Automated assessment of disclosure risk

ABSTRACT: Information systems continue to progress in terms of collecting, characterizing and assessing information. While this evolution has provided unprecedented intelligence capability to the U.S. and our allies, it has also raised unique challenges in the area of information security and disclosure risks. In particular, the intelligence community (IC) currently lacks the ability to understand how the continuous release of information through approved information sharing, intentional or unintentional leaks, or malicious, covert breaches risks divulging secrets either directly or through inference. To address this gap in Phase I Securboration and Dartmouth College designed and prototyped RIQUEST (Risk Quantification and Estimation Toolkit). To highlight the systems potential, we selected a well-known security-breach (PRISM) and went back in time to analyze open source data that showed the evolution of key PRISM elements being disclosed and actually elevating PRISMs disclosure risk prior to the breach. The use-case also highlights RIQUESTs ability to auto-generate an ontological representation of a secret by applying text analytics. This overcomes a major limiting factor associated with current model-based approaches that have been notoriously complex, requiring excessive detail and effort before seeing any benefit; and then extremely brittle and unable to adapt and evolve as new knowledge is gained.; BENEFIT: RIQUEST provides significant benefit to both the public and private sectors. Because of RIQUESTs ability to bootstrap the disclosure monitoring process by ingesting typical documents, such as CONOPS, specifications, requirements, etc.; the use cases for RIQUEST are numerous and diverse. They range from auto-risk disclosure at the NSA level for clandestine programs and capabilities, to the more mundane aspect of patent e-discovery which requires the patent subject to not have been publically released (i.e. to the wild). In this latter case RIQUEST could ingest the patent (secret) and then perform the disclosure search for instances of public disclosure. In the commercial sector, RIQUEST has the potential to allow corporations to understand at what level their strategic policy (e.g. mergers), internal operations (e.g. product releases), or even internal/external investigations (e.g. SEC) are disclosed to the public. This allows corporations to be proactive in dealing with the leakage and minimize adverse effects in shareholder confidence and stock share price / company valuation.