Identix Touchlock Fingerprint Identification System, California Department of Corrections, Review (July 2001)

O I G FFICE OF THE NSPECTOR ENERAL S W I G TEVE HITE, NSPECTOR ENERAL R EVIEW OF THE C D ALIFORNIA EPARTMENT C OF ORRECTIONS I T DENTIX OUCHLOCK F I INGERPRINT DENTIFICATION S YSTEM J 2001 ULY S C G D G TATE OF ALIFORNIA RAY AVIS, OVERNOR State of California Office of the Inspector General P.O. Box 348780 Sacramento, CA 95834-8780 Memorandum Date: July 17, 2001 To: TERESA ROCHA, Acting Director California Department of Corrections From: STEVE WHITE Inspector General Subject: REVIEW OF THE CALIFORNIA DEPARMENT OF CORRECTIONS IDENTIX TOUCHLOCK FINGERPRINT IDENTIFICATION SYSTEM The enclosed report presents the results of the review of the California Department of Corrections Identix Touchlock Fingerprint Identification system conducted by the Office of the Inspector General. The review disclosed that three-and-a-half years after the project was approved, only two of the state’s institutions have usable Identix systems and neither is using the system as it was intended to be used. The review raised questions about whether the system ever can be fully implemented at the state’s correctional institutions. The Office of the Inspector General recommends that the California Department of Corrections establish a task force to evaluate the advisability of proceeding with the Identix system. The Office of the Inspector General discussed the results of the review on June 12, 2001 with the Chief of the Department of Corrections Facility Maintenance and Technology Section and her staff. Comments from that office were taken into consideration when the report was finalized. We have been advised that the department has made progress in implementing the Identix system since the date of this review, but it should be noted that the Office of the Inspector General has not had the opportunity to confirm that information. Throughout the course of this review, the Office of the Inspector General staff received excellent cooperation from the Chief of the Facility Maintenance and Technology Section and her staff. I wish to acknowledge and express my appreciation for the courtesy extended to my staff. Please contact my Chief Deputy, John Chen, at (916) 830-3660 if you have any questions concerning this report. Cc: Robert Presley, Secretary, Youth and Adult Correctional Agency Jan Polin, Chief, Facility Maintenance and Technology Section John Chen, Chief Deputy Inspector General OFFICE OF THE INSPECTOR GENERAL REVIEW OF THE CALIFORNIA DEPARTMENT OF CORRECTIONS IDENTIX TOUCHLOCK FINGERPRINT IDENTIFICATION SYSTEM JULY 16, 2001 REPORT This report presents the results of a review conducted by the Office of the Inspector General of the Identix Touchlock Fingerprint Identification System and the Datatag Photo Imaging Identification Card System, which have been planned for implementation at the state’s 33 adult correctional institutions. The two systems were intended to be used together to improve staff safety by monitoring those entering and leaving an institution’s secured perimeter and tracking the length of time a person remains inside the institution. The project was approved by the former director of the Department of Corrections in September 1997 after two pilot projects were conducted. The project was to have been completed in two phases, with 17 of the most high-risk institutions implementing the system in phase one and the remaining institutions receiving the system in phase two. The Office of the Inspector General found that at the time of this review, three-and-a-half years after the project was approved, only two of the state’s institutions have usable Identix systems and neither is using the system as it was intended. The results of the review raised questions about whether the system can ever be fully implemented at the state’s correctional institutions. The Office of the Inspector General found that the Department of Corrections proceeded with the project without enough information to accurately assess the systems and circumvented state controls by failing to conduct a feasibility study and by not obtaining the necessary approvals from state control agencies. Although department records show an expenditure of approximately $3.8 million to implement the Identix and Datatag systems, the Office of the Inspector General found that this amount fails to account for significant additional costs and that the actual cost of efforts to install the systems cannot be quantified from the department’s records. The Office of the Inspector General recommends that the California Department of Corrections establish a task force that includes representatives from state control agencies to evaluate the feasibility of proceeding with the Identix system. The department also should strictly adhere to state control policies and requirements in any future efforts to develop and implement information technology systems. STATE OF CALIFORNIA GRAY DAVIS, GOVERNOR OFFICE OF THE INSPECTOR GENERAL CONFIDENTIAL PAGE 1 BACKGROUND Implementation of the Identix and Datatag systems was prompted by two incidents that occurred at state correctional institutions in 1996. In the first incident, a correctional counselor was fatally assaulted inside the secured perimeter of the Heman G. Stark Youth Correctional Facility and was not discovered for two days. In the second incident, an inmate escaped from the R. J. Donovan Correctional Facility by fabricating a department employee identification card. The Identix system was intended to improve security by logging those entering and leaving the secured perimeter of an institution with the use of a fingerprint-scanning device. Under the system, an employee places an index finger on a crystal sensor, which “reads” the fingerprint and matches it to fingerprints