COMPUTERIZED DATABASE- AREAS APPROVED FOR STORAGE OF COLLATERAL AND SCI MATERIAL (AIUO)

• Document Type: CREST
• Collection: General CIA Records
• Document Number (FOIA) /ESDN (CREST): CIA-RDP96B01172R000900020007-5
• Release Decision: RIPPUB
• Original Classification: C
• Document Page Count: 29
• Document Creation Date: December 12, 2016
• Document Release Date: February 26, 2002
• Sequence Number: 7
• Publication Date: March 27, 1978
• Content Type: MF

, ? "
Approved For Releme 2002/05/07: CIA-RDP96B01172R0M100020007-5
jP 8--3484
MEMORANDUM FOR: Director of Security
FRO~I Clifford D. 1M,Iay, Jr.
Director of Data Processing
Storage of Collateral and SCI =Material
SUBJECT . Computerized Database - Areas Approved :~=
a. Memo to D/ODP fri D/OS dtd 27 Jan. 77,
same subject. -
b. Memo to D/US fm D/ODP dtd 25 Feb. 77,
same subject.
- 1. My previous memorandum (reference b.) stated
tha t Jun Jas the earliest date that ODP would have
personnel available to work on your request. However, an
analyst from B Division of Applications is now available to
begin work on this project. Chief, B 25X1A
Division, has contacted of the special 25X1 A
Security Center to begin a preliminary study of your requ.ire-
ments.
2.0 After analyzing the requirements of the proposed.
Storage Facilities system we have concluded that we could
readily implement it using ODP' s central comput rs. -Iowever,
a significant resource commitment is required to collect the
necessary data and enter it into the data base. We have pre-
pared an analysis of the data collection and preparation tasks
and recommended procedures to obtain the data necessary for
the system. These are contained in' the attached study.
3. Because there is a significant resource com Zit-
ment required of Security, ODP, and other Agency components,
I recommend that coordinate the review of this
study with those people identified in paragraph 1. of the
attachment. Before you and I approve UDP' s continuing with
the system develo pent, we should be certain that we agree
with the findings and recommendations of the attached study.
If you concur with the study's recommendations and wailt GDP
to continue work on the schedule provided in the study, please
sign below.
Approved For Release 2002/05/07 CIA RQP9fiQQ1 I72R000900
0007-5. - -
__, :yS`.
---==[V~~U=' CL ~,.f ' _4
I
 a_~1i 3x.d'i
a' I e
Approved For Release 2002/05/07: CIA-RDP96B01172R00QW0020007-5
4:L has been assign d responsibi.l' ~(JA
for -L-hic 4 an3 may be reached on ext if yo x-XA
or your staff have any questions concerni ng.7LIzi.s pact.
Att: a/s
CONCUR:
Da rector of Security
cc : C/BD/ODP
C/i S/ODP
Approved For Release 2002/05J0-?.-",c 0 6i 01172R000900020007-5
 Ot,
Approved For Release 2002/05/07: CIA-RDP96B01172R008N0020007-5
STORAGE FACILITIES DATA BASE
(STOIRFAC) STUDY REPORT
References: (1) Memo fr CD/ODP, dtd 16 Nov 7-5X1A
subject: Requirements De n for 25X1
Storage Facility Data Bas
(2) Menlo fr Chief, Compartmented' Information
Branch, DD/P&M/OS, dtd 15 Jan 77, subject:
Top Level nts for Storage Facility 25X1
Data Base
1. 1 kency personnel. who have an interest in the
Storage Facilities Data Base Concept presented in References
1 and 2, met during the month of Decemhcr 1.977. The following
inidividuals were present:
C/CIB/SSC/OS
ISB/PSD/OS
OD&E Security Staff
OD&E Security Staff
OL Security.Staff
C/BD/ODP
CD/ODP
C/SMS/DDS&T
NFAC Security Staff
CSD/OC
C/ISSG/OS
The references had been studied prior to the meeting. The
data base concept was thoroughly discussed. The final outcome
of the meeting was a general concurrence that such a system
is needed, general- agreement on the typos of data which should
be collected and maintained, and satisfaction with the formats,
Approved For Release 2002/05f&7 : CIA-RbP96B0'M`t72R00 AOO20007.=5_______.._-,___
 Approved For Release 2002/05/07 CIA-RDP96B01172R009i00020007-5
and frequencies of the reports which should be produced. The data
elements which would be needed to support the system are listed
in Reference 1. Report formats are detailed in Reference 2.
