Government Accountability Offices Finds Government Still Mostly Terrible When It Comes To Cybersecurity

from the can't-even-secure-a-filing-cabinet,-apparently dept

The government has done a spectacularly terrible job at protecting sensitive personal information over the past couple of years. Since 2013, the FDA, US Postal Service, Dept. of Veterans Affairs, the IRS and the Office of Personnel Management have all given up personal information. So, it's no surprise the Government Accountability Office's latest report on information security contains little in the way of properly-secured information.

It opens with this depressing graph, showing just how many agencies flunked its information security controls assessment. Keep in mind that it only surveyed 24 agencies.

But what's most concerning about the report (which is full of concerning conclusions) is that, in an era of cyber-everything, the most common "security incidents" have nothing to do with phishing, security holes or any other cyber-related threat. They have to do with people and the mishandling of dead tree byproducts.


Non-cyber incidents are defined by the GAO as:

...a report of PII [personally-identifiable information] spillage or possible mishandling of PII that involves hard copies or printed material as opposed to digital records.

The GAO reports that security incidents have skyrocketed over the past eight years, from 5,500 in 2006 to nearly 70,000 last year.


It also notes that incidents involving personally-identifiable information have increased steadily as well.

[T]he number of information security incidents involving PII reported by federal agencies has more than doubled in recent years, from 10,481 in 2009 to 27,624 in 2014.

It all adds up to something fairly disturbing. Not only are government agencies increasingly under attack from outside forces, but their internal handling of hard-copy PII is getting worse as well -- even if the percentage of non-cyber incidents has declined over the past five years.

And despite the government's increased focus on all things cyber, the first chart makes it clear there has been almost no improvement in information security controls since 2013.

It also appears as though there's only one agency taking the GAO's past recommendations seriously: the Department of Defense.

OMB established a fiscal year 2014 target of 75 percent implementation for strong authentication. In its report on fiscal year 2014 FISMA implementation, OMB indicated that the 24 federal agencies covered by the CFO Act had achieved a combined 72 percent implementation of these requirements, but this number dropped to only 41 percent implementation for the 23 civilian agencies when excluding DOD.

Obviously, overhauling security controls in a large number of agencies is an enormous undertaking. But this low level of implementation is both frightening and pathetic. The government demands large amounts of personal information from citizens, as well as from its employees and job applicants. There's no opting out. Then it takes this information and provides only the most perfunctory of protections. Government agencies clearly can't be trusted with securing this information, but there's no option other than to submit and hope for the best. It's even more disheartening when you realize that some of these directives that still haven't been fully complied with have been in place since 2002.

The government asks for too much and provides too little in return. Multiple agencies want to be the "ground force" in the cyberwar. But until the homefront is secured, it seems unwise to deploy elsewhere.

Filed Under: cybersecurity, dod, gao, government, nsa

Copyright Office's Online Registration System Has Been Down All Week

from the time-to-fix-it dept

Back in March, the Government Accountability Office (GAO), which tends to do really great work, came out with an absolutely scathing report on the disaster that is the Library of Congress, and didn't beat around the bush in blaming the Librarian of Congress James Billington for being technologically illiterate and out of touch, leading to gross mismanagement. The report noted that the Library of Congress appeared to have no leadership or strategic plan in place to address technology issues. Just a few months later, Billington -- who had served in the job for 27 years -- announced his retirement. And apparently things were so bad at the Library of Congress, that rather than the usual bland platitudes, people working there were immediately willing to run to the press about how excited they were to be rid of Billington:

The reaction inside the library was almost gleeful, as one employee joked that some workers were thinking of organizing a conga line down Pennsylvania Avenue. Another said it felt like someone opened a window.

“There is a general sense of relief, hope and renewal, all rolled into one feeling,” said one staffer who spoke on the condition of anonymity for fear of reprisal. “Like a great weight has been lifted from our shoulders.”

Maureen Moore, who retired in 2005 but volunteers at the library, said she and her friends were thrilled.

“It’s a great day for the library. The man has had 27 years to do good things, and he hasn’t,” she said.

Ouch.

Anyway, given all that, it should be no surprise that the Copyright Office which is (rightfully) a part of the Library of Congress, is apparently experiencing a bit of technical difficulty these days:

The U.S. Copyright Office’s electronic registration system has been down since Friday, costing the office an estimated $650,000 in lost fees and causing headaches for approximately 12,000 customers.

