[Senate Hearing 117-424]
[From the U.S. Government Publishing Office]
S. Hrg. 117-424
GAO'S 2021 HIGH RISK LIST: ADDRESSING WASTE, FRAUD, AND ABUSE
=======================================================================
HEARING
before the
COMMITTEE ON
HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS
UNITED STATES SENATE
ONE HUNDRED SEVENTEENTH CONGRESS
FIRST SESSION
----------
MARCH 2, 2021
----------
Available via the World Wide Web: http://www.fdsys.gov/
Printed for the use of the
Committee on Homeland Security and Governmental Affairs
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
GAO'S 2021 HIGH RISK LIST: ADDRESSING WASTE, FRAUD, AND ABUSE
S. Hrg. 117-424
GAO'S 2021 HIGH RISK LIST: ADDRESSING WASTE, FRAUD, AND ABUSE
=======================================================================
HEARING
before the
COMMITTEE ON
HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS
UNITED STATES SENATE
ONE HUNDRED SIXTEENTH CONGRESS
FIRST SESSION
__________
MARCH 2, 2021
__________
Available via the World Wide Web: http://www.govinfo.gov
Printed for the use of the
Committee on Homeland Security and Governmental Affairs
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
U.S. GOVERNMENT PUBLISHING OFFICE
44-783 WASHINGTON : 2022
COMMITTEE ON HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS
GARY C. PETERS, Michigan, Chairman
THOMAS R. CARPER, Delaware ROB PORTMAN, Ohio
MAGGIE HASSAN, New Hampshire RON JOHNSON, Wisconsin
KYRSTEN SINEMA, Arizona RAND PAUL, Kentucky
JACKY ROSEN, Nevada JAMES LANKFORD, Oklahoma
ALEX PADILLA, California MITT ROMNEY, Utah
JON OSSOFF, Georgia RICK SCOTT, Florida
JOSH HAWLEY, Missouri
David M. Weinberg, Staff Director
Zachary I. Schram, Chief Counsel
Lena C. Chang, Director of Governmental Affairs
Yelena L. Tsilker, Professional Staff Member
Yogin J. Kothari, Professional Staff Member
Pamela Thiessen, Minority Staff Director
Andrew Dockham, Minority Chief Counsel and Deputy Staff Director
Amanda H. Neely, Minority Director of Governmental Affairs and General
Counsel
Laura W. Kilbride, Chief Clerk
Thomas J. Spino, Hearing Clerk
C O N T E N T S
------
Opening statements:
Page
Senator Peters............................................... 1
Senator Portman.............................................. 2
Senator Carper............................................... 12
Senator Hassan............................................... 15
Senator Rosen................................................ 18
Senator Lankford............................................. 20
Senator Ossoff............................................... 23
Senator Scott................................................ 27
Senator Sinema............................................... 31
Senator Romney............................................... 33
Senator Padilla.............................................. 35
Prepared statements:
Senator Peters............................................... 39
Senator Portman.............................................. 41
WITNESSES
Tuesday, March 2, 2021
Hon. Eugene L. Dodaro, Comptroller General of the United States,
U.S. Government Accountability Office; accompanied by J.
Christopher Mihm, Managing Director, Strategic Issues; Mark
Gaffigan, Managing Director, Natural Resources and Environment;
Nick Marinos, Director, Information Technology and
Cybersecurity; and David Trimble, Managing Director, Physical
Infrastructure
Testimony.................................................... 5
Prepared statement........................................... 44
APPENDIX
GAO High Risk Report............................................. 59
Responses to post-hearing questions for the Record:
Mr. Dodaro................................................... 361
GAO'S 2021 HIGH-RISK LIST: ADDRESSING WASTE, FRAUD, AND ABUSE
----------
TUESDAY, MARCH 2, 2021
U.S. Senate,
Committee on Homeland Security
and Governmental Affairs,
Washington, DC.
The Committee met, pursuant to notice, at 2:35 p.m., via
Webex and in room SD-342, Dirksen Senate Office Building, Hon.
Gary C. Peters, Chairman of the Committee, presiding.
Present: Senators Peters, Carper, Hassan, Sinema, Rosen,
Padilla, Ossoff, Portman, Lankford, Romney, Scott, and Hawley.
OPENING STATEMENT OF CHAIRMAN PETERS\1\
Chairman Peters. The Committee will come to order.
---------------------------------------------------------------------------
\1\ The prepared statement of Senator Peters appear in the Appendix
on page 39.
---------------------------------------------------------------------------
I want to thank Comptroller General Gene Dodaro for being
here and for your service to the American people. This year
marks the 100th anniversary of the founding of the Government
Accountability Office (GAO), and we are grateful for all of the
work that you do to help ensure the government is working
efficiently for all taxpayers.
Since its creation, the Government Accountability Office,
has acted as Congress' watchdog, giving us the independent,
nonpartisan analysis that we need to ensure that Federal
agencies and programs are working effectively.
GAO plays a critical role in reviewing operations and
activities across the Federal Government, from cybersecurity to
health care services for our Nation's veterans. At the start of
every new Congress, GAO presents some of its most important
findings in the High-Risk List, which we will be discussing
here today.
The High-Risk List report examines government programs and
operations considered to be the most at risk of waste, fraud,
abuse, or mismanagement. The list also focuses on government
functions most in need of reform. This important report is not
only an essential tool for saving taxpayer dollars, but it also
helps us ensure that government works better for every
American.
Over the last 15 years, Federal agencies, lawmakers, and
this Committee have been able to save hardworking American
taxpayers nearly $575 billion by addressing key issues in the
High-Risk List. In the past two years alone, we have saved
taxpayers more than $225 billion by implementing changes based
on recommendations from the GAO. However, there are still many
pressing challenges raised by GAO that we will still need to
make progress on and must address in the near future.
For example, I have long pressed the Federal Government to
help prevent exposure to toxic polyfluoroalkyl substances
(PFAS) chemicals that are harming the health of Michiganders
and people all across our country. The GAO report\1\ that I
helped release yesterday found that the previous administration
did not take significant steps to keep our communities safe
from these harmful substances and made limited progress in
protecting communities and drinking water resources from PFAS,
and that much of the progress identified in the report was
exclusively due to congressional efforts.
---------------------------------------------------------------------------
\1\ The GAO report referenced by Senator Peters appear in the
Appendix on page 59.
---------------------------------------------------------------------------
The recent SolarWinds breach at multiple Federal agencies
shows the urgent need for Congress to take additional action on
Federal cybersecurity protections, and the ongoing crisis
caused by the Coronavirus Disease 2019 (COVID-19) pandemic
continues to raise new and unprecedented challenges for the
Federal Government to address.
I appreciate the work the GAO has done to conduct critical
and timely analysis of the emergency spending Congress has
authorized in the past year to ensure that these funds are
getting to the people, to small businesses, and to communities
who need them the most. Overall, this year's list highlights 36
areas GAO has determined as being high risk and that Congress
must take action to improve.
I look forward to hearing today's testimony from Mr. Dodaro
who has led the GAO since December 2010 and has worked at the
agency for more than 45 years. That is an amazing career. Thank
you for your service. We appreciate your work and the efforts
of everyone at the GAO that allows us to continue working
together on a bipartisan basis to ensure that the Federal
Government can and does better serve the American people.
With that, I am happy to turn this over to Ranking Member
Portman.
OPENING STATEMENT OF SENATOR PORTMAN\2\
Senator Portman. Thank you, Chair Peters. Mr. Dodaro, good
to see you again. Thank you for being here. I know you are
going to bring some of your experts with you as well today, and
we look forward to your testimony.
---------------------------------------------------------------------------
\2\ The prepared statement of Senator Portman appears in the
Appendix on page 41.
---------------------------------------------------------------------------
The subject of the hearing today, examining Federal
programs identified by GAO as vulnerable to fraud, waste,
abuse, and mismanagement, coincides exactly with the oversight
responsibilities of this Committee, which aims to ensure that
government programs are both cost-effective to root out waste
and misconduct in Federal spending. This is a great hearing for
us. I enjoy it every year and enjoy reading your report.
