State of Connecticut AUDITORS OF PUBLIC ACCOUNTS Of?ce of the Attorney General November 20, 2013 CJ IS Governing Board c/o Under Secretary Mike Lawlor Of?ce of Policy Management Criminal Justice Policy Planning Division 450 Capital Avenue Hartford, CT 06106 Re: Connecticut Criminal Justice Information System Dear Criminal Justice Information System Governing Board Members: In response to a complaint filed pursuant to Connecticut General Statutes 4? 6ldd, the Office of the Attorney General and the Auditors of Public Accounts have been conducting an investigation of certain issues raised regarding the planning, construction, costs, and oversight of the Criminal Justice Information System Connecticut?s criminal justice community consists of ll agencies.2 The need for Connecticut to create an electronic, modern document sharing system became the centerpiece of the criminal justice reform package approved by the General Assembly in 2008. The project was not adequately funded until 2011. In September 2011, Governor Malloy announced that the state had signed a contract with Affiliated Computer Services, Inc. (ACS), a Xerox company, to build the state?s new Connecticut Information Sharing System (CIS S), which will help criminal justice personnel enhance public safety by sharing intelligence through automated document integration tools that will allow the exchange of information among state and local agencies. The goal of CISS is to allow appropriate criminal justice personnel and support staff from various agencies and 1 CJIS is the umbrella term for the information sharing activity-among state agencies, Specifically, CJIS is a term encompassing programs that generaily incorporate a number of interagency initiatives and projects among the criminal justice agencies relating to data and information sharing. 2 Of?ce of Policy Management, Department of Correction, Of?ce of the Chief State?s Attorney, Department of Emergency Services and Public Protection, Of?ce of the Chief Public Defender Services, Office of the Chief Court Administrator, Department of Administrative Services, Board of Pardons and Paroles, Office of the Victim Advocate, Connecticut Police Chiefs Association, Department of Motor Vehicles. branches of state government and local law enforcement to share comprehensive files and information on suspects, arrestees, and offenders electronically. The establishment of an effective information and electronic document sharing system among the state?s criminal justice agencies and local law enforcement is vitally important. It is our understanding that the Governor is committed to the project and nothing in this letter in any way suggests that the project should not move forward. We think it should. However, based on our investigation, we conclude that the CJIS Governing Board (Board) must have greater access to information on the status of the C188 construction phase so that it can exercise more effective and robust oversight as the project proceeds. A. THE STATUTORY AUTHORITY The Board has broad and comprehensive statutory authority to oversee the complex and highly technical CJ IS project. By statute, the Board is composed of the Chief Court Administrator, the Commissioner of the Department of Emergency Services and Public Protection, the Secretary of the Office of Policy and Management, the Commissioner of the Department of Correction, the chairperson of the Board of Pardons and Paroles, the Chief State?s Attorney, the Chief Public Defender, the Commissioner of the Department of Administrative Services, the State Victim Advocate, the Commissioner of the Department of Motor Vehicles, the Chairpersons and ranking members of the joint standing committee of the General Assembly on Judiciary and the president of the Connecticut Police Chiefs Association. (See Connecticut General Statutes The Board is within the Office of Policy and Management (0PM) for administrative purposes only.3 By statute, the Chief Court Administrator and a person appointed by the Governor from among the membership serve as chairpersons. Currently, OPM Undersecretary for Criminal Justice Michael Lawlor and Superior Court Judge Patrick Carroll, Deputy Chief Court Administrator, are the Board?s chairs. The Board is statutorily authorized to develop, plan, and maintain policies in addition to providing direction for the efficient operation and integration of criminal justice information systems, whether such systems service a single agency or multiple agencies. (See Connecticut General Statutes The Board shall establish standards and procedures for use by agencies to ensure the interoperability, authorized access and security of such systems. Id. In addition, the Board is directed by statute to: (1)-oversee the operations and administration of criminal justice information systems; (2) establish such permanent and ad hoc committees as it deems necessary, with appointments to such committees not restricted to criminal justice agencies; (3) i recommend any legislation necessary for implementation, operation and maintenance of criminal justice information systems; (4) establish and implement policies and procedures to meet system-wide objectives, including the provision of appropriate controls for data access and security; and (5) perform all necessary functions to facilitate the coordination 3 See C.G.S. 4-38f for de?nition of "administrative purposes only". 