The outage is part of a bigger computer failure at the Library of Congress, the federal agency that oversees the national library, provides Congress with research advice and operates the Copyright Office, a major player in the global digital economy.

Scheduled maintenance on the library’s James Madison Building resulted in buildingwide power outages, officials said. The library’s information technology office is trying to restore the systems, but officials can’t say when service will return.

Double ouch. Yes, yes, we all know that government computing is a total mess. But this is pretty disgraceful, especially for areas (both the Library of Congress and the Copyright Office) that are so closely associated with the technology world these days. Getting new management into the Library of Congress -- in particular someone who understands technology and innovation -- can't come fast enough.

Filed Under: computer system, copyright office, gao, james billington, librarian of congress

Healthcare.gov Is A Security Disaster... And Those Working On It Knew It, And Tried To Stop Independent Security Review To Hide It

from the well-that's-not-at-all-comforting dept

We've written before about how problematic the technology is behind the federal healthcare.gov website, pointing out that the federal government hired political cronies rather than web development experts to build it. There was an effort to open source the code, but after the feds put the code on github, they removed it after people started pointing out just how bad it was. Then, just about a month ago, we noted that the government turned down a FOIA request from the Associated Press concerning the site's security practices, arguing that it might "give hackers enough information to break into the service." As we noted at the time, if revealing the basic security you have in place will give hackers a road map to breaking into the site, the site is not secure at all.

A damning new report from the Goverment Accountability Office (GAO) more or less confirms this is the case. This is further backed up by an even more astounding "Behind the Curtain of the Healthcare.gov Rollout" released by the House Oversight Committee. To be fair, the GAO is non-partisan and known to be even-handed and fair. That's not always the case with Congressional committee reports. Still, the two are worth reading together. The level of mess behind the project is rather astounding and it appears that the site still is not particularly secure, which obviously explains the refusal to do that FOIA release.

Here's the GAO basic summary of the security situation for the site:

While CMS has taken steps to protect the security and privacy of data processed and maintained by the complex set of systems and interconnections that support Healthcare.gov, weaknesses remain both in the processes used for managing information security and privacy as well as the technical implementation of IT security controls. CMS took many steps to protect security and privacy, including developing required security program policies and procedures, establishing interconnection security agreements with its federal and commercial partners, and instituting required privacy protections. However, Healthcare.gov had weaknesses when it was first deployed, including incomplete security plans and privacy documentation, incomplete security tests, and the lack of an alternate processing site to avoid major service disruptions. While CMS has taken steps to address some of these weaknesses, it has not yet fully mitigated all of them. In addition, GAO identified weaknesses in the technical controls protecting the confidentiality, integrity, and availability of the FFM. Specifically, CMS had not: always required or enforced strong password controls, adequately restricted access to the Internet, consistently implemented software patches, and properly configured an administrative network. An important reason that all of these weaknesses occurred and some remain is that CMS did not and has not yet ensured a shared understanding of how security was implemented for the FFM among all entities involved in its development. Until these weaknesses are fully addressed, increased and unnecessary risks remain of unauthorized access, disclosure, or modification of the information collected and maintained by Healthcare.gov and related systems, and the disruption of service provided by the systems.

That failure to restrict access to the internet was for test servers, one of which got infected with malware recently.

But the really damning story is that CMS, the Centers for Medicare and Medicaid Services, which was in charge of the product, seemed totally incompetent throughout this process -- and directly chose to kill off an independent security review by MITRE, knowing the results would be bad and that they might get out:

Once MITRE completed their September Security Assessment, Mr. Schankweiler’s FFM development team was unhappy with the report and sought to have it changed. On September 26, 2013, Darren Lyles, one of the IT security officials assigned to the FFM development team, wrote Ms. Fryer:

The Draft SCA [security control assessment] Report has been called into question by CGI [primary contractor building the FFM] and CIISG [Consumer Information Insurance Group, the team within CMS that works with contractors to develop the FFM and other Healthcare.gov components] Stakeholders. There are assertions made in the report that are deemed to be erroneous and misrepresentative of what actually occurred. I have attached the report that has been commented on by CGI and would like to submit this for your review.

