Intelligent Enterprise

More than four years after the September 11 terrorist attacks, the U.S. government still lacks adequate policies and procedures for sharing sensitive and terrorism-related information, according to a Government Accountability Office report issued today.

The GAO surveyed 26 agencies for the report, finding 56 classifications of sensitive but unclassified information and many concurrent efforts in place to share data. Each agency determines independently how to use and share the data. The office warns that a dearth of government-wide policies makes consistency impossible.

"The lack of such recommended internal controls increases the risk that the designations will be misapplied," the report says. "This could result in either unnecessarily restricting materials that could be shared or inadvertently releasing materials that should be restricted."

There have been presidential mandates on the table to create these policies, but the decision-making power has shifted three times so far and little has been done. Last December, President Bush worked out details on how a new Information Sharing Council and a program manager in the Office of the Director of National Intelligence (ODNI) will work with other agencies to come up with united policies on information sharing by the end of 2006. The ODNI has since released a general draft plan to increase and strengthen information-sharing initiatives.

Though the GAO acknowledges that some progress has been made, stumbling blocks remain. The program manager for the ODNI resigned in January, and a replacement hasn't been named. Meanwhile, there's little employee knowledge of who and how many employees can designate documents, and little training on how to make designations or do policy reviews. And some agencies still don't trust the ability of others to keep sensitive information secure.

The government may be heading down the path to robust, secure information sharing, but it has a long way to go.