The general consensus was that a system was
needed to inventory and monitor secure storage facilities.
It was questioned, however, whether the development should
proceed at this time, since the Agency is currently performing
other studies related to industrial security practices. it
was decided that ODP should expend sufficient effort to investi-
gate the following:
? Where is all the data which is needed for data
base generation currently located?
How can this information be gathered and reduced
to machine readable format?
? What input media should be used (cards, CANEXEC,
etc)?
? What are the STORFAC development costs?
? Hoy; long will it take to develop such a sys tem?
The paragraphs which follow address these questions and con-
tain the findings of this short study effort.
Data which is needed to generate a Storage
Facilities file is stored in several offices at various loca-
tions. Some of the data sources will be relatively easy
Approved For Release 2002/0 ijbl, Q1A-1 bP96B6 172R000900020007-5
 y 1 4 c f 4 4 i
L
Approved For Releasw2002/05/ A'-'CiA-kDP966di4,1-2R000900020007-5
to research. Some of the data is stored in voluminous
folders and will require considerable effort and some source
familiarity in order to extract the required information.
The primary offices which currently maintain most of the
required information are:
Office of security (Os)
Special Security Center (SSC)
Information Systems Security Group (ISSG)
Physical Security Division (PSD)
Industrial Security Branch (ISB)
Overseas Security Branch (OSSB)
Domestic Security Branch (DSB)
Technical Security Division (TSD)
Office of Logistics (OL), Security Staff
Office. of Communications (OC)
Communications Security Division
(CSD)
Additional data sources may be identified as the development
effort progresses.
locations
25X1A
Information on approximately 1,200 active storage
is maintained in
This information is logged
and maintained on manual. records (5 x 7 index cards). Each
card contains data for one location. Data values on the
index cards are labeled and, therefore, would be relatively
easy to extract. The following information is normally
Approved For Release 20 1'd5/&7 -;6IA RDR9fB01172R000900020007-5
 Approved For Relea 2002/05/07: CIA-R6P961301172R000000020007-5
available on each facility index, card:
? Facility Name
? Activity Indicator
? Facility Location
o Cover
? SPECLE Number (assigned by SSC)
? Agency Interest'
? Security Officer w/telephone number.
? Alternate Security Office w/telephone
number
? Responsible Agency, Component, Division, Contract Team
?
Type of Operation
? Facility Clearance Level
? Accreditation Date
? Special Activities
? Associated SCI Projects
? Comments
5L___~hq~OL Securityy S maintains approximately
1,900 contract folders. About 600 of these folders are main-
tained for active contracts/contractors. The folders contain
all the information concerning the contract that a vendor hs
with.the Agency. In addition, the folder has information
regarding the contractor facility in which classified informa-
tion is stored and/or produced. These folders are for facili-
ties which may or may not be the same as those facility index
cards maintained by SSC. Detailed examination of these folders
would normally yield the following data items:
? F
? F
? C
? S
C. S
acility
acility
learance
terility
ecurity
Name
Location
Level
Code
Officer
w/telephone number
? A
?
lternate
Security Officer w/telephone number
S
?
ecurity
Survey Date(s)
C
omponent
/Division/Team Responsible for the Facility
Extraction of the data from the OL Security Staff contract
Approved For Release 20O . CiA=FfbP$61301172R000900020007-5
 foldo4WrQMOIEpr} gA~2/@15i/g7fjcIjIF DP96jQ117 4a0(9;0N7L-_ even if
the researcher had a limited familiarity with the contents of
the folder. This is primarily due to the quantity of data
stored for a particular contract.
0
II
The S PSV maintains folders on approximately
active stations located around the world. Information for
most of the facilities (stations) maintained by PSD is also
located on the 5 x 7 index cards kept by SSC.' In addition to
data which describes and locates a station, the folders
identify storage type, cover and type of operation. Also,
they specify the historical security survey and security audit
dates which are required for development of STORFAC. These
folders contain a considerable volume of data and would require
some degree of familiarity with the contents in order to re-
search and retrieve the necessary historical information.