Michael Mellor, Ms. Fryer’s deputy, responded to Mr. Lyles: “Keep in mind – that the purpose of the SCA is to provide an independent assessment of the security posture of a system. As part of that independent assessment, the maintainer of the system likely will not agree with all of the findings and the SCA report.”

Mr. Schankweiler, Mr. Lyles’ superior, then responded to Mr. Mellor, insisting that the report should be reviewed by senior CMS officials and worried the report would be seen by others outside CMS: “We need to hit the pause button on this report and have an internal meeting about it later next week. It is important to look at this within the context of the decision memos and ATO memo that is going up for Tony [Trenkle, CMS Chief Information Officer] and Michelle [Snyder, CMS Chief Operating Officer] to sign.” Mr. Schankweiler then wrote the report was “only partially accurate, and extremely opinionated, false, misrepresentative, and inflammatory.” Mr. Schankweiller noted that “It is very possible that this report will be reviewed at some point by OIG, and could see the light of day in other ways.” Mr. Schankweiler offered to “look at the report from the government perspective and provide ... analysis.”

On October 7, 2013, the lead security tester for MITRE, Milton Shomo, wrote Jane Kim, a CMS official on Ms. Fryer’s EISG team, “CCIIO [Centers for Consumer Information and Insurance Oversight, one of the divisions at CMS responsible for running the exchange] and CGI Federal had some issues with some of the information in our Marketplace … draft SCA report from the assessment we did in August and September. MITRE stands behind everything in our report as an accurate description of the assessment.

There were a number of other similar problems, but it becomes clear that choices were made for political reasons, rather than technological or security reasons.

Filed Under: cms, gao, healthcare.gov, hhs, politics, security

Sen. Coburn Offers To Put An Outdated Agency Out Of Its Misery With His 'Let Me Google That For You' Bill

from the microsoft-now-hastily-composing-angry-response-letters dept

No entity highlights the ridiculous amount of bureaucratic inefficiency and ineptitude of government agencies better than the Government Accountability Office (GAO). Its reports are loaded with the sort of damning evidence that would lead those unfamiliar with how government actually works to assume that heads will be rolling. In reality, the agencies investigated by the GAO soldier on from scathing report to scathing report with little to no sign of improvement.

Tom Coburn, a long-time combatant of government waste and fraud who publishes a yearly report exposing the worst of worst in terms of senseless government spending (the "Wastebook") is now using the GAO's own words to craft a bill targeting the money pit that is the National Technical Information Service (NTIS).

Here's the leadup:

(3) NTIS is tasked with collecting and distributing government-funded scientific, technical, engineering, and business-related information and reports.
(4) GAO found that NTIS sold only 8 percent of the 2,500,000 reports in its collection between 1995 and 2000.
(5) A November 2012 GAO review of NTIS made the following conclusions:

(A) 'Of the reports added to NTIS's repository during fiscal years 1990 through 2011, GAO estimates that approximately 74 percent were readily available from other public sources.'
(B) 'These reports were often available either from the issuing organization's website, the Federal Internet portal (http://www.USA.gov) or from another source located through a web search.'
(C) 'The source that most often had the report [GAO] was searching for was another website located through http://www.Google.com.'
(D) '95 percent of the reports available from sources other than NTIS were available free of charge.'

(6) No Federal agency should use taxpayer dollars to purchase a report from the National Technical Information Service that is available through the Internet for free.

And here's the punchline:

SECTION 1. SHORT TITLE.

This Act may be cited as the 'Let Me Google That For You Act.'

Someone had fun cranking out this "Short Title."

As the bill points out, it was suggested by the Secretary of Commerce in 1999 that the NTIS would eventually outlive its usefulness. According to the GAO's 2012 findings, that sell-by date was reached more than a decade ago.

NTIS product expenditures exceeded revenues for 10 out of the past 11 fiscal years.

The "Let Me Google That For You" Act calls for the repeal of the 1988 National Technical Information Act and the disbandment of the agency itself, with the redistribution of whichever of its duties are still deemed essential to the Commerce Department.

It's not often you get the chance to watch an extraneous government agency be put down and even rarer still under a snarky, incisive, short title. This is for the best. As we've seen all too frequently, time marches on, swiftly distancing itself from the glacial pace of government innovation.