This year's report, the GAO 2021 High-Risk report, can
serve as a road map to maximizing the effectiveness of Federal
expenditures. It is sort of a to-do list for this Committee. We
had a good meeting this morning with you, with some of the
media, talking about some of the highlights of it. I am glad in
particular that this report identifies some important new
areas, one of which is the national efforts to prevent, respond
to, and recover from drug misuse and drug abuse. That is the
first time it has been one of your important high-profile,
high-risk issues.
Illicit drugs, as we know, and the misuse of prescription
drugs in particular has devastated so many people's lives in my
home State of Ohio and around the country, and the opioid
epidemic, in effect, has been started by prescription drug
abuse. Not that there were not uses of heroin and other opioids
previously, but that is really what spawned so much expansion
of it. Unfortunately, we continue to see a lot of misuse of
prescription drugs. I appreciate your doing it.
We introduced legislation over time, including in December
new legislation, the Comprehensive Addiction and Recovery Act
(CARA) 2.0, and that will provide Federal resources for
evidence-based education and prevention, treatment, recovery
programs. It focuses a lot on this misuse of prescription drugs
as well.
We have used you all as a source of information. I
appreciate that, and we will continue to use you. I think what
you have done here in this report is pointed out the need for
better coordination, which is really important. The Office of
National Drug Control Policy (ONDCP), I think can play a more
active role in coordinating the Federal response. You also talk
about data, which I think is really important, to have better
information to be able to legislate.
We have been in the middle of this pandemic with
coronavirus, and yet underneath it the epidemic of drug abuse
has grown. As you point out, in the last 12-month period we
have data for, which would be May 2019 to May 2020, you have
the highest number of overdose deaths in the history of our
country. Very sad. It is really heartbreaking given that we
were making progress, including on Federal legislation that was
making a difference in our communities.
I am looking forward to hearing from you more on that and
how we can implement some of your recommendations to address
this issue, particularly on leadership and coordination.
You have also identified cybersecurity as one of the five
high-risk areas found to have regressed since you issued your
2019 High-Risk List. That concerns me a lot because we are
going to in the wrong direction in terms of cybersecurity based
on your analysis. I think that is correct. Probably the most
obvious example of that is SolarWinds where we had this massive
hack into our system, sensitive Federal agencies being hacked,
but also the private sector through the Federal agencies and
through some of the contractors. I appreciate the fact that you
have identified not just this as a problem, but as a problem
that is getting worse, not better. This would track our report
we did in this Committee and our Subcommittee called
``Permanent Subcommittee on Investigations (PSI),'' which I
know you were a part of. We basically showed how eight Federal
agencies over the course of two administrations had failed to
address their vulnerabilities in information technology (IT)
infrastructure and how that is going to lead to problems. And
sure enough it did, and it has made our personal information as
Americans more subject to theft.
The lack of a central authority to implement and
coordination the Nation's cybersecurity strategy is a problem,
and you identify that. I happen to agree with you on that, and
I am hopeful that we can have legislation to address it, in
particular using the Department of Homeland Security (DHS) more
effectively where we do have the ability to organize around
Cybersecurity and Infrastructure Security Agency (CISA).
I know that the National Cyber Director position has yet to
be filled, so I look forward to talking to you about that and
how to work with the administration to ensure that we have a
position in the White House that effectively helps coordinate
this. Recently, we learned of this SolarWinds hack, and that
should be a wake-up call for all Americans.
Finally, the report today highlights a number of high-risk
areas this Committee has prioritized and will continue to
prioritize as we progress through this Congress. The areas
include the enforcement of tax laws, managing Federal real
property. This is one of the great frustrations I have had. We
passed a couple of bills now to try to do that, but we still
have not figure out how to move Federal property much more
quickly. There is a lot of excess property, so many thousands
and so many billions of dollars wasted. Improving Federal
oversight of food safety, something that is increasingly a
concern, and, of course, the U.S. Postal Service's (USPS)
financial viability. We have heard from the Postmaster General
about his new reform. He just initiated some new reform ideas
last week, so we hope to be able as a Committee to take that on
with your help. We need you. We need GAO's help to deal with
all these high-risk areas. Essentially, you have given us a
checklist of some urgent priorities and on other issues as
well.
Thank you, Mr. Chairman. I look forward to hearing from Mr.
Dodaro and our other witnesses today, and I look forward to
using this GAO data information to help us do our work more
effectively.
Chairman Peters. Thank you, Ranking Member Portman.
It is the practice of this Committee to swear in this, so,
Mr. Dodaro, and those from the GAO who may be testifying
remotely, if you would stand and raise your right hand, the
folks who are remotely as well, if you may be giving some
testimony today.
Do you swear the testimony you will give before this
Committee will be the truth, the whole truth, and nothing but
the truth, so help you, God?
Mr. Dodaro. I do.
Mr. Mihm. I do.
Mr. Gaffigan. I do.
Mr. Marinos. I do.
Mr. Trimble. I do.
Chairman Peters. Everyone has answered in the affirmative.
Gene Dodaro has served as Comptroller General of the U.S.
Government Accountability Office since 2010 following two years
as Acting Comptroller General, and in his over 45 years of
service at the GAO, he has held a number of leadership
positions, including Chief Operating Officer (COO) and head of
GAO's Accounting and Information Management Division.
Mr. Dodaro, once again, welcome to our Committee. You may
proceed with your opening remarks.
TESTIMONY OF THE HONORABLE EUGENE L. DODARO,\1\ COMPTROLLER
GENERAL OF THE UNITED STATES, U.S. GOVERNMENT ACCOUNTABILITY
OFFICE; ACCOMPANIED BY J. CHRISTOPHER MIHM, MANAGING DIRECTOR,
STRATEGIC ISSUES; MARK GAFFIGAN, MANAGING DIRECTOR, NATURAL
RESOURCES AND ENVIRONMENT; NICK MARINOS, DIRECTOR, INFORMATION
TECHNOLOGY AND CYBERSECURITY; AND DAVID TRIMBLE, MANAGING
DIRECTOR, PHYSICAL INFRASTRUCTURE
Mr. Dodaro. Thank you very much, Mr. Chair, Ranking Member,
Senator Portman. It is very good to see both of you today. I
appreciate the opportunity to be here to talk about GAO's
latest High-Risk List update.
---------------------------------------------------------------------------
\1\ The prepared statement of Mr. Dodaro appears in the Appendix on
page 44.
---------------------------------------------------------------------------
There have been some bright spots of improvement since 2019
when we last updated the list. But, overall, there has been
limited progress.
In 20 of the high-risk areas, the ratings substantially are
not changed from what they were in 2019, and in five areas,
they have actually regressed. Senator Portman referenced one.
There are others. I am not satisfied with the progress that has
been achieved, and I do not believe that Congress should be
either. I think there is a lot of room for improvement here.
Now, on the positive side, seven areas did improve, one to
the point of removal from the list. That is the Department of
Defense (DOD) support infrastructure. They actually reduced
office space, warehouse space. They were able to get rid of
some properties. Senator Portman, they were a big part of the
government's efforts that were able to receive progress in that
area. They reduced their leasing costs, and they have struck
deals with local governments now to provide support services
that have reduced their costs. We felt they were in good shape.
They have also promised to implement all our recommendations if
Congress ever authorizes another base closure round. I was very
pleased with that. DOD in particular has made some very good
progress over the past couple years.
Now, we are adding two areas. Senator Portman, you
referenced the one, which is on Federal efforts to prevent,
respond to, and recover from drug misuse. From 2002 to 2019,
800,000 Americans lost their lives to drug overdose, and the
May 2019 to May 2020 period has the highest recorded annual
increase, according to preliminary data from the Centers for
Disease Control (CDC) of 80,000 people on an annual basis. We
need greater national leadership, coordination, not only among
Federal agencies but with State and local partners and partners
in the private sector, in the health care industry, and in the
law enforcement community as well. This is a multi-faceted
issue. We have 67 open recommendations yet that need to be
fulfilled.
The other area we have added is the emergency loan programs
created for Small Business Administration (SBA): the Paycheck
Protection Program (PPP) and the Economic Injury Disaster Loan
(EIDL) programs. Now, these programs have been very important
components of helping small businesses, so I do not want to
take anything away from the positive impact that they have had.