7. The OC, CSD anal off_icexs maintain data 25X1A
for installations on which a COMSEC or TEMPEST survey is to
be or has been conducted. Information on COMSEC and TEMPEST
surveys is maintained and readily accessible in CSD and
0
on chronological lists which identify the facility and specify
the latest survey dates.
OS/ISSG maintains a data file which contains
records on approximately
computer facilities. These
computer areas are primarily located at contractor facilities-
Information in this data file consists of the following:
25X1A
Approved For Release 21602%n %W; C A-R6f?b6BO1172R000900020007-5
 Approved For RQpase 2002/05/07 CIA-RDP96B0l172R 0900020007-5
? Facility Name
? Facility Location
? Clearance Level
? Responsible Component/Division/etc.
? Date of latest computer Facility Inspection
? Identification of the types of Computing Equipment
w/vendor
This data is processed periodically to produce tabular reports
in several different sequences (Location, Facility Name, etc.).
It would be relatively easy to research and extract data for
inclusion in the STORFAC data base.
TSD maintains information concerning the
dates on which an ACM survey was conducted at a specific facility.
This information is readily available for extraction and
inclusion in the STORFAC.data base.
he primary problem which must be solved in
order to develop the STORFAC data base is how to collect,
edit, collate, and enter the information which is available
at the various sources. A procedure must be developed which
will either (1) allow all available data to be collected,
collated and edited for each unique facility prior to intro-
duction to the data base; or (2) allow for incremental develop-
ment. After considering both approaches, it is suggested
that the second approach be considered for the development
effort. An incremental approach would allow for development
of a partial data base which would contain partially complete
records. Subsequent operations would supply additional facili-
ties not: currently included in the SSC files and provide the
Approved For Release 2002/05/07 CfA-RDP96B01172R000900020007-5
 nece az i~rfor q_u g~002/05~/07hCti oRuid .mai1e7?tRt10q~8000r ~200g171
completed
y
records complete. Figure 1, pages ]. through 7 is a flow
diagram of the suggested approach.
ny attempt to assemble all the necessary infor-
mation prior to data base generation would require a signifi-
cant redundant effort to code information at the various data
source locations. In addition, it would place a tremendous
burden upon SSC to collate all the data for a unique-facility
prior to its introduction to the data base.
Approved For Release 200 ,/5/07 :.CIA-RtP96 1172R000900020007-5
 Approved For*Iease 2002/05/07 CIA-RDP96B0117000900020007-5
SSC
5 X 7
1200
FACILITIES
NIPS
FM
FILE GEN
V
STORFAC
DATA
BASE
CAMEXEC
MENU
NIPS
RET/OP
TRANS
DATA
LIST OF
INITIAL 1200
Zb rACILITI'S
FIIOUI1Ap~roved For Rely W262y6/07! - }A-RDR96B01;1?728000900020007-5
 Approved For *ecW02/0541Y.: CIA-RDP96BOl
S`lUR.FACILI`i'I ;S
OL-RESRAA
FOLDERS
~--j
COMPLETE
ZBIqll< PEPO1'
RM
/ 1 J
'AC ON O,,u YE
FAC LIS
-'ORRIS IN
4?ENU FORMAT
&~AD;DATIA
-_ TO EXISTING
TFAC FORM
F I: C. (T PApp oved Fd?1Re ea&e c2009050;j :~..6 DP, 6 O'f,172R000900020007-5
 Approved For
}3~ 1@@9 r06~ `j7-5
Rod `Se (2002105
CIA-RDIP96BO1AT2jf I
~Oz
I NITmL 1200
L`r!v\TJ t:7r-rr-rmi T'012~IS IN
'+AL)1aITIO~I?~TI
P-, I'dI.1~LT ` -CGTf-,LTE
~ L
V
PSD RESa H
FILES
I':CGURE 1. PAGE 3 o f 7
Approved For Release 2002/05/07 : CIA-RDP96B01172R000900020007-5
 Approved Fq
R@16a 2602 CIA-RDP96
1 q~OOM
O07-5
II
,~!
