Intranet Makes Way

As part of the Navy/Marine Corps Intranet (NMCI), the U.S. Navy has stood up network operation centers (NOCs) in Oahu, Hawaii, and Norfolk, Virginia, similar to this one in San Diego. Another NOC is being set up at the U.S. Marine Corps base in Quantico, Virginia.

As with the weather, the ongoing rollout of the Navy/Marine Corps Intranet is sometimes sunshine and sometimes storms. Now entering its fourth year of work, the program has experienced smooth sailing and unexpected squalls in its adaptation of commercial processes. Despite some grumbling in the ranks and the underestimation of the magnitude of issues such as legacy applications, the U.S. Navy not only is making steady progress but also is discovering unforeseen benefits from its decision to tackle information technology acquisition in an innovative way.

The Navy awarded the Navy/Marine Corps Intranet (NMCI) contract in October 2000 to the Information Strike Force (ISF), an industry team led by Electronic Data Systems Corporation, Herndon, Virginia (SIGNAL, December 2000, page 37). It was the first time that a military service decided to get out of the business of information technology acquisition and adopt a seat management contract approach. The NMCI offers the services a single network, which is easier to manage and more secure, and enables military personnel to focus on their defense mission rather than information technology acquisition and service.

The implementation process consists of 360,000 seats being moved into the NMCI in three stages. The Navy first orders the seats, then the ISF assumes responsibility for the site. The final step is the seat cutover. As of this fall, the ISF had responsibility for approximately 300,000 seats, with more than 107,000 seats already moved to the cutover stage. Three network operation centers are fully operational in San Diego; Oahu, Hawaii; and Norfolk, Virginia. A center also is in the process of being set up at the U.S. Marine Corps base in Quantico, Virginia. Help desks are in place in Norfolk and San Diego.

Capt. I. Chris Christopher, USN, NMCI staff director, Arlington, Virginia, relates that during the past three years, challenges have surfaced primarily in legacy applications but also in terms of change management. Working with the ISF, the Navy has employed some creative solutions to addressing these issues, and the work continues.

The sheer number of legacy applications shocked the NMCI team. Capt. Christopher relates that the Navy was prepared to find around 10,000 legacy applications in use and thought that finding 20,000 would be a nasty surprise. However, in the fall of 2001, when an inventory was conducted, the number totaled more than 100,000, and the NMCI team had to determine the best way to handle the situation.

Legacy applications are not permitted onto the NMCI network either because of security risks or because they do not run in the intranet’s Windows 2000 environment, the captain explains. However, some of these applications are still needed for missions. To address this issue, a quarantine system has been set up. Applications are left behind on a seat but quarantined on the old network. Several organizations are working hard to reduce the number of required legacy applications down to a target of 10 percent, Capt. Christopher says.

“We’ve recognized that we’re probably going to have about 10 percent quarantined seats into the foreseeable future until we make real progress with these applications. If they were something we could throw away, we would have already thrown them away. In some cases it’s a joint application, something that the DOD [U.S. Defense Department] or one of the services runs and operates, and we have to use it because it’s required. In many cases, we can’t change it because it may become inoperative for other people. So things like that may live on for a long period of time,” he explains.

Last year, the Navy turned this challenge into an opportunity. Cataloging applications enabled the Navy to assess and understand which commands had which applications. A group of managers was designated to examine the applications in 23 functional areas such as logistics, personnel and administration. The managers scrutinized the list of applications and determined which to keep and which to delete. As of October 1, 2003, only applications on the functional area manager list are allowed on NMCI seats.

The work that has been completed in this area has produced unforeseen benefits, Capt. Christopher notes. “Having its arms around that entire portfolio enables the Navy to manage it effectively. We’ve never, ever—in the information technology arena at least—been able to harness the entire buying power of the Department of the Navy. So we spend a huge amount of money buying software one copy at a time, or 15 copies at a time, or whatever. Now, we’ll be able to buy any software you can name at a price that reflects buying it for the entire Department of the Navy. That’s going to be great from a budget perspective. But this is not easy and not simple,” the captain admits. Although this will not happen quickly and it is a difficult process, it is essential, he adds.