Filed Under: documents, gao, let me google that for you, ntis, search, tom coburn
Companies: google

GAO Finds Handling Of Intelligence Contractors Just As Screwed Up As Everything Else It's Investigated

from the a-regular-Snowden-breeding-ground dept

The NSA's problem with contractors surfaced in the most internationally spectacular way when one of them made his way to Hong Kong with a drive full of agency documents. Other failures were less spectacular, but didn't go completely unnoticed. A recent investigation uncovered years of fraudulent behavior by a government contractor charged with vetting potential hires for various agencies, including the NSA. The contractor was accused of (among many things) interviewing dead people and falsifying a massive number of background checks.

So, the release of a GAO report on intelligence contractors is perfectly timed. Like every GAO report, there's a dearth of good news. What's been uncovered by the GAO is another bureaucratic web that makes just tracking contractor information nearly impossible.

Limitations in the intelligence community’s (IC) inventory of contract personnel hinder the ability to determine the extent to which the eight civilian IC elements—the Central Intelligence Agency (CIA), Office of the Director of National Intelligence (ODNI), and six components within the Departments of Energy, Homeland Security, Justice, State, and the Treasury—use these personnel. The IC Chief Human Capital Officer (CHCO) conducts an annual inventory of core contract personnel that includes information on the number and costs of these personnel. However, GAO identified a number of limitations in the inventory that collectively limit the comparability, accuracy, and consistency of the information reported by the civilian IC elements as a whole. For example, changes to the definition of core contract personnel and data shortcomings limit the comparability of the information over time. In addition, the civilian IC elements used various methods to calculate the number of contract personnel and did not maintain documentation to validate the number of personnel reported for 37 percent of the 287 records GAO reviewed. Further, IC CHCO did not fully disclose the effects of such limitations when reporting contract personnel and cost information to Congress, which limits its transparency and usefulness.

Bad data brings bad results (not to mention the attendant detrimental effect on accountability) and there were plenty of bad results to report, including the fact that contractors might be abusing this broken system to push the government around.

Further, the elements’ ability to use the core contract personnel inventory as a strategic planning tool is hindered because the inventory does not provide insight into the functions performed by contractors, in particular those that could inappropriately influence the government’s control over its decisions.

The GAO attempted to audit IC records dating from 2007 to 2011, but immediately ran into problems.

[W]e could not conduct a reliability assessment of the data for fiscal years 2007 through 2009 due to a variety of factors. These factors include civilian IC element officials’ stating that they could not locate records of certain years’ submissions or that obtaining the relevant documentation would require an unreasonable amount of time.

Amazing. The government stonewalls the government. This isn't people waving FOIA requests. This is the Government Accountability Office carrying out an order from Congress and yet, the responding office claims it would take too long to find these documents, if they can actually be found at all.

As the report goes on, it becomes clear the GAO never had a chance to compile anything comprehensive. First, it was informed that some contractors not previously designated as such were arbitrarily given that designation at some point in 2010. Then the CHCO informed the GAO that it had made significant changes to its contract management system in 2011, making most of what had been gathered prior useless for year-to-year comparisons.

Then there were problems stemming from the civilian contractors themselves, who also altered their data reporting during the same time frame, further complicating any attempts to compare year-to-year data.

In the end, the GAO settled for sampling 287 records from 2010-2011 to generate this report. Even with this limited sample set, there were issues.

We found that the civilian IC elements either under- or over-reported the amount of obligations by more than 10 percent for approximately one-fifth of the records. In addition, the civilian IC elements could not provide complete documentation to validate the information reported for 17 percent of the records we reviewed. Overall, we were able to validate the amount of reported obligations for approximately 43 to 77 percent of the records we reviewed at any one element.

So, only 43-77% of the records were deemed "verifiable" by the GAO. But this same unreliable data was used by the CHCO to report costs and set budgets.

However, IC CHCO used the core contract personnel inventory information to report fiscal years 2010 and 2011 contract costs for the eight civilian IC elements in our review…

IC CHCO’s guidance for the fiscal years 2010 and 2011 inventories generally requires IC elements to report on the total amount of funds obligated to contracts during the fiscal year. However, the guidance also indicates that reporting on a snapshot of active contracts on September 30 is an acceptable method for the large elements. This practice may lead to elements not fully accounting for the amount of obligations within a fiscal year on contracts…

But that's OK, because there's apparently no way to hold the IC CHCO accountable.

