Search

The Department of the Interior's (Interior) U.S. Fish and Wildlife Service (Service) is generally required to use the best available scientific information when making key decisions under the Endangered Species Act (ESA). Controversy has surrounded whether former Deputy Assistant Secretary Julie MacDonald may have inappropriately influenced ESA decisions by basing decisions on political factors rather than scientific data. Interior directed the Service to review ESA decisions to determine which decisions may have been unduly influenced. ESA actions include, among others, 90-day petition findings, 12-month listing or delisting findings, and recovery planning. The Service distributed informal guidance in May 2005 on the processing of 90-day petitions. Recovery plans generally must include recovery criteria that, when met, would result in the species being delisted. GAO examined three separate issues: (1) what types of decisions, if any, were excluded from the Service's review of decisions that may have been inappropriately influenced; (2) to what extent the Service's May 2005 informal guidance affected 90-day petition findings; and (3) to what extent the Service has, before delisting species, met recovery criteria. GAO interviewed Service staff, surveyed Service biologists, and reviewed delisting rules and recovery plans. Interior did not provide comments in time for them to be included in this testimony. Several types of decisions were excluded from the Service's review of decisions that may have been inappropriately influenced. Using the following selection criteria, the Service identified eight ESA decisions for potential revision: (1) whether Ms. MacDonald influenced the decision directly, (2) was the scientific basis of the decision compromised, and (3) did the decision significantly change and result in a potentially negative impact on the species. The Service excluded (1) decisions made by Interior officials other than Ms. MacDonald, (2) policy decisions that limited the application of science, and (3) decisions that were changed but not significantly or to the point of negative impact on the species. The Service's May 2005 informal guidance had no substantive effect on 90-day petition findings. In May 2005, Service headquarters distributed a guidance document via e-mail to endangered-species biologists that could have been interpreted as instructing them to use additional information collected to evaluate a 90-day petition only to refute statements made therein. GAO's survey of 90-day petition findings issued by the Service from 2005 through 2007 found that biologists used additional information collected to evaluate petitions to both support and refute claims made in the petitions, as applicable, including during the 18-month period when the May 2005 informal guidance was being used. However, GAO found that the Service faces various other challenges in processing petitions, such as making decisions within 90 days and... [ABSTRACT FROM AUTHOR]

The control systems that regulate the nation's critical infrastructures face risks of cyber threats, system vulnerabilities, and potential attacks. Securing these systems is therefore vital to ensuring national security, economic well-being, and public health and safety. While most critical infrastructures are privately owned, the Tennessee Valley Authority (TVA), a federal corporation and the nation's largest public power company, provides power and other services to a large swath of the American Southeast. GAO was asked to testify on its public report being released today on the security controls in place over TVA's critical infrastructure control systems. In doing this work, GAO examined the security practices in place at TVA facilities; analyzed the agency's information security policies, plans, and procedures in light of federal law and guidance; and interviewed agency officials responsible for overseeing TVA's control systems and their security. TVA had not fully implemented appropriate security practices to secure the control systems used to operate its critical infrastructures at facilities GAO reviewed. Multiple weaknesses within the TVA corporate network left it vulnerable to potential compromise of the confidentiality, integrity, and availability of network devices and the information transmitted by the network. For example, almost all of the workstations and servers that GAO examined on the corporate network lacked key security patches or had inadequate security settings. Furthermore, TVA did not adequately secure its control system networks and devices on these networks, leaving the control systems vulnerable to disruption by unauthorized individuals. Network interconnections provided opportunities for weaknesses on one network to potentially affect systems on other networks. For example, weaknesses in the separation of network segments could allow an individual who gained access to a computing device connected to a less secure portion of the network to compromise systems in a more secure portion of the network, such as the control systems. In addition, physical security at multiple locations that GAO reviewed did not sufficiently protect the control systems. For example, live network jacks connected to TVA's internal network at certain facilities GAO reviewed had not been adequately secured from unauthorized access. As a result, TVA's control systems were at increased risk of unauthorized modification or disruption by both internal and external threats. An underlying reason for these weaknesses was that TVA had not consistently implemented significant elements of its information security program. For example, the agency lacked a complete and accurate inventory of its control systems and had not categorized all of its control systems according to risk, limiting assurance that these systems are adequately protected. In addition, TVA's patch management process lacked a mechanism to effectively prioritize... [ABSTRACT FROM AUTHOR]