But they are far short of transparency and accountability
goals. We made recommendations back in June, a few months after
they had gotten started, recognizing they needed to get the
money out, but they needed to have oversight plans to protect
program integrity, to protect against fraud. There has been
fraud in the programs. Their financial auditors could not give
an opinion on SBA's financial statements this past year because
they could not support documentation for loan balances and the
fact that they had flagged a lot of ineligible potential
recipients and not had good controls in place both at their
level or with the financial intermediaries that they hired to
provide the loans. This area needs a lot of attention in order
to take care of it.
Now, there are several existing high-risk areas that I
think are worthy of additional focus by the Congress. First is
cybersecurity to protect our Nation, both among Federal
agencies as well as critical infrastructure protection. I first
designated this as a high-risk area across the entire Federal
Government in 1997, so I have been trying to get Congress' and
the agency's attention on this area. Unfortunately, the
government is still not operating at a pace commensurate with
the evolving and serious threats that are continuing to emerge.
We have many recommendations in that area, and I am happy to
elaborate on those further.
I am also concerned about the State of the Federal
workforce. Twenty-two of the high-risk areas are on the list
because of skill gaps and critical shortages of both numbers of
people and the type of skills that they need. I do not think
the Federal Government's workforce is well postured to meet
21st century challenges. So that is in need of attention as
well.
Limiting the Federal Government's exposure by better
managing climate risk is another area that needs considerable
attention. Focusing in on the government's growing
environmental liabilities is another. Senator Portman
referenced the Postal Service travails and financial issues,
and their business model needs attention. These are among the
areas.
Importantly, I want to emphasize that only 12 of the
areas--36 on the list--have demonstrated the leadership needed
that we look for to begin the process of coming off the list.
The areas that we have taken off the list in the past have all
had essential ingredients: top agency leadership support,
support from the Office of Management and Budget (OMB), which
has been lacking recently, and also support from the Congress
and leadership. When those three ingredients are present, that
is the prescription for success here and dealing successfully
with these high-risk areas, and achieving what we all want, is
to get them off the list, to save billions of dollars, provide
better services to the public and public safety and other
matters, and to help build confidence in our government.
Thank you very much, Mr. Chairman. I am happy to answer
questions.
Chairman Peters. Thank you, Comptroller.
There is certainly an awful lot in the report that you have
put out. I am going to focus on a couple of those items, and I
am sure you are going to get questions on an awful long list of
these over the course of the hearing.
I want to start with the U.S. Government's environmental
liability, which continues to stay on the list and grows, but I
am going to focus on the DOD's liability in particular in my
question to you.
The Department of Defense, as I know you are aware, has
identified more than 600 military installations and surrounding
communities, including 14 of those installations in my home
State of Michigan, that could be affected by highly toxic
chemicals known as ``PFAS.'' That is why I am concerned about
the lack of progress that has been made by the DOD to address
this public health and environmental crisis, and I understand
that GAO is reviewing the military's response to PFAS
contamination.
My question to you, sir, is: Can you give us some more
information on that review and what can we expect?
Mr. Dodaro. We are looking at how DOD is approaching this
issue both identifying the existence of PFAS chemicals--thee
are mostly firefighting foams at installations to put out
fires, but they can get into the groundwater and contaminate
things, so it is very serious. So we are looking at the
prevalence of how DOD is going about identifying these
dangerous chemicals and then remediating the action that has
been placed.
We are looking at the estimate cost of attending to this
issue, and we are also going to be looking at DOD's efforts to
identify products to provide these important services that do
not have PFAS or other dangerous contaminants. We should have
that report out later this year.
Chairman Peters. Thank you. Ranking Member Portman, you had
a quick question before I think you have another commitment?
Senator Portman. Yes, thank you for the PFAS question. That
is one we are deeply concerned about in the Wright-Patterson
Air Force Base in the Dayton area, and thanks for your
leadership on that, and we look forward to working with GAO on
coming up with better ways to deal with it nationally.
Just a quick question on the High-Risk List now including
the drug misuse question, as you talked about. This has been
going on, as you know, for decades, and specifically the opioid
issue over the last 10 or 15 years. Why now? Why did you put it
on the High-Risk List? What has changed?
Mr. Dodaro. I was concerned about the escalating rate of
overdose deaths, and I was also concerned--as has been
mentioned, I have been in government for decades now. This has
always been an issue as long as I have been present in
government, and I wanted to try to do something about it and
raise the profile.
I do not believe we are dealing with the demand side of
this issue as much as we need to. We need to deal with
interdiction. We need to deal with treatment, of course. But
unless we reduce the demand for these products through
education and prevention and other things, we are never going
to make headway.
Drugs has always been a problem. The only thing has been
drug of choice and, what is happening, and then this
prescription drug element that added to it brought a different
dimension to it as well. I am concerned. As a father of three
and a grandfather of eight, I am concerned----
Senator Portman. I am glad you included it this year, and I
think one thing I thought you might say is that ONDCP clearly
has not followed the national drug policy, which is what you
lay out in your report, that they have actually missed putting
out the strategies they are supposed to put out under law.
Specifically, they have statutory requirements that they are
supposed to be talking about in their five-year projections
that they have not done.
So my hope is that these recommendations would improve
ONDCP's leadership role, clarify their mission, and make them a
better coordinating body. So we appreciate you are doing that.
The second question is with regard to this issue of worker
training. I appreciate the fact that you got into that a little
bit in your report. I hear back home the same thing. I heard it
before the pandemic, which is we are looking for workers, but
skilled workers, we cannot find them. So whether it is a welder
or whether it is an IT professional, a coder, or whether it is
a truck driver, the skilled workers are in demand again. In
fact, there are lots of companies in Ohio who are advertising.
I am told there are more people now looking for work than there
have been since the pandemic began, which is good news for the
economy, but, again, the same issue that was present before.
In terms of how you get at this issue, have you looked much
at what the Federal Government does vis-a-vis someone who wants
to go to college versus somebody who wants to get a short-term
training program? And shouldn't there be some more parity
there, not to take, for instance, Pell grants away from
colleges or universities at all, but to also offer a Pell if
you want to get what is pretty expensive but which is a
training program that gets you an industry-recognized
credential like a welding degree?
Mr. Dodaro. Right.
Senator Portman. And shouldn't that be something that we
should be promoting given our need right now and our workforce
shortage with skilled workers. Any thoughts on that.
Mr. Dodaro. I agree with you completely. There is a range
of skills that are needed. There are things that people can
adapt to. I will go back and take a look at that issue and see
what we have done in the past. But I will certainly look more
carefully at that issue in the future. The same thing is true
of even community college degrees and things of that nature. I
think the Federal Government can diversify. What we also find
is there are a lot of best practices occur in some of the
worker training programs, but the Department of Labor (DOL)
does not share that among the States, so they do not really
have ideas on how they can refine their practices. So we made
that recommendation as well.
But I agree completely with you, and we will look more
carefully at that issue.
Senator Portman. Great. The final thing I want to mention
is the cyber issue, and Senator Peters and I have worked on
this issue over time, and it is so frustrating to have this
massive hack, and hopefully it is a wake-up call for all of us.
But specifically with regard to Federal coordination, you talk
about the fact that we have yet to fill this position, which is
really a White House position, as I understand it. But we also
have not given CISA, which is the Department of Homeland
Security cybersecurity entity, all of the resources it needs
along with the authority that we have provided.
What is your thought on that? Who should be coordinating
this? We have DOD involved; we obviously have the intelligence
agencies involved; and we have DHS involved; we have the White
House involved; OMB is involved to make sure agencies are doing
what they are supposed to do. But who should be coordinating?
And shouldn't there be more accountability in this process?
Mr. Dodaro. Absolutely. that is one of the reasons we rated
them down, was there was not enough accountability and clear
delineation of roles and responsibilities. My thought on this
is you need a whole-of-government approach to this issue. CISA
can play a very important role, but they do not decide who
appoints the Chief Information Officers (CIOs) in the agencies.