Officials acknowledged that in some cases, obligations may not be reported as a result of the exclusion of inactive contracts or contract option periods. However, IC CHCO does not disclose this methodology or its effects on the information it reports to Congress.

Not surprisingly, given this lack of direct accountability, the IC CHCO's methodology and controls have not improved over the past half-decade despite the constant generation of faulty info and the misplacement of IC records. The GAO recommends several changes to the current system (of course), but the past tells us these will be ignored by both the head office and the agencies under its "control."

Filed Under: gao, intelligence community, nsa, privacy

GAO Report Finds That CBP, ICE Have No Project Management Skills, Relying On 1980s Equipment To Guard Borders

from the seems-like-a-national-security-issue,-non? dept

Another GAO report is out, this time discussing the CBP's and ICE's failed attempts at modernizing their computer systems. As I've noted before, the word "scathing" often precedes the words "GAO report," most of which detail the sort of ineptitude that only large-scale bureaucracies can achieve. As I've also noted, the operative phrase following "scathing GAO report" is more often than not, "business as usual." Most GAO reports mention previous findings that were ignored, haphazardly implemented or back-burnered indefinitely.

The latest GAO report deals with two of our favorite government entities/targets, the CBP (Border Patrol) and ICE (IP industry go-fers). Both are under the purview of the DHS and both have computer systems sorely in need of an upgrade. The good news is… well, there's really no good news in here. The explanatory note helps set the stage.

DHS’s border enforcement system, known as TECS, is the primary system for determining admissibility of persons to the United States. It is used to prevent terrorism, and provide border security and law enforcement, case management, and intelligence functions for multiple federal, state, and local agencies. It has become increasingly difficult and expensive to maintain and is unable to support new mission requirements. In 2008, DHS began an effort to modernize the system. It is being managed as two separate programs by CBP and ICE.

TECS keeps our borders safe, fights terrorism, provides support for multiple levels of law enforcement… and has been undergoing modernization for more than a half-decade. This should be disheartening enough -- an outdated system is being used to secure a nation, a system that can't even keep up with current demands. But it gets so much worse as the report goes on.

The schedule and cost for the Department of Homeland Security’s (DHS) border enforcement system modernization program known as TECS Mod that is managed by Customs and Border Protection’s (CBP) continue to change; while the part managed in parallel by Immigration and Customs Enforcement (ICE) is undergoing major revisions to its scope, schedule, and cost after discovering that its initial solution is not technically viable.

CBP’s $724 million program intends to modernize the functionality, data, and aging infrastructure of legacy TECS and move it to DHS’s data centers by 2016. To date, CBP has deployed functionality to improve its secondary inspection processes to air and sea ports of entry and, more recently, to land ports of entry in 2013. However, CBP is in the process of revising its schedule baseline for the second time in under a year. Further, CBP has not developed its master schedule sufficiently to reliably manage work activities or monitor program progress. These factors raise questions about the certainty of CBP’s remaining schedule commitments.

If everything works out according to, well, normally I'd say "plan" right here but it certainly appears that nothing resembling a "plan" is actually in place, it will be eight years from start-to-finish on the TECS modernization. And that's the CBP only. And that's only if the CBP can keep it on schedule, which at this point, appears to be something it can't actually do.

Then there's ICE, running its own parallel update to TECS, and failing just about as spectacularly as the CBP.

Regarding ICE’s $818 million TECS Mod program, it is redesigning and replanning its program, having determined in June 2013 that its initial solution was not viable and could not support ICE’s needs. As a result, ICE largely halted development and is now assessing design alternatives and is revising its schedule and cost estimates. Program officials stated the revisions will be complete in spring 2014. Until ICE completes the replanning effort, it is unclear what functionality it will deliver, when it will deliver it, or what it will cost to do so, thus putting it in jeopardy of not completing the modernization by its 2015 deadline.

Five years after TECS mods is put in motion, ICE decides the modernization won't work. Six years later, it's promising a new estimate by spring of 2014. The previous best guess was completion in seven years, but the GAO notes that this end date is highly improbable considering work has been completely halted to "assess design alternatives." A realistic scenario most likely puts modernization completion a decade out from the start date, at which point one has to wonder if the new system will be outdated before it even goes completely live.

