Is TEMPEST Testing Complete?

The Coast Guard seems to be joining the chorus that fixing the government's acquisition system isn't about large overhauls and new rules. On Tuesday, I had the opportunity to interview Rear Admiral Gary Blore, the Assistant Commandant for Acquisition at the Coast Guard, as part of Department of Defense's Bloggers Roundtable. Our conversation focused on the Coast Guard's troubled Deepwater program, which Blore cited as an example of an innovative concept that was exciting "academically" as a possibility for transforming how the Coast Guard does acquisition, but never demonstrated maturity or innovation. "We would've been better off just using the usual techniques," he said.

This isn't a groundbreaking conclusion. In his March testimony before the House Subcommittee on Coast Guard & Maritime Transportation, he talked about how the Coast Guard is trying to depart from the Lead Systems Integrator concept, and heralded the eight cornerstones for successful acquisition: checks and balances, relying on the Coast Guard for final certification, a reliable and standard reference for acquisition management, robust strategic planning, transparency, avoidance of duplication, independent validation, and renewed oversight.

And on that last point of the need for renewed oversight, it seems like there is still work to be done. One of the primary issues POGO has focused on is the program's past failure to meet government-wide communications protection standards, commonly referred to as TEMPEST. Admiral Blore told me that both the visual and the instrumented tests for the TEMPEST were completed in April. But follow-up questions on that statement suggest that it isn't the case at all.

An important element for testing the TEMPEST is the Sensitive Compartmented Information Facilities (SCIF), which have not yet been installed. Currently, the plan is to have the SCIF installed and operational in March 2010. When I asked a Coast Guard representative if they would have to conduct more testing following the SCIF's installation, they confirmed that they would.

Which can only lead me to conclude that depending on your definition of "done"--and I favor a definition of operational testing, in which a system has demonstrated stability in an environment that closely parallels how it will have to actually function--the Deepwater program is still missing the key technology whistleblower Mike DeKort raised concerns about in 2003. The GAO is also concerned that the program is continuing procurement without completing operational testing.

The recent defense acquisition reform work demonstrates a recognition that major defense acquisition programs (MDAPs) experience more cost and schedule success if they don't wait until technology is tested and proven before ramping up production. The Coast Guard should cross-apply that analysis and not only be more transparent about the problems that exist, but also be wary of ramping up other Deepwater assets until the TEMPEST is proven. Sources tell POGO that there are still significant design problems that Congress should investigate and consider holding people responsible for. Without action, the problems and the fixes necessary for TEMPEST will only carry on to the other assets.

-- Mandy Smithberger

Comments

[Ian Murphy]

James M. Atkinson has been found to be a fraud and a bit out of sorts to put it mildly. You may want to distance yourself from this guy.

http://www.myfoxboston.com/dpp/news/local/cops-find-huge-stash-of-weapons-in-rockport-mans-home

http://www.gloucestertimes.com/punews/local_story_342225554.html

[Michael DeKort]

Open call for assistance in Deepwater case:

Within the next few months we will be fighting the motions to dismiss from Lockheed, Northrop and ICGS. If we lose this round the case is over. That means there will be no refund and the contractors will not be held accountable for the Deepwater problem.

(In addition to that Northrop has signaled that the companies actually intend to seek damages from the Coast Guard for stopping the program. Text from Northrop motion to dismiss the Bollinger suit states the following:

"Presumably, Lockheed Martin could seek compensation from the Coast Guard under the CDA for C4ISR equipment and information delivery delays, if any, caused by the government. As the prime contractor, ICGS, not NGSS or Bollinger, could best determine whether Lockheed Martin or NGSS could assert a CDA claim against the government for delays experienced in delivering equipment or information to Bollinger. ICGS could also sponsor such a claim against the Coast Guard on behalf of Lockheed Martin.")

Additionally one of the tactics Northrop is using is to blame the Coast Guard for the 123 problems. They state that the Coast Guard abused these boats, did not operate nor not maintain them properly. From the motion:

"The Coast Guard decision to decommission vessels does not lead to the inescapable conclusion that the defendants committed fraud. To the contrary, there is strong evidence suggesting that the 123 structural issues were attributable to the Coast Guard's operation of the vessels beyond their performance parameters and failure to maintain the structural integrity of the vessels, not any nonconformance with contract requirements."

This is an open call for assistance. We are asking for the Coast Guard and even contractor personnel who read these blogs to get involved. We feel there should actually be very little trouble winning this motion but given the importance and finality of the event we believe it is prudent to not take anything for granted. If there was ever a time to act to ensure the refund is paid and the contractors are held responsible this may be the last opportunity. Finally I am calling on the Commandant himself to make a public and service wide call for the men and women who serve in the Coast Guard to assist in our efforts.

- Michael DeKort
[email protected]

[Mandy Smithberger]

Thanks to Admiral Blore for continuing to engage with POGO and others on the Deepwater program. While it may have always been the plan to install the SCIF following the delivery and acceptance of the cutter--though sources have contacted POGO questioning whether this really was the plan--there are still legitimate questions as to whether this plan is advisable. As I mention in the post, the GAO has also been concerned about the state of operational testing and the rate of procurement in the Deepwater program. Sources also wonder what this will mean for the course of the other National Security Cutters.