They do not pick the Chief Information Security Officers
(CISO). That is the agency head's responsibility, so they need
to be involved. OMB needs to be involved, and they have not
been as involved as they have been in the past and need to be
in the future. They can help both in making sure the resource
investments are there, properly set out the right policies and
guidance and make sure that they get vetted during the budget
preparation process. As a former head of OMB, you recognize how
powerful that process can be. CISA is basically the civilian
side of things. They are not DOD. So you need the National
Security Council (NSC) and DOD involved with the intel
agencies. That is why I think this statutory provision in the
White House is so important.
The other thing that is important, Senator, is to get the
message out that anybody that touches a Federal computer,
whether it be a Federal employee or a contractor, or touches a
system is a potential risk to the system in introducing
malware. We need a whole-of-government thing. This has some
technical dimensions, but in large part, it is a management
problem, an awareness and trying to deal with having the right
workforce associated with doing this. I think you need it at
the White House level. CISA will play a role, the National
Security Council, DOD. But, also, we need to build trust with
the private sector to exchange information. We talked a little
bit about that this morning at the press event. That is
critical because, most of the assets, computing assets, are in
the private sector hands. Unless we have sharing between the
government and the private sector on a more easily flow basis,
we are never going to get ahead of this issue, because it is
like having intelligence but having it compartmentalized and
not sharing it.
Senator Portman. Right.
Mr. Dodaro. That is dangerous.
Senator Portman. We want to work with you on this one, and
I think the report is very helpful. But we have talked about a
legislative response to increase the coordination and the
accountability, as you say, and I think there is only so much
you can do from the legislative perspective if you authorize a
position and it is not filled, so we also have to put pressure
on the administration to step up. I assume that they would want
to do that.
But thank you again for all your work. We look forward to
continuing to work with you every day on these issues of
oversight that are a critical part of the mission of this
Committee.
Thank you for your indulgence, Mr. Chairman.
Mr. Dodaro. Thank you, Senator.
Chairman Peters. Absolutely, Ranking Member.
Comptroller Dodaro, to continue going down the list, we
talked about PFAS contamination with the Department of Defense,
but also on your list is transforming the Environmental
Protection Agency (EPA's) process for assessing and controlling
toxic chemicals, which has also declined as well. The
Environmental Protection Agency and other public health
agencies have found that PFAS exposure above certain levels may
lead to some very significant negative health impacts. Yet
there has been little action across the Federal agencies to
help families and their communities either reduce or eliminate
their exposure to PFAS in drinking water or in the broader
environment.
My question to you, sir, is: What specific actions do you
believe the Federal agencies should be considering right now in
order to address the widespread public health and environmental
crisis associated with PFAS?
Mr. Dodaro. They need to fully identify and investigate all
the different dimensions of that issue. Let me turn to one of
our experts in the area, Mark Gaffigan, Senator, if I might.
Mark, would you help respond here, please?
Mr. Gaffigan. Sure, I would be happy to, Senator. Thanks
for the question. I would say they can help in two areas.
Mr. Dodaro. Mark, you need to speak up, if you can, please.
We are not hearing you very well.
Mr. Gaffigan. OK. Can you hear me a little better now?
Chairman Peters. Yes, that is great. That is good.
Mr. Gaffigan. OK. I would say there are two areas. There is
the area of finding out more about these things, which the
Comptroller General alluded to. Then the other area is to
establish some standards as to what level we are going to clean
this up to, and that can be a complicated thing. We have
several considerations at the Federal level both, for example,
in the Drinking Water Act and through Comprehensive
Environmental Response, Compensation and Liability Act
(CERCLA), which is the act of the Superfund, which would deal
with existing sites.
It is really important to figure out what standard we are
going to clean that up to, and then as you go around these
communities, they are all going to have a stake in this. To
what extent that they want to have this cleaned up, and so
there is a huge effort that needs to go in terms of regulating
and then involving the other stakeholders and making sure that
we are cleaning up to the right levels.
Chairman Peters. Thank you for that.
Comptroller Dodaro, Federal cybersecurity, as was mentioned
in previous questions, once again is on your High-Risk List,
and it remains there again after many years. Despite the
existence of Federal information security standards, we
continue to suffer unacceptable breaches.
This Committee is going to be taking a close look at making
some significant improvements to Federal cybersecurity. You
mentioned some, but what are some of the key issues that you
believe that we should be looking at in this Committee? What
should the government and individual agencies be doing
differently than they are doing right now?
Mr. Dodaro. First, we have identified ten critical actions
that need to be taken in the cybersecurity area in four areas.
First, Mr. Chairman, is that we need a comprehensive both
national and global cyberspace strategy, and it needs to be
implemented effectively. It needs to address supply chain risk.
We issued a report in December showing that none of the 23
agencies we looked at had implemented the full range of best
practices to managing supply chain risk, which was at the heart
of the SolarWinds incident.
We need to focus on the workforce issues. We need to deal
with global issues. There needs to be some cyber diplomacy in
this area and some norms set that there are in other areas that
are very dangerous, whether it be chemical weapons or other
matters. We need to look at emerging technologies. This issue
is going to get more complicated with artificial intelligence
(AI), quantum computing, and other factors. The strategy has to
be holistic; it has to be domestic and international; and it
has to focus on existing and emerging technologies.
The second area is getting the Federal agencies to fix
their problems, known weaknesses. These are weaknesses that
have existed. Very few agencies have good, holistic IT security
programs, including the Department of Homeland Security, by the
way. They need to fix the problem and have good responses when
incidents do occur to respond in a quick manner. There is more
attention that needs to be done in those areas.
We have 750 open recommendations right now. Since 2010, we
have made 3,300 recommendations. These are very specific
vulnerabilities that need to be closed. In the supply chain
area, we made 145 recommendations to these agencies, so
Congress can, you know, make sure that the agencies implement
those recommendations.
The third area is critical infrastructure protection. Now,
here the standards for the private sector, except in a few
instances where the Federal Government has regulatory
responsibilities, are voluntarily implemented by the private
sector. The Federal agencies have sector liaisons, and they are
supposed to help promote the adoption of those standards in the
private sector. But the fact remains that the Federal
Government really does not have a good handle on the extent to
which the private sector has adopted the standards from the
National Institute of Technology (NIT) in those areas.
Then the last area is protecting consumer information that
is collected over the Internet. We have called for a number of
years that Congress legislate a comprehensive consumer privacy
protection framework that can protect the collection of the
data, the reselling of that data, to make sure the public
understands what is happening in those areas. There has not
been any real serious legislation to deal with privacy issues
since 2002, and, of course, the landscape has changed
dramatically.
Chairman Peters. Absolutely. I have a quick question for
you, because I have to run off to vote, and when I vote,
Senator Ossoff will assume the chair, but I will call on
Senator Lankford before I leave. Comptroller Dodaro, our Nation
is in the midst of a pandemic, and we have invested significant
taxpayer dollars, as you know, to ensure that our communities
have the support that they need. But oversight of these
resources is absolutely critical for ensuring that the taxpayer
money is actually going where it was intended and is being
spent wisely.
Will you commit to continuing GAO's strong oversight of the
COVID-19 response and associated spending and keeping this
Committee informed all along the way if you face any challenges
whatsoever in your work or need for additional resources?
Mr. Dodaro. I definitely commit to that. We have been
giving monthly briefings since March 2020 and bimonthly public
reports. We just issued our sixth bimonthly report. Going
forward, we plan on issuing quarterly public reports but
continue the monthly briefings, and I will definitely let this
Committee know if we run into any difficulties obtaining
information.
Chairman Peters. Thank you. I will be running off to vote,
but we have someone who just came in who was on the list. Sorry
about that, Senator Lankford. As I run off, I recognize Senator
Carper for your questions, Senator.
OPENING STATEMENT OF SENATOR CARPER
Senator Carper. Thanks, Mr. Chairman. Can you hear me, Mr.
Chairman?
Chairman Peters. Yes, we can hear you well.
Senator Carper. Good. Can you see me?
Mr. Dodaro. Yes, we can see you now, Senator.
Senator Carper. Mr. Dodaro, how are you doing?
Mr. Dodaro. I am doing just fine, Senator. How are you?
Senator Carper. I really enjoyed talking to you the other
day. Thank you for taking the time with us then and today as
well.
