STEPS toward a disaster response
an interim solution to support critical criminal justice services in an emergency
This paper describes the STEPS Disaster Response Project for New York State Division of Criminal Justice Services (DCJS). In formulating effective disaster responses, DCJS conceived a temporary disaster response for vital functions: the statewide temporary electronic fingerprint transmission standard (EFTS) processing system, or STEPS. Implementing STEPS posed several challenges: multiple organizational boundaries, aggressive timetables, and diverse architectures. Lessons learned focus on creative use of overlapping resources and capabilities, excellent support, and project advocacy by senior management, and a disciplined and proven project management process, supported by the agency chief information officer and project management office (PMO).
The STEPS Project
This paper describes project management practices reflected in a successful disaster response project for New York State Division of Criminal Justice Services (DCJS).
DCJS enhances public safety and improves criminal justice through core functions: fingerprint identification, arrest tracking, and maintaining criminal histories. In fulfilling these functions, DCJS relies on the US Federal Bureau of Investigation (FBI) and National Crime Information Center (NCIC) for national and other state data.
DCJS sets a high priority on disaster preparedness. In formulating effective disaster responses, DCJS conceived a temporary disaster response for vital functions: the statewide temporary electronic fingerprint transmission standard (EFTS) processing system, or STEPS. STEPS forwards EFTS requests to the FBI, receives an FBI rap sheet in response, and sends FBI rap sheets back to requesting agencies.
The project to implement STEPS as a temporary solution for disaster scenarios, leading to extended site or system outage of critical fingerprint identification processes, was accomplished in a 6-month project, at an approximate cost of US $250,000. The STEPS system provides temporary business continuity for vital DCJS systems, which are currently scheduled for replacement with high availability systems, at an anticipated cost in excess of US $25 million. A DCJS official referred to the cost effectiveness of the STEPS solution as spending “less than a penny on the dollar.”
Implementing STEPS posed several project management challenges: dealing with multiple organizational boundaries, aggressive management timetables, and diverse technologies. Managing the STEPS project involved supervising the activities of DCJS and vendor technical resources, and coordinating the activities of other project stakeholders, including: US FBI, New York State Police, New York State Integrated Justice and Office for Technology Network staff, Monroe County Information Technology staff, and New York City Police Department technical staff.
The STEPS project suggested several important lessons learned in the areas of creative use of overlapping resources and capabilities, project advocacy by senior management, and a disciplined and proven project management process, supported by the agency chief information officer and project management office (PMO).
Criminal Justice in New York
State and local governments in New York state evidence multiple layers of public protection. At the state level, the Department of Homeland Security (DHS) holds responsibility for domestic security, while a consortium of law enforcement agencies are consolidated as New York State Integrated Justice (IJ)--Division of Criminal Justice Services (DCJS), New York State Police, Department of Correctional Services (DOCS), and Division of Parole. New York's counties employ sheriffs, and cities, towns, and municipalities maintain police departments. New York's citizens are also served by district attorneys and district courts, at the state, county, city, town, and village levels.
Division of Criminal Justice (DCJS) Mission
DCJS enhances public safety and improves criminal justice through core functions (NYS DCJS, 2008a):
- Criminal history checks and fingerprint operations
- Providing timely information, public safety, law enforcement training
- Breathalyzer and speed enforcement equipment repair
- Accreditation of police departments and forensic laboratories
- Coordination of grant funds, Uniform Crime Reporting, research, hosting criminal justice boards and commissions
Under executive direction, DCJS also holds the following additional priorities (NYS DCJS, 2008a):
- Sex offender management—public outreach and education, community participation
- Sentencing commission—top-to-bottom review of New York's sentencing statutes
- Reduce violent and firearm crime
- Reduce recidivism through re-entry
- Increase DNA collection and compliance
- Information systems and performance management
- Human trafficking
Disaster Planning in Context
(Or, a Primer in Law Enforcement Biometrics)
Integrated Automated Fingerprint Identification System (IAFIS)
The Integrated Automated Fingerprint Identification System (IAFIS) is maintained by the Federal Bureau of Investigation (FBI), Criminal Justice Information Services (CJIS) Division. The IAFIS is considered the world's largest biometric database, containing fingerprints and criminal history information for more than 55 million individuals. The FBI makes IAFIS available 24 hours a day, 7 days a week for state, local, and federal law enforcement agencies, providing automated fingerprint search, latent searching and identification, and image storage. With IAFIS, the FBI can respond to criminal fingerprint submissions within 2 hours.
