20 Jul 15. Can big data fight both shooters and hackers? After the September 2013 shooting at the Navy Yard, the Defense Department directed the establishment of the DoD Insider Threat Management Analysis Center to try to close some of the gaps that allowed a credentialed military contractor into the Navy Yard facilities. (Photo: Staff)
Keeping tabs on workers in contact with the federal government is high priority in an era that is not only post-Edward Snowden, but post-Fort Hood, post-Navy Yard and generally post-general-sense-of-security. The government’s struggles to maintain thorough backgrounds of its workers are well-documented, but now officials hope the use of big data will fix many of the problems. After the September 2013 shooting at the Navy Yard, the Defense Department directed the establishment of the DoD Insider Threat Management Analysis Center to try to close some of the gaps that allowed a credentialed military contractor into the Navy Yard facilities – and that also made it possible for other security breaches by cleared personnel. Part of that reconciliation will hinge on the use of continuous evaluation, an IT-powered version of the background checks regularly performed on military personnel. A pilot program employing continuous evaluation currently monitors roughly 250,000 personnel and will scale to 500,000 by the end of the year, according to Carrie Wibben, director of the security policy operations directorate in DoD’s Office of the Under Secretary of Defense (Intelligence).
Wibben spoke as part of a panel held by Defense One in Arlington, Virginia, on July 16.
“We’ve spent a lot of time and energy establishing a centralized DoD element to gather and fuse relevant information from different data sources within the department,” Wibben said. “And I imagine continuous evaluation will be one of those key data sources…in producing information on our workforce that will give us a better understanding and more holistic picture of the people working for and on behalf of the department.”
Continuous evaluation is a critical mission of the DITMAC. The center also relies on the service components to provide their own data they’ve collected from capabilities that currently are in development, the panelists said. The undertaking additionally relies on the vast troves of publicly available data online – including social media and other sources of public information.
“The mission is to enable information-sharing, collaboration, analysis and risk management across the DoD components to address current and emerging threats to DoD personnel and missions, including their information,” said Mark Nehmer, deputy chief of implementation at DITMAC. “Our job is to actually fuse the information we can find with the information they’ve already got at the component level, query inside and outside the department for additional information, bundle that and hand it back to the component for action as fast as possible. We’re an information exchange and enabling function.”
DITMAC’s mission and the Pentagon’s focus on maintaining up-to-date personnel background information are at the crosshairs of ongoing debates: What constitutes an insider threat versus a whistleblower, or what data is legal – or ethical – for the government to collect and keep?
“It’s not the technical issues anymore,” said Patricia Larsen, co-director of the National Insider Threat Task Force at the Office of the Director of National Intelligence. “It’s the legal questions, the non-technical constrains that are really the problem. As soon as you try to build a national-level program, you stumble across the different legal and civil liberties interpretations.”
But Wibben emphasized it’s less about personal information being collected and used by the government, and more about fixing the problems – including the failure to identify and flag certain behaviors and patterns – that led to the Navy Yard, Fort Hood and Edward Snowden.
“There are gaps in our periodic