Page 434

tion information, are included, the storehouse is immense. But the U.S. gov-
ernment has a weak system for processing and using what it has. In interviews
around the government, official after official urged us to call attention to frus-
trations with the unglamorous "back office" side of government operations.

In the 9/11 story, for example, we sometimes see examples of information

that could be accessed--like the undistributed NSA information that would
have helped identify Nawaf al Hazmi in January 2000. But someone had to ask
for it. In that case, no one did. Or, as in the episodes we describe in chapter 8,
the information is distributed, but in a compartmented channel. Or the infor-
mation is available, and someone does ask, but it cannot be shared.

What all these stories have in common is a system that requires a demon-

strated "need to know" before sharing.This approach assumes it is possible to
know, in advance, who will need to use the information. Such a system implic-
itly assumes that the risk of inadvertent disclosure outweighs the benefits of
wider sharing.Those Cold War assumptions are no longer appropriate.The cul-
ture of agencies feeling they own the information they gathered at taxpayer
expense must be replaced by a culture in which the agencies instead feel they
have a duty to the information--to repay the taxpayers' investment by making
that information available.

Each intelligence agency has its own security practices, outgrowths of the

Cold War.We certainly understand the reason for these practices. Counterin-
telligence concerns are still real, even if the old Soviet enemy has been replaced
by other spies.

But the security concerns need to be weighed against the costs. Current

security requirements nurture overclassification and excessive compartmenta-
tion of information among agencies. Each agency's incentive structure opposes
sharing, with risks (criminal, civil, and internal administrative sanctions) but few
rewards for sharing information. No one has to pay the long-term costs of over-
classifying information, though these costs--even in literal financial terms--
are substantial.There are no punishments for not sharing information.Agencies
uphold a "need-to-know" culture of information protection rather than pro-
moting a "need-to-share" culture of integration.

Recommendation: Information procedures should provide incentives
for sharing, to restore a better balance between security and shared
knowledge.

Intelligence gathered about transnational terrorism should be processed,

turned into reports, and distributed according to the same quality standards,
whether it is collected in Pakistan or in Texas.

The logical objection is that sources and methods may vary greatly in dif-

ferent locations.We therefore propose that when a report is first created, its data
be separated from the sources and methods by which they are obtained. The

HOW TO DO IT?

417

FinalCh12_13.4pp 7/17/04 4:14 PM Page 417