As the title of GAO's 2021 high-risk report clearly states,
committed leadership is essential to making progress in
addressing high-risk areas. I always like to say leadership is
the most important ingredient in anything that has something to
do with success of the organization. Leadership is always the
key to success.
In 2019, GAO reported that about half of the high-risk
areas identified had met the leadership commitment criteria,
and of the 36 high-risk areas included in the 2021 report, only
12 met the leadership commitment criteria. We dropped from a
couple years ago, when we had 36--there were only just a very
few relatively high-risk problems that were tied in with
leadership. We have gone to hell in a hand basket here the last
couple years in this report. It is not the direction we want to
be trending.
I just want to ask if you would take a moment to discuss
with us the importance of leadership attention to these areas,
these issues, and OMB leadership in particular given the many
high-risk areas in multiple agencies. Could you do that for us,
please?
Mr. Dodaro. Yes. OMB leadership is essential because a
number of the high-risk areas involve multiple agencies or
governmentwide in scope, whether it be strategic human capital
management, which is governmentwide; cybersecurity is
governmentwide. A number of the other IT acquisitions and
operations is governmentwide; personnel security clearance is
governmentwide. OMB plays a very important role.
Unfortunately, over the past few years, the practice that
we had in place with previous administrations, both Democratic
and Republican, of having meetings between OMB, GAO, and the
agencies on the High-Risk List fell by the wayside. And that
efforts needs to be restored. I am going to be talking to the
new leaders at OMB, and hopefully we can--once they are
confirmed and we have people in place, and hopefully we can get
those meetings back on. They were extremely helpful in getting
the attention of the agency leaders, and it was important for
the agency leaders to know that OMB cared about these areas and
would be sensitive to them when they reviewed their budget
submissions as part of the President's budget development
process. That was very helpful as well. Congress needs to stay
involved as well.
I also plan to meet with new agency leaders once they are
in place and confirmed to keep up my practice of dealing with
agency leaders as well as trying to engage OMB again in a
tripartite type of dialog on this issue.
Senator Carper. That would be great if you could do that.
Let me go to my second question so I do not run out of time. I
understand that in the past the OMB Deputy Director for
Management would meet regularly with agency leaders and GAO to
discuss high-risk areas and monitor progress. I think you just
alluded to this, but, however, you note that these regular
meetings stopped occurring in recent years. You have already
spoken a little bit to that, and is there anything you could
say to speak to the value of OMB maintaining regular
communications with Federal agencies and GAO? What advice would
you offer to President Biden's nominee for OMB Deputy Director
Shalanda Young and the President's nominee for Deputy Director
for Management, Jason Miller, both of whom are scheduled to
appear before our Committee I think later this week?
Mr. Dodaro. Yes, these high-risk areas, there are a couple
things I would suggest to them. First, the high-risk areas
permeate some of the most important areas across the
government, and some of the fastest-growing programs in the
health care area, for example--Medicare and Medicaid are fast-
growing programs; the DOD weapons systems portfolio is $1.8
trillion. There is a lot of money at stake in these areas and a
lot of potential savings of tens of billions of dollars that
could occur. There is a fiscal component of this which should
interest both the Deputy Director for Budget as well as the
Management Director. OMB has a large set of responsibilities by
statute to address a lot of these cross-cutting management
issues that are in place, over a period of time. It is very
important for them to do this.
Second is that I have seen administrations get consumed by
crises and fires that occur, and the last two administrations,
both had the double hat, the Deputy Director for Management
with the Director of Office of Personnel Management (OPM),
which diluted the attention of the Deputy for Management over
there. Both happened in the Obama Administration and the Trump
administration. That is one of the reasons OMB has kind of lost
this focus over time.
There is also by statute and this Committee sponsored
legislation on performance management in government that
requires OMB to do a portfolio analysis of any area identified
by GAO as a high-risk area, and so far they have not complied
with that requirement as well. That gives this Committee
additional leverage to require the attention of OMB on these
very important issues, any of which can lead to management
breakdowns.
Senator Carper. One more quick one, if I could, General. It
just deals with applying lessons learned from the 2009 American
Recovery and Reinvestment Act (ARRA). I think it was in
February 2009 President Obama signed into law the American
Recovery and Reinvestment Act. We think of it as the Great
Recession, but the economic stimulus package authorized I think
about $800 billion in emergency appropriations to counteract
the worsening economic conditions following the 2008 financial
crisis.
To evaluate agency spending of those funds, the bill
established certification requirements, quarterly reports, a
board of agency Inspectors General (IG) that was responsible
for directing oversight and maintaining a public website with
information about how agencies were using the money. Similarly,
to conduct oversight of funds appropriated under the CARES Act,
Congress created the Pandemic Response Accountability Committee
(PRAC), the Congressional Oversight Commission, and the Special
Inspector General for Pandemic Recovery. Each task had specific
oversight responsibility. The CARES Act also directed GAO to
monitor and report on the Federal Government's pandemic
response efforts.
Mr. Dodaro, with regard to oversight and accountability,
what are the most significant differences you see between
recovery efforts during the Great Recession and now as we
combat the COVID-19 pandemic? Second, what are some of the
lessons learned from that time period that we could apply,
should apply to these oversight efforts today? Thank you.
Mr. Dodaro. Yes, first, the global financial crisis efforts
were targeted largely in the financial institutions area, so it
was a much more sector-focused issue. The pandemic has a wide
impact across various sectors, virtually all sectors of the
economy. The scope of them is different and the construct of
the efforts are different, but there are some lessons to be
learned. I would contrast the Troubled Asset Relief Program
(TARP) that was set up with $700 billion to provide support to
the financial markets and the banks and the auto makers and
others with what was done in the SBA with the emergency loan
programs, so about similar size and scale.
The TARP program, we worked hand in glove, starting with
the Bush Administration through the Obama Administration, to
build in internal controls up front, and they were able to get
a clean opinion on their financial statements in the very first
year, even though this was a brand-new, multi-hundred-billion-
dollar kind of program. SBA, I made the same offer there and
did not really get any traction with the people, and so they
were unable to pass their audit, and they did not build in
enough controls up front--not before they started lending, but
soon thereafter, to build in the safeguards as soon as
practicable without holding up the release of the money.
So building in transparency and accountability issues early
is very important. The legislation for the Recovery Act
required a public website, which was true in the pandemic, but
SBA decided not to initially release the recipients of loans
under $150,000, and it was not until a Freedom of Information
Act (FOIA) request and the courts ordered them to release the
information did they release the information.
The other part of this is there is a need for clear,
consistent communication, particularly with the State and local
governments. During the Recovery Act, I received a letter from
a lot of State budget officers, procurement officials, IT
professionals, asking for coordination with the Federal
Government. I worked with the OMB Director at the time, and we
had regular meetings with them on a regular basis.
In the coronavirus, the coordination with the State and
local governments was not as robust as it needed to be, in my
opinion, and so you had a lot of confusion, the most recent
being in the vaccine area, but, before that it was in who is
responsible for what. Is the Federal Government responsible for
providing Personal Protective Equipment (PPE)? Is it the
States' responsibility since they are the locus of
responsibility for public health service? We were sorting those
things out in the middle of a pandemic, and that is not the
time to do it.
You need to have clearer lines of authority and
communication. You need to build in transparency and
accountability earlier. You need to have better data to make
good decisions. Right now this pandemic has laid bare the
frailties of our public health system being on a very
decentralized basis, and we do not have good national data for
surveillance purposes and targeting our responses. We have made
a lot of recommendations in those areas, including dealing with
racial disparities and the impact of the pandemic and now the
distribution and the administration of the vaccines going
forward.
Those are the key lessons learned on all these things that
I have been involved with for many decades now.
Senator Carper. I want to thank you for your leadership. I
want to thank Chris Mihm for his good work and your entire
team. We are blessed by you. You have more than earned your pay
in the last year, but you have been doing it forever, so thank
you very much. Keep up the great work. God bless.
Mr. Dodaro. Thank you, Senator Carper. I appreciate it.
Senator Ossoff [presiding.] Thank you, Senator Carper.
Senator Hassan is recognized.
