OMB and Information Sharing Michael Daniel Office of Management and Budget National Security Division C4I Branch Good morning. My name is Michael Daniel, and I am the branch chief for the Intelligence branch at OMB. If some of you came expecting the former Director of OMB, a man with a name very similar to mine, I can only say that I hope to be at least as entertaining as you expected a budget director to be. Roger Smith asked me to discuss information sharing and interoperability issues from OMB’s perspective. I tend to think that you’ll get more out of the session if I limit my talk to a few slides, and let you ask questions. So I’ll go through a few things from my point of view, and then give you the opportunity to pepper me with questions.

OMB’s Point of View Information sharing and interoperability form critical components of national security The federal government doesn’t consistently share information well Federal agencies need to improve their capabilities in this area From our pov, I would say OMB approaches this topic with three themes: It’s critical – okay, we’re a budget office, but even we can pick up on the fact that improved sharing of information is the only way to confront the national security and homeland security challenges we currently face. Right now, we don’t do such a good job of sharing in a formalized manner. I am well aware that many of you who have good relationships with your friends and counter-parts in other agencies may dispute this assertion. However, while we have some individual examples of sharing, it is not formalized and consistent.

What is OMB doing to support information sharing? Supporting the creation of the Terrorism Threat Integration Center (TTIC) Requiring IT business cases to demonstrate linkages and interoperability Making information sharing implicitly part of the criteria for success on the E-gov/IT area of the President’s Management Agenda Scorecard Closely following implementation of Intelligence Community-wide IT systems, like ICSIS and ICMAP All right, if I say that OMB thinks info sharing is important, what are we doing about it? 1. TTIC – we have been very involved in the process of creating the Terrorism Threat Integration Center (TTIC). Implemented properly, this project has the possibility of significantly

What are the challenges to information sharing from OMB’s perspective? More resources, new systems, or revised org charts will not necessarily guarantee better information sharing Greater information sharing and interoperability, while solving some problems, will create security risks Spending more is not always the answer (I’m the budget guy – I get paid to say this kind of stuff), but it is true that we don’t always need to simply spend more to achieve better information sharing. Sometimes the issues are more cultural and procedural than technical. New systems: we don’t want to simply add new IT systems without regard to what we’ve already built, or without looking at what agencies can borrow from each other. Revised org charts: simply drawing dotted lines on org charts won’t get the information to flow. Manages and employees will have to change their culture – a much harder task. Every solution contains elements of risk. Better sharing of information will necessarily entail increased risk in other areas, such as increasing the possibility of compromise if someone gains access to the system. Or it will make the spread of disinformation easier, if someone can get it into the large shared network.

Where are we going from here? IT spending justifications will have to show how the investment improves sharing or interoperability “Spend smarter, not just more” Management reviews will continue to emphasize information sharing as a requirement for success “Manage risks, as well as gains” I’m not sure exactly where we are going, but in light of the challenges we face, I think I can identify two trends: IT justifications will need to show more clearly how the system or investment supports the goals of information sharing. OMB is continuing to update and expand its use of business case reviews, and this idea is becoming more prominent in our reviews. The PMA scorecard will continue to have sharing as a goal. In addition, since we can’t get rid of it, managers will need to develop ways to handle the risk inherent in implementing information sharing solutions.