1. Written by: Harry Goldstein Published: IEEE Spectrum, September 2005 1

2. September 2000: FBI IT begins Upgrade Project o Virtual Case File (VCF) planned to replace the Automated Case Support (ACS) system April 2005: Project failed spectacularly, and was cancelled. FBI scrapped $105 million worth of unusable code 2

3. As of 2004, the FBI had 40-50 different investigative databases and applications So, of course there were a lot of duplicate information and functions The FBI’s work environment is paper-based Agents document every step and build case files Each form goes through approval chain 3

4. Most heavily used investigative application Stores forms related to investigations Debuted in 1995, and was considered antique even then Cumbersome, inefficient, limited capabilities Complicated menus Allows basic searches 4

5. September 2000: FBI Upgrade Project approved by Congress Project consisted of 3 parts: Information Presentation: provide new Pentium PCs, scanners, printers and servers Transportation Network: provide secure local and wide networks User Application: identify a way to replace the FBI’s 40-something investigative software applications 3 rd component ultimately became the VCF 5

6. June 2001: Applications International Corp. (SAIC) awarded contract for software part Trilogy supposed to be delivered by the middle of 2004 But in 11/9 the inability if the FBI to share information became public knowledge: “The FBI’s information systems were woefully inadequate. The FBI lacked the ability to know what it knew.” (11/9 commission report, 2004) Trilogy is shifted to high gear 6

7. Automate the FBI’s paper based work environment Allow agents and intelligence analysts to share investigative information Replace the Automated Case Support system 7

8. The FBI didn’t have a blueprint o The FBI couldn’t “make coherent or consistent operational or technical decisions” about creating policies and methods for sharing data, and making tradeoffs between information access and security (NRC report, 2004) The team began to “feel their way in the dark”. Characterized investigative processes and mapped them to the FBI’s databases 8

9. FBI’s team and SAIC’s engineers hashed out what functions the VCF would perform Requirements document ended up being 800- plus pages long o Violated the first software planning rule: keep it simple Included system layout and application logic Agents would bring web pages to sessions to demonstrate how they wanted VCF to look 9

10. The requirements were not sufficiently defined in terms of completeness and correctness Later in the project, they required continuous redefinitions This had a cascading effect on what had already been designed and produced 10

11. January 2002: FBI requested an additional $70 million to accelerate Trilogy. Congress approved $78 million SAIC agreed to deliver the initial version of VCF in December 2003 (instead of June 2004) SAIC and the FBI were committed to creating an entirely new system in 22 months FBI wanted to switch to VCF using flash cutover 11

12. Trilogy contracts were changed to reflect the new deadlines Trilogy contracts didn’t specify any formal criteria for the FBI to accept of reject the finished VCF software Trilogy contracts specified no formal project schedule o In particular, they specified no milestones 12

13. December 2002: FBI asked Congress for additional $137.9 million for the Trilogy The inspector general issued a report on the FBI’s IT management o “The lack of critical IT investment management processes for Trilogy contributed to missed milestones and led to uncertainties about costs, schedule, and technical goals” Undisturbed by the findings, Congress approved $123.2 million Total cost of Trilogy so far: $581 million 13

14. Meanwhile, SAIC programmers were cranking code, using a spiral development methodology Roughly 400 change requests of the system were made by FBI from December 2002 to December 2003 Some were cosmetic, but others required adding new functions to the system o Example: page crumb 14

15. Many changes of the program had to be made by all 8 of SAIC’s development teams SAIC officials admit that in the rush to get the program finished in time, they didn’t ensure that all the teams were making the changes the same way The inconsistency meant that when one module needed to communicate with another, error sometimes occurred 15

16. SAIC began testing the VCF in the fall of 2003 13 December 2003: SAIC delivered the VCF to the FBI, only to have it declared DOA The FBI found 17 functional deficiencies it wanted SAIC to fix before the system was deployed Additional tests revealed 400 more deficiencies 16

17. June 2004: The FBI contracted an independent reviewer to recommend what the FBI should do with the VCF Delivered in January 2005, the report said: o High level documents, including the concept of operations, were neither incomplete, inconsistent, and didn’t map to user needs o The software cannot be maintained without difficulty o It is therefore unfit to use 17

18. April 2005: FBI officially cancelled the VCF project May 2005: FBI announced Sentinel. A 4-phase, 4-years project intended to do the VCF’s job and provide the FBI with a web based case management system Sentinel’s estimated cost was unrevealed FBI’s officials seem confident that the FBI can handle the complicated project 18

19. 19