EFTS and EBTS
The FBI, the National Institute of Standards and Technology (NIST), and the fingerprint identification community collectively evolved a standard for the electronic storage and transmission of fingerprint image, identification, and arrest data. An American National Standards Institute (ANSI) standard entitled Data Format for the Interchange of Fingerprint Information (ANSI NIST-CSL 1-1993), and an addendum, Data Format for the Interchange of Fingerprint, Facial and SMT Information (ANSI/NIST-ITL 1a-1997), provide the formal basis of the FBI and NIST standards (FBI, EFTS).
The FBI formally communicated these standards in the form of the Electronic Fingerprint Transmission Specification (EFTS), the same acronym used by New York State DCJS to refer to the Electronic Fingerprint Transmission Standard. The EFTS, whether understood as specification or standard, was the accepted format for transmission of fingerprint, identification, and arrest information by the FBI, states, and other federal and local law enforcement. EFTS described operational concepts, field formats, values and edit specifications, and other parameters for exchanging data via IAFIS and state automated fingerprint identification systems (AFIS).
In response to advances in biometrics and biometric identification technologies, the FBI has developed the Electronic Biometric Transmission Specification (EBTS), which replaces EFTS Version 7.1. The new EBTS expands the specification to provide formats and parameters for new advances by the biometric identification industry, such as palm-print, facial, and iris identification.
The latest update to the ANSI/NIST Information Technology Laboratory 1-2007 (ANSI/NIST-ITL 1-2007) standard specifies record types for sharing data for new biometric identification features (FBI IAFIS).
Store and Forward
The New York State DCJS implemented the Store and Forward system to enable fingerprint storage and identification for New York State state and local law enforcement contributors, and to provide an interface with the FBI.
“The phrase ‘Store and Forward’ describes the transmission of data (biographic or pedigree data, such as name and address, sex, race, date of birth, etc., as well as related event-specific information), fingerprint images (as captured by use of a live-scan device, which eliminates traditional ink-and-roll images, or by use of a card scan device, a high resolution scanner which captures images from an inked fingerprint card), mug shots, palm prints, scars, marks, and tattoos, electronic signatures, and possibly other data pertinent to criminal justice processing.” (NYS DCJS, Store and Forward Implementation Overview)
The Store and Forward system allows DCJS to respond to arrest and inquiry submissions within 3 hours and facilitates an FBI response within 2 hours. The average turn-around time is usually considerably less. New York State and FBI rap sheets are delivered to meet statutory requirements, and allow arraignment decisions to be made immediately with up-to-date criminal history information (NYS DCJS, Store and Forward Implementation Overview).
Messages received or transmitted by Store and Forward must adhere to data standards maintained by NIST, FBI, and DCJS. That electronic transmission standardization provided the opportunity for New York State DCJS to implement STEPS as a quick, cost-effective, temporary disaster response capability, for critical fingerprint identification in service to New York State law enforcement.
Problem: Disaster Preparedness
DCJS, like other state agencies on September 11, 2001, experienced the widespread disruption of systems, infrastructure, and vital communications capabilities. In the years since 9/11, DCJS has been part of a state government response to civil emergencies, such as floods, ice storms, and blizzards.
Threat assessments also suggest the possibility of pandemic, or other disruption to the DCJS workforce. Current agency senior management places a high priority on support for homeland security and disaster preparedness, and viewed current infrastructure as inadequate to allow for business continuity and disaster recovery. Management also placed a high priority on effective coordination of federal and state resources and on establishing mechanisms for continuity of essential criminal justice services.
Opportunity: Fallback Layers
In assessing their business functions, DCJS recognized fingerprint identification, arrest/incident tracking, and maintenance of a criminal history rap sheet as critical agency functions. To perform these essential functions, DCJS relies on agency-maintained state data, as well as the FBI and National Crime Information Center (NCIC) for national and other state data. DCJS cooperates in joint arrest and incident tracking via the store and forward system, receiving and transmitting data in EFTS format.
In this context, DCJS fingerprint processing experts and STEPS project sponsors formulated a disaster response concept for their critical fingerprint identification processes. A disaster or outage mechanism should be designed to:
- automatically forward fingerprint requests directly to the FBI for identification and rap sheet;
- receive FBI rap responses and forward to requesting agency; and
- achieve a capability for temporary business continuity in lieu of a full-scale disaster solution.
In effect, the existing layers of mutually supporting federal and state EFTS-based systems provided DCJS with a built-in potential to create expeditiously a simple temporary disaster response system.
First STEPS Towards a Solution
After developing the concept for STEPS EFTS processing, DCJS sought to identify a vendor with subject matter expertise. DCJS and vendor engineers developed an elaborate design for partial and full outage scenarios. To accommodate and provide an effective solution for a wider range of disaster scenarios, DCJS requested the use of Monroe County Department of Information Systems data center facilities in Rochester, New York. DCJS enlisted the support of its technical services group, and assigned from their PMO a PMP-certified project manager, who implemented a formal project management approach.
