The Federal Bureau of Investigation's
Management of the Trilogy Information Technology Modernization Project
Audit Report No. 05-07
February 2005
Office of the Inspector General
|
This audit assesses the progress of the Federal Bureau of Investigation’s (FBI) Trilogy project. Initiated in mid-2001, the objective of Trilogy is to modernize the FBI’s information technology (IT) infrastructure; provide needed IT applications for FBI agents, analysts, and others to efficiently and effectively do their jobs; and lay the foundation for future IT improvements in the FBI. Trilogy consists of three parts: 1) upgrading the FBI’s hardware and software, 2) upgrading of the FBI’s communications network, and 3) upgrading the FBI’s five most important investigative applications, including its antiquated case management system. Because of the FBI’s immediate and critical need for modern IT systems and the past problems in the Trilogy project, we conducted this audit to assess the FBI’s progress in meeting cost, schedule, technical, and performance targets for the three components of Trilogy. We also examined the extent to which Trilogy will meet the FBI’s current and longer-term IT needs. In April 2004, the FBI completed the first two components of Trilogy. Among other improvements, the FBI has improved its IT infrastructure with new desktop computers for its employees and has deployed a Wide Area Network to enhance electronic communication among FBI offices and with other law enforcement organizations. However, despite additional funding the FBI had received to accelerate Trilogy, the first two phases of Trilogy were not completed any faster than originally planned. While the infrastructure components are now in place to support improved user applications, the FBI is still far from implementing the third component of Trilogy. In this third phase, the FBI has been seeking to implement a case management system called the Virtual Case File (VCF), which was intended to replace the FBI’s antiquated case management application, the Automated Case Support system (ACS). The VCF was designed to improve the FBI’s ability to manage investigative case files, facilitate data and document searches, and share information within and among FBI offices. The need for a new automated investigative case management system to replace the existing obsolete and limited ACS system is vital to the FBI’s ability to perform its mission effectively. Yet, the VCF has proven to be the FBI’s most troublesome IT challenge in the Trilogy project. Our audit found that as of December 2004 the VCF still remains under development. Moreover, after more than three years and $170 million expected to be spent developing the VCF, the FBI has not provided a clear timetable or prospect for completing the VCF. Between January and March 2005, the FBI plans to test a “proof-of-concept,” or prototype, VCF. This test is designed to demonstrate that documents can be approved electronically and uploaded into the ACS. However, this very limited version of the VCF does not provide the FBI with the intended case management and information- sharing capabilities. Instead, FBI officials informed the OIG that a parallel effort is underway in the FBI to reevaluate and update its requirements for a case management system and to identify solutions for a multi-agency case management framework called the Federal Investigative Case Management System (FICMS). The FBI believes this will provide a blueprint to guide the FBI in eventually acquiring the capabilities that the current VCF effort has been unable to accomplish and facilitate interagency information sharing. Working with officials at the Departments of Justice and Homeland Security, the FBI expects to enter into a contract by April 30, 2005, with a vendor to develop the framework for an interagency case management system for law enforcement components of the two participating departments, including the FBI. The FBI expects the resulting case management system to use off-the-shelf technology. The FBI is serving as the executive agent to lead the process of obtaining vendor information on potential solutions and to award a contract for FICMS. However, the FBI informed us that until it enters into the FICMS contract, which is intended to eventually result in a case management system to replace the largely unsuccessful current VCF effort, it will not know with certainty the proposed schedule and cost for completing the third component of the Trilogy project — replacing its antiquated case management system. Further, any system resulting from the FICMS effort is unlikely to benefit substantially from the 3-years and $170 million already devoted to the VCF effort because of technological advances since the FBI began the Trilogy project in 2001 and because of the FBI’s current planned approach to adapt off-the-shelf systems to meet its case management requirements. We concluded that the delays and cost growth in completing the Trilogy project were partially attributable to: 1) design modifications the FBI made as a result of refocusing its mission from traditional criminal investigations to preventing terrorism, 2) poor management decisions early in the project, 3) inadequate project oversight, 4) a lack of sound IT investment practices, and 5) other lessons learned over the course of the project. History of the Trilogy Project As noted above, the Trilogy project was intended to upgrade the FBI’s 1) hardware and software — referred to as the Information Presentation Component (IPC), 2) communications network — referred to as the Transportation Network Component (TNC), and 3) the five most important investigative applications — referred to as the User Applications Component (UAC). The IPC and TNC upgrades provide the physical infrastructure needed to run the applications for the UAC portion. Early in the project, the FBI decided it needed to modify Trilogy’s design requirements due to changes in FBI priorities after the Hanssen espionage case, the belated production of documents in the Oklahoma City bombing case, and the September 11, 2001, terrorist attacks. Most significantly, the UAC