The Perils of Paperless some Questions about the Latest Defense Business Trend - technical data in electronic formats

Naval War College Review, Summer, 2001 by Patrick J. Geary

In a document released in November 1997, Defense Reform Initiative: The Business Strategy for Defense in the 21st Century, then-Secretary of Defense William Cohen stated, "To carry out our defense strategy into the 21st century with military forces able to meet the challenges of the new era, there is no alternative to achieving fundamental reform in how the Defense Department conducts business." (1) One initiative spelled out in the document concerns how Defense Department business practices are related to the management of technical data supporting defense weapons systems.

Citing how recent improvements in information technologies have allowed the business world to conduct numerous operations in a paper-free environment, Secretary Cohen brought attention to the need for the Department of Defense (DoD) to move in the same direction. This department-wide initiative calls for 85 percent of all DoD technical manuals and 80 percent of all technical drawings to become electronically accessible. It is designed to achieve significant benefits: "By integrating paperless technical data management with electronic commerce for business information, DoD will eventually be able to support all major weapons systems in a paperless environment, from the initial design phase through production, operation, and maintenance." (2)

If fully implemented, the initiative promises such specific benefits as: a reduction in the cycle time for production contract awards; a reduction in the time to review technical drawings; a reduction in the number of contract data requirements lists needed to conduct business with DoD program offices; and significant cost avoidance. (3)

Despite these potentially significant benefits, however, the conversion of tens of millions of technical drawings, models, manuals, and manufacturing information into electronic images for easier access has profound implications for the adequate protection of the nation's most critical and sensitive defense-related information. Two primary concerns are access control to proprietary information and protection of classified information. Without addressing these issues fully, DoD's "new business strategy" might very well have an overall negative impact on U.S. national defense strategy.

PROPRIETARY INFORMATION

Defense-related technical data includes a variety of sensitive (and sometimes classified) information that must receive limited distribution and careful access control. Protection requirements for this information are specified in federal statutes and regulations, as well as directives, instructions, and standards of the Department of Defense, each of the military services, and the Department of Commerce. (4) One type of sensitive data requiring protection from unauthorized disclosure is proprietary information. There are three main concerns with electronically accessible proprietary information: legal liability, labeling and controlling the accuracy of data, and identifying users.

Recent federal court decisions, such as Bernstein v. U.S. Department of State, and subsequent written opinions from legal counsel of the Department of the Navy have focused on the need to protect proprietary data from unauthorized access via the Internet. (5) This legal issue has significant implications for systems that will operate and interface via the Internet. These legal interpretations have specifically stated that failure to properly protect proprietary data could result in violations of federal statutes such as 18 USC 1905, which prohibits the disclosure of proprietary data by the federal government.

The legal issue involving proprietary information is especially complex. Much of what the United States needs to conduct its national defense strategy comes from defense contractors, many of whom rely heavily on their proprietary or trade-secret information to stay in business. They allow the U.S. government access to their proprietary information on the condition it will be protected. If, however, in compliance with DoD's new business strategy, such information is put in electronic form but then not adequately protected, an unauthorized individual, organization, or company could obtain access to another company's proprietary data.

Until recently, almost all such data was kept in stand-alone storage facilities, which made it relatively easy to set up access control procedures. However, it is much more difficult to control access to data that is available through the Internet. Therefore, implementing a new DoD business strategy for electronic access poses an increased--and increasing--risk of legal liability to the U.S. government because of inadequate protection of proprietary information.

Also, in all cases where access is limited and distribution strictly controlled, there must be a method for the U.S. government to indicate who may have access. Maintaining control of this data will require labeling. It is not possible to control access to sensitive electronically stored information unless it is labeled in a way that can be universally recognized and understood. Most of the data described, including proprietary data, is either inadequately labeled or not labeled at all, making it impossible to determine the sensitivity of each item. (6) Providing adequate electronic labels for the voluminous proprietary data will undoubtedly be a time-consuming and costly undertaking.