: “The FBI’s information systems were woefully inadequate. The FBI lacked the ability to know what it knew. ” (11/9 commission report, 2004) • Trilogy is shifted to high gear 6

VCF - Goals • Automate the FBI’s paper based work environment • Allow agents and intelligence analysts to share investigative information • Replace the Automated Case Support system 7

First problem – no general direction • The FBI didn’t have a blueprint o The FBI couldn’t “make coherent or consistent operational or technical decisions” about creating policies and methods for sharing data, and making tradeoffs between information access and security (NRC report, 2004) • The team began to “feel their way in the dark”. Characterized investigative processes and mapped them to the FBI’s databases 8

Defining the requirements (1) • FBI’s team and SAIC’s engineers hashed out what functions the VCF would perform • Requirements document ended up being 800 plus pages long o Violated the first software planning rule: keep it simple • Included system layout and application logic • Agents would bring web pages to sessions to demonstrate how they wanted VCF to look 9

Defining the requirements (2) • The requirements were not sufficiently defined in terms of completeness and correctness • Later in the project, they required continuous redefinitions • This had a cascading effect on what had already been designed and produced 10

• January 2002: FBI requested an additional $70 More money million to accelerate Trilogy. Congress approved $78 million • SAIC agreed to deliver the initial version of VCF in December 2003 (instead of June 2004) • SAIC and the FBI were committed to creating an entirely new system in 22 months • FBI wanted to switch to VCF using flash cutover 11

Contracts problems • Trilogy contracts were changed to reflect the new deadlines • Trilogy contracts didn’t specify any formal criteria for the FBI to accept of reject the finished VCF software • Trilogy contracts specified no formal project schedule o In particular, they specified no milestones 12

And yetasked Congress for additional more money • December 2002: FBI $137. 9 million for the Trilogy • The inspector general issued a report on the FBI’s IT management “The lack of critical IT investment management processes for Trilogy contributed to missed milestones and led to uncertainties about costs, schedule, and technical goals” o • Undisturbed by the findings, Congress approved $123. 2 million • Total cost of Trilogy so far: $581 million 13

The writing cranking • Meanwhile, SAIC programmers were code, using a spiral development methodology • Roughly 400 change requests of the system were made by FBI from December 2002 to December 2003 • Some were cosmetic, but others required adding new functions to the system o Example: page crumb 14

Changing the VCF • Many changes of the program had to be made by all 8 of SAIC’s development teams • SAIC officials admit that in the rush to get the program finished in time, they didn’t ensure that all the teams were making the changes the same way • The inconsistency meant that when one module needed to communicate with another, error sometimes occurred 15

Delivering the VCF • SAIC began testing the VCF in the fall of 2003 • 13 December 2003: SAIC delivered the VCF to the FBI, only to have it declared DOA • The FBI found 17 functional deficiencies it wanted SAIC to fix before the system was deployed • Additional tests revealed 400 more deficiencies 16

VCF – The end • June 2004: The FBI contracted an independent reviewer to recommend what the FBI should do with the VCF • Delivered in January 2005, the report said: High level documents, including the concept of operations, were neither incomplete, inconsistent, and didn’t map to user needs o The software cannot be maintained without difficulty o It is therefore unfit to use o 17

VCF – After • April 2005: FBI officially cancelled the VCF project • May 2005: FBI announced Sentinel. A 4 -phase, 4 -years project intended to do the VCF’s job and provide the FBI with a web based case management system • Sentinel’s estimated cost was unrevealed • FBI’s officials seem confident that the FBI can handle the complicated project 18

Thank you ! 19