A few pages later the GAO points out that the system being upgraded dates back to the 1980s and several government entities rely on it for mission-critical data. However, "archaic" doesn't mean "cheap." The CBP estimates licensing and maintenance on its TECS system runs $40-60 million per year. Sadly, this expensive, outdated system can't even keep up with written languages that have been around for hundreds and thousands of years.

The current TECS system uses obsolete technology, which combined with expanding mission requirements, have posed operational challenges for CBP and others. For example, users may need to access and navigate among several different systems to investigate, resolve, and document an encounter with a passenger. In addition, CBP identified that TECS’s search algorithms do not adequately match names from foreign alphabets.

Seems like a Border Control agency might need a system that can parse foreign alphabets accurately. Foreigners are its main concern. You would think an issue like this, which could lead to misidentification of innocent people as threats or vice versa would be a chief concern. (I'm sure the DHS/CBP are more concerned with the latter than the former, but it's still a big hole in their ability to "secure" the nation's borders.)

What's even sadder about this "foreign alphabet" issue is the fact that the GAO had to list it as a recommendation. This means the CBP had no current plans in place to patch this critical hole in its TECS system.

The CBP keeps promising a 2015 date for delivery of the updated system, but the more the GAO digs, the less it believes it has any chance of meeting this deadline. The agency apparently can't be bothered to follow simple best practices to help guide the modernization project to completion.

CBP is in the process of revising its schedule baseline for the second time in under a year, making it unclear when the program ultimately intends to deliver needed functionality. Exacerbating this situation is the fact that CBP has not developed its master schedule sufficiently to effectively manage work activities or monitor the program’s progress.

Not only that, but nothing's linked together in the shambolic project management the CBP has slapped together. A delay elsewhere in the project won't be reflected by current budget and date estimates, which will pretty much dump the project into the "it'll be done when it's done" category. All the while, tax dollars are being pumped in to maintain a system that can't keep up with what was asked of it a half-decade ago.

How does a project like this slip into a mismanaged mess without any cohesive guiding force? Well, if the agency behind the project feels like it isn't a job worth doing, it has plenty of ways to ensure the job will never get done.

Program officials stated these deficiencies existed because the program has only two staff members with skills needed to properly develop and maintain the schedules, and that fully documenting all the dependencies would be time consuming, and in their view, not sufficiently important to warrant the additional resources necessary to complete them.

An agency, one tasked with The Most Important Job (national security), can't even be bothered to entrust modernization of a computer system dating back to the 1980s to more than two people. And when pressed, it can't even be bothered to care that these limits will result in excess expenditures and endless delays.

Things aren't much better on the ICE side.

Instead of continuing with the existing technical solution, the program manager explained that ICE would scrap a significant portion of the work done to date and start over. As a result, ICE halted most development work in June 2013 and has since been assessing different design and technical alternatives. In January 2014, ICE reported that it had rebaselined its program requirements and that it anticipates having its revised cost and schedule estimates finalized this coming spring. Nevertheless, given the time lost in developing the current technical solution, as well as the already reduced program scope, ICE cannot say what specific features it will release to users, when this functionality will be delivered, or how much such efforts will cost. As such, ICE is at significant risk of not achieving independence from the existing system by 2015.

So, ICE has basically informed the GAO that it has no idea whether the upgraded system, if and when it arrives, will be capable of meeting the demands of the agency. It has already made one false start and scrapped that entirely, rather than used whatever gains it achieved as a new starting point. The report delves a little deeper and details just how much ICE scrapped before starting over, and why.

In ICE’s case, management weaknesses and the lack of appropriate guidance for the program’s requirements management process led to technical issues, testing failures, and ultimately, the deferral and/or deletion of about 70 percent of the program’s original requirements. ICE issued new requirements guidance for the program in March 2013 that is consistent with leading practices, but has yet to demonstrate that these have been fully implemented.

ICE will now move forward on a new modernization plan, one that looks to be handled no better than the one it scrapped in 2013. Both agencies seemingly have no idea how to run a project of this scope (and have shown little interest in doing so). If either of these agencies were private businesses, they'd already be dead and long-forgotten. Even those tasked with evaluating ICE/CBP's modernization plans seem to be unqualified to do the job.

In its most recent program health assessments, the Enterprise Business Management Office partially based its rating of moderately low risk on CBP’s use of earned value management; however, the program manager stated to us that the CBP program is not utilizing earned value management because neither it nor its development contractor had the capability to do so. Similarly, even though ICE had not reported recent cost or schedule data for its program—an issue that may signal a significant problem—the Office of the CIO rated ICE’s program as medium risk. The reliance on incomplete and inaccurate data raises questions about the validity of the risk ratings.

The GAO took its findings up the bureaucratic ladder to the DHS, which didn't seem to be very troubled by the bumbling incompetence of the agencies under its purview.

DHS concurred with all but one of our recommendations, disagreeing with the recommendation regarding the weaknesses in CBP’s schedule. In response, DHS stated that CBP’s scheduling efforts for TECS Mod were sound. However, given the weaknesses in CBP’s master schedule, we continue to believe that management will be unable to determine how a slip in the completion date of a particular task may affect the overall project or program schedule, and thus, absent any changes, continuing to use it as a tool to track progress will remain ineffective.

In conclusion, the GAO found plenty of money wasted and nothing to show for it.

[A]fter spending nearly a quarter billion dollars and over 4 years on its two TECS Mod programs, it remains unclear when DHS will deliver them and at what cost. While CBP’s program has delivered one of the five major projects that comprise the program, its commitments are being revised again and the master schedule used by the program to manage its work and monitor progress has not been fully developed.

The $250 million is more than one-quarter of the CBP's total estimated budget for its TECS overhaul. At this point, it's still basically at square one and is doing absolutely nothing to ensure the project stays on track or within budget. ICE's expenditures aren't broken out separately, but judging from its decision to scrap one attempt entirely and start over, there's little doubt that its modernization program is doomed to the same fate at the CBP's.

Filed Under: cbp, gao, ice

The GAO's Office In The NSA Is Collecting Dust Because Congress Hasn't Asked For A Report In Years

from the oh,-you-mean-this-'stringent-oversight?' dept

The NSA's defenders go to great lengths to convince everyone (the public and many angered legislators) that it operates under a tremendous amount of oversight -- so much though that even THINKING about abusing its capabilities is out of the question. The leaks have repeatedly proven this assertion false as members of the supposedly stringent oversight continue to state their shock and dismay over what's been uncovered.

Steven Aftergood at Secrecy News points out there's another layer of oversight that's gone unutilized for years as well.

Years ago, the Government Accountability Office, the investigative arm of Congress, conducted routine audits and investigations of the National Security Agency, such that the two agencies were in “nearly continuous contact” with one another. In the post-Snowden era, GAO could perform that oversight function once again.

“NSA advises that the GAO maintains a team permanently in residence at NSA, resulting in nearly continuous contact between the two organizations,” according to a 1994 CIA memorandum for the Director of Central Intelligence.

Why haven't we read any damning reports from the GAO about the NSA's abuses over the past several years? Well, apparently it's because no one wants to know.

At a 2008 Senate hearing, Sen. Daniel Akaka asked the GAO about its relationship with NSA. “I understand that GAO even had an office at the NSA,” Sen. Akaka noted.

“We still actually do have space at the NSA,” replied David M. Walker, then-Comptroller General, the head of the GAO. “We just don’t use it. And the reason we don’t use it is we are not getting any requests [from Congress]. So I do not want to have people sitting out there twiddling their thumbs.”

There's that oversight at work again. Idle for "years" by 2008 and no signs that anything has occurred since then. The GAO maintains an office (currently unstaffed) within the NSA but because if no one's asking any questions, it's not providing any answers.

If there's something the GAO does well, it's track down internal issues and problematic behavior. Unfortunately, it's limited to recommending courses of action rather than mandating any serious changes, meaning its follow-up reports are generally filled with descriptions of how these audited entities failed to pursue the recommendations and (often) performed considerably worse during the interim.

On the other hand, the GAO's reports do at least make it clear to the American public exactly what's wrong with nearly everything the government spends its money on. It's very limited accountability that does nothing to change the underlying agency ethos, but at least it prevents them from pretending these problems don't exist.

Being in-house should naturally raise concerns about the GAO's objectivity. Unfortunately, considering the nature of the agency's intelligence work, there's probably no way around that. But the first step in renewing this layer of oversight is to remind Congress of its existence. It has the power to order a GAO investigation, but until it does, the office will continue to gather dust and the NSA's internal problems will worsen -- or at least go unnoticed by Congress.

Aftergood points out that James Clapper has ordered the agency to be responsive to GAO inquiries, apparently in the eventuality that it ever gets back to the business of asking questions.

In Intelligence Community Directive 114, issued in 2011 following years of stagnation in GAO oversight of intelligence, DNI James Clapper instructed U.S. intelligence agencies to be responsive to GAO, at least within certain boundaries.

“It is IC policy to cooperate with the Comptroller General, through the GAO, to the fullest extent possible, and to provide timely responses to requests for information,” the DNI wrote.

Of course, Clapper's definition of "responsive" probably differs greatly from the normally-accepted usage of the word. Having Clapper condone cooperation with an agency that exists to find flaws and misconduct is a bit underwhelming. The NSA's top men have been less than cooperative in the many hearings since the Snowden leaks began, most often recycling old talking points and insisting on discussing it in the context of one program (Section 215) when everyone else is clearly focused on another area.

Still, whatever the GAO finds (that somehow doesn't get blotted out with black ink) will provide more useful information for its Congressional overseers. This certainly shouldn't be used in place of more independent oversight committees, but it should prove to be a valuable addition. The real question Congress needs to answer is why it has ignored this option for so many years.

Filed Under: congress, gao, nsa, oversight, surveillance

GAO Suggests It's Time To Ditch Dollar Bills For Coins

from the that'll-upset-some-folks dept

While not the first time it's done so, the GAO has once again urged the federal government to get rid of dollar bills and replace them with dollar coins. It says that this single move could save the government $5.5 billion over 30 years. That's chump change to the government, but it's still $5.5 billion. The report notes that Canada and the UK have done similar moves, and it has worked despite initial public resistance. Still, I'd imagine that US public resistance can be stronger than elsewhere on issues that are fundamentally meaningless, but to which people apply a sentimental value. And let's not even get started on the question of whether or not it's finally time to ditch the penny...

Filed Under: bills, coins, currency, dollars, gao, money

GAO Concludes Piracy Stats Are Usually Junk, File Sharing Can Help Sales

from the completely,-painfully-unsurprising dept

For many years we've explored how entertainment and software industry piracy statistics are very reliable -- at least in terms of being consistently and notoriously wrong on an annual basis. Each year companies (especially the BSA) like to throw out marginally-coherent data "proving" the supposedly-huge impact piracy has on the economy, national security or employment. The claims are quickly debunked as nonsense -- yet the same claims return year after year, and often get cited by U.S. politicians as gospel.

Carl was the first amongst many to direct our attention to a new study by the GAO on the effects of piracy (covering all sectors, even toys, clothing, automobile parts, and medicine). The GAO's study unsurprisingly found that U.S. government and industry claims that piracy damages the economy to the tune of billions of dollars "cannot be substantiated due to the absence of underlying studies." The full GAO report is worth a read, and not only argues that claims of economic impact have not been based on substantive science -- but that file sharing can actually have a positive impact on sales:

"Some experts we interviewed and literature we reviewed identified potential positive economic effects of counterfeiting and piracy," The GAO wrote. "Some consumers may knowingly purchase a counterfeit or pirated product because it is less expensive than the genuine good or because the genuine good is unavailable, and they may experience positive effects from such purchases. Consumers may use pirated goods to 'sample' music, movies, software, or electronic games before purchasing legitimate copies," the GAO continued. "(This) may lead to increased sales of legitimate goods."

Study after study have supported the conclusion that file sharers purchase more media -- though the idea never resonates the same way as claims of economic armageddon caused by file sharing. While the GAO's report does obviously highlight some of the negative impacts of counterfeiting, the GAO goes on to argue that any overarching conclusions of piracy's impact on the broader economy may not even be possible. The GAO was instructed to study piracy's impact as part of the Intellectual Property Act of 2008 (PRO-IP Act) -- which delivered plenty of handouts to the entertainment industry. ProIP was ironically pushed through using unreliable studies to justify its creation. Of course we'll soon be swimming in new dubious data "proving" the GAO wrong -- and around and around we go.

Filed Under: economics, gao, piracy, proip, studies