Virtual Case File

This article needs additional citations for verification. Please help improve this article by adding citations to reliable sources. Unsourced material may be challenged and removed. Find sources: "Virtual Case File" – news · newspapers · books · scholar · JSTOR (August 2010) (Learn how and when to remove this message)

Virtual Case File (or VCF) was a software application developed by the United States Federal Bureau of Investigation (FBI) between 2000 and 2005. The project was officially abandoned in April 2005, while still in development stage and cost the federal government nearly $170 million. In 2006, The Washington Post wrote "In a 318-page report, completed in January 2005 and obtained by The Post under the Freedom of Information Act, [the Aerospace Corporation] said the SAIC software was incomplete, inadequate and so poorly designed that it would be essentially unusable under real-world conditions. Even in rudimentary tests, the system did not comply with basic requirements, the report said. It did not include network-management or archiving systems—a failing that would put crucial law enforcement and national security data at risk"^[1]

In September 2000, the FBI announced the "Trilogy" program, intended to modernize the bureau's outdated Information Technology (IT) infrastructure. The project had three parts: purchasing modern desktop computers for all FBI offices, developing secure high-performance WAN and LAN networks, and modernizing the FBI's suite of investigative software applications. The first two goals of Trilogy were generally successful^{[citation needed]}, despite cost overruns. Replacing the Bureau's Automated Case Support (ACS) software system proved difficult. It had been developed in-house by the bureau and was used to manage all documents relating to cases being investigated by the FBI, enabling agents to search and analyze evidence between different cases. The project was originally scheduled to take three years and cost US$380 million. ACS was considered by 2000 a legacy system, made up of many separate stovepipe applications that were difficult and cumbersome to use. ACS was built on top of many obsolete 1970s-era software tools, including the programming language Natural, the ADABAS database management system, and IBM 3270 green screen terminals. Some IT analysts^[1] believed that ACS was already obsolete when it was first deployed in 1995.

Bob E. Dies, then the bureau's assistant director of information resources and head of the Trilogy project, prepared initial plans in 2000 for a replacement to ACS and several other outdated software applications. In June 2001, a cost-plus contract for the software aspects of the project was awarded to Science Applications International Corporation (SAIC), and the network aspects were contracted to DynCorp. Dies was the first of five people who would eventually be in charge of the project. The software was originally intended to be deployed in mid-2004, and was originally intended to be little more than a web front-end to the existing ACS data.

Robert Mueller was appointed director of the FBI in September 2001, just one week before the September 11, 2001 attacks. The attacks highlighted the Bureau's information sharing problems and increased pressure for the Bureau to modernize. In December 2001, the scope of VCF was changed with the goal being complete replacement of all previous applications and migration of the existing data into an Oracle database. Additionally, the project's deadline was pushed up to December 2003.

Initial development was based on meetings with users of the current ACS system. SAIC broke its programmers up into eight separate and sometimes competing teams. One SAIC security engineer, Matthew Patton, used VCF as an example in an October 24, 2002 post on the InfoSec News mailing list regarding the state of federal information system projects in response to a Senator's public statements a few days earlier about the importance of doing such projects well. His post was regarded by FBI and SAIC management as attempting to "blow the whistle" on what he saw as crippling mismanagement of a national security-critical project. Patton was quickly removed from the project and eventually left SAIC for personal reasons.

In December 2002, the Bureau asked the United States Congress for increased funding, seeing it was behind schedule. Congress approved an additional $123 million for the Trilogy project. In 2003, the project saw a quick succession of three different CIO's come and go before Zal Azmi took the job, which he held until 2008. Despite development snags throughout 2003, SAIC delivered a version of VCF in December 2003. The software was quickly deemed inadequate by the Bureau, who lamented inadequacies in the software. SAIC claimed most of the FBI's complaints stemmed from specification changes they insisted upon after the fact.

On March 24, 2004, Robert Mueller testified to Congress that the system would be operational by the summer, although this seemed impractical and unlikely to happen. SAIC claimed it would require over $50 million to get the system operational, which the Bureau refused to pay. Finally, in May 2004 the Bureau agreed to pay SAIC $16 million extra to attempt to salvage the system and also brought in Aerospace Corporation to review the project at a further cost of $2 million. Meanwhile, the Bureau had already begun talks for a replacement project beginning as early as 2005. Aerospace Corp.'s generally negative report was released in the fall of 2004. Development continued throughout 2004 until the project was officially scrapped in April 2005.^[2]

The project demonstrated a systematic failure of software engineering practices:^[3]

• Lack of a strong technical architecture ("blueprint") from the outset led to poor architectural decisions
• Repeated changes in specification
• Repeated turnover of management, which contributed to the specification problem
• Micromanagement of software developers
• The inclusion of many FBI personnel who had little or no formal training in computer science as managers and even engineers on the project
• Scope creep as requirements were continually added to the system even as it was falling behind schedule
• Code bloat due to changing specifications and scope creep—at one point it was estimated the software had over 700,000 lines of code.
• Planned use of a flash cutover deployment made it difficult to adopt the system until it was perfected.

The bureau faced a great deal of criticism following the failure of the VCF program. The program lost $104 million in taxpayer money. In addition, the bureau continued to use the antiquated ACS system, which many analysts felt was hampering the bureau's new counter-terrorism mission. In March 2005, the bureau announced it was beginning a new, more ambitious software project code-named Sentinel to replace ACS. After several delays, new leadership, a slightly bigger budget, and adoption of agile software development methodology,^[4] it was completed under budget and was in use agency-wide on July 1, 2012.^[5]

• IEEE Spectrum article: Who killed the virtual case file? 11 page detailed article of the entire timeline
• The FBI's Upgrade That Wasn't - Washington Post article about the project
• Testimony of Inspector General Glenn A. Fine before the Department of Justice - February 3, 2005: Project Audit results
• Testimony of Inspector General Glenn A. Fine before the Department of Justice - July 27, 2005
• Matthew Patton's October 24, 2002 posting on InfoSec News about VCF
• IEEE Spectrum Radio audio discussion of the failure. Participants are Peter Neumann, Steve Bellovin, Matt Blaze, and Robert Charette.