Nancy Patel

Nancy Patel is VP/GM of Public Sector at Immuta.  She holds graduate degrees in Systems Engineering from George Washington University and Business Administration and Management from University of Kentucky (UK) as well as an undergraduate degree in Computer Science from UK.

PRIVATE SECTOR PERSPECTIVE — It happens more often than it should – a Pentagon data owner, often a manager of a collection platform, has spent months working with an agency analytics team to complete a data sharing Memorandum of Agreement (MOA). Getting all the rules written down, the regulations cited, the policies documented, reviewed, and approved was a heavy lift. Then, add to that the weeks it took to pass the PDF around to the one individual in each organization who was allowed to approve it. Finally, the process is complete, and the data can be shared, often copied from one repository to another. The new repository might be someone’s hard drive, or it might be a second data platform with no data access controls in place at all – allowing anyone to access everything.

Hopefully, the analytics organization will find the time, developers, and money to implement the protections from the MOA – still a PDF signed in ink that one hopes has been stored somewhere safe and not just lost in an overcrowded inbox. This scenario also assumes the information shared remains internal to an organization. If a data owner wants to now share that data outside of the organization… well, forget about it.

If this anecdote appears dramatized, it is not. In a surprising number of cases, the US Government handles and manages data this way, and even with all of these protections in place, we still witness unauthorized disclosures and data leaks. The policies on data protection for information sharing are right, but the implementation of these policies needs further refinement. As data architecture and engineering teams work through the pain of the data sharing compliance process, often taking longer to complete than the creation of the system itself, many observers are left to wonder if it has to be this hard. Has the pendulum swung too far from implementation to process? Have we regulated ourselves into a corner?

Data access controls and policy enforcement have become a check-in-the-box process with a long list of rules and regulations that often get shoved aside in favor of getting data into the hands of consumers faster. Speed of execution is good, but today, this also means that either the data never sees the light of day in the receiving organization – it’s too risky! – or the data is improperly controlled, and it’s up to the consumer to do the right thing. In the current system of paper, informal agreements, and having to throw decisions over the wall to developer teams to implement, how can data consumers be sure that they can trust the data they access?

The DoD’s Data Strategy, released in September 2020, reiterates the Department’s tenet that, for data to be “trustworthy” users must “be confident in all aspects of data for decision-making.” This includes knowing that the data they have in their hands is data they are allowed to see and share. In order for data consumers to be confident in their access to data – as well as their products – they need to know that the policies outlined in compliance documents, MOUs, and MOAs have been properly implemented. In other words, proper policy implementation and enforcement is a good thing, assuming the US Government has a reusable, automated system for implementing these policies both globally and locally.