Intelligence failure: get the right IT system thinking

[Presley Cannady]

Interesting little aside, since clouds were mentioned. I think this highlights the slow walk of IT towards even a clearly stated solution with a supposedly manageable scope. The problem the here is definitely a worthy one, especially in light of news reports detailing Amazon Web Service outages. A single IaaS/PaaS provider could still represent single point of failure. Can we federate these providers in a way to permit customers ot migrate their processes and data from amongst multiple cloud providers?

To that end, the Cloud Computing Interoperability Forum is at least a year old. They apparently made a big splash, considering the org's list of sponsors. They're targeting the major IaaS and PaaS providers, which probably numbers around 20 world-wide and of which probably less than ten really matter. The cheerleaders from Enomaly envision a future where such providers compete over your bytes and uptime cycles. They also want to go about this in a very open way, even hosting the API portion of the project on Google Code.

A year later, here's where the actual development effort stands.

[Jason Port]

The reality is that we do not have a technical problem. While I won't pretend to understand the advanced arithmatic above, I suspect that the mathmatical solution to predicting behavior is not so far from a reality. Looking at a person, observing their behavior and applying those behaviors against a model of a "terrorist" (No, Liles, this is not a boolean - more of a sliding scale, that someone is more likely than someone else to be a baddie). In turn we can then focus our efforts on those people. Naturally, this type of system will seldom capture the angry guy who just goes off and drives his SUV through a university or a nut case who is otherwise "ok" and shoots up Ft. Hood, but it _should_ provide us a list of people to observe more closely, and so we can stop searching cub scouts.

However, there is a policy issue and a people issue at hand here. Regardless of what we want to believe, our government doesn't like to share. This is often promoted by contractors who are protecting their own turf (Data makes you king, and sharing data is seen as weakening your realm). In turn, we find that various agencies can "collect" on someone, and failure to share is not met with a firing squad.

Conversely, I posit that data entry is annoying at best, and hard at worst. Given human nature and *our* desire to find the most leisure whenever possible, people don't bother to collect on the details. I flew through RDU this morning at 0600. The woman in front of me was meddling with her personal toiletries. The TSA rep told me I could jump into another line to bypass her. However, our practice should have been to report her by name on this behavior. Was it criminal? No. Suspicious? Not really. But when taken in conjunction with other behavior, it could show trends or patterns that might indicate negative or dangerous behaviors in the future. Sadly, my crack TSA agent instead made a smart assed comment and I was on my way.

The reality is that during a survey of any data store in the intelligence or C2 arena, we might be surprised at how many fields of data we ask for and how few are actually completed. It is really hard to do trending when 80% of your database is blank.

So, at the end of the day, the reality is that the ideas you all are promoting are sound mathematically and technologically, and if used to highlight individuals, organizations or even regions, these can be effective to help us plan. But until we are really serious (I mean firing some senior people in both the Government and Industry), I will just continue fighting the good fight and hoping that we get lucky again.

[Jason Port]

Until we solve for all of the rest, the Social Media - Faceyspaces, and TwitteryTweets are all just a time suck. Trust me - I use all of them, and they all waste time. To try and use these to paint a picture, when we can't mine structured, normalized data is simply a bridge too far.

During last year, I read about a use case from the intel community for twitter - Imagine two patrols twitter about the same event (like an IED blast) from two vantage points. Or that all of the patrol members twitter about the event. Now we have 24 reports (or whatever) about the event, and in turn our intel studs can form a complete picture based on the 24 strories of 140 characters each.

Seriously? The market has been blown sky high, and I am jumping on my iPhone? I don't know how to text and return accurate fire. Moreover, how do we know it was one event or 24? Location, separated by time could create multiple events? Is that 1 or 24?

Again, until we are mature enough to use the systems in play, let's keep reporting out of MilBook and Twitter. (OK - We can use Wikis - Intellipedia is supposed to be pretty hot - though it is just another island of information not accessible to the enterprise half the time)

[Presley Cannady]

If anyone's heard of a higher up tasking a junior to post or link to a Word doc on the wiki, that's one huge glaring indicator that Intellipedia is nothing more than a high tech circular file. I've seen it happen too many times in business that I'm not prepared to believe a government employee makes for a better user.