Normal DCJS Processing
Normal DCJS fingerprint processing is depicted in Exhibit 1 below.
Exhibit 1--Normal DCJS Processing EPS Processing
Store and Forward users submit fingerprints to DCJS for Identification processing. DCJS attempts to identify, and if identified, DCJS forwards the identification and associated criminal history.
At the same time, DCJS forwards S&F requests to the FBI via the CJIS wide area network (WAN). DCJS then forwards any FBI response to Store and Forward contributors’ breakout rooms, for preparation of a packet for arraignment purposes. Store and Forward contributors can receive both DCJS and FBI responses via Store and Forward processing.
Exhibit 2—STEPs Activation
STEPS activation is depicted in Exhibit 2 to the left.
Once DCJS has been declared disabled, all incoming electronic Store and Forward fingerprint transactions will be routed to STEPS.
STEPS edits and stores electronic fingerprint transactions, and forwards criminal transactions to the FBI for FBI and NCIC processing.
The FBI processes the fingerprint transactions and sends a response (including an FBI rap sheet, if identified to a criminal history) back to STEPS. STEPS automatically forwards the responses to the fax number supplied by each Store and Forward contributor, based on a table of ORIs and fax numbers of participating agencies.
Business Continuity in a Disaster or Extended Outage
The criminal justice system in New York State depends on the automated systems of the DCJS to provide quick, accurate, and reliable processing of criminal fingerprint transactions. If the DCJS site in Albany were to become unavailable for a significant period of time, or if the Store and Forward system or system components experienced an extended outage, there would be a critical disruption to the administration of criminal justice in the state.
STEPS provides a disaster response for the continuation of Priority 1 criminal fingerprint processing, in the event of extended system outages or catastrophic site failures. The activation of STEPS in an emergency immediately switches all Store and Forward electronic fingerprint transactions from DCJS to an alternate location in New York State, and then forwards only criminal transactions to the FBI for processing and response. This allows for a virtually seamless process that would provide uninterrupted service to our Store and Forward customers for criminal fingerprint submissions.
STEPS was designed as temporary business continuity, and while activated, provides critical support of state and local law enforcement while DCJS works to rebuild or re-establish systems and normal processing capability.
Project Management Challenges
Organizational and Technology Boundaries
Organizational boundaries presented some unique project management challenges for the STEPS project. Multiple management layers separated diverse technical services departments, such as network, e-mail, and messaging, as well as other business groups, including application development, customer services, and Store and Forward--related program areas.
STEPS solution components spanned federal, state, and local systems, components, and capabilities. Multiple law enforcement agencies and networks participate in the Store and Forward system processes, with differing requirements, systems, capabilities, and client software products.
Although they share a high correlation, federal and state EFTS formats, systems, edits, and validations retain important and sometimes problematic differences. Store and Forward software itself has been implemented by different vendor partners of the multiple law enforcement agencies that participate. The STEPS project required both in-house technical staff and contractor/vendor participation, with significant technical interdependencies across disparate organizations.
However simple conceptually, the STEPS solution spanned diverse technologies and messaging architectures and formats, including IBM's MQ Series, SMTP, and XML. Multiple platforms were accommodated across federal, state, county, and local architectures. STEPS involves or touches mainframe, client server, Linux, Windows, and open systems network architectures.
STEPS was intended as a “temporary” solution, and cost-benefit assessments were predicated on a relatively short development and implementation timetable, versus a more comprehensive (and anticipated) enterprise disaster recovery solution. DCJS considered critical DCJS services to be vulnerable in several anticipated, possible, or probable outage scenarios. Project sponsors therefore set aggressive timetables and spurred the team towards timely completion.
Additionally, the New York City Police Department (NYPD) represents approximately 50% of statewide Store and Forward transactions. The high volume and high visibility of New York City as a primary customer generated added urgency for the timely implementation of STEPS. STEPS also attracted US Department of Homeland Security and New York State Office of Homeland Security interest. Clearly, STEPS provided New York State with the opportunity and challenge of serving as an “Early Adopter” model for other states. STEPS also generated high interest and expectations from the DCJS commissioner, her executive staff, and other top state officials. STEPS was even mentioned in State of the State communications.
What Worked Well
The STEPS solution depended on the use of overlapping capabilities as fallback in the event of disaster or outage, which ultimately represents the best accomplishment of STEPS. Redundant systems, independently designed and implemented, served as available and compatible resources for disaster response. New systems were not required, only new connections between existing resources.
