Who Killed the Virtual Case File?

Who Killed theVirtual Case File? Written by: Harry Goldstein Published: IEEE Spectrum, September 2005

Overview: September 2000: FBI IT begins Upgrade Project Virtual Case File (VCF) planned to replace the Automated Case Support (ACS) system April 2005: Project failed spectacularly, and was cancelled. FBI scrapped $105 million worth of unusable code

FBI background - why was the VCF so important? • As of 2004, the FBI had 40-50 different investigative • databases and applications • So, of course there were a lot of duplicate • information and functions • The FBI’s work environment is paper-based • Agents document every step and build case files • Each form goes through approval chain

Most heavily used investigative application Stores forms related to investigations Debuted in 1995, and was considered antique even then Cumbersome, inefficient, limited capabilities Complicated menus Allows basic searches Automated Case Support (ACS)

September 2000: FBI Upgrade Project approved by Congress Project consisted of 3 parts: Information Presentation: provide new Pentium PCs, scanners, printers and servers Transportation Network: provide secure local and wide networks User Application: identify a way to replace the FBI’s 40-something investigative software applications 3rd component ultimately became the VCF The Trilogy (1)

June 2001: Applications International Corp. (SAIC) awarded contract for software part Trilogy supposed to be delivered by the middle of 2004 But in 11/9 the inability if the FBI to share information became public knowledge: “The FBI’s information systems were woefully inadequate. The FBI lacked the ability to know what it knew.” (11/9 commission report, 2004) Trilogy is shifted to high gear The Trilogy (2)

Automate the FBI’s paper based work environment Allow agents and intelligence analysts to share investigative information Replace the Automated Case Support system VCF - Goals

The FBI didn’t have a blueprint The FBI couldn’t “make coherent or consistent operational or technical decisions” about creating policies and methods for sharing data, and making tradeoffs between information access and security (NRC report, 2004) The team began to “feel their way in the dark”. Characterized investigative processes and mapped them to the FBI’s databases First problem – no general direction

FBI’s team and SAIC’s engineers hashed out what functions the VCF would perform Requirements document ended up being 800- plus pages long Violated the first software planning rule: keep it simple Included system layout and application logic Agents would bring web pages to sessions to demonstrate how they wanted VCF to look Defining the requirements (1)

The requirements were not sufficiently defined in terms of completeness and correctness Later in the project, they required continuous redefinitions This had a cascading effect on what had already been designed and produced Defining the requirements (2)

January 2002: FBI requested an additional $70 million to accelerate Trilogy. Congress approved $78 million SAIC agreed to deliver the initial version of VCF in December 2003 (instead of June 2004) SAIC and the FBI were committed to creating an entirely new system in 22 months FBI wanted to switch to VCF using flash cutover More money

Trilogy contracts were changed to reflect the new deadlines Trilogy contracts didn’t specify any formal criteria for the FBI to accept of reject the finished VCF software Trilogy contracts specified no formal project schedule In particular, they specified no milestones Contracts problems

December 2002: FBI asked Congress for additional $137.9 million for the Trilogy The inspector general issued a report on the FBI’s IT management “The lack of critical IT investment management processes for Trilogy contributed to missed milestones and led to uncertainties about costs, schedule, and technical goals” Undisturbed by the findings, Congress approved $123.2 million Total cost of Trilogy so far: $581 million And yet more money

Meanwhile, SAIC programmers were cranking code, using a spiral development methodology Roughly 400 change requests of the system were made by FBI from December 2002 to December 2003 Some were cosmetic, but others required adding new functions to the system Example: page crumb The writing

Many changes of the program had to be made by all 8 of SAIC’s development teams SAIC officials admit that in the rush to get the program finished in time, they didn’t ensure that all the teams were making the changes the same way The inconsistency meant that when one module needed to communicate with another, error sometimes occurred Changing the VCF

SAIC began testing the VCF in the fall of 2003 13 December 2003: SAIC delivered the VCF to the FBI, only to have it declared DOA The FBI found 17 functional deficiencies it wanted SAIC to fix before the system was deployed Additional tests revealed 400 more deficiencies Delivering the VCF

June 2004: The FBI contracted an independent reviewer to recommend what the FBI should do with the VCF Delivered in January 2005, the report said: High level documents, including the concept of operations, were neither incomplete, inconsistent, and didn’t map to user needs The software cannot be maintained without difficulty It is therefore unfit to use VCF – The end

April 2005: FBI officially cancelled the VCF project May 2005: FBI announced Sentinel. A 4-phase, 4-years project intended to do the VCF’s job and provide the FBI with a web based case management system Sentinel’s estimated cost was unrevealed FBI’s officials seem confident that the FBI can handle the complicated project VCF – After

Thank you !

Who Killed the Virtual Case File?