Can Coalitions Move at the Speed of Their Metadata?

As the U.S. Department of War and its allies push a zero-trust framework into the Indo-Pacific, a problem is surfacing beneath the architecture: inconsistent, incompatible security metadata. 

This metadata interoperability gap is the disconnect between how different systems and nations label, interpret and exchange security metadata, even when they follow similar classification policies. Getting classification labels to mean the same thing across systems is becoming as important as the networks that carry the data.

Unlike Europe’s NATO-centered model, today’s Indo-Pacific security architecture is a flexible network rather than a rigid alliance. It blends national defense strategies with targeted, minilateral coalitions like the Quad and AUKUS. Coalition combat power only counts if information moves to partners as quickly and safely as it does across U.S. networks. When the British carrier HMS Prince of Wales sailed through four U.S. combatant command areas last year, standards made those connections possible, Joint Staff J6 Jenniffer Minks told an AFCEA TechNet Cyber audience in June.

The standard she named was Allied Communications Publication 240 (ACP 240). The  Combined Communications-Electronics Board (CCEB) publication sets data-level protections for encryption and access control and provides a standardized metadata framework for data-centric security. Minks urged industry and acquisition authorities to learn it. “Networks are important, but it is all about the data,” she said.

“Zero trust changes the basis of security decisions,” said Greg Colla, co-founder and chief technology officer at Janusnet, who co-wrote the classification standard that underpins whole-of-government email marking in Australia and whose technology is used in Five Eyes and NATO environments. “Historically, many decisions were based on network location or application boundaries. In a zero-trust architecture, decisions depend on trusted attributes about the data itself. In other words, the data itself tell you how it needs to be handled.”

That shift turns classification, releasability, caveats and handling instructions into operational data rather than administrative labels to allow faster information-sharing. The 2022 U.S. DOW Zero Trust Strategy puts data labeling and tagging requirements in its data pillar, the hardest part of the model. That is where decades of classification policy must become machine-readable metadata that can drive attribute-based access control, data loss prevention, encryption and cross-domain enforcement ahead of the department’s 2027 milestone.

Same Intent, Different Representation

When coalition systems meet, one side often understands the classification policy but not the metadata representation, or the representation but not the policy vocabulary. 

These interoperability failures show up in three areas: program risk, which causes delays and cost overruns; security risk, where controls act on ambiguous or misrepresented classifications; and operational risk, where files fall into manual exception handling procedures. Colla said this can add hours, days or weeks to information-sharing, potentially affecting mission outcomes.

Metadata representation standards such as ACP 240 and NATO’s STANAG 4774 and 4778 are designed to address this. But the difficulty is the number of points where interoperability can break currently—endpoints, applications, data repositories, gateways and
cross-domain solutions.

Standards are not the obstacle. “Adopting these standards is in most nations’ data-centric security road maps,” Colla said. “How to build a bridge between today’s systems and the standards is the hard part.”

Indo-Pacific operations magnify this challenge. “Rather than every system and control converging on a single metadata model, organizations increasingly need the ability to translate between different representations while preserving security intent,” Colla said.

Shared Infrastructure, Not Another Silo

A trusted distributed enterprise service that reads, validates, translates and writes security metadata lets each application integrate, instead of building custom translations to every other system. That is the premise behind Janusnet Accord, the metadata authority layer Janusnet brings to market this fall. The company says it is compatible with ACP 240 and STANAG and augments existing systems rather than replacing them: systems keep the metadata they already produce, and the layer renders it in a compatible form.

Colla poses one question to ask before the next mission partner integration: when information is tagged, is that tag honored correctly everywhere the data travels, for its full life cycle? Encryption applied over an ambiguous or wrong label does not fix the problem. It locks it in.

For more information: https://www.janusnet.com/