BlueSpace

'All source' intelligence analysis is a strategic goal of the intelligence community, but as the number of network domains and information silos continues to increase, it is an elusive goal. BlueSpace’s MLS applications enable intelligence analysis across multiple network domains from a single user interface.

The Challenge

Intelligence analysts are being asked to break out of their own agency’s information repositories, to do all source intelligence analysis from data across the community. This is hard enough in a joint context in the US between intelligence agencies, where there are valid concerns about how data will be used and distributed, potentially leading to disclosure of sources and methods. Given the increasing coalition nature of current operations, the challenge is now extending beyond the internal 9/11 focus of US intelligence agencies’ TS/SCI network compartments. NATO Secret, ISAF Secret, Mission Secret and various CENTRIX networks are increasingly become repositories of useful intelligence. On top of that, the volume and quality of ‘open source’ intelligence continues to improve.

When the information systems on each network domain are separate, intelligence analysts are being forced to repeat the same steps on each network to carry out their research – e.g. performing the same search on five different networks. This becomes impractical, and the tendency is for intelligence analysts to slowly reduce their activity on networks that provide only occasional value. Instead, they focus their search and analysis on the one or two network domains where most of the information resides, because users have little tolerance for repetitive processes that feel like they should be done by a computer.

This leads to incomplete intelligence analysis – rather than true ‘all source’ results, analysts provide intelligence products based on a subset of the information available.

Various projects have been implemented to try to address this challenge, and most have been based on cross domain transfer technologies, e.g. the MDDS cross domain transfer search solution. This solution allows a user on a dominant domain (typically JWICS) to search content from multiple networks, and it then pulls any resulting content up to the high-side for viewing. This strategy has two problems:

• High-side Infection: Moving rich data up to the high-side risks infecting the high-side network with a virus or cross-site scripting attack.
• Low-side Spills: To prevent low-side spills, users are typically not able to update or interact with the source documents on the low-side, so inaccurate or out of date content is not corrected.

Intelligence analysts need a suite of intelligence tools that enable ‘all source’ intelligence analysis while keeping the data on the right networks. This reduces information assurance risks, and also allows improved data access controls and auditing that can provide additional comfort to agencies as they are considering how to share information without putting sources and methods at risk of disclosure.

The Solution

This requirement can be fulfilled through Multi-Level Secure (MLS) applications. The intelligence community is already deploying the infrastructure to support MLS applications in the form of trusted desktops, such as SABER/DTW, HAP/TVE, NGD, etc. These trusted desktops are typically implemented to provide infrastructure cost savings – consolidating multiple physical networks into multiple logical networks running on a single physical infrastructure.

But these trusted desktops are capable of much more. They can run MLS applications – going beyond a Keyboard Video Mouse (KVM) switch between separate instances of Microsoft Windows at different security levels. MLS applications enable users to have a single user interface that spans multiple security domains:

• Discover: An MLS search client that can span multiple domains, enabling collaborative research, tagging, commenting etc. The US Government funded BlueSpace’s S2 {search and share} project as a replacement candidate for MDDS – Discover includes components from this project.
• GeoSpace: An MLS geospatial application enabling multi-INT analysis from different networks inside Google Earth. This product was originally created with a C2 focus in partnership with Hanscom, but support from DIA / USD(I) in the DCGS arena has highlighted requirements for the intelligence community outside of the C2 use case.

Providing intelligence analysis tools that can span multiple domains is a key enabler for an intelligence community that is being asked to work with an increasing number of network domains.