stored in a computer database. The system also assigns a time period within which the employee must exit the secured perimeter in order to alert staff of possible danger if the person does not leave within the designated time period. The system is also intended to alert security staff of attempted unauthorized entry or exit from the institution. The Datatag system was designed to produce a hologram identification card with a magnetic strip similar to a California driver’s license, which would be swiped through the Identix Touchlock unit to retrieve the person’s fingerprint file for matching against the fingerprint placed on the sensor. The former director of the Department of Corrections approved the project for implementation at all institutions in September 1997 after a pilot project of the Identix system conducted at Centinela State Prison and a pilot project of the Datatag system conducted at the Richard A. McGee Correctional Training Center. The systems were to have been installed in two phases as shown below, with the state’s 17 most high-risk institutions receiving the systems first. Phase one was funded in the department’s 1997-98 fiscal year budget surplus. Phase One California State Prison-Sacramento Pleasant Valley State Prison Mule Creek State Prison Corcoran State Prison Centinela State Prison California Correctional Institution Pelican Bay State Prison San Quentin State Prison California State Prison, Los Angeles Sierra Conservation Center Salinas Valley State Prison California Medical Facility Deuel Vocational Institute Wasco State Prison Calipatria State Prison Substance Abuse Treatment Facility at Corcoran High Desert State Prison Phase Two California Correctional Center California Rehabilitation Center California Men’s Colony Central California Women’s Facility Ironwood State Prison Correctional Training Center North Kern State Prison Chuckawalla Valley State Prison R. J. Donovan Correctional Facility Folsom State Prison California Institution for Men California Institution for Women California State Prison-Solano Valley State Prison for Women Northern California Women’s Facility Avenal State Prison STATE OF CALIFORNIA GRAY DAVIS, GOVERNOR OFFICE OF THE INSPECTOR GENERAL CONFIDENTIAL PAGE 2 The Department of Corrections contracted with Datatag and Identix to implement the systems under the California multiple award schedule. Nine months into the Datatag contract, which was signed in January 1998, Datatag began defaulting on the contract specifications, and eventually the contract was terminated. The scope of the project, which originally was to have included identification cards for both staff and inmates, was reduced to include only department staff. The California Attorney General’s Office became involved in the contractor default in September 1999, but determined that because of Datatag’s insufficient assets, it would not be cost effective to pursue litigation. The Department of Corrections subsequently replaced the Datatag vendor with Identix and the two projects were merged into one. OBJECTIVES, SCOPE, AND METHODOLOGY The review of the Identix system by the Office of the Inspector General was conducted to evaluate the operational success of the system and to determine whether the California Department of Corrections properly managed the Identix project from initiation through implementation. Because the Identix and Datatag systems eventually merged into one, the review by the Office of the Inspector General included the department’s efforts to implement the Datatag system. To accomplish the review objectives, the Office of the Inspector General: • Reviewed and evaluated the policies, procedures, and documentation used by the Department of Corrections to initiate, manage, and implement the project; • Interviewed key personnel with knowledge of the project; • Conducted a telephone survey of the 17 institutions in phase one of the project; and • Conducted site visits to the two institutions where the Identix system was operational. The review did not include an audit of computer systems or databases used in the Identix System. FINDING 1 The Office of the Inspector General found that the California Department of Corrections approved implementation of the Identix and Datatag systems without sufficient information to accurately assess the project. The Department of Corrections estimates that as of February 1, 2001, it had spent approximately $3.8 million to implement the Identix and Datatag systems. Despite this substantial outlay of state funds, the Office of the Inspector General found that the department made little effort to evaluate the systems before proceeding with full project implementation. The project approvals consisted of two separate two-page memoranda to the former director of the California Department of Corrections from the chair of the STATE OF CALIFORNIA GRAY DAVIS, GOVERNOR OFFICE OF THE INSPECTOR GENERAL CONFIDENTIAL PAGE 3 department’s technology transfer committee. The two memoranda, both dated September 12, 1997, cited the results of the pilot studies and requested approval to proceed with full implementation of both the Identix and the Datatag systems. The former director approved both projects on September 12, 1997, the same day the approval requests were submitted. The Office of the Inspector General reviewed both memoranda and found that: • The project’s expected costs were grossly understated. Citing the Centinela State Prison pilot project cost of less than $40,000, the technology transfer committee reported to the director that the cost for most institutions to implement Identix would remain under $50,000. Documents provided by department staff show that the department actually spent $1,886,663, or an average of $110,980 per institution, for the 17 institutions scheduled to install Identix during