]] rr= T~
200 ~~0.z f- c_' 1
Report
ities & par -i~11y
Forms
on~e foz*n:
P
- --
~
from OL
PS
,
Figure 1. Page 4 of 7
1 .5
Approved For Release 2002/05/07 _: CIA-RDP96B01172R000900020007-5
 Approved Teaos 2M I1991:
1200 ~..f`zc: li-
ties & adcltuo, a1
~am~~1 I:e #o7_m_
i~rnm OTC . PS . `1
Figure 1 Page 5 of 7 t, ..-.:.~ _, -. , ., 1
Approved For Release 20020 d j IA Dk6b'0'1172R000900020007-5
 Approved For lease 2002/ 07 : CIA-RDP96B011 000900020007-5
List of= `ir\tal Blank
1200 STOR fFicI_lity Report
+ new FAc 1 on OL, Forms
ISSG,/ra, TSI\j
Complete
a blank
report
'. form
Add data
to existing
FtxC form
I, `~L' p roved Fo` ele se ZOQ2/05 ~.:.~~i4- [ 96 Q 172R000900020007-5
 Approved For I e 00-210.51 IA-RDP96B0l172Rg00900020007-5
Facility
0 J----~ Forms
0rigina1~__&. .
S:-C
TRANS
DATA
r7
Complete
nenu operation
change or
add
NIPS
Re-Lr. ieval/
Output
Current Lisp
of Storage It
Facilities--j
4 i 1 + t ti 15t;i
Fig" Wpp lovTdd for ReIis612002/05/ .. C1A-R~~6'~O1 ~72R000900020007-5
 AV_Rr ease
in the SSC of the Office of Security. Data from each of the
1,200 index cards would be examined. Data items required in
the STORFAC data base which are available in SSC would be
entered on a Delta Data terminal using a CAMEXEC menu. Figure
2 is a copy of the menu which identifies those data items
input by SSC. Edit routines would be invoked, where applicable,
to ensure that the data entered conformed to acceptable formats,
ranges and values prescribed by SSC. After the data passes
the applicable edits, it will be stored in a transaction disk
file. Periodically (perhaps once or twice a week), the trans-
action data would be batched into a job stream which would
invoke the File Maintenance (FM) module of NIPS. This trans-
action information would be used to generate (first time) or
add to the STORFAC data base.
After each FM process, SSC would be provided
with an audit trail report which would consist of a formatted
dump of the content of each STORFAC facility record which was
added to the file or changed in any way during the FM run.
This activity would continue until data from all 1,200 index
cards had been extracted and entered into the file. At this
point in time, a partially complete STORFAC data base would
be available for processing by SSC. However, this file would
only contain partially completed data records. The other
information needed to make each facility record complete re-
sides in the other offices identified in paragraph 1 of this
repor. t.
Approved For Release 2002P,5/,07 .:? C.IA-F DP9&B;01172R000900020007-5
 Approved For Release 2002/05/07 : CIA-RDP96B01172R000900020007-5
Approved For Release 2002/05/07 : CIA-RDP96B01172R000900020007-5
 Approved For se 2002/05/07: CIA-RDP96B01172900020007-5
14. In order to -continue the incremental develop-
ment effort, the data residing in the STORFAC data base would
be-extracted, sorted and processed to produce a master report
similar in appearance to the CAMEXEC menu used for data intro-
duction. The sequence of this report would be in facility
name order. Only data for one facility would appear on each
printed page of the report. At the same time, one line per
facility cross index listings would be produced to assist
the other offices who will be contributing data in their
facility research and identification activities. The cross
indices could be provided in facility location by State,
SPECLE Number, etc. orders, as considered necessary for
identification purposes. The master report format would con-
tain all of the known (previously entered by SSC) data together
with sufficiently labeled space for that information not
currently in the data base.
A quantity of blank forms similar to the
CAMEXEC menu wpuld be produced for use by the offices other
than SSC, to enter data for facilities not currently resident
in the STORFAC data base. These forms would have space for
all the required data fields with labels for data entry.
The master report, cross index reports and
a supply of blank menu forms would then be forwarded to the
OL Security Staff for their inputs.
