Jennifer Sims of Georgetown University recently made remarks at the Open Source conference that “open source intelligence should be more secret” — I totally disagree. This is exactly the mindset and secretive culture we need to get away from. While she makes a good case that sometimes open source intelligence products can tell the enemy what critical pieces of information decision makers are seeking, she overstates the risk that unclassified open source reports actually have.

The co-chair of the 9/11 commission, Lee Hamilton, issued scathing remarks against the U.S. government’s propensity to classify information that had no business being classified, putting a huge burden on the special handling requirements and red tape that must be performed to manage that information and eventually declassify it. Additionally, the Director of National Intelligence issued an information sharing policy memorandum calling for intelligence products to be written at the lowest classification, even unclassified, if possible, without loosing context. Moreover, homeland security, law enforcement, and first responders need intelligence in the unclassified form to do their jobs.

Instead, if open source information answers a policymaker’s question, and it is sensitive, then the IC should mark it “CUI” a caveat that means it’s controlled but unclassified. This way it can be released across the federal government, but isn’t posted on the internet or other widely public forums for the world (our enemies) to see. We have a responsibility to provide intelligence information to the widest audience possible.

Check out the interview with Mr. Chris Rasmussen of NGA on emarv’s blog, discussing the Intelligence Community’s use of social software tools, such as their wiki, Intellipedia. It’s worth your time!

DNI Mike McConnell reached out recently to Arab- and Asian-Americans to discuss recruiting issues… if the Office of the DNI can fix the broken sytem for hiring people with language and culture skills it so desperately needs, it will vastly improve the IC’s capabilities…

See: The DNI’s 500 Day Plan for Integration and Collaboration

The post at “Organization Theory and Collaboration” gives a good synopsis of the Director of National Intelligence’s new intelligence community-wide “500 Day Plan for Integration and Collaboration.” The blog lists the six core objectives laid out in the plan, each with a number of enabling initiatives which are designed to propel the transformation.

I did an “executive spotlight” interview with Executive Biz October 11, 2007. See here for my interview on Web 2.0 and the future of Intellipedia.

I came across a post at “All News, All About Intellipedia” by eMarv, and he had an interesting quote from the MAZZ-INT blog that said:

“IT tools don’t naturally lead to collaboration or intelligence sharing…get the tools…to transform analysis through collaboration and intelligence sharing in place quickly, but do not expect this behavior to be commonplace until the community leadership models it, values it, incentivizes it.”

I certainly agree that technology is not a sufficient condition for collaboration to take place. The fundamental reality is collaboration is more about behavior than technology. Having said that, it is also a myth that collaboration is not about technology. Clearly technology makes forms of collaboration and capabilities possible that would not be without technology. For example, the concept of Network Centric Warfare, whereby a competitive warfighting advantage is gained by robustly networking geographically dispersed sensors, shooters, and decisonmakers, allows new forms of organizational behaviors to take place, all of which would be impossible without information technology. Why? The enabler is technology which allows networking. Networking enhances information sharing. Information sharing improves quality of information and provides shared situational awareness. Shared situational awareness enables collaboration, self-synchronization, and speed of command, and thus, translates into mission effectiveness.

On the whole, there are very few senior leaders who “walk the walk” when it comes to collaboration or using these new tools which advocate a flatter world. Unfortunately, in order for this new paradigm to expand throughout the government, it will take today’s users to become tomorrow’s leaders.

Emarv asked, “What is going to be different about this time around?”

Great question. This time around will be and already is different. We now have the structures in place to ensure the community’s communication systems are compatible and service-oriented architecture is integrated across organizational boundaries. The Office of the Director of National Intelligence (ODNI) is streamlining the community’s classification guidelines, and standardizing control mechanisms which will allow the community to share information back and forth easily. ODNI is also working on altering policies and removing impediments which discouraged information sharing. Michael McConnell’s 500-Day plan intends to write collaboration into analysts’ performance appraisals. Given these movements, I believe this time will be different, and we owe it to the government for creating an office which sits above the community, and can ensure it acts like a true enterprise. I just hope DNI has the authority to actually execute its charter, because there is going to be a lot of resistance from agencies which are housed in other department’s and chain of commands. But Congress is eager to make this work. And so are the American people.

A continuing need exists to establish “analysis-driven collection” in the intelligence community. After all, identifying gaps in what one knows and collecting and analyzing information to answer those gaps is the primary function of intelligence. In order to do so, collectors and analysts must work together toward identifying what is and what is not known, and to collect on those issues that remain unanswered according to policymaker’s priorities.

The harsh truth is collectors and analysts don’t work together. Past recommendations cite the need for both professions to understand each other’s processes and methods, but this approach hasn’t, isn’t, and won’t solve the problem.