phase one. The costs ranged from $55,744 at Centinela State Prison to $278,656 (including $119,450 for five years of maintenance support) at Deuel Vocational Institution. In addition, department staff acknowledged that these amounts do not reflect costs associated with site modification, staff time, and supplemental equipment purchased with institution funds. Some institutions reported that they also incurred significant amounts of overtime to create identification and fingerprint files for each employee. These additional costs cannot be quantified from department records. In the memorandum requesting approval for the Datatag project, the technology transfer committee reported a cost of $12,570 without specifying how this money would be used. Presumably, the $12,570 represented the amount required to obtain equipment for a Datatag system to produce the new identification cards, but the memorandum did not provide the estimated total cost of the project or specify how many systems were needed to fully implement the system throughout the state’s correctional institutions. Without such information, it would not have been possible for the department to make an informed decision about whether the project should be approved. According to documents provided by the Department of Corrections, the department spent a total of $1,900,121 on equipment for the project. It appears that all institutions and offices purchased multiple Datatag systems and that the costs ranged from $34,370 at the Northern California Women’s Facility to $142,944 at the California Institution for Men, which purchased equipment for five Datatag systems. • The department did not take into account differences among institutions. There is little evidence that the department adequately considered operational and environmental differences among the state’s correctional institutions. Approval of the Identix project was based on the results of the pilot study at Centinela State Prison without consideration of the significant differences between Centinela State Prison and other institutions. In the memorandum requesting approval of the project, the technology transfer committee did not mention the differences, other than alluding to the possibility that older institutions might incur higher costs because of limited electrical conduit capacity. Differences among the institutions have hampered efforts to successfully implement the Identix system throughout the state, with institutions encountering a myriad of logistical and system hardware and software problems that should have been identified and STATE OF CALIFORNIA GRAY DAVIS, GOVERNOR OFFICE OF THE INSPECTOR GENERAL CONFIDENTIAL PAGE 4 addressed before the decision to proceed with the system. For example, the staff at San Quentin State Prison told the Office of the Inspector General that the institution has 11 separate entrances that would have to be covered by the Identix system, necessitating extensive site modification and considerable expense. Another institution reported that the fingerprint readers were not working well because of the dry climate. Another institution, situated in a cold and wet climate, developed hardware problems when it stored equipment outside. Overall, 15 of the 17 phase-one institutions are still encountering significant problems in attempting to implement the systems and no institution is using the systems as they were intended to be used. • The department did not adequately consider how to integrate the two systems. The Office of the Inspector General found little evidence that the department devoted adequate attention to how the Identix and Datatag systems would be integrated before proceeding with the project. In the approval requests for Identix and Datatag, the technology transfer committee noted that the two systems were to be integrated; yet they were implemented as two separate systems without any linkage. Under the present configuration, personnel staff maintain employee information on a computer system, which is used to generate the photo identification card, and the information is re-entered into a separate database to update the fingerprint portion of the system. This duplication of effort is time consuming when institutions implement the system and the process is susceptible to database input errors and inconsistencies. FINDING 2 The Office of the Inspector found that the California Department of Corrections circumvented state control procedures by failing to conduct a feasibility study and by not securing the required outside approvals before proceeding with the Identix project. No feasibility study was conducted. State Administrative Manual Section 4921 requires that a feasibility report be conducted before state funds are encumbered or expended on any information technology project. In addition, Section 43020.5 of the California Department of Corrections Operations Manual requires the department to strictly adhere to state policy requiring a feasibility report for information technology projects. The department apparently circumvented the requirement for a statewide feasibility study by having each of the 17 phase-one institutions submit a workgroup computing justification form instead. Workgroup computing justification forms should not supplant a feasibility study. The workgroup computing justification form is not an appropriate substitute for the feasibility study. Under Section 4989.1 of the State Administrative Manual, departments may use the workgroup computing justification form to procure general-purpose hardware and software without a feasibility study. The intent of the section is to allow departments flexibility in purchasing and implementing general purpose hardware and software under certain dollar threshold limits, specifically, personal computers and “off-the-shelf” software, such as Windows 98 and Microsoft Office. The procurement of the Identix technology does not meet the criteria of general-purpose hardware or software. The department apparently recognized this distinction in another project employing Identix technology for parole STATE OF CALIFORNIA GRAY DAVIS, GOVERNOR OFFICE OF THE INSPECTOR GENERAL CONFIDENTIAL PAGE 5 offices by preparing a feasibility report and submitting it to the Department of Information Technology. That project was approved on November 15, 1997, at approximately the same time phase one of the Identix project was under consideration. Likewise, in 2000, the department prepared a feasibility report for phase two of the Identix project. Had a feasibility study been performed for the statewide Identix project, many of the project’s shortcomings might have been identified before the department’s decision to proceed. Instead, the department went ahead without knowing whether the project was feasible or what problems would have to be overcome during implementation. The department did not obtain required approvals from the Department of General Services. The Department of General Services sets contract limits for all vendors included in the California Multiple Award Schedule. To exceed contract limitations, agencies must obtain approval from the Department of General Services. The limit on the Datatag contract, a non-information technology commodity project, was set at $100,000. The limit on the Identix contract, an information technology project, was set at $500,000. The Department of Corrections did obtain an exemption from the Department of General Services to exceed the $100,000 Datatag limit, with an approval to spend up to $1.8 million, but exceeded this limit by almost $100,000 without securing additional approval. The department did not request or obtain approval to exceed the $500,000 limit on the Identix project, yet appears to have exceeded this limit by as much as $1.4 million. The Department of General Services was able to locate an Identix exemption letter for the Department of Corrections, but the Office of the Inspector General determined that the exemption was for a separate project relating to inmate parole. The department did not obtain approval from the Department of Information Technology. Under provisions of the State Administrative Manual, Section 4817.37, for projects that exceed the cost limit that the Department of Information Technology assigns to an agency, agencies must do one of the following: ● Submit a feasibility study for the project to the Department of Information Technology and receive approval from the department; ● Submit and obtain approval for a request for delegation from the Department of Information Technology with subsequent approval of the feasibility study by the agency director; or ● Obtain specific delegation from the Department of Information Technology in the agency’s memorandum of understanding with the department. The cost limit assigned by the Department of Information Technology to the Department of Corrections for information technology projects is $500,000. Both the Datatag and Identix projects exceeded that limit. The Datatag and Identix equipment for phase one cost approximately $1.9 million each, for a combined cost of $3.8 million. Yet, the Department of Corrections did not consult with the Department of Information Technology about the Identix project and did not submit a feasibility study or submit a request for delegation. Nor STATE OF CALIFORNIA GRAY DAVIS, GOVERNOR OFFICE OF THE INSPECTOR GENERAL CONFIDENTIAL PAGE 6 does the Department of Corrections have specific delegation from the Department of Information Technology for information technology projects. FINDING 3 The Office of the Inspector General found that as of February 2001, the Identix system was fully usable at only two of the 17 phase one institutions and that neither institution was using the system as it was intended to be used. As of February 2001, approximately three-and-a-half years after the project was approved by the former director, the Office of the Inspector General found that Identix systems were operating only at Centinela State Prison and Mule Creek State Prison. The system was not yet in operation at five of the remaining 15 phase-one institutions because of problems attributable to the institutions’ physical configurations and other factors. San Quentin State Prison, for example, has required extensive site modifications to install the Identix system because the institution has 11 separate entrances into secured areas. Progress in implementing the system at the other 10 phase-one institutions varies, but all of the institutions are encountering problems that prevent the system from operating accurately and reliably. In response to an Office of the Inspector General survey question about the anticipated operational date for Identix, an official at one institution said he has no idea when the system might be operational. The staff at another institution reported that they need more terminals in order for the system to work, but did not expect to get them. Responding to a question about possible solutions to problems that had been identified, the staff at a third institution replied, “still waiting.” Even where the system is operating, a key feature is not being used. Neither of the two institutions at which the system is presently operating, Centinela State Prison and Mule Creek State Prison, are utilizing the main feature used to justify implementation of the system — the ability to track the length of time a person remains inside an institution. The Office of the Inspector General found that the system at Mule Creek State Prison could not generate accurate reports to alert security that a staff member had stayed inside the secured perimeter beyond the designated shift time. At Centinela State Prison, the system was capable of preparing the reports, but they were no longer being generated because staff was not reviewing them. Without this important security feature, the two institutions are using the Identix system merely as an enhanced version of a staff identification system. In addition to the department’s failure to conduct a feasibility study and to consider differences among institutions, the survey results attributed problems to the following: • Lack of guidance and support from department headquarters. Staff at most of the institutions reported that they receive little support from headquarters when they encounter system installation or operational problems. Institutions have been left to implement the system on their own with no standardized procedures or training. In many cases, institutions have sought guidance from other institutions further along in the process. This uncoordinated approach has seriously hampered implementation efforts. STATE OF CALIFORNIA GRAY DAVIS, GOVERNOR OFFICE OF THE INSPECTOR GENERAL CONFIDENTIAL PAGE 7 ● Lack of adequate budgetary resources for the project. Phase one of the project was funded through the department’s 1997-98 fiscal year budget surplus. The Department of Corrections funded the institutions’ initial equipment purchase according to the anticipated needs of each institution. When the actual needs of the institutions have proven to be greater than anticipated, headquarters has not provided additional funding. In addition to equipment costs, the projects involve numerous other expenses, including those associated with site modification, overtime, and ongoing maintenance agreements, which vary significantly among the institutions. Department headquarters has not provided funding for these costs and many institutions have been either unable or unwilling to fund the costs from institution budgets. As a result, each of the 17 phase- one institutions has implemented the project at its own pace and on its own initiative, further contributing to delays and inconsistencies. • The default of the Datatag contractor contributed to implementation problems. Approximately $150,000 of equipment purportedly shipped by Datatag to the institutions was lost and eventually written off. During the contract dispute, the department continued to purchase Identix equipment, but had to store it because of the missing Datatag components necessary to run the system. Institution staff surveyed advised the Office of the Inspector General that some of the stored Identix equipment deteriorated and became unusable because of dust, mold, rust, heat, and other factors. FINDING 4 The Office of the Inspector General found that the California Department of Corrections lacks the resources to complete the Identix project and that the Identix technology may be outdated. The Department of Corrections presently has no practical means of funding and completing the Identix project. Although the department funded phase one of the project through its 1997-98 fiscal year budget surplus, the department’s subsequent year budgets did not include enough monies to fund the remaining portions of the project. The department submitted a budget change proposal requesting $2,181,951 in the 2001-02 budget year to complete the project, but the proposal was rejected. Of the amount requested, $164,951 was to have funded system maintenance costs for the phase-one institutions and $2,017,000 was to have funded the installation of the Identix system at the 16 phase-two institutions. The prospect of the department achieving a significant budget surplus in the future is remote. The Identix technology may be obsolete. The executive officer of the technology transfer committee told the Office of the Inspector General that the Identix technology is outdated and that the Department of Corrections is now researching another system that records and monitors the whereabouts of both inmates and custody staff at all times within a defined perimeter. Although the union has raised concerns, and the new system may not be practicable because of its high cost (approximately $1 million per institution), the department is presently conducting a pilot test to investigate its feasibility. STATE OF CALIFORNIA GRAY DAVIS, GOVERNOR OFFICE OF THE INSPECTOR GENERAL CONFIDENTIAL PAGE 8 RECOMMENDATION The Office of the Inspector General recommends that the Department of Corrections establish a task force to evaluate the feasibility of proceeding with the Identix system. The Department of Corrections also should strictly adhere to state policies and requirements in all future efforts to develop and implement information technology systems. The task force established to evaluate the Identix system should include representatives from control agencies, including the Department of Finance, the Department of General Services, and the Department of Information Technology. Specifically, the task force should assess the following: ● The status of the phase-one implementation process and the likelihood of success in fully implementing the Identix project as originally intended. ● The advisability of using Identix in the current technology environment. ● The availability of sufficient funds to complete the project. If the department decides to proceed with Identix, it should concentrate its initial efforts on successfully completing the systems at the 17 phase-one institutions. Department of Corrections headquarters should actively monitor the progress of the project and provide guidance and assistance as necessary. Before proceeding with phase two of Identix, the department should develop a detailed implementation plan, including clearly specified project tasks and milestones. STATE OF CALIFORNIA GRAY DAVIS, GOVERNOR OFFICE OF THE INSPECTOR GENERAL CONFIDENTIAL PAGE 9