Sources and others also still question how TEMPEST testing can really be considered complete if they are not run with everything operational. There are also concerns about the high costs of making the modifications and retrofits that will be necessary following this test, which may be even more costly than some of the past problems this program has seen. I hope to be able to go into more specifics about this soon.

For those looking for more on this, Coast Guard Report is a good place to start, specifically - http://cgreport.wordpress.com/2009/05/21/james-m-atkinson-on-pogos-report-on-tempest/

[Rear Adm. Gary T. Blore, U.S. Coast Guard]

I appreciated the recent opportunity to discuss Coast Guard National Security Cutter (NSC) acquisition-related issues with POGO. Unfortunately, confusion remains regarding the differences between TEMPEST certification of Bertholf’s standard electronic communication systems, and the separate Sensitive Compartmented Information Facility (SCIF) equipment, which will be installed during the post shakedown availability. Important to this discussion is an understanding of what TEMPEST is—and isn’t. It is a set of federal standards to be met vice a specific capability, suite, or set of equipment to be installed.

Most Coast Guard cutters have “secure” (controlled access) areas that house classified communications and sensor systems that are required for the ship to complete its mission. Cutters with this capability must meet TEMPEST requirements and be certified to process classified information.

A SCIF is an area where sensitive kinds of classified information may be stored, used, discussed, and/or processed. A SCIF should not be confused with other secure areas that do not meet SCIF standards. The SCIF is separate from the other secure areas including the “Operations Center” of the NSC, where much of the cutter’s command and control activities will take place.

The SCIF on board Bertholf will be a first for the Coast Guard—no other current Coast Guard cutters are equipped with a SCIF and it was not part of the cutter’s pre-September 11, 2001, requirements or design. However, the need for a SCIF was identified following that tragic event. Therefore, during Bertholf’s construction, the SCIF space was designed and built starting in 2003. The SCIF installed sensors and communications equipment design began with the Navy in 2004. Our plan has been consistently to install the SCIF systems within that space following delivery and acceptance of the cutter. Suggestions that this post-delivery installation of the SCIF is the result of an error are not correct.

Completing the April TEMPEST testing of the cutter’s non-SCIF electronic communications systems, prior to installation of the SCIF, was the prudent and normal approach to ensure Bertholf’s suite of advanced mission systems could begin operation and service to the public. TEMPEST certification of those non-SCIF electronic communication systems, as-is, enables Bertholf to be fully interoperable with other Coast Guard ships, aircraft and communications systems, as well as with those of the Navy.

The SCIF is not necessary for Bertholf to be interoperable with Coast Guard, joint, and interagency partners. However, it will increase the cutter’s ability to perform some missions, compared with other Coast Guard cutters.

Following the SCIF installation, the cutter will undergo additional TEMPEST testing to ensure it remains in compliance with applicable standards. This will also consider any of the already installed equipment on Bertholf, and how it would affect the cutter’s overall TEMPEST posture. Once certified, the SCIF will enhance the intelligence capabilities of the cutter’s already operational systems.

This situation is no different than any other Coast Guard ship that had an existing TEMPEST certification and then received major communications or sensor equipment changes, which over the 30 plus year service life of a cutter is typical.

The Coast Guard takes TEMPEST and other Information Assurance requirements very seriously and ensures that all tests and certifications comply with federally established standards.

[Thomas Jackson]

Makes you wonder doesn't it. From the start Coast Guard knew it wanted a ship that could operate with the U.S. Navy and other services in secure network. Yet to believe Blore, the SCIF was an after thought they planned all along to worry about about after they took delivery.

[James M. Atkinson]

So by the Coast Guards own admission, the ship really did not pass TEMPEST examinations as equipment was missing that was supposed to be inspected, and the place where the equipment is supposed to be installed is not actually built yet.

It is sort of hard to "pass" an inspection when the thing that you are suppose to be inspecting really isn't there.

Also, by the Coast Guards own admissions (of questionable veracity) the TEMPEST testing on the ship will not even be able to be started for another year.

Are you sure that Gary Blore is not actually a public relations specialist for the CG, and not actually involved in Acquisition at the Coast Guard? He seems to spend a lot of time spinning the failures of the Commandant and the Coast Guard in regards to Deepwater, and not so much time or effort in actually fixing the problems.

But by Neptune, the ship has an excellent paint job, and more public relations reports have been written about the ship then TEMPEST reports.

Why the cover-up, why all the spin control, why refuse to provide documents when asked, why all of the deception wrapped in deception, and why all the public relations machinations, why all the twisting of the media, and why all the lying by the Coast Guard.

-jma

[Order more Red Tape]

Naturally since it is a military surface vessel the NSC was designated to transmit and receive classified information. Consider that the NSC is advertised on the internet as being interoperable with the US Navy. Hence, this requirement is expected. The Coast Guard stated the NSC is undergoing all this work after delivery to ensure it satisfies the requirement for classified information. This begs follow-on questions such as,

Why was this requirement not addressed during the design and construction phase?

How much modification such as structural, electrical, and mechanical to the NSC is required to meet this requirement?

Will the post-delivery costs of meeting this requirement be readily available to POGO, or will they be classified?

Will the same post-delivery modifications be required for the other NSC's delivered after the Bertholf?