One of the primary reasons these two professions lack the spirit of cooperation necessary is they are not structured to work together “collaboratively.” Sure information is coordinated back and forth haphazardly, but not in an efficient, fluid-like way, and certainly not directly from analysts to collectors. For example, if Bob the analyst writes a report using Mary the collector’s report, the only way Mary will know Bob found the report useful is if Bob writes another report (evaluation) on Mary’s report. Not only this, but Bob must submit it through another layer of bureaucracy, known as collection management. Certainly collection management provides a “quality control” aspect to the evaluation, however, this process lacks the speed, agility, and relationship building between the collector and the analyst to respond to the rapidly changing security we now must face.

A New Way: A lesson from the blog world

One powerful function of blogs is the trackback feature, which gives an author notification when one of their products is cited somewhere else. Imagine if every document had this feature, whereby the value of a given report could be determined by the number of individuals linking to it. The collector could see “automatically” and immediately how their product was used. In addition, this product could have a feature where analysts could instantly attach further questions to the collector’s report, removing the “middle-man” out of the process. I know many will counter that collection management serves a purpose, but the added benefit (particularly speed) will likely outweigh the detractions, such as spelling or grammar errors.

In addition, collection reports go “unevaluated” everyday because analysts simply lack the desire or time to write these reports and submit them through collection management. If greater swarms of analysts were participating then the collective interaction would bring a whole new level of professional collaboration between analysts and collectors, finally allowing analysis-driven collection to self-organize itself into the process.

There are many reasons why Intellipedia is a valuable tool for the Intelligence Community. If I had to summarize the reasons in one sentence, I’d say: Intellipedia provides a place where the community can pool its resources and integrate its collective knowledge in an interlinked environment on a particular issue. However, since its inception in April 2006, many criticisms remain. The good news is they all have answers. This blog addresses the following three criticisms: (1) seniors won’t use it; (2) it perpetuates bad information; and (3) its never really useable.

Problem 1: Seniors Won’t Use It

As hard as it is to imagine (I’m in my mid-twenties), there was a time when there were no word processors to type reports, or email to send messages. Information was typed and distributed hard copy. So, like wikis and blogs today, people feared these new emerging technologies. Senior-level employees were offended to be asked to type their reports themselves—after all, they were hired to think, not type. And email was seen as a manager’s nightmare. Anyone could send a message to anyone without going through the manager and team leader—unheard of! General James Cartwright, USMC, Vice Chairman of the Joint Chiefs of Staff, is a case in point. During his tenure at U.S. Strategic Command (STRATCOM) this “four star Blogger” created a rank-neutral blog for his entire command so anyone could post information, and he would post back. Imagine that. E-3’s communicating directly with a four-star. This was an astonishing move, especially from someone who comes from a chain-of-command culture. But what’s interesting is what initially happened. Only majors, colonels, and other senior-level managers and NCO’s were posting because they told their lower-ranked employees that they were not allowed to participate. But Cartwright wouldn’t accept that, and sent a message:

“The metric is what the person has to contribute, not the person’s rank, age, or level of experience. If they have the answer, I want the answer. When I post a question on my blog, I expect the person with the answer to post back. I do not expect the person with the answer to run it through you, your OIC, the branch chief, the exec, the Division Chief and then get the garbled answer back before he or she posts it for me. The Napoleonic Code and Netcentric Collaboration cannot exist in the same space and time. It’s YOUR job to make sure I get my answers and then if they get it wrong or they could have got it righter, then you guide them toward a better way… but do not get in their way.”

STRATCOM has continued that message, citing that command hierarchy does not apply to information. “We have a command chain, but not an information chain,” explained Lieutenant General Robert Kehler , USAF, Deputy Commander USTRATCOM.

So, in my view, we are getting the same resistance that we’ve seen in the past. Change is hard. Transformations are hard. But the Wiki and Blog are here to stay.

Solution: It’s not a matter of if seniors will use it; it’s a matter of when.

Problem 2: It’s never finished, and thus never usable.

Critics claim wiki’s lack clear indicators of the status of an article—and to be honest, they are somewhat correct. This is something were still trying to come to grips with. However, since Intellipedia keeps track of every edit as a separate version with a unique URL (see here for example), contributors of an article can determine and reference the latest “reviewed and vetted” version of an article, even though edits are continuously made. Another option is to take the vetted information and publish it in a static document, sort of like taking a snap shot at any given time, and then reference that version.

Solution: Processes are evolving that do indicate the article’s status.

Problem 3: It Perpetuates Bad Information

There are weaknesses and strengths with everything. Intellipedia is no different. One advantage of the traditional approach—that is, static “finished” reports—is they go through a vetting process. You know product “x” from organization “y” has standards “z.” And thus, you know the degree to which you can rely on that information and analysis. However, we all know that these reports, which are reviewed hierarchically, still have errors. Intellipedia is reviewed or “vetted” too, but in a different way—it’s “peer-reviewed” horizontally. The only real difference is static reports aren’t released until they’re “finished” but information in a wiki is posted and then edited.