Bottom line, Wikipedia works because its users--some 300,000 listed editors + God knows how many million anonymous ones--grew it to meet their mostly individual needs, and the aggregate of their contributions meets the needs of hundreds of millions more. A corporate wiki exists solely because someone ordered it deployed and then ordered someone else to contribute to it. Another example of how differences in scale pose drastically different problems.

[selil]

A good example of the Wiki problem is at my Uni. My students all said how they needed a Wiki (woe I'm a dullard if I don't support their little socmed needs). So, we built it (remember this is the "user" community demanding it). They had many grandiose ideas of how they would use it. We populated it with course information, set it up, allowed some students editorial control (and the ability to grant it) and off to the races. We got stagnant pond water. It's still there (no real cost to leave it up), but the reality is that ONE wikipedia works, maybe a special one here or there. I know of one socmed web forum that tried a wiki too, but nobody participated.

I do reject a few things. The government intelligence community problem is not unique. It is a knowledge management issue (which is a lossy system). Wiki's are a form of knowledge repository but they are not the only ones. Small Wars Journal/Council is also a form, Amazon Answers (and others) are other forms of knowledge repositories.

The problem with most (not all) repository systems is they are passive/reactive. The issue with any technology is that it will likely be event driven and as a result not-predictive. Trend analysis and such strategies are flawed (if not we'd all be rich on the stock market). The best we can hope for is "best case" that fails rarely. I realize my compadre Presley has a bone to pick with the tech but, there are places where similar systems work pretty well if not perfectly. The imperfect, failure prone, immature technology that keeps getting referred to is over-hyped. Each of those criticisms are life cycle issues and in many cases development failures. You can't say all tech is bad and be any more relevant than the current failures in tech.

My personal belief (near religious zealotry) is that the only scalable effect that works is a mandelbrot fractal solution starting with the human being and integrating the technology. I'm far from the first person to suggest this strategy. The resulting solution is a person using technology and being replicated again and again with each smaller piece making a similar larger piece. This is how wiki's work but it isn't a wiki (if that makes any sense). Each person is a writer, editor, evaluator making thousands of judgements on each topic. Then larger groups and larger communities do the same. It is a known imperfect system (as many fake editing incidents prove). What we want to do with the technology solution is the same pattern of behavior only automate it as much as possible (the writing and data entry is all over the place being done by outsiders) and apply some filters to look for those outliers we're interested in. Will it be perfect? Not on your or my life. We still haven't reached Minority Report status and personally I hope we never do.

[JM2008]

Don't just discard the value added of IC versions of twitter and facebook. Though they may not fill the need for many of the topics covered in this thread, mainly Terror Watchlisting, they willl/do provide a invaluable human networking resource. Not sure if you have seen the video for Chirp (IC Twitter) but if not check it out. I could not find a good link but I will keep looking and post back if I find it. But as I see it, two of the biggest problems an analyst faces is 1) not being able to get the information needed to make proper assessments due to lack of knowledge where the data he/she needs is available and 2) once they produce products not being able to distribute those products to the customers that need them but the analyst doesn't know exists. This is where Chirp really fits in: allowing analyst to publish reporting to the masses while tagging it for relevance, and allowing other analysts to pull the info based on needs from sources they didn't know existed. And allowing them to follow those sources to keep up to date.

I know there is lots of debate about whether the push or pull method of data dissemination is the best. And I think that it is really neither one but more of a combination of them. This is what Chirp does. But what it doesn't do is provide the human networking capacity like facebook... That is currently filled by old fashion email. But an IC facebook would combine the functionalities into one place and likely provide even more.

-Just my 2 cents
James

[davidbfpo]

Reviewing my workload in 2011 I found this link to a presentation by Jeff Jonas to an EU-funded project: Macro Trends in CT Technologies. It is a rather large Mb Powerpoint:http://www.detecter.bham.ac.uk/pdfs/..._JeffJonas.ppt