OPENING STATEMENT OF SENATOR HASSAN
Senator Hassan. Thank you. I want to thank the Chair and
our Ranking Member and our substitute Chair right now for this
hearing. Comptroller General Dodaro, thank you and your
dedicated team for your testimony today.
I also want to congratulate the Government Accountability
Office as it celebrates 100 years of service. I am particularly
grateful, as Chair of the Emerging Threats and Spending
Oversight Subcommittee (ETSO), for GAO's work to help the
Federal Government save taxpayer dollars and operate more
effectively. To that end, Senator Paul and I plan to circulate
a bipartisan resolution to recognize GAO's 100th anniversary,
and I will invite all of our colleagues to join.
My first question to you today, Comptroller General, is
about IT acquisitions and operations. The pandemic has put into
sharp relief something many of us already knew, namely, that
aging Federal IT systems lagged behind those of private
organizations in terms of their ability to innovate and adapt
to the ever-changing technological landscape.
Last summer I wrote to the 10 agencies with the most
critical legacy IT systems identified by a 2019 GAO report, and
I asked them for their plans to move away from legacy IT. Yet
several months later, as the High-Risk List notes, three out of
those ten agencies had yet to produce plans to reduce reliance
on these outdated systems that are costly, opened Federal
systems up to security vulnerabilities, and do not meet the
level of customer service that Americans expect in the 21st
century.
Why is it important, Comptroller General, for all agencies
to have a plan in place to transition away from legacy IT
systems?
Mr. Dodaro. This is critical to improving services to the
public, First, and particularly during a pandemic when you are
limited to virtual amounts. The disability claims have been
backlogged both at the Department of Veterans Affairs (VA) and
Social Security Administration (SSA) because things were not
set up to do things smoothly virtually and to conduct
transactions and conduct business. Citizens are used to dealing
with the private sector and getting more regular, better
service from them. To be more responsive, efficient, and have
greater transparency, but also these security issues cannot be
overestimated. These legacy systems are a millstone around the
neck of Federal agencies and the efforts of the Federal
Government to secure its systems. They were designed 40 and 50
years ago with nowhere near the concern about cybersecurity
that we have today, and they desperately need to be changed.
They are not nimble when things occur and things happen.
I thought the Congress, in setting up the Technology
Modernization Fund (TMF), which is a good move--and I would
encourage Congress to look at funding that properly because
things could be rapidly approved there and they could have some
efforts underway to be able to begin to modernize these
systems. But it is also why you need to have authorities to the
Chief Information Officers in the agencies.
Now, I first worked with this Committee in the 1990s to
pass the Clinger-Cohen Act, which first established Chief
Information Officers in the government, and they were supposed
to have a seat at the table and really control this. It did not
really pan out that way. The agencies did not give them a full
set of authorities. In 2014, Congress passed the Federal
Information Technology Reform Act (FITRA) to really emphasize
CIOs having these authorities. They still do not have them
completely across government. This would be an important issue
as well.
Senator Hassan. That is very helpful feedback, and it
brings me to my next concern, which is really a follow-up on
what you just said on cybersecurity and Continuous Diagnostics
and Mitigation (CDM) programs, too. Cybersecurity has been on
the High-Risk List for 24 years, and over the past 2 years, the
leadership commitment in this area has declined. This is
disturbing, especially, of course, in light of the SolarWinds
attack, and I look forward to working with the Biden-Harris
administration and all of my congressional colleagues to ensure
that we have the necessary leadership in place to coordinate
Federal cybersecurity efforts to anticipate and prevent these
attacks.
Along those lines, this year's report also shows how
Federal agencies struggle to implement programs to monitor and
address cybersecurity risks. These programs include the
Department of Homeland Security's Continuous Diagnostics and
Mitigation Program.
What obstacles are preventing agencies from fully
implementing these types of monitoring programs? How can
Congress help agencies overcome these obstacles? Then after you
answer that, I have one more question, so if you can be fairly
brief here, that would be great.
Mr. Dodaro. OK. I will ask Nick Marinos, who is our
cybersecurity expert, to respond to your question. He is
younger. He will be briefer than me. [Laughter.]
Senator Hassan. I would appreciate that very much, not the
briefer part but just getting fully up to speed on what we need
to do.
Mr. Dodaro. Sure.
Senator Hassan. My last question is----
Mr. Dodaro. No. He is here. He is on----
Senator Hassan. Oh, is he on? OK.
Mr. Dodaro. Nick, could you please respond?
Mr. Marinos. Yes. Can you hear me OK?
Mr. Dodaro. Yes, just talk up a little more.
Senator Hassan. There we go.
Mr. Marinos. Sure, will do. Senator, I think to be very
brief on this, CDM is a governmentwide initiative that CISA has
put out there, and it has several others, and the reality is
that for these things to be successful, it requires agencies to
be best positioned to actually leverage the skill, the
capabilities that DHS is providing. In many cases, we have seen
challenges from agencies in using some of these tools because
they themselves do not have a good accounting of what is
connected to their environments. In other words, you cannot
protect what you do not know is on your network. We need to see
improvements not only from Federal agencies, but also DHS in
providing them assistance to get better at that.
Senator Hassan. OK. Thank you very much. I appreciate that.
I am glad you are here.
So now my third question. Mr. Dodaro, as part of the year-
end COVID-19 relief package, Senator Collins and I negotiated
$10 billion in flexible funding for the United States Postal
Service. That money was intended to assist the Postal Service
in addressing its immediate financial hardship while upholding
service standards expected by the American people. As the High-
Risk List notes, even with this funding to cover its operating
costs, the Postal Service anticipates that it still will not be
able to meet its required payments under its current business
model.
In your view, what statutory reforms to the current
business model are required to bring the Postal Service back
from the brink of insolvency without sacrificing service?
Mr. Dodaro. I think there needs to be a clear agreement
between the Congress and the Postal Service that is immutable
about what service is expected to be provided and then to
figure out how to pay for it. I am not sure the current
business model that relies on First-Class mail is a sustainable
model on how to pay for that over time. While the Postal
Service may be able to deal with the margins with that, I am
not sure that they are going to be able to operate like a
business, if you will, which has been the expectation, and
finance that level of service.
The Federal Government provides support and carries out
functions that are not viable functions for the private sector.
Unfortunately, the postal operations are sort of moving in that
direction and has been slowly for years and been precipitated
even more by the global financial crisis, now by the pandemic.
With the advent of technology and generational change
statistics are coming with expectations of younger people
dealing not with paper mail, I do not think the prospects are
there that the Postal Service by itself is going to be able to
generate the revenue necessary to meet the Congress'
expectation for services. Some other arrangement for financing
and governance needs to be struck, in my opinion.
Senator Hassan. OK. Thank you for that feedback as well.
Again, thank you and your entire team for its excellent work,
and congratulations on 100 years.
Mr. Dodaro. Thank you for the recognition you plan to give
us.
Senator Hassan. You are welcome.
Senator Ossoff. Thank you, Senator Hassan.
Senator Rosen is recognized.
OPENING STATEMENT OF SENATOR ROSEN
Senator Rosen. Thank you, Mr. Chair, and, first, thank you
Mr. Dodaro, and your whole team for the tireless work that you
do every day.
I want to build a little bit on what Senator Hassan was
talking about on cybersecurity, and I want to focus a little
bit on data centers because the GAO notes in this report that
information security has been designated as a governmentwide
high-risk area since 1997. In 2003, GAO expanded this hearing
area to include protection of critical cyber infrastructure.
Chair Peters, Senator Hassan, and I all supported cybersecurity
legislation. It was signed into law as part of the National
Defense Authorization Act (NDAA) last year, but there is so
much more to do, and I hope that we are going to continue to do
that work here in Congress.
But in the report, GAO has a section on page 173 on what
remains to be done. In cybersecurity, one of the
recommendations is, like we talked about, protecting cyber
critical infrastructure. One idea my office has been working on
is legislation that would require OMB to develop a new set of
standards for Federal data centers in areas such as resilience
against natural disasters, against power failures like the ones
that we saw with the winter storm just the last few weeks,
particularly in Texas, and, of course, cyber intrusions. Nevada
is home to numerous data centers, and we know the major role
that they play in both our economy and our national security.