Approved For Release 2002/05/Q7 z-CjA,RDR96.B,01172R000900020007-5
 Ai3aro
4S~1~o`d IQ M? : PA9-R~~ &eOr1 7 oo br d2~~of~~1tr~~ is
must be researched in OL:- If the folder is for a facility
already in the STORFAC data base, additional items of infor_r.a?-
tion (dates, etc.) must be extracted and entered in th:. appro-
priate space on the partially complete master report page for
that facility. If the folder is for a facility not currently
in the STORFAC data base, one of the blank forms must be com-
pleted. All applicable data in the folder must be extracted
and entered. Figure 3 identifies those data values which
would be supplied by the OL Security Staff folder research
effort.
When all 600 contract folders have been
researched, the partially completed forms, the blank menus
and the cross index listings -w-".1 he forwarded to Physical
Security. The records in PSD would be researched, data ex-
tracted and entered on the forms in the same manner as the
process accomplished in OL. (Figure 4 identifies those data
values which would be supplied by the PSD folder research
effort.) ?When all PS facility records have been exhausted,
the forms and index reports will be forwarded to TSD where the
process is repeated (Supply ACM dates for existing STORFAC
records, create new forms for previously not identified facili-
ties.). When_the TSD activity has been completed, the entire
package will be passed to ISSG for their data extraction process.
When the ISSG extraction effort is finished, the package is
Approved For Release 20021c1510'T ~ `Cb4`-RbP'96B01172R000900020007-5
 Approved For Release 2002/05/07 : CIA-RDP96B01172R000900020007-5
Next 1 Page(s) In Document Exempt
Approved For Release 2002/05/07 : CIA-RDP96B01172R000900020007-5
 ove& 9 ~ C3 - pP Qt172 PW9t~ 0 Son process
passec~po
is repeated. When complete, OC will return the entire package
to SSC. (Figure 5 identifies those data values which would be
supplied by TSD; Figure 6 identifies those data values supplied
by ISSG; and Figure 7 identifies the data values supplied by
OC/CSD and
19. Upon receipt of the package from OC, the final
stage of incremental development can begin. Each facility form
must be examined to determine if it is a new facility (not one
of the original 1,200 SSC records) or if it is one of the
original SSC facilities. If it is a form for a new facility,
SSC must determine its SPECLE Number and assign a machine
reference number (MRN). Since the MRN is the record control
element for STORFAC, care must be exercised to ensure that
this MRN is unique from all others. When these two data
fields have been completed, the information can be entered via
the CA14EXEC menu and transactions created and stored on the
transaction file.
if the form is for one of the original 1,200
facilities, the data added by OL, PSD, ISSG, TSD, and OC would
be entered via the CAMEXEC menu and stored with the transactions
produced in the previous step. When all information has been
entered, the transaction data would be batched into an FM job
stream and the STORFAC file updated. At this point, SSC should
be in control of a complete Storage Facilities Data Base. It
is suggested that Master Format. Reports be produced for each
21
Approved For Release 2002/0 47, : CFA;RDP9fB01;172R000900020007-5
 Approved For Release 2002/05/07 : CIA-RDP96B01172R000900020007-5
Next 2 Page(s) In Document Exempt
Approved For Release 2002/05/07 : CIA-RDP96B01172R000900020007-5
 of thAprjY d F WWPi?gq-44 /P,7ri3,CIA-50PWB011 9900020007 ducted,
new facilities identified and errors found in the data base,
blank forms similar to the CAMEXEC menu can be used to forward
new or changing information to SSC for inclusion in the data
base.
The previous paragraphs briefly describe a
suggested process which could be used to incrementally develop
the STORFAC data base. The pages which follow estimate the
costs for this effort. Costs are identified for Agency re-
search and entry effort in working days, software development
in working days and machine costs in terms of computer usage
and terminal hook-up costs.
