NAS Recommendation 12, Part 2: A Funny Thing Happened on the Way to the IAFIS

As I mentioned in my last post, I initially thought Recommendation 12 from the NAS Report was going to be a no-brainer:

Make all the Automated Fingerprint Identification Systems (AFIS) talk to each other so you can solve more crimes.

Sounds simple. Sounds logical. But, as I already discussed, it is not simple at all for some very, very frustrating reasons. Here are a few more, with jokes.

A couple of days ago (July 26, 2010) the FBI issued a news item on their website announcing that they have implemented a “technological fix” to allow for partial interoperability between their own own AFIS which is called the Integrated Automated Fingerprint Identification System or IAFIS and that of the Department of Homeland Security, called the IDENT.

So now the two federal agencies responsible for keeping our country safe can sometimes search each other’s AFIS databases. Sometimes. And that is a victory worthy of a press release.

And, no, the feds didn’t even get the same system for themselves. The FBI started designing IAFIS in 1992 and it was put into service in 1999. IDENT, according to the FBI press item, was created in 1994. I’ve said it before when talking about government, but I’ll say it again: I am not making this up.

Lessons Learned

Now I’d like to share with you what the FBI recently shared with the rest of the world (outside of the US) about its own shortcomings in developing and maintaining the IAFIS.

First, I would like to acknowledge that it is very big of the FBI to share that they screwed up in some very big, basic ways. We all make mistakes. And I do think it is very important to admit when you have made a mistake and learn from it. I doubt that the FBI knew that their mistakes would end up on a website for the world to see, but still…

So… props to the FBI for helping others learn from their mistakes. I hope they have a sense of humor about it, too.

Recently Interpol published part of a paper submitted by the FBI to illustrate some “Lessons Learned” from the FBI’s experience in building and maintaining IAFIS. Interpol chose to list the 6 primary lessons that the FBI supposedly learned in their process.

In considering this list, remember that IAFIS was placed into service in July 1999. The processes these “Lessons Learned” covered were seven years of development (1992-1999) and eleven years of management and maintenance (1999 to 2010). 1992 to 2010. Not 1892 to 1910. 1992 to 2010.

The six primary Lessons (Allegedly) Learned by the FBI in building and maintaining IAFIS were:

1. Define Your Standards
   Define Your Standards?!? For a national IT project?!? That’s what you forgot?!? Yes, thank you, FBI. Thanks for sharing that nugget of wisdom with the rest of the world. Don’t think we could have managed that without you. Sleep tight, America.
2. Limit the Number of Vendors
   Believe it or not, this particular lesson does not involve the glut of AFIS vendors for local and state systems. It appears that the FBI chose different vendors for each component of the system. According to the paper it “led to situations where the system-level understanding of one contractor did not match the understanding of another.”
   
   The idea was probably similar to building a house and choosing an electrician to do the electrical work, a plumber to do the plumbing, a roofer to put on the shingles, etc.
   
   However, what it sounds like it turned in to was hiring some NASA engineers to wire the kitchen, your kid’s high school lab partner to do the electrical in the living room, and taking your chances with some guys you picked up in front of Home Depot to wire the bathroom. Now let’s talk about the plumbing…
3. Design a Non-Operational Environment
   So users can practice using the system without cluttering up your database with fake samples.
   
   P.S. Will you please stop arresting Brian from the Narco Lab? It stopped being funny in, like, 2003.
4. Build Incrementally
   The paper states:
   
   “An incremental build is one that achieves the desired system architecture in a series of phases, each self sustaining and individually measurable, but integrated into the previous contract deliverable…
   
   By segmenting the delivery of services in a structured way, system components can be tested independently and system functions can be evaluated as each phase is enabled.”
   
   In other words:
   
   Pants first, then shoes.
5. Vendor Service Contracts
   Get your service contract from the same vendor that built your system. You should read this whole paragraph on the website. It’s really entertaining for anyone who’s actually bought a car or a computer or a TV or a watch. And I’m in a hurry to get to Number 6.
6. Documentation
   This one is my favorite. They really did save the best for last.
   
   This one advises that you need to get all the regular documentation that you get with any IT system that you would buy. If you’ve ever bought a computer, it’s all the documentation they give you when you buy the computer that tells you what you bought and all the discs that have all the software that’s already on the computer.
   
   Then the paper states (emphasis added):
   
   Keep in mind that the actual core technology software is the intellectual property of the AFIS vendor and they are extremely unlikely to want to provide it to you – and there is no real reason you should want it. If you were to change their core software and it no longer works all warrantees would be null and void.
   
   So… which genius at the FBI went monkeying around in the code of the software and crashed the IAFIS?
   
   C’mon. This made the Top 6 Lessons Learned that was passed along to Interpol to share with the rest of the world. What Level 5 Tiefling Warlock decided that they had enough experience points to take on the IAFIS?
   
   What were you trying to do? Change the background color? Or the font? Or put a picture of your cat in place of the FBI logo for your birthday?
   
   How did you get the vendor to fix it? Who got to make that phone call? “We realize that Agent Quickness voided our service contract when he tried to change your logo to ‘Lockheed Fartin’, but Vice President Cheney would be ever so grateful if you’d reconsider. He’s invited you out quail hunting this weekend …”

To offer some defense to the FBI, this process did start in 1992 when computers were a relatively new gizmo to a lot of people and designing a massive system like IAFIS was something to be left to the spooky tech dorks down the hall, just like today (I kid because I love).

But the first Macintosh (Apple) was launched in 1984, Microsoft Windows was launched in 1985, and IBM had been around forever. There were experts around to be consulted about how this new technology worked. But instead of consulting the best and the brightest, the project was bid out to the usual suspects and the entire process was left up to whoever got the bid. Don’t forget, Lesson Learned Number 1 was “Define Your Standards.” The FBI didn’t even bother to do that.

Maybe that was one reason the NAS Committee stated so emphatically in their report:

There was also a strong consensus in the committee that no existing or new division or unit within DOJ would be an appropriate location for a new entity governing the forensic science community…

the committee determined that the research funding strategies of DOJ have not adequately served the broad needs of the forensic science community. This is understandable, but not acceptable when the issue is whether an agency is best suited to support and oversee the Nation’s forensic science community.

In sum, the committee concluded that advancing science in the forensic science enterprise is not likely to be achieved within the confines of DOJ.

However, with that farce called the Subcommittee on Forensic Science operating out of the White House and the guys who relied on some very badly motivated human beings to help them write the Draft Legislation that puts forensic reform squarely in the hands of the Department of Justice with instructions to hand it off to the usual suspects who have already proven themselves insufficient at carrying out the job, history seems destined to repeat itself.

Let’s hope someone wises up before then.

See all NAS posts.