As the United States faces a growing number of serious cyber
attacks, I think it is safe to say data centers are critical
infrastructure.
Mr. Dodaro, GAO had issued that report that we want to OMB
to continue to report on data centers because of their
potential to be targets for cyber attack. Could you give us a
progress update on that report? Have you been following what
OMB has been doing and if they have been implementing their
recommendations?
Mr. Dodaro. Yes, we have been following that carefully.
There have been data center consolidations that have saved
billions of dollars. Unfortunately, OMB changed the definition
of what they consider to be a data center, which we do not
think was a good development. I will ask Nick Marinos to
explain a little bit more about that and what the potential is,
but I definitely think the remaining data centers that the
government needs to keep need to be protected and be resilient
and protected from cyber attacks.
Nick.
Mr. Marinos. Sure. Yes, Senator Rosen, I would just add
that specific to the OMB definition, the change last year in
how OMB categorized or identified what was considered a data
center presents some security problems as well, because
previous to that change in the definition, OMB had recognized
that many of those facilities that had been previously
identified as data centers presented security vulnerabilities.
Now looking forward, if you are tracking less of these data
centers, you are also tracking the potential that they could be
exploited, those security vulnerabilities could be exploited. I
think anything that Congress can do to help encourage OMB to
accurately depict what data centers are continuing to still be
out there will help. They have definitely made progress in
implementing a lot of our recommendations, and we have seen an
additional $440 million in savings. But the security risk is
still there.
Senator Rosen. Thank you. I want to follow up on that
because GAO also wrote in the report that it has suggested
revisions to the Privacy Act of 1974 and the E-Government Act
of 2002. They have still not been enacted as of December 2020.
Could you speak a little bit to those revisions and why GAO
believes they are important for protecting sensitive data?
Mr. Dodaro. Yes. The Federal Government's requirements in
this area are terrible outdated and do not really reflect
proper focus on protecting the privacy of information,
particularly the information reselling that is occurring on the
Internet. A lot of people are unaware of these issues, so I
think there needs to be some minimum standards.
There have been a lot of discussions about social media and
other collection of information and the marketing of that
information. But right now, the consumers are at a decided
disadvantage, and it has been particularly acute during the
pandemic when they do not have other alternatives and have to
turn to doing a lot of things virtually and online that they
maybe not would have done previously in order to protect their
health. Congress needs to modernize these areas so that also is
important. When there are breaches in the private sector, that
there are standards for notifications to people to be able to
have them figure out how to protect themselves and what kind of
rights they have during that period of time.
Nick, did I miss anything there?
Mr. Marinos. I would just add that on the Federal side, in
terms of the Privacy Act, we are sadly coming to the 50th
anniversary of that act, and to recognize what the Comptroller
General articulated, how much technology has changed the way
that we collect and use information, there are really three key
things that we have talked to needing revisions when it comes
to the Federal privacy law.
The first is making sure that we are applying privacy
protections consistently across all information, so that means
getting a better understanding of what is really identified as
personally identifiable information (PII) at Federal agencies.
The second is making sure that whatever we are collecting
the personal information for is the only thing that we are
using that information for. Making sure that agencies
understand how they can actually use the information and what
they cannot use it for.
Then the last is making sure there are effective ways to
communicate to the public what information the Federal
Government has on them and then how can they find out that
information as well. We need better redressing to be
articulated within a future law.
Senator Rosen. I think that is great. I think that everyone
agrees that there needs to be some kind of robust conversation
in regards to all of our personal information. But, quickly--I
only have 30 seconds--I am just going to ask this question. I
will take the answers off the record, but I would like to have
you talk a little bit about the skills gap in the Federal
workforce. It poses a high risk to our Nation that we do not
have--the root cause of some of our problems is we do not have
a highly skilled workforce, particularly in the cybersecurity
area, and the Department of Defense really in particular. DOD
acknowledges that workforce planning across the Department is
inconsistent, and we need to be sure, especially in DOD, that
we attract top talent, that we up-skill everyone with all the--
as we do IT modernization, it also means we have to train folks
to come up, to do those skills, to know what is going on, to
pay attention to new technology and be forward thinking. We are
going to have to address that skill gap.
Do you think there is motivation in DOD to do that? I guess
my time has expired. I do not know if I am the last person, so
if I am, I can let you answer. If not, I will be glad to take
it off the record.
Chairman Peters [presiding.] We do have other folks here
asking questions.
Senator Rosen. Thank you. I will take it off the record.
Thank you very much.
Chairman Peters. Thank you, Senator.
Senator Lankford, you are recognized for your questions.
OPENING STATEMENT OF SENATOR LANKFORD
Senator Lankford. Thank you, Mr. Chairman. Gene, it is good
to see you again.
Mr. Dodaro. Good to see you, Senator.
Senator Lankford. We have seen each other year after year
for several years, and each year we have talked a little bit
about the Taxpayer's Right to Know, and each year you have said
we really need that if we are going to get accurate information
and we are going to be able to get it to Congress fast.
Guess what? In December, we finally passed that bill that I
have been working on for a decade to be able to get through
this process. It is now going through the process at OMB and
then will be coming to you. What do you anticipate with the
Taxpayer's Right to Know, with that bill? What do you need from
it first?
Mr. Dodaro. First we need an unequivocal commitment from
OMB to implement it properly. There have been previous bills
that have been passed--the Government Performance and Results
Act (GPRA). We still do not have a complete program inventory
even though that law passed 10 years ago now, the Modernization
Act. They committed to it in the Digital Accountability and
Transparency (DATA) Act; they made good headway, them and
Treasury. It was a good partnership, and that is coming along.
we need that commitment.
I also plan, even though the requirements for GAO to
evaluate the implementation of that do not trigger in for a few
years, that I am going to engage right away and try to build
in--that is what we did on the DATA Act, right from the
beginning, and I plan to be very engaged in that.
I want to offer my congratulations to you on getting that
legislation passed. I think it is a great accomplishment for
you and for the country. I think it will yield tremendous
results if implemented properly.
Senator Lankford. Yes, we will stay on top of that for
implementation as well, so I appreciate the partnership to be
able to help get that done. It does not help anyone if it is
sitting on the shelf somewhere and they are thinking about it
at that point.
Let me shift to some other issues. Census has been a
challenge this year, obviously, with the pandemic. This
Committee, I understand, is planning to have a census hearing
to be able to go through some of the issues that they have had.
They are obviously very delayed. It is causing a constitutional
problem in multiple States, including my own, when Census is
not going to turn over their data until months after when our
State Constitution requires that all of our redistricting be
complete, and that is in multiple States that are out there.
At the same time, the Internal Revenue Service (IRS) was
given additional time. They communicate with just as many
Americans--in a different format, obviously. I think my
question is: What can Census learn from IRS on how to be able
to make a connection with that many Americans? As we look 10
years into the future, as you all have looked at Census, are
there ways to be able to combine that work with IRS and Census
every 10 years so that they are not having to replicate, so we
do not have one part of the government connecting with every
American in IRS and another part of the government connecting
with every American through Census, as if the two of them
cannot actually talk to each other? Are there ways we can
actually gain some insight?
Mr. Dodaro. Right. I am going to ask Chris Mihm, who is in
charge of both IRS and the Census in the work at the GAO, to
respond quickly, Senator.
Senator Lankford. Thanks. Chris.
Mr. Mihm. Thank you, Senator Lankford. It was wonderful to
see you, sir.
Senator Lankford. Good to see you again.
Mr. Mihm. First, one of the things that was new this time
is the use of administrative records to help take some of the
final census counts, and in part, the Census Bureau did rely on
IRS records to help them identify and do some of the
fundamental enumeration. That willingness to engage in
partnerships and use administrative records that have been
validated and verified for their quality and completeness is an
important step that the Census Bureau has taken and that we
have been encouraging at least since the 1990 census, and they
need to keep exploring additional opportunities to do that not
just in the enumeration but, building address lists and all the
rest.
There are plenty of opportunities for them to work not just
with IRS but with agencies across government that have all of
these data sets. As I am sure you have heard from people, and
we certainly have, people seem to be of two minds when they are
answering the census and say, first, ``Why are you asking me
these invasive questions?'' Second, ``The government already
has this information.''