concept for the project changed from consolidating a variety of existing individual user applications to developing a new overall workflow process for FBI agents, analysts, and support personnel, which became known as the VCF.1 The VCF was intended to develop a new case management system that would vastly improve the FBI’s ability to manage investigative leads, evidence, and cases; analyze and share information; and approve and manage the flow of paperwork. Initially, the Department of Justice required the FBI to use two contractors for the Trilogy project because the project was considered too large for a single contractor to manage. The FBI combined the IPC and TNC portions of Trilogy in one contract because both components involved physical IT infrastructure enhancements. That contract was signed in May 2001 with DynCorp (which later merged into Computer Sciences Corporation (CSC)). In June 2001, the FBI awarded a contract to develop the UAC portion of Trilogy to another contractor, Science Applications International Corporation (SAIC). The purpose of the UAC was to:
After the September 11 terrorist attacks, the FBI reviewed the two Trilogy contracts and determined that the project did not fully meet the FBI’s changed IT needs because of a significant design limitation. Providing web-enablement of the existing but antiquated and limited ACS system, as was originally planned, would not provide the investigative case management capabilities required to meet the FBI’s post-September 11 priorities and mission. Instead, the FBI decided to develop a new case management system, the VCF, that would make both criminal and terrorist investigation information readily accessible throughout the FBI. Further, the FBI developed plans to accelerate Trilogy’s planned completion because the original 3-year modernization timeframe was considered too slow in light of the FBI’s urgent need to modernize its IT. Trilogy Schedule Our review found that the Trilogy project has been plagued by delays, and it is still not clear when the final component of the Trilogy project (originally called the UAC and now called the VCF) will be completed. Without completion of the VCF user application, the FBI continues to lack a fully functional case management system. This raises national security implications because the FBI is continuing to rely on the ACS and paper files, which hampers FBI agents and analysts from adequately searching and sharing information from investigative files. The original target dates for completing the IPC/TNC infrastructure and the UAC were May and June 2004, respectively. However, even before September 11, 2001, the FBI was looking for ways to accelerate this schedule. As described in this report, although the FBI received $78 million to accelerate Trilogy, the IPC/TNC portion was not completed more quickly than the original schedule. Instead the IPC/TNC portion was completed by April 2004, only slightly before the original pre-accelerated target date of May 2004. UAC/VCF Completion Dates The user applications portion of the Trilogy upgrade is still not completed, and our audit found that the FBI does not know when this component will be implemented. The FBI told us that the completion date of this portion of Trilogy depends on the outcome of the FICMS contracting process that the FBI believes will eventually lead to a fully functional investigative case management system. From its inception, this portion of Trilogy has undergone repeated revision and schedule delays. In June 2002, the FBI decided to deploy the UAC in two phases under an accelerated plan: delivery one in December 2003 and delivery two in June 2004 (a third delivery eventually was added, also for June 2004). Delivery one of the UAC was supposed to consist of the VCF, which was intended to be a completely new case management system with data migrated from the ACS. The VCF also was intended to serve as the backbone of the FBI’s information management systems, replacing paper files with electronic case files. The contractor, SAIC, provided the first delivery, or version, of the VCF in December 2003 in accordance with the accelerated schedule. However, the FBI did not accept that version because it was not a functional system and did not meet the FBI’s requirements. Deliveries two and three under the current contract consisting of enhancements and additional operational capabilities to the VCF, did not occur because of the difficulties experienced in completing the initial version of the VCF. The FBI informed us that these deliveries are not being pursued given the problems in the first delivery and the FBI’s plans to seek a common interagency platform for a case management system. With continued slippage in the VCF schedule, the FBI announced in June 2004 — the original target completion date prior to the FBI’s attempts to accelerate the development schedule — a new two-track plan for continuing work on the VCF involving an "Initial Operational Capability" and "Full Operational Capability." The first track is an 6-week test of an electronic workflow process scheduled to be completed in March 2005. During this test, one FBI field office and a smaller resident FBI agency office will enter investigative lead and case data into the "proof-of-concept," or prototype, VCF file system and this information will be uploaded into the ACS. Paper case files will be created through the existing ACS system upon electronic approval of the information entered into the VCF. The FBI intends to obtain user comments on, and assess the performance of, this new workflow system. Yet, the version of the VCF being tested in Track One will not provide the FBI with the case management application as envisioned throughout the Trilogy project because it represents just one developmental step in creating a fully functional investigative case management system. The tested version does not offer case management capabilities, but rather is designed to demonstrate that documents can be approved electronically and uploaded into the existing, obsolete ACS. The second track, called Full Operational Capability, is intended to reevaluate and