Mind the Gaps: Agencies Rush to Plug Software Holes in Wake of Underpants Bomber Lapses

When you Google someone, the search engine routinely offers you alternative spellings for the name of the person whose records you are trying to locate. But according to Obama administration officials who have been briefing Congress on the aftermath to the Christmas underpants-bombing plot, a critical State Department computer that is used to track the U.S. visa status of millions of foreigners does not have an effective mechanism for generating alternative spellings for people whose names are being searched.

Administration officials are now acknowledging that more than one potentially serious systematic gap highlighted by underpants-bombing postmortems relates to search capabilities which are routinely available to ordinary Internet users but are unavailable to officials who use some of the government's most critical, sensitive intelligence and law-enforcement databases. In the case of the State Department's visa database, for example, a White House inquiry established that there may have been "incomplete/faulty database searches on [accused underpants-bombing suspect Umar Farouk Abdulmutallab's] name and identifying information."

Officials have told Congress that what the White House report is referring to, at least in part, is that there was a delay of uncertain duration in recognizing that Abdulmutallab had a valid visa to enter the U.S. The reason behind the delay: after Abdulmutallab's father warned the U.S. Embassy in Abuja, Nigeria, in late November that his son had gone missing and may have fallen in with Islamic "extremists" in Yemen, when an embassy official first entered a record of the father's warning in the State Department computer system which tracks U.S. visa applicants and holders, Abdulmutallab's surname was misspelled. (One official said that what happened was that the embassy apparently left out the D.) Because of the misspelling, and because the relevant State Department database was not capable of matching the misspelled name with the correct spelling of the data entry, which reported that Abdulmutallab had a two-year multiple-entry U.S. visa which did not expire until June of this year, neither officials in Abuja nor in Washington immediately noticed that the father's warning related to someone who had a valid visa to enter the United States. Because of the initial faulty State Department data entry on Abdulmutallab, when the National Counterterrorism Center (NCTC) entered information about the Nigerian's father's warning in TIDE, its classified master database of information about terrorist suspects, the TIDE entry was also flawed. The misspelling made it difficult, if not impossible for NCTC analysts to know that Abdulmutallab had a valid U.S. visa.

Indeed, according to a U.S. national-security official, the most reliable information circulating inside the government at the moment indicates that because of the State Department misspelling, the National Counterterrorism Center remained unaware that Abdulmutallab had a U.S. visa until after the attempted underpants attack. According to another U.S. official, the correct spelling of Abdulmutallab's name was not reported to Washington in writing until six days after the father's visit with embassy officials; this was done in a cable to CIA headquarters, which was available to NCTC analysts but was not circulated elsewhere around the government, including to the State Department. This cable did cause NCTC to revise Abdulmutallab's TIDE entry with the correct spelling. But according to the best available accounts, even though the TIDE entry spelling was corrected, it was never updated before Christmas with information indicating that Abdulmutallab had a current U.S. visa.

According to a report from Reuters, at a hearing Wednesday before the Senate Judiciary Committee, the State Department's top management official, Undersecretary Patrick Kennedy, acknowledged that because of the misspelling, the State Department apparently didn't put together the report from Abuja about the father's warning with the fact that Abdulmutallab had a U.S. visa that was currently valid. Officials told Declassified that the software mechanism used by Google to match names that are spelled similarly but not identically is known as "fuzzy logic," and that other databases used by U.S. government agencies, including a crucial NCTC system, do use software containing fuzzy logic. A State Department official told NEWSWEEK that the State Department visa database did, before Christmas, include a mechanism called People Finder. But administration officials have told Congress that if this mechanism was in place before Christmas, it evidently was not effective in matching the misspelled initial data entry on Abdulmutallab's father's warning with his son's visa record. The State Department official acknowledged that the agency was soon going to "upgrade to a better program."

The NCTC's TIDE database─the intelligence community's ultimate compendium of info on terrorist suspects─does include fuzzy-logic capabilities, according to an intelligence official, who like others quoted in this story asked for anonymity when discussing sensitive information. However, at one of Wednesday's congressional hearings on the underpants plot, NCTC Director Michael Leiter did acknowledge that his agency lacked what he characterized as a Google-like ability to search a broad range of government databases. The problem in this case: that NCTC has access to dozens of closed-circuit government computer networks─which because many contain classified information are completely isolated from the outside world or the Internet─which in turn link in to literally several score of classified databases. Presently, there is no mechanism for NCTC analysts to use a single search engine to comb all the databases. One possible solution is for intelligence agencies somehow to redesign their databases and networks so that any message entered into any of the systems related to terrorism would automatically be copied into a central database that NCTC analysts could then access with a single Google-type search. But the mechanics of designing and then implementing such a revision in current arrangements would be complex, although improving the NCTC's search capabilities is certainly a prominent item on the administration's agenda for post-underpants improvements to the intelligence system. The NCTC declined to comment.