Resistance to change is another challenge the NMCI team has been facing. Changing the paradigm from computers as individual property to a point of service is a major shift, and it has been an issue that the team has had to address at every site. “Realistically, we have not done a good job of managing the cultural change piece, but we’re trying to get better,” the captain says. Research shows that satisfaction increases as time passes and customers get accustomed to any new system; however, this process can take a couple of years, he offers.

On the cultural change front, the Navy also faced the task of reiterating the nature of the NMCI contract approach to other organizations within the federal government. Many viewed this effort as an information technology purchase, but Capt. Christopher emphasizes that the NMCI is a seat services contract and not an acquisition. This issue has largely been resolved, he adds.

The security benefits of the NMCI are a “real good news story,” the captain says. Through the enterprisewide network, the Navy can conduct the defense in depth that the Defense Department requires. When a threat is identified, a defensive measure can be pushed out to the entire intranet quickly. “It has been very effective. We’ve only had one thing that’s leaked in. During all the months when we’ve had the Blaster and the So Big and the ILoveYou and all those viruses, none of them has gotten to us,” he states.

The single breach was a worm that was categorized as a “good will” transmission because it was being circulated to download a Microsoft patch automatically. It was designed for small networks, but when it hit the NMCI, it created large ping storms that looked like a distributed denial of service attack. As soon as the Navy obtained the signature, it immediately stopped penetration and eliminated it within 48 hours. The network operated throughout the incident, and the NMCI team is examining how to prevent this from occurring in the future.

“Look at our record over the last couple of years, and it’s impressive. All these things going on out there, and I think our record is second to none, especially compared to our status in a pre-NMCI environment,” Capt. Christopher states. Prior to the introduction of NMCI, the Navy’s Fleet Information Warfare Command would try to hack into Navy systems, and the captain says the news was bad. This work continues in the NMCI environment, but the system has proved secure.

“The longer we have systems outside of the NMCI security umbrella, the longer we are perpetuating those vulnerabilities. So there’s a real need for speed to get everything into the NMCI shelf. Even if everything is not working perfectly in NMCI, being inside that security perimeter is really, really important,” he says.

The Navy continues to try to identify the imperfections of the NMCI and is in the process of conducting an operational evaluation of the intranet. The original plans from September 2001 called for a series of tests that resembled a ship evaluation. The network would have to pass specific tests before the next set of seats would be brought onboard.

Although this approach was beneficial, Capt. Christopher explains that, after conferring with the then Office of the Assistant Secretary of Defense for Command, Control, Communications and Intelligence, the Navy decided to move to an evaluation technique that assesses performance. Unlike the original testing plans, the operational evaluation is not a “go, no-go” decision, and the entire network is being rolled out, he says. An operational assessment took place in 2002, and the process is being refined for this operational evaluation to determine how it fits in with ongoing testing. The data gathered from this work will be compiled with other information that is being collected to determine how to make improvements. “Nothing that we’ve seen through all the trials and tribulations that we’ve encountered in doing this has told us that our goal is not the right goal,” the captain emphasizes.

The NMCI also will enable the Navy to reap benefits in unanticipated ways. For example, each naval facility has a variety of sensors such as thermostats and fire alarms. In some cases, data from these sensors is sent to a central point. The Navy recently signed a contract that allows the service’s facilities personnel to take the information from all the sensors and put it on the NMCI. Once all the sensors are on the network, the commander of installations can view all the information and manage energy, for instance, or negotiate with utility companies for better prices.

Capt. Christopher offers another example. Through the NMCI, a flag officer recently was able to determine exactly how many contractors the organization was paying. “That’s not an NMCI function—to give us an inventory of contractors—but it’s something that it has enabled. And as we go along out to 2010 with NMCI, we will be discovering thing after thing that will allow us to operate as an entity more effectively,” he says.

Additional information on the Navy/Marine Corps Intranet is available on the World Wide Web at http://www.nmci.navy.mil.