The project was very well supported by senior management, who approved an expedited procurement from a leading biometric vendor with DCJS-specific expertise. New York State's Office of Homeland Security also provided funding support for STEPS. The STEPS project coordinated a collaborative design by in-house and vendor subject matter experts (SME), and major customer representatives (NYPD) participated in the testing of STEPS.
Finally, the STEPS project was supported by a disciplined and proven project management process, supported by the DCJS chief information officer and PMO.
Other Lessons Learned
STEPS would not have been successfully implemented without key management buy-in and leadership. DCJS conducted an effective cost-time-benefit assessment of requirements before project initiation. The STEPS project team conducted frequent conference calls and design meetings during design and implementation, allowing physically separate staff to work together effectively. The STEPS project undertook extended testing cycles, including a “production” test with DCJS major Store and Forward customer, NYPD. Project success was further ensured by continuous and deliberate follow-up and issue management.
Conclusion: A Definition of Success
The implementation of STEPS provided New York State DCJS with effective, temporary business continuity of critical law enforcement support functions via a quick-hit, lower-cost interim solution, in lieu of a more permanent and substantial disaster recovery infrastructure. This capability allows DCJS business continuity across a diverse range of disasters or extended system outages, while relying on existing fallback layers of national, state, and local law enforcement resources.
STEPS formed an extensible foundation for improved and enhanced disaster response capability for New York State, and led to increased New York State public safety and law enforcement community confidence in the resiliency of New York State DCJS support of vital law enforcement functions. The STEPS solution represents a model for other state law enforcement disaster response, particularly for existing Store and Forward system contributors.
STEPS project principals won two prestigious New York State governance awards: the 2008 Alfred E. Smith Award from the Empire State Capital Area Chapter of the American Society for Public Administration, awarded to DCJS chief information officer Anne Roest, and the 2008 “Best of New York Award” from the Center for Digital Government, awarded to project sponsor Nancy Campbell.
Shortly after leading STEPS to successful implementation as PROJECT Sponsor, Nancy Campbell passed away after a long, courageous, and inspirational battle with cancer. To honor her memory, dedication, and 26-year career with DCJS, Commissioner Denise O‘Donnell established the Nancy Campbell Award for Leadership and Innovation, to be presented annually to the DCJS employee or team who best demonstrates the spirit of leadership, courage, and innovation that Nancy modelled throughout her career.
e.Republic, Inc. (2008). Center for Digital Government 2008 Best of New York Award Winners. Albany, NY: Center for Digital Government, e.Republic, Inc.
Keane, Inc. (2002). Productivity Management: Keane's Project Management Approach. Boston: Keane, Inc.
New York State. (2005). New York State Criminal Justice Electronic Fingerprint Transmission Standard (EFTS). Albany, NY: NYS Division of Criminal Justice Services.
New York State. (2008). STEPS disaster response for fingerprint processing. Albany, NY: NYS Division of Criminal Justice Services.
New York State Division of Criminal Justice Services. (2006). Store & Forward Implementation Overview. Retrieved June 23, 2008 from http://criminaljustice.state.ny.us/advtech/overview.pdf.
New York State Division of Criminal Justice Services. (2008a). About DCJS. Retrieved June 26, 2008 from http://www/internet/crimnet/about.htm.
New York State Division of Criminal Justice Services. (2008b). DCJS official wins prestigious award. Retrieved June 23, 2008 from http://criminaljustice.state.ny.us/pio/press releases/2008-04-01 pressrelease.html.
New York State Division of Criminal Justice Services. (2006). Store & Forward Implementation Overview. Retrieved June 23, 2008 from http://criminaljustice.state.ny.us/advtech/overview.pdf.
Project Management Institute. (2004). A guide to the project management body of knowledge (PMBOK®Guide)---Third edition. Newtown Square, PA: Project Management Institute.
US Department of Justice, Federal Bureau of Investigation. (2008). Integrated Automated Fingerprint Identification System or IAFIS. Retrieved June 23, 2008 from http://www.fbi.gov/hq/cjisd/iafis.htm.
US Department of Justice, Federal Bureau of Investigation‥ (1999). Criminal Justice Information Services (CJIS) Electronic Fingerprint Transmission Specification. Retrieved June 23, 2008 from http://www.fbi.gov/hq/cjisd/iafis/efts70/cover.htm.
US Department of Justice, Federal Bureau of Investigation. FBI Biometric Specification (BioSpecs). Retrieved June 23, 2008 from http://www.fbibiospecs.org/fbibiometric/biospecs.html.
© 2008, Jeffrey C. Nuding
Originally published as a part of 2008 PMI Global Congress Proceedings – Denver, Colorado
Organizations must invest in building a culture - and project teams - that can turn cutting-edge ideas into reality, according to new PMI research.