22. The cost for the ongoing File Maintenance
activities which will be required to keep STORFAC current are
difficult to determine. It is estimated that the data base
would normally be updated on a weekly basis. This process
would be required to enter data for new facilities and update
information on existing facilities. In addition, it is assumed
that there would be approximately 2 report production runs
per week. Each File Maintenance run will require approximately
1 minute CPU time at a cost of $22 per run. Each report pro-
duction run will require approximately .5 minute CPU time at
a cost of $11 per run. Computer usage costs will be billed to
OUP. The cost for data extraction and terminal entry will
depend upon the amount of activity associated with introduce--ion
Approved For Release 2002/0 / C1A- ROP8 6011472R000900020007-5
 Approved For Release 2002/05/07 CIA-RDP96B01172Rdbs'900020007-5
of nc secure facilities and the number of surveys/inspections
performed by the various teams and offices. Terminal hook-up
time for entry of a new facility will be in the range of 5 to
10 minutes. Hook-up time for entering new data on an existing
facility will depend upon the amount of data being added. This
should not exceed more than 5 minutes per facility.
_.,,1_Lu,., 1,.Luvl.ae an estimate for
the various costs associated with STORFAC development. Figure
8 presents the estimate for programmer effort associated with
software development which would be charged to the ODP budget.
Figure 9 provides an estimate of the machine costs for software
and data base development activities which would be charged to
the ODP budget. Figure 10 is an estimate of the number of
work days which would be required to extract and enter the
data via a terminal using a CAMEXEC menu. Figure 11 is a
schedule for STORFAC development in terms of calendar weeks
per task.
Approved For Release 2002/O'5/0T',C:IA-RDP961301172R000900020007-5
 Approved For Rise 2002/05/07 : CIA-RDP96B01172R900020007-5
PROGRAN:~iER
Software Development Cost Estimates
CAMEXEC MENU W/EDITS
NIPS FILE ANALYSIS & DESIGN
22 work days
FILE MAINTENANCE LOGIC
(Design, Code, Test)
SSC DESIGNED REPORTS (6)
AUDIT TRAIL REPORT
DUPLICATION OF CAMEXEC MENU REPORT
CROSS INDEX REPORT
FILE GENERATION & TEST
NIPS SOFTWARE DOCUMENTATION
USER TRAINING & MONITORING
COVERSION TABLES
89 work days
Note: This translates into approximately $10,800
@ $600 per work week.
(18 wk x $600 = $10,800)
Figure S. Programmer Software Development Cost Estimates
Approved For Release 2002/05/07 : C1~12DP961301172R000900020007-5
 Approved FoseI200/0~3nZA '~.E6DT~1QNA,
020007-5
MACHINE COST ESTIMATES
SOFTWARE DEVELOPMENT COMPUTER COST $1,300
(approx. 1 hour CPU time)
SOFTWARE DEVELOPMENT TERMINAL HOOK-UP COST $2,400
(approx. 200 hours @ $12 hour)
COMPUTER COST FOR FILE GENERATION & $ 650
REPORT PRODUCTION DURING INCREMENTAL
DEVELOPMENT
(approx. .5 hour CPU time)
TERMINAL HOOK-UP TIME FOR SSC DATA ENTRY $3,840
DURING INCREMENTAL DEVELOPMENT
(75 facilities per day = 320
hours at $12 per hook-up hour)
TOTAL MACHINE COST $8,190
Figure 9. Machine Cost Estimates
Approved For Release 200 /? /0 ?: E(A-(RD,R9001172R000900020007-5
 Approved For Rel a 2002/05/07 : CIA=RDP96B01172R0W600020007-5
DATA EXTRACTION COSTS IN
TERMSOF WORKING DAYS
SSC ORIGINAL DATA EXTRACTION & 20-25 person work days
CAMEXEC ENTRY TIME
OL DATA EXTRACTION
PSD DATA EXTRACTION
TSD DATA EXTRACTION
ISSG DATA EXTRACTION
OC/CSD
20-30
20-30
10-15
10-15
DATA EXTRACTION 10-15
SSC CAflEXEC ENTRY OF NEW
FACILITIES & ADDITIONAL DATA
20-25
110-155 person work days
Note: If records must be researched in other offices, the
data extraction work day costs must be increased
proportionately.
Figure 10. Data Extrac'Cion Cost Estimates
29
Approved For Release 2002/05/07r~: CIA_-RDP96B01172R000900020007-5
 Approved For Release 2002/05/07 : CIA-RDP96B01172R000900020007-5
Approved For Release 2002/05/07 : CIA-RDP96B01172R000900020007-5