iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A 2016 Justice Department watchdog audit urged the FBI to use a more objective, data-driven and auditable method to rank cyber threats and allocate investigative resources. The findings concern the period from fiscal year 2014 through fiscal year 2016; they do not establish how the FBI prioritizes cyber investigations today.
What the DOJ watchdog examined
The Department of Justice Office of the Inspector General (DOJ OIG) published Audit Report 16-20, Audit of the Federal Bureau of Investigation’s Cyber Threat Prioritization, on July 21, 2016. The OIG began its audit in August 2015 to assess the FBI’s cyber-threat mitigation strategy. During its initial work, it identified prioritization and resource allocation as essential steps toward mitigation, then narrowed its objective to how the FBI prioritized cyber threats.
The audit focused principally on the Cyber Division’s prioritization and resource allocation from FY 2014 through FY 2016. The OIG interviewed 40 FBI officials across the Cyber Division, Directorate of Intelligence, Inspections Division, Office of General Counsel and Resource Planning Office. It also visited FBI field offices in Pittsburgh, San Antonio and Washington, and gathered perspectives from the National Cyber-Forensics and Training Alliance, the Air Force Office of Special Investigations and the National Security Agency.
What the audit said was wrong with the approach
Contemporaneous FedScoop coverage described Threat Review and Prioritization (TRP) as the FBI’s primary cyber case-assessment procedure at the time. It was updated annually for operational divisions and field offices. The OIG characterized the process as “subjective and open to interpretation,” according to FedScoop, and the article noted that terms such as “small business” lacked specific targets.
#1 Best Overall
- Students build unmatched deductive-reasoning skills as they become crime-solving stars
- Most scenarios have more than one plausible outcome, allowing individuals or groups to broadly interpret evidence
- Includes interpretive handwriting, body language, fingerprinting, and many more activities
The problem was not simply that one scorecard needed replacing. If categories are open to interpretation, offices may assess comparable threats differently; if guidance is updated only annually, it may not adjust quickly to a changing threat landscape. A ranking process also has limited value for resource management unless managers can see what investigative time is being spent on each threat category.
How TRP and TExAS differed in 2016
In 2016 coverage, TRP was described as the established annual assessment procedure, while Threat Examination and Scoping (TExAS) was an in-development platform in limited use. The comparison below is historical, based on FedScoop’s account of the audit; it is not a description of current FBI systems.
| Dimension | TRP | TExAS |
|---|---|---|
| Status at the time | Primary cyber case-assessment procedure. | In development and in limited use. |
| Assessment method | Judgment-based classification, which the OIG described as subjective and open to interpretation. | Agents answered 53 quantitative questions and entered numerical threat scores; an algorithm generated recommendations about classifications and resources. |
| Update approach | Updated annually for operational divisions and field offices. | The FBI planned a daily automatic feed of available, appropriate data from Sentinel beginning in FY 2017, plus manual entry at least every 30 days for information Sentinel could not transfer. |
| Consistency and collaboration | Terms without specific targets could be interpreted differently. | The tool supported collaboration and used numerical inputs, but the audit’s recommendations addressed the need for defined procedures and clear data-entry responsibilities. |
The planned Sentinel connection and manual-entry schedule were plans reported at the time, not evidence that the integration was completed or remains in use.
Free tools Windows power users keep installed
One-click scans. No signup required.
What the OIG recommended
The recommendations linked threat ranking to procedures, system integration and accountability for staff time. The report’s first recommendation said to “Utilize a algorithmic, data-driven, and objective methodology in the scoping and prioritization of cyber threats.” The report’s wording is reproduced as written.
- Use objective, data-driven prioritization. Apply an algorithmic methodology to scoping and ranking cyber threats rather than relying on guidance that could be interpreted inconsistently.
- Document procedures and train staff. Set out how prioritization works, who enters information and how that information is used, and train personnel on those responsibilities.
- Connect the ranking tool with Sentinel. Automatically integrate the threat-ranking tool with the FBI’s Sentinel system.
- Refresh emerging-threat information. Manually update threat-ranking results at least every 30 days so emerging threats can be identified and addressed in a timely way.
- Track agent time by threat. Keep records of agent time utilization across threat categories so managers can assess how investigative resources are being used.
What the report does—and does not—establish
Audit Report 16-20 documents the watchdog’s assessment and recommendations for the period it examined. It does not establish whether the FBI later implemented the recommendations, whether TExAS was deployed as planned, or what prioritization process the Bureau uses now. The findings should therefore be read as a historical oversight account, not a current description of FBI policy or technology.
Quick Recap
Best Value
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
