Applied analytics: What other states can learn from Indiana's wins (and missteps)

Dewand Neely has been Indiana’s CIO since 2015, when he was appointed  by Gov. Mike Pence. Since then, Neely has spearheaded the state's use of data analytics, something he spoke to GCN about at this year’s National Governors Association's “Meet the Threat” conference. He also spoke about a new cybersecurity training program for state employees that aims to eliminate some of the inadvertent security risks from insiders.

This interview has been edited for length and clarity.

What are some projects that you’re excited about?

Our data analytics practice is getting quite a bit of notoriety from other states that want to know how they can take advantage of what we’ve done, how they can do it and how we can help them. We’ve got a lot of great work going on with analytics, especially using data to help address the opioid crisis that going on across the country. We’re also using data to analyze traffic fatalities.

What have you learned from your work with data analytics?

I’d say the most important thing is how to get our agencies to participate more willingly. The initiative came out of IT, and we were maybe too gung-ho about it. We didn’t really bring the partners along in the best way.

Partners meaning the other agencies?

Correct. The beauty of capturing all of that data from each individual agency's bucket  and bringing it together is that it helps us solve bigger issues, which is something we traditionally hadn’t done. Agencies would make a decisions based on what data they had, but they didn’t account for outliers or information from another agency that could help them make better decisions.

Since we had executive buy-in from the governor, we were able to push through to get some things done. And it really wasn’t a good experience. Some agencies felt forced to do some things they didn’t see value in. So we went back and figured out how to make it a win-win, how to give them the value for their programs and still get what we need. Now agencies are coming to us asking for help solving an issue instead of the other way around.

For the analytics in the opioid crisis, what data are you getting? How are you getting it? And how are you analyzing it?

We’ve successfully connected all of our forensics laboratories to a centralized database that contains information on all of the drugs that are taken off the street. We’re pulling in data on arrests and drug seizures. But we’re also tracking overdoses. So we’re trying to see if, first off, overdoses are concentrated in one area. And we’re also using that data to track where we need to put more patrols and, since the ultimate goal is to save lives, tracking where we need Narcan, or naloxone [an opioid antidote] available so we can catch these folks early and hopefully save their lives. That’s worked out well; we’ve been able to get [Narcan] into the hands of our state troopers while they’re patrolling so they always have it handy. The data showed what we needed.

An unexpected consequence of connecting the forensics lab and tracking the drugs that are coming into the state is that we’ve been able to anticipate some trends. For instance, all of the states are starting to see a heavy uptick in fentanyl, which is an elephant tranquilizer folks are starting to lace heroin with. Very early on that drug wasn’t classified by the Drug Enforcement Agency as a controlled substance. But some counties closest to the Ohio border starting seeing more fentanyl, insinuating it was coming in from Ohio. We saw that Ohio had just reached out to get a classification on [fentanyl] so they could mark it as banned and start arresting for it. That trend analysis allowed us to get ahead in the game and get the drug on our schedule. Now we’re looking to ban it.

What tools are you using for the backend of your analytics?

It’s a combination of several tools. We’re using the [SAP] HANA platform to do a lot of the heavy work -- the crunching, dealing with the unstructured data and doing the matching. And Tableau, to date, has been our visualization tool of choice to create the dashboards end users see.

We’re starting to play with different tools. We’re playing with Hadoop and Splunk. We’re trying to see what the best fit is depending on the project. HANA has by far been the most used because we’re working with some pretty hefty datasets, so we need something with a lot of power.

When states are curious about your data program, what do they ask?

The No. 1 question is, “How do you get this done?” There were a lot of policy and barriers we had to break though. But there is also a pretty hefty financial lift  that some states can’t stomach for something that’s not proven to them yet. So I get asked for use cases we’ve been able to successfully solve.

We’re trying to get creative with some states to do [a more formal] analysis for them, like a memorandum of understanding.

Switching to cybersecurity, you’ve said you’re trying to train the workforce to understand what the issues are. What have you seen that has worked?

To date we have not really had a good system for training. We’ve treated cybersecurity and awareness like HIPPA or workforce harassment where you do it once at the start of the year, and then you’re done. And I think a lot of folks still do that, and it’s not very effective – people forget about it after three weeks.

Just this week we launched the pilot for our new security awareness and training, which is more interactive and more up to date. Employees complete training modules monthly, but it only takes a few  minutes of their time. Each month they’ll get new things to look out for: threat vectors or new phishing scams. The hope is they’ll be looking forward to these exercises. We’re looking to have that completely rolled out in the next 60 days.

What is it going to look like?

It includes watching a short 10-minute interactive video, a little reading and answering some questions. You don’t get a score, but it does tell you what you got wrong and why it was wrong. It’s very user-centric; it applies to things that happen every day, like letting your daughter use your work laptop for Facebook. Those are issues that are occurring today, but most people just don’t think of them as being a risk.