Social Network-Savvy Workers Improve Agencies, DHS Workshop Hears

Social networks, broadly understood, enable “security through transparency,” making it “manifestly more efficient” for agencies to fix software or other flaws, said Dan Chenok, chairman of the congressionally chartered Information Security and Privacy Advisory Board. Web 2.0 tools change the way agency staff think, and improve “intelligence gathering,” Drapeau said. “We often think we have the list of experts on some topic … and invariably we don’t,” especially on emerging threats. The Navy is considering such tools for recruitment and boosting morale, said Brian Burns, deputy chief information officer for emerging technology. The armed forces would prefer to create something like “Forcebook,” a service-wide social network, though, he said.

An informal survey of agencies by Drapeau and a colleague found “huge inconsistencies” on Web content that gets blocked, “and it gets pretty silly,” he said. Twitter may be blocked in one agency, but applications built on the Twitter service may get through. What’s more problematic is that decision-makers in each agency don’t seem to be talking to each other on some basic rules for blocking, resulting in wide disparities, Drapeau said. Burns said the military’s initial blocking of about a dozen sites and tools in 2005 was largely provoked by simple bandwidth hogging, not perceived new threats. It’s taking a more policy-based approach now, trying to make “generic” decisions on what to block, he said. The government has used a risk-based approach template for all other technology decisions for two decades, and it should apply the same for social networking tools, said Chenok. Data should be considered independently of their agency - a “significant wall” but not total ban on the sharing of intelligence data may be the best course, he said.

Data reliability through “authoritative sources” can be aided through Web 2.0 tools, Chenok said, pointing to the “Wikipedia effect” in which mass attention to inaccuracies leads to a quick correction. Burns said data tagging for location, duration, privacy and security settings should be added to regular content tagging. The military is moving towards “privileged management” in which device identification is considered in tandem with a person’s authority level, he said: “We don’t want to mash up data that’s a day old” if it will be used to deploy troops into combat.

Helping Internet users identify the authenticity of government communications is crucial, said Ed Felten, Princeton University professor of computer science and public affairs. In a crisis, “there will be people saying what the government is doing … and saying,” and much of the communication will be in the form of Web links, he said. Though the world is fixated on tweets from protestors in Iran’s election dispute, earlier this year a rumor spread on Twitter involving a military coup in Madagascar, Drapeau said. The State Department, with its own official Twitter presence, “had the guts to take action immediately” on the site to dispel the claim that the ousted president was hiding at the U.S. embassy there. A press release followed the Twitter correction, he said.

It’s not clear that government managers know that workers are social networking at the office, Drapeau said, calling a rarity the “enlightened bunch” at the workshop. They should, because “it’s not too hard to track down that so-and-so works in accounting at National Defense University,” especially with Facebook-loving interns, he said. But it’s good that workers are so savvy, because “informal intelligence gathering” through such connections can benefit the agency, he said. The challenge for top agency officials after setting the policy is educating “millions of people,” including contractors. Felten said workers’ use of social networking in itself, “even if the person doesn’t say anything about work,” can build an agency’s brand in the public eye. Drapeau already has a term and a study about the phenomenon: “indirect intimate influence.”

Cloud computing may also help security by pooling what are now disparate servers that must each be managed, Chenok said. The real question isn’t the security level of hosted services by Google or Amazon that hold government data, but who technically owns the data in the event of a security problem, he said. The cloud won’t fundamentally change the certification and accreditation process for agencies, inventory management or National Institute for Standards and Technology guidance, even as agencies move to service-level agreements, Burns said. But agencies will want to have a view of their own “local weather pattern,” or a localized cloud, he said. The danger is when agency clouds don’t have the functionality that workers need right away, which could lead them to create “spontaneous clouds,” Drapeau said. Felten told officials to brace for “crazy things” in the cloud’s data center that workers previously did, undetected, on their desktops. - Greg Piper