So the first thing we need to come to grips with is posted information (information visible on a virtual network) should no longer mean it’s static or finished, or at least not in a wiki. It’s simply the latest version of what’s known on a given issue. But unlike static reports, the wiki is up to date, and allows anybody to find and fix errors quickly. It’s essentially a “living document” prone to change as new information arises.

Second, Intellipedia has an alert feature, so individuals interested in an article can “watch” it and be alerted when the article has changed. Users are even provided a double-framed page (see here for example), which highlights changes between the old and new version. As the number of eyeballs increase on an article, the quality increases.

Finally, as discrepancies arise, users can add little tags indicating there is a discrepancy and they can be brought up on the article’s discussion page where debate is conducted transparently. Unlike Wikipedia, Intellipedia has no anonymous contributors. Every edit is attributed to somebody. This eliminates the vandalism issues Wikipedia deals with.

Solution: It Perpetuates Continuous Self-Correction through Peer-Review.

Taken as a whole, Intellipedia has many more advantages. It’s up to date. It represents the community’s knowledge on a specific issue. Anyone can correct errors. Multiple eyeballs and attributable edits ensure errors entering the space are eliminated. And vetted versions can be supplied by static links. By the way, if you saw an error in this blog, wouldn’t you want to fix it?

See Also:

1. Reliability of Wikipedia
2. Cal Andrus Discusses Pros and Cons of Intellipedia
3. How Intelligence Agencies Use Social Software – Presentation by Chris Rasmussen

In the aftermath of the 9/11 terrorist attacks on the United States, the U.S. government initiated sweeping changes to the Intelligence Community (IC) to enable it to better protect and defend its citizens and interests abroad. The Office of the Director of National Intelligence (ODNI) was created to ensure close coordination and integration of the Government’s 16 intelligence agencies and various other components. As a result, we are now better organized to address the threat, with more robust information sharing capabilities and a greater capacity for coordinated and integrated action.  

A key challenge to fully achieving these changes is the current “need to know” principle, which is heavily engrained into the intelligence community’s culture. According to the 9/11 Commission Report, the “need to know” principle mistakenly assumes: 1) It is possible to know, in advance, who will need to use the information, and 2) The risk of inadvertent disclosure outweigh the benefits of wider sharing. (p. 417) 

“Those Cold War assumptions are no longer appropriate…current security requirements nurture overclassification and excessive compartmentalization…there are no punishments for not sharing… [Agencies] uphold a “need to know” culture of information protection rather than promoting a “need to share” culture of integration.” (p. 417) 

In 2004, Congress passed the Intelligence Reform and Terrorism Prevention Act of 2004 (IRTPA), which set the “need to share” mindset into motion. IRTPA called on the DNI to “ensure maximum availability of and access to intelligence information” and to “establish policies and procedures to resolve conflicts between the need to share intelligence information and the need to protect sources and methods.” In October 2005, the DNI released its first ever National Intelligence Strategy, which directed the IC to “Remove impediments to information sharing within the Community, and establish policies that reflect need-to-share (versus need-to-know) for all data, removing the “ownership” by agency of intelligence information.” (p. 14) Director Mike McConnell’s “100 Day Plan for Integration and Collaboration” expanded the “need to share” concept to what he termed “responsibility to provide,” which entails the idea of information stewardship. On “need to share,” the Director’s plan said, “The intent is to shift from the current “need to know” mindset to create appropriate tension in the system to more effectively balance the “responsibility to provide” while still addressing the requisite need to protect sources and methods.” (p. 9) 

However, in February 2006, the Honorable Lee H. Hamilton, vice-chairman of the 9/11 Commission, said the need to move to a “need to share” mindset does not mean we should abandon the “need to know” principle, but recalibrate the “balance between secrecy and sharing.” (A New Look at Secrecy) In fact, the 9/11 report’s recommendation used the same vernacular, calling for “better balance between security and shared knowledge.” (p. 417 emphasis added) At this point, we are left to deal with two opposing ideas:

1) the need to know principle is faulty, and

2) it should not be abandoned in its entirety.

So what gives? 

Clearly the past “need to know” mindset was an impediment to information integration and horizontal collaboration and should change to “need to share.” This means are basic ethos must change to one where we share first and make information as accessible as possible.  A balance must still exist between the “need to share” and the need to protect sources and methods, which means ”need to know” will be determined by one’s access to a virtual network, and less restrictive, balancing the need to protect sources and methods with the need for wider sharing.  As cited earlier, to know in advance what one needs to know is impossible, and overly protective. Such a policy causes risks equal to or greater than the risk of inadvertent disclosure, and doesn’t allow us to tap into the wisdom of crowds.

By law, the ODNI is required to act as the arbitrator to ensure a “risk management” philosophy is enacted across the IC. Intelligence reports will need multiple tearlines so information can be “scrubbed” and released; analysts should be trained to “write-to-release” and be rewarded or punished for overclassifying just as much as underclassifying; and bold policies will need to be published and enforced to close loop-holes agencies use to prevent access to information. - Jesse Wilson