Assurance Post 9 - 11 : Enabling Homeland Security

this country's critical infrastructure, the ability to share information and to do it securely is the key to an effective homeland security regime. This is a staggering undertaking. In the new Department of Homeland Security alone, a complete information-sharing system will have to encompass some 22 current agencies, many of which are not accustomed to working with one another. These agencies must also be connected to the intelligence community, the Department of Defense (DoD), and other civilian agencies. In essence, most of the federal government needs to be involved. Now add state and local organizations from law enforcement to public health and the private sector, which – after all – controls most of our critical infrastructure. The need for information assurance is paramount. For organizations that gather critical information – especially the law enforcement and intelligence communities – to be willing to share quality information , the computer infrastructure must be secure. This is particularly true if the information that is to be shared in a timely manner between these federal, state, and local entities and private sector organizations is actionable. If officials in these organizations do not trust that the information they provide will be protected and that it will only be shared appropriately, the information may be either withheld or sanitized to the point of uselessness. To build this data-sharing infrastructure , a set of technical, policy, and cultural issues must be addressed. The technical issues are complex but in some ways easier to deal with than the policy and especially the cultural challenges. For some time now, the problem for law enforcement and intelligence organizations has not been a lack of information. On the contrary, authorities are often swamped with information, but it resides in separated, isolated, and discrete systems. The problem is exacerbated when the data are stored in different formats in those different systems. Much of the time the problem is the lack of sufficient capability to establish relationships between these various bits of information. Real knowledge is found in these relationships, often more so than in the data itself. As seen in the days and weeks after 9-11, there were lots of facts about the individual terrorists responsible for the attacks. Because these facts were not brought together, however, no one could see the whole picture. Of course, there are numerous ways to create the needed information-sharing system. One approach would be to create …