Let us make it easier on people to the extent that we can,
and that is one of the key things that we need to be looking
for as we get to the 2030 census.
When you talk about the Committee holding a hearing, we
would certainly look to support you as part of that hearing. I
think just one of the vital steps that I would urge you to be
looking at is how are they beginning the early planning for the
2030 census? Because if we only begin to care about that in
year 5, 6, or 7, then we are basically flying a plane that
someone else has built. The fundamental design decisions are
going to be made early in the decade, and that is when
Congress' intervention and oversight is most needed on the
census.
Senator Lankford. I would agree on that, and that is
something I have been pushing for years as well on this. There
is no reason why we cannot use the IRS collection of data, and
when people turn their taxes in that year in 2030, also they
have additional questions on their tax forms that completes
their census as well. There is no reason we need to have two
sets of mail, two sets of connection points, if we can only
have one and have a pretty efficient system and then get a
chance to be able to do cleanup connections with other people
that did not turn in tax forms, of which there are millions of
people that do not.
Let me ask about telework. This is something I have looked
at for a long time, that suddenly a government that has been
dragging their feet on it for a long time suddenly became
experts at it in 2020. We have lots of agencies that said, ``We
do not have many people that could do telework.'' In 2019 they
said that. Then in 2020, the vast majority of the folks did
telework on it.
What are the lessons learned? What can we begin to examine
for the future in this?
Mr. Dodaro. Definitely there are advantages to this, both
in terms of broadening out the diversity of your hires, in many
areas, if you did not have a physical location, people would
not want to be employed there. But they could be employed in a
lot of different locations now and not be tied to that physical
location. It can gain the government access, and people, to
other individuals that normally would not potentially be in
your pool of potential employees. That is number one.
Number two, you need IT systems to be able to do this, to
operate effectively as well. Fortunately, just to use GAO's
experience, we were already allowing our people to telework up
to 66 out of 80 hours every two weeks. When the pandemic hit,
we went to 100 percent telework, no problem, and we did not
really lose any efficiency, except for classified work that you
need it to be.
There are a lot of lessons. You also do not need as much of
a physical footprint for office space, so you can reduce costs
that way. When we did this, we reduced our footprint in our 11
field offices almost by 40 percent in terms of office space.
Then you can hire more people rather than pay for buildings.
Senator Lankford. Is there a gain of doing remote work
rather than telework, where remote work is a title that you
would never be expected to be able to physically come into an
office rather than you are expected to come in one day a week
or something when you do telework, often, but to actually--you
could hire someone in South Dakota or Oklahoma or other places
to be able to work for a Federal agency here?
Mr. Dodaro. There are definitely possibilities for doing
that. If you look at the private sector and call center
operations, I mean, you talk to people around the world if you
call and ask for help from a company or whatever. I was having
a problem during the pandemic. I called and was talking to
somebody in Central America, and he helped me fix my problem.
It was not a problem.
Yes, there are more opportunities for that. It has to be in
select areas. It has to be monitored and supervised
appropriately, but there are opportunities for that.
Senator Lankford. Good. I look forward to that dialog.
Thank you.
Chairman Peters. Thank you, Senator Lankford.
The Chair recognizes Senator Ossoff for your questions.
OPENING STATEMENT OF SENATOR OSSOFF
Senator Ossoff. Thank you, Mr. Chairman. Thank you to you
and your team for joining us.
I appreciate that you lay out a specific list of programs
requiring oversight, requiring improvement of performance,
because naming names and being specific is vital to
accountability. I want to ask if you can extend that
specificity and name those Federal contractors or vendors
specifically who are the worst offenders when it comes to
performance, when it comes to cost discipline, when it comes to
the honesty and integrity of their engagement with the U.S.
Government.
Mr. Dodaro. That would take additional research to be able
to do that. I do not have that off the top of my head, so I
cannot respond to that right now.
Senator Ossoff. Your colleague who has the strategic
jurisdiction, that includes the Department of Defense. Is that
correct?
Mr. Dodaro. Yes.
Senator Ossoff. Sir, could you please name those specific
defense contractors whose performance, whose adherence to
procurement guidelines, whose keeping with budgets and
responsiveness perhaps to GAO increase, is most deficient?
Mr. Dodaro. Yes, I do not think that I have anybody on the
line that can answer that specific question.
Senator Ossoff. The GAO does not know which Federal
contractors are the worst offenders when it comes to
procurement contracting performance cost?
Mr. Dodaro. There are shared responsibilities here in these
areas. In some cases the Federal agencies were not specific in
their requirements, in setting the requirements, so it is hard
to adjudicate. I mean, our list focuses on--like, for example,
we have the DOD weapons systems development on the High-Risk
List. We have National Aeronautics and Space Administration
(NASA) on the High-Risk List. We focus on how the Federal
agencies are managing the contractors, not evaluating the
contractors' performance themselves. That is the agency's
responsibility.
Our responsibility is to evaluate how well the agencies are
managing the contractors, and so that is why you have the
accountability pinpointed by us----
Senator Ossoff. OK.
Mr. Dodaro [continuing]. On the agencies at this point.
Senator Ossoff. Within the Department of Defense, which
specific program offices have shown the least competence and
discipline at managing contractors and procurement processes?
Mr. Dodaro. It varies, I mean, across the defense weapons
portfolio and other areas. Defense is a big enterprise. I would
have to go back and take a look and see if we can do that. Part
of the problem there is they rotate a lot of individuals over a
period of time. They are also going to through a big
transformation right now where they are moving to delegate more
responsibilities to the three services to manage the
contractors and the weapons systems development and move away
from centralized management across the defense portfolio. They
are undertaking a lot of reforms at this point, which makes it
a little bit more difficult to----
Senator Ossoff. You and your staff pore through the details
of these programs and program offices such that you can
generate specific lists of the worst offenders, and so I would
like to ask again if you cannot name specifically some program
offices within the Department of Defense that have been most
deficient in their responsibility to competently and in a
disciplined way execute their obligations to manage defense
programs and procurement processes?
Mr. Dodaro. Yes, I would have to go back and see if I could
provide something.
Senator Ossoff. OK. You can provide that?
Mr. Dodaro. I will see what we can do, what I can provide
for the record.
Senator Ossoff. OK. I am looking forward to that.
We have discussed in this hearing the financial viability
of the U.S. Postal Service. Could you specify the causes of the
widely reported and universally observed slowdown in mail
service over the last year?
Mr. Dodaro. Yes, I have our postal expert on. Dave?
Mr. Trimble. Yes, thank you for the question. The quality
of service during the last year was a problem for the post
office. The service performance was in the 80 to 90 percent
range in terms of meeting their targets. But by the end of the
years, in terms of November and December, that dropped down
much closer to 60 percent in some cases.
According to the post office, a lot of that was due to,
obviously, COVID had a huge impact both in terms of employees--
a lot of employees were out sick--but also in terms of
fundamental things like getting transportation services. With
the decrease in air travel, there are a to of challenges in
terms of the logistics meeting service delivery. Those are
pretty big hurdles they had to handle, and, of course, they had
a huge surge in package volumes, which also taxed their
systems.
Senator Ossoff. Thank you. I appreciate that. And you say
``according to the post office.'' I am curious what steps GAO
takes to corroborate the explanations provided by agencies
where you make such inquiries and what steps specifically you
took to investigate this matter with the Postal Service.
Mr. Dodaro. Yes, go ahead, Dave. We look at their data,
their performance data. We just do not take their word for it.
Senator Ossoff. But when it comes to causes of poorer
performance--because the fact that performance declined is not
controversial, but we are trying to understand why. In addition
to requesting explanations from the relevant agency, what steps
did you take to corroborate or validate their claims?
Mr. Dodaro. Yes, go ahead, Dave.
Mr. Trimble. Yes, so we have an ongoing review looking at
performance as a result of COVID, during the time of COVID, if
you will. We would obtain detailed documentation from them in
terms of employees out sick, employees taking sick leave. They
have had to do a lot of hirings. We have gotten a lot of data
on actual hiring as they have attempted to backfill those
vacant spots. Then the service performance changes, we are also
doing data analysis to track that by location