Securing the control systems that regulate the nation's critical infrastructures is vital to ensuring our economic security and public health and safety. The Tennessee Valley Authority (TVA), a federal corporation and the nation's largest public power company, generates and distributes power in an area of about 80,000 square miles in the southeastern United States. GAO was asked to determine whether TVA has implemented appropriate information security practices to protect its control systems. To do this, GAO examined the security practices in place at several TVA facilities; analyzed the agency's information security policies, plans, and procedures against federal law and guidance; and interviewed agency officials who are responsible for overseeing TVA's control systems and their security. TVA has not fully implemented appropriate security practices to secure the control systems and networks used to operate its critical infrastructures. Both its corporate network infrastructure and control systems networks and devices were vulnerable to disruption. The corporate network was interconnected with control systems networks GAO reviewed, thereby increasing the risk that security weaknesses on the corporate network could affect those control systems networks. On TVA's corporate network, certain individual workstations lacked key software patches and had inadequate security settings, and numerous network infrastructure protocols and devices had limited or ineffective security configurations. In addition, the intrusion detection system had significant limitations. On control systems networks, firewalls reviewed were either inadequately configured or had been bypassed, passwords were not effectively implemented, logging of certain activity was limited, configuration management policies for control systems software were inconsistently implemented, and servers and workstations lacked key patches and effective virus protection. In addition, physical security at multiple locations did not sufficiently protect critical control systems. As a result, systems that operate TVA's critical infrastructures are at increased risk of unauthorized modification or disruption by both internal and external threats. An underlying reason for these weaknesses is that TVA had not consistently implemented significant elements of its information security program. Although TVA had developed and implemented program activities related to contingency planning and incident response, it had not consistently implemented key activities related to developing an inventory of systems, assessing risk, developing policies and procedures, developing security plans, testing and monitoring the effectiveness of controls, completing appropriate training, and identifying and tracking remedial actions. For example, the agency lacked a complete inventory of its control systems and had not categorized all of its control systems according to risk, thereby limiting assurance that these... [ABSTRACT FROM AUTHOR]

Various public records in the United States, including some generated by the federal government, contain Social Security numbers (SSN) and other personal identifying information that could be used to commit fraud and identity theft. Public records are generally defined as government agency-held records made available to the public in their entirety for inspection, such as property records and court records. Although public records were traditionally accessed locally in county courthouses and government record centers, in recent years, some state and local public record keepers have begun to make these records available to the public through the Internet. While it is important for the public to have access to these records, concerns about the use of information in these records for criminal purposes have been raised. In 2006, these concerns were heightened when an Ohio woman pled guilty to conspiracy, bank fraud, and aggravated identity theft as the leader of a group that stole citizens' personal identifying information from a local public record keeper's Web site and other sources, resulting in over $450,000 in losses to individuals, financial institutions, and other businesses. Although we previously reported on the types of public records that contain SSNs and access to those records, less is known about the federal government's direct provision of records with SSNs to state and local public record keepers. Because of Congress's interest in information on these issues, we agreed to answer the following questions: (1) Which federal agencies commonly provide records containing SSNs to state and local public record keepers, and what actions have been taken to protect SSNs in these records? (2) What significant vulnerabilities, if any, remain to protecting SSNs in public records? IRS and DOJ are the only federal agencies that commonly provide records containing SSNs to state and local public record keepers, and in recent years, both have taken steps to truncate or remove SSNs in those records. These agencies provide property lien records to public record keepers, on which they traditionally included full SSNs for identity verification purposes. However, both agencies have recently taken steps to better protect SSNs in these records. Currently, IRS mandates the use of a truncated version of SSNs on tax lien notices, which displays only the last four digits of the SSN. However, the agency does not mandate SSN truncation on all lien releases it issues. In addition, many of DOJ's districts have begun to truncate or fully remove SSNs on the lien records they provide to public record keepers. However, because DOJ's districts act independently to issue lien notices, some continue to display full SSNs in these records. Independent of IRS and DOJ efforts in this area, some states have begun to remove SSNs in all public records they maintain, though this approach can be costly and may not be fully effective at protecting SSNs. Both full and... [ABSTRACT FROM AUTHOR]