2 and integration of criminal justice information systems. (See Comiecticut General Statutes By statute, the Board has the authority to hire an Executive Director to serve at its pleasure. 0PM is directed by statute to provide the CJIS Executive Director with necessary staff and supplies to carry out the project.4 Sean Thakkar currently serves as the Executive Director. B. THE INVESTIGATION Our review commenced on or about January 30, 2013 with the ?ling of a complaint pursuant to the Whistleblower Act, Connecticut General Statutes The Whistleblower Act provides for investigation by our of?ces of complaints concerning, among other things, ?mismanagement? in any state department or agency or large state contract. Our investigation involved review of documents, interviews with contractors and other project stakeholders, discussion with Board chairs and attendance at Board meetings. Our investigation focused on serious issues with the CISS project. These concerns are corroborated by the July 2013 quarterly risk assessment prepared by MTG Management Consultants (MTG), the contractor that CJIS retained to provide audit and oversight assistance throughout the design and construction of CISS. The July 17, 2013 quarterly risk assessment speci?cally stated that the CISS project is at a ?high risk for failure? and it is unlikely to be completed in November 2014, as was projected in the most recent report to the Connecticut legislature on the status of the CJIS project (July 1, 2013) Although further investigatory steps are possible, our investigation to date provides sufficient basis both to reveal areas of major concern and to formulate general recommendations to assist the Board and the CJ IS leadership team in remediating them. C. AREAS OF CONCERN Our investigation reveals the following significant concerns the Board should address or in some instances, continue recently instituted efforts to address if the CJ IS project is to be completed successfully and with a minimum of further unnecessary delay and cost overrun: 1. There have been significant deficiencies in the timeliness, clarity, and accuracy of information communicated to the CJ IS Governing Board by CJIS staff and others. 4 The CJIS Support Group (CSG) assists with overseeing, monitoring, and maintaining technical and business support for IS initiatives, including CISS. 3 2. The operational costs incurred and projected to complete the project have exceeded expectations due to poor communication and management and must be restrained to the extent feasible. 3. Management and communication de?ciencies have reduced the likelihood that will be completed within the projected timeframe or that it will achieve projected cost savings. 4. The Board must continue to ensure that the CJIS leadership team has the requisite technical, business, and leadership skills and experience necessary to effectively and efficiently manage the project. Central to each of these concerns is our conclusion that the quality of information provided to the Board by CJ IS staff has been consistently poor, substantially explaining and contributing to a failure by the Board to meaningfully engage the Executive Director, the former CISS program manager, its outside consultant, contractors and others in candid and substantive conversations about the project. Status reports presented to the Board have been incomplete and obscured by technical jargon. Significant issues of concern have not been brought to the Board?s attention in a timely and effective mamier. For instance, the Board does not currently receive the quarterly risk assessments prepared by MTG. The assessments identify, among other things, specific risks associated with the C188 project implementations In addition, it is not clear that either the Executive Director or the CJ IS Support Group (CSG) possess a suf?cient understanding of the system?s technical design and intended workflow. Nor does it appear that all Board members have been provided an adequate explanation of the fundamental aspects of the planned information sharing system. For example, there has been an ongoing issue as to whether so called information? was intended to or should be part of CISS. Yet, based on a review of documents, discussions with stakeholders, consultants and contractors, and attendance at Board meetings, it was evident that there was neither a unified understanding of what constituted information? nor of how documents were generated or flowed through the criminal justice system. This issue and the inability to effectively and timely address it, contributed to significant project delays and considerable discord amongst certain stakeholders regarding the C188 project?s direction and ability to fulfill its promise of information sharing. In addition, at the August 2013 Board meeting, representatives from Xerox expressed clearly that the Board needed to make a decision regarding how CISS will operate and communicate that goal to Xerox so that it could meet its contractual obligations. To date, however, it is our understanding that the state has not yet reached an agreed upon work plan and timeline of deliverables with the vendor. The lack of a clearunderstanding of the key elements of the project and inability to reach a timeline of deliverables with the contractor has a direct bearing on the 5 The Quarterly Risk Assessment Detail is specifically intended to ?help in identifying potential problem areas that may exist so the appropriate mitigation plans can be developed and implemented.? The purpose of the assessments is to this information to CJIS ?executive management and project staff members.? completion of the project, which may result in cost oVerruns, and therefore must be rectified immediately. D. RECOMMENDATIONS We recognize that the Board, the Executive Director and the CSG have recently taken positive and encouraging steps to improve some areas of concern. In particular, we commend them for implementing more frequent meetings of a steering committee and replacing the C188 program manager with a durational program manager who has displayed impressive communication skills and technical project knowledge. However, additional changes should be implemented, as discussed below, to improve communication, correct project mismanagement and increase operational transparency. In setting out these recommendations, we emphasize that the Board is not simply an advisory panel. Rather, by statute, it has broad authority and responsibility to establish and implement policies and procedures to meet system?wide objectives. As such, the Board can and should take a more active role in project development and exercise greater oversight of the Executive Director, project budget, contracting matters, and quality assurance. Recommendations to the Board 1. Assess whether, due to complexity and time demands of the project, Board members should appoint designees with the available time and experience necessary to ensure the Board is fulfilling its statutory responsibilities. (See Connecticut General Statutes establishment of an Executive Committee staffed with criminal justice agency and/or non?criminal justice agency persomiel with the requisite technical and operational experience). - 2. Direct the CHS Executive Director to communicate all'significant issues, both positive and negative, to the Board in a comprehensive, easily understood and timely manner, including by providing the Board with complete copies of all past and future Quarterly Risk Assessment Detail reports issued by MTG. 3. Direct the Executive Director to report the status and timeline for completion of the contract discussions with Xerox, including the status of any revised work plan, the timeline of deliverables and the status of payment issues. Representatives from Xerox should participate in such a presentation. 4. Direct the Executive Director to provide a detailed briefing on the current budget and timeline of the project, to include an explanation for any differences between the current work plan, budget and projected timeline with the original work plan, budget and project timeline. 5. Review information developed through the contract status report and/or budget and timeline brie?ng in order to determine whether corrections or clari?cations should be made to the July 2013 Report to the Legislature and, if so, provide any necessary corrections. - - 6. Address and resolve all payment issues with Xerox. 7. Consider implementing frequent quality assurance reviews. 8. Assess the current status of the durational program manager and, if necessary, engage in a search for a permanent CISS program manager with a strong IT background and the ability to effectively communicate and collaborate with the stakeholders, consultants, and contractors. Such an individual should possess a practical understanding of the criminal justice process, including how a matter develops in the criminal justice system and how documents are developed and used by the various criminal justice agencies. 9. Evaluate whether changes, including the addition of personnel, are necessary in the CJ IS Leadership and CSG. E. CONCLUSION Because state resources continue to be spent on the CJIS project and because its successful completion advances vital state interests the public is best served by alerting you immediately to our conclusions and recommendations. Accordingly, we have decided that the best course is to conclude our active investigation at this time subject to reopening in response to new information or circumstances. Our staffs are available to discuss with you our conclusions and recommendations in further detail. We wish you all the best for your continued efforts on this important project. Thank you for your attention to this matter. Sincerely, John C. Geragosian 4 Robert M. Ward Georgie C. Jepsen Auditor of Public Accounts Auditor of Public Accounts Attorney General cc: Judge Patrick L. Carroll, Ill