update requirements for the next phase of developing a functional case management system to replace the ACS. To aid in determining the necessary requirements for a new case management system, the FBI will identify user activities and processes for creating and approving documents and managing investigative leads, evidence, and cases. The FBI states that information gleaned during Track Two will help the FBI update and confirm the case management requirements to be met through a new interagency system that will replace the current VCF effort. On September 14, 2004, the Department of Justice and the Department of Homeland Security (DHS) — with the FBI acting as executive agent — issued a Request for Information (RFI) to discuss with potential vendors the creation of the interagency FICMS framework because the participating investigative agencies share in common an estimated 80 percent of the case management requirements. The FICMS effort is expected to ultimately result in what the FBI expected the VCF to provide: the ability to manage investigative leads, evidence, and cases; analyze and share information; and approve and manage the flow of paperwork. On September 28, 2004, the FBI and the Department, along with the DHS and the Office of Management and Budget (OMB), presented an overview of the FICMS concept to the potential vendors in order to obtain information on available or potential solutions to meet the Department’s and DHS’s case management requirements. Given the technological advances over the last three years, the FBI anticipates that an off-the-shelf federal case management system might be adapted to meet the FBI’s user applications requirements. The FBI’s Chief Information Officer (CIO) told us that until a contract is signed for the FICMS project, which he expects to occur by April 30, 2005, he cannot estimate the schedule for completing an investigative case management system for the FBI. Trilogy Costs The current total funding for the FBI’s Trilogy IT modernization project is $581.1 million. As described in the chart below, Trilogy began as a 3-year, $379.8 million project. The FBI informed Congress in its February 2002 Quarterly Congressional Status Report that with an additional $70 million in FY 2002 funding, it could accelerate the deployment of Trilogy. Congress then supplemented Trilogy’s budget with $78 million from the Emergency Supplemental Appropriations Act of January 2002 to expedite the deployment of all three components. Therefore, total funding for Trilogy increased from $379.8 million to $457.8 million by the end of FY 2002. In December 2002, the FBI estimated $137.9 million was needed to complete Trilogy, in addition to the $78 million it received to accelerate completion of the project. Congress approved a $110.9 million reprogramming of funds that took into account DynCorp’s estimates to complete the IPC/TNC portions, as well as an estimate of SAIC’s costs to complete the UAC portion. The $110.9 million reprogramming increased the FBI’s total available funding for the project to $568.7 million. In addition, $4.3 million for operations and maintenance and $8 million for computer specialist contractor support were added in FY 2003, for a total of $581.1 million.
Currently, the FBI has not provided an estimated completion date for the third phase of Trilogy or an estimated cost. Pending the upcoming contract for FICMS, the FBI also does not have a firm cost estimate for bringing an investigative case management system to completion. Reasons for Trilogy’s Delays and Cost Increases Various reasons account for the delays and associated cost increases in the Trilogy project, including:
A more detailed discussion of the reasons for Trilogy’s schedule, cost, technical, and performance problems is included in the full audit report. The combination of these factors resulted in a project that has yet to be fully implemented. The current version of the VCF will not provide the needed case management capability to replace the obsolete but still functioning ACS. Whether and how soon the FICMS effort will result in the capabilities originally envisioned for the VCF remains to be seen. Conclusions The FBI recognized the need to modernize its IT systems before the September 11 terrorist attacks, but that event underscored the FBI’s significant problems in effectively retrieving, analyzing, and sharing investigative information needed to carry out its mission. Although attempts to accelerate completion of the Trilogy project with additional funding were unsuccessful, the FBI completed the sorely needed infrastructure upgrade portion of the project in late April 2004. However, we remain concerned about the FBI’s ability to complete and deploy the VCF so that FBI agents and analysts can effectively enter, retrieve, analyze, and share investigative case information and other data. Costing an estimated $170 million to date and in development for more than 40 months so far, the VCF is scheduled to undergo testing of workflow features of a prototype from January to March 2005. But the full VCF will not be functional or deployed at that time, and the FBI is moving away from the existing VCF as the solution for its case management requirements. Instead, the FBI is relying on the future (and uncertain) development of an interagency FICMS framework intended to result in a system that meets its case management needs. However, as of December 2004, the FBI informed the OIG it was not in a position to state the schedule or cost for completing and deploying such an investigative case management system until a FICMS contract is awarded in the third quarter of FY 2005. In the interim, the critical need to replace the ACS, the FBI’s obsolete case management system, remains. During this period, the FBI’s operations remain significantly hampered due to the poor functionality and lack of information-sharing capabilities of its current IT systems. OIG Recommendations In this report, we make nine recommendations for improving the FBI’s management of the remaining aspects of the Trilogy project and its IT management in general. These recommendations are:
Footnotes
|