To ensure that essential government services are available in emergencies, federal agencies are required to develop continuity of operations (COOP) plans. The Federal Emergency Management Agency (FEMA), within the Department of Homeland Security (DHS), is responsible for providing guidance to agencies on developing such plans. Its guidance states that in their continuity planning, agencies should consider the use of telework--that is, work performed at an employee's home or at a work location other than a traditional office. The Office of Personnel Management (OPM) recently reported that 43 agencies have identified staff eligible to telework, and that more than 140,000 federal employees used telework in 2004. OPM also reported that many government operations can be carried out in emergencies using telework. For example, telework appears to be an effective strategy for responding to a pandemic--a global outbreak of disease that spreads easily from person to person and causes serious illness and death worldwide. In previous work, GAO identified steps that agencies should take to effectively use telework during an emergency. GAO was asked to testify on how agencies are addressing the use of telework in their continuity planning, which is among the topics discussed in a report being released today (GAO-06-713). Although agencies are not required to use telework in continuity planning, 9 of the 23 agencies surveyed reported plans for essential team members to telework during a COOP event, compared to 3 in GAO's previous survey. However, few documented that they made the necessary preparations to effectively use telework during such an event. For example, only 1 agency documented that it had communicated this expectation to its emergency team members. One reason for the low levels of preparations reported is that FEMA has not provided specific guidance on preparations needed to use telework during emergencies. Recently, FEMA disseminated guidance to agencies on incorporating pandemic influenza considerations into COOP planning. Although this guidance suggests the use of telework during such an event, it does not address the steps agencies should take when preparing to use telework during an emergency. Without specific guidance, agencies are unlikely to adequately prepare their telework capabilities for use during a COOP event. In addition, inadequate preparations could limit the ability of nonessential employees to contribute to agency missions during extended emergencies, including pandemic influenza. In its report released today, GAO recommends, among other things, that FEMA establish a time line for developing, in consultation with the OPM, guidance on preparations needed for using telework during a COOP event. In commenting on a draft of the report, DHS partially agreed with GAO's recommendation and stated that FEMA will coordinate with OPM in developing a time line for further telework guidance. DHS also stated that both FEMA and... [ABSTRACT FROM AUTHOR]

Ineffective oversight and management of the Department of Defense's (DOD) travel card program, which GAO has previously reported on, have led to concerns about DOD's use of first and business class airfares. GAO was asked to (1) identify the magnitude of premium class travel, (2) determine if DOD's key internal control activities operated effectively and provide examples of control breakdowns, and (3) assess DOD's monitoring and key elements of the control environment. Breakdowns in internal controls and a weak control environment resulted in improper first and business class travel and increased costs to taxpayers. Based on extensive analysis of records obtained from Bank of America, GAO found that DOD spent almost $124 million on about 68,000 premium class related tickets--primarily business class--during fiscal years 2001 and 2002. Each premium class ticket costs the government up to thousands of dollars more than a comparable coach class ticket. GAO's work also indicated that civilian supervisors, managers, and executives and senior military officers accounted for almost 50 percent of the premium class transactions, and for 27 of the 28 most frequent premium class travelers. GAO considers travel by high-ranking officials to be a sensitive payment area because of its susceptibility to abuse. Breakdowns in key internal controls resulted in a significant level of improper premium class travel. GAO estimated that 72 percent of DOD's fiscal year 2001 and 2002 premium class travel was not properly authorized, and 73 percent was not properly justified. Further, DOD did not have accurate and complete data on the extent of premium class travel and performed little or no monitoring of this travel. In regard to the control environment, GAO found that DOD (1) issued policies that were inconsistent with General Service Administration governmentwide travel regulations, (2) did not require military services to issue and update premium class policies to implement DOD's travel regulations consistently, and (3) did not issue guidance on how to document the authorization and justification of premium class travel. As a result of GAO's audit, DOD has begun updating its travel regulations to more clearly state when premium class travel can be authorized and to emphasize that it must only be used when exceptional circumstances warrant the additional cost. [ABSTRACT FROM AUTHOR]