FBI Sentinel: Lessons 25 Years After 9/11

The central lesson the FBI learned after 9/11 was that it needed to change its work structure before changing its tools. Fragmented information and delayed validation led to the failure of VCF, while Sentinel was fully deployed in 2012 after introducing short development cycles and field feedback.

The figures and timeline in this article are based on the 2004 commission report and Sentinel oversight records from 2012 to 2014.

Signals the FBI Missed Before 9/11

Before the attacks, the FBI had leads worth reviewing. The problem was that those leads were scattered across different organizations and systems. The path for field intelligence to inform headquarters’ decisions was also weak. The 2001 attacks, which killed about 3,000 people, exposed this disconnect.

Representative examples were the Phoenix memo and the Minneapolis investigation. A Phoenix agent reported on trends at flight schools in July 2001. Minneapolis agents sought to search Zacarias Moussaoui’s belongings. The two pieces of information did not develop into an integrated warning of the attack plot.

The 9/11 Commission did not blame only information sharing. It also identified flaws in analytical capabilities and management systems. The sentence below is an English translation of the relevant passage from the report.

“The FBI did not know what it already knew.” — The 9/11 Commission Report

Interpreting this case simply as a lack of data misses the point. Information cannot be used if it cannot be found. Without someone accountable, connecting multiple leads is also difficult. When channels for raising dissenting views are weak, warnings disappear more easily.

×

Analysts examine a digital workflow to identify bottlenecks and potential improvements.

Timeline of VCF and Sentinel

The FBI’s transition to electronic case management proceeded through two projects. VCF was discontinued in 2005 without ever being deployed for actual work. Sentinel also struggled initially with scheduling and cost management. However, after being restructured in 2010, it reached full deployment in 2012.

About $170 million is reported to have been invested in VCF. However, audit documents differ in how they define the scope of contract costs and related project expenses. This amount therefore should not be interpreted as the cost of the FBI’s entire modernization effort. What is clear is that VCF itself never became operational as a case management system.

Sentinel’s initial project budget was $425 million. The project was divided into multiple phases, but delays accumulated. In 2010, officials concluded that it would be difficult to complete under the existing plan. The FBI divided the scope again and brought development control in-house.

Comparing VCF with the Reorganized Sentinel

The difference between the two projects lay more in how they were validated than in the names of the software. With VCF, a major problem was that the completed product was reviewed too late. The reorganized Sentinel frequently released functional units. Feedback from field users was also incorporated into the next development cycle.

It is not enough to view this solely as a victory for a methodology called agile. The FBI also revised the project scope and command structure. It expanded the role of its internal technical staff as well. Short development cycles were the means by which these changes worked.

AI Adoption by Use Case

The work that must be fixed first varies depending on where AI is applied. Document search requires metadata and access permissions. Decision support requires evidence and approval procedures. Automation requires someone responsible for handling exceptions.

First, map one workflow from start to finish. Next, mark waiting time and duplicate data entry. Apply AI only at confirmed bottlenecks. Measure not only accuracy but also the cost of corrections.

Knowledge Structure Problems Added by the AI Era

Generative AI can connect scattered information in a plausible way. However, it cannot connect documents it cannot access. If there are many outdated documents, it may produce outdated answers. Nor can it independently take responsibility for conflicting rules.

For this reason, knowledge management in the AI era is difficult to evaluate by storage volume. Each document must indicate its author and period of applicability. Disposal status and approval status must also be distinguished. Users must be able to trace answers back to the original supporting sources.

The following items can be checked before selecting a model.

• Are rules on the same topic duplicated across multiple repositories?
• Can current documents be distinguished from retired documents?
• Are role-based access permissions applied to sensitive information?
• Can the source documents and versions behind AI answers be verified?
• Is someone responsible for reporting and correcting wrong answers?
• Are tasks that require human approval clearly defined?

This perspective also reveals a new risk that was absent from the earlier FBI case. In the past, the major problem was that information could not be found. Now, incorrectly connected information can spread rapidly. Searchability and verifiability must be designed together.

Common Mistakes and Misconceptions

First, 9/11 should not be described simply as an incident caused by insufficient information. Multiple leads existed, but they were not analyzed together. Organizational structure and decision-making procedures also affected the outcome. Simply collecting more data makes it difficult to prevent the same problem.

Second, the failure of VCF should not be reduced to the waterfall approach alone. Requirements management and contract oversight were also problems. User participation and technical control were likewise insufficient. The development approach was only one of several causes.

Third, Sentinel should not be considered automatically successful because it adopted agile. The project scope was adjusted and leadership changes occurred in parallel. Internal staff also assumed greater responsibility. A methodology does not replace an accountability structure.

Fourth, describing the collapse of the World Trade Center with a single definitive figure of “14 seconds” may be inaccurate. The two towers differed in the timing of their impacts and collapses. Descriptions of the collapse duration also vary depending on the measurement criteria. A single figure unrelated to the central lesson should be treated cautiously.

Implementation Sequence for Organizations

It is safer to validate AI adoption within small units of work. Goals should be defined by business outcomes, not tool usage rates. Criteria for stopping early when failure is detected are also necessary. The following sequence can be used when piloting a single workflow.

1. Select one task that is repetitive or frequently delayed.
2. Record the input information and final approver.
3. Measure the current processing time and types of errors.
4. Separate the scope handled by AI from the scope handled by people.
5. Deploy first to a small group of users.
6. Incorporate errors and correction time into the next cycle.
7. Expand the scope only when the criteria are met.

Do not define performance metrics solely by the number of uses. Consider processing time and the amount of rework together. Check how quickly critical errors are detected as well. You should also record whether field feedback leads to actual changes.

Organizational Questions Raised by the FBI Case

This case shows that AI can amplify an organization’s existing habits. In an organization where information is isolated, AI also receives incomplete context. If approval stages are unclear, faster generation increases rework. If validation is postponed, errors likewise accumulate at scale.

Organizations can begin by answering three questions.

• Who holds the necessary information?
• Who is responsible for connecting different signals?
• When can small failures be detected and stopped?

The central lesson of the FBI Sentinel case is not to replicate a particular development method. It lies in the operating principle of dividing uncertainty into small units and checking them frequently. AI tools must be placed under the same controls. The organization’s pace of learning must stay ahead of its pace of adoption.