Risk
1/7/2010
12:22 PM
John Foley
John Foley
Commentary
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Airline Security: The Technical Task Of Connecting Dots

The Obama team must not underestimate the integration effort required to assimilate intelligence data generated by myriad sources.

In his investigation into the government's bungled handling of the would-be Christmas Day bomber, President Obama was miffed to learn that sufficient information existed to reveal the plot, but that intelligence experts failed to "connect the dots." The President will soon find that connecting the dots is the hardest part of this highly complex intelligence undertaking.

"This was not a failure to collect intelligence; it was a failure to integrate and understand the intelligence that we already had," Obama said of the intelligence breakdown. "The information was there." He has ordered a review of the government's aviation screening technology and procedures and its terrorist watch list system, and preliminary findings are due as early as today.

There are many pieces to this puzzle, including intelligence data on known terrorists and suspects, information gleaned from passports and visa applications, ticket purchases, airport screening systems and procedures, airline passenger lists, video surveillance, information generated by acquaintances of terrorists and suspects, phone records, and even clues on social media sites.

Pulling those data streams together--from federal agencies, law enforcement, foreign governments, and private sector companies--and getting that information to the right people quickly and in useable format are huge technical challenges. While there were obvious missed opportunities in the case of Umar Farouk Abdulmutallab, including failure to take action with information in hand, it would be a mistake to underestimate the end-to-end data integration effort required as one of, simply, "connecting the dots."

Many corporate IT departments struggle daily with similar data integration issues in their customer service, supply chain, manufacturing, and other operations. They may have invested millions of dollars in data analysis infrastructure, but be caught off guard when a disgruntled customer jumps to a competitor.

For TSA, Homeland Security, and other government agencies on the front lines of the fight against terrorism, the consequences of missed signals are potentially much more serious, but the technical challenges of assimilating and analyzing data from myriad sources are familiar. Intelligent Enterprise's Doug Henschen, an authority on business intelligence, says the feds face a classic information management challenge, one of sifting through many terabytes of structured data in disparate databases and unstructured data in the form of documents and e-mail, all in hopes of finding a few fragments of potentially life-saving information.

The information is "there," as the President says, but how do tidbits of data in a dozen different places get transformed into actionable insight? Some of the technologies and practices that come into play include enterprise content management, master data management (i.e. data governance), data cleansing, complex event processing, text mining, identity resolution, data integration middleware, data mining, BI tools, relational databases, and data warehouses. U.S. intelligence agencies have already implemented many of these capabilities, so the question is whether they've done so effectively and what more can be done.

President Obama has ordered that corrective steps be taken immediately, which means agency heads and CIOs are already busy evaluating what to do differently as they try to stop the next bomb-clad terrorist. Emerging technologies could play a role. In-Q-Tel, the CIA's tech investment arm, has recently invested in social media analysis software and open source search capabilities, in two examples of the possibilities. As InformationWeek's Alex Wolfe reports, Obama's security push is also spurring scanner patents.

Of course, technology alone won't do it. Security lapses in the Dec. 25 incident weren't merely a matter of technical limitations or failings, as the forthcoming White House report will demonstrate. Solutions will require attention to people, process, and communications.

Federal CIO Vivek Kundra should play a central role in the push for better government intelligence. Kundra knows how to scrutinize IT architecture to unearth data and how to rally government CIOs around a common cause, as he's doing in support of Obama's government transparency initiatives. Kundra must tackle homeland security and the fight against terrorism with the same focus and urgency.

There's a saying in the BI crowd that hints at the intractable nature of the problem: "If only we knew what we know." (There's a book on knowledge management by that title.) President Obama is understandably frustrated over the government's inability to aggregate and share critical, time-sensitive information, and he's right to insist on improvement and accountability. Getting it right won't be fast or easy, but government intelligence can and must be better.

Government Technologist is a regular column by John Foley, editor of InformationWeek Government. You can follow him at Twitter.com/jfoley09.

Federal CIO Vivek Kundra is our Chief of the Year. Find out his plans for executing on his many goals as well as the many challenges ahead. Download the report here (registration required).

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-2413
Published: 2014-10-20
Cross-site scripting (XSS) vulnerability in the ja_purity template for Joomla! 1.5.26 and earlier allows remote attackers to inject arbitrary web script or HTML via the Mod* cookie parameter to html/modules.php.

CVE-2012-5244
Published: 2014-10-20
Multiple SQL injection vulnerabilities in Banana Dance B.2.6 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) return, (2) display, (3) table, or (4) search parameter to functions/suggest.php; (5) the id parameter to functions/widgets.php, (6) the category parameter to...

CVE-2012-5694
Published: 2014-10-20
Multiple SQL injection vulnerabilities in Bulb Security Smartphone Pentest Framework (SPF) before 0.1.3 allow remote attackers to execute arbitrary SQL commands via the (1) agentPhNo, (2) controlPhNo, (3) agentURLPath, (4) agentControlKey, or (5) platformDD1 parameter to frameworkgui/attach2Agents.p...

CVE-2012-5695
Published: 2014-10-20
Multiple cross-site request forgery (CSRF) vulnerabilities in Bulb Security Smartphone Pentest Framework (SPF) 0.1.2 through 0.1.4 allow remote attackers to hijack the authentication of administrators for requests that conduct (1) shell metacharacter or (2) SQL injection attacks or (3) send an SMS m...

CVE-2012-5696
Published: 2014-10-20
Bulb Security Smartphone Pentest Framework (SPF) before 0.1.3 does not properly restrict access to frameworkgui/config, which allows remote attackers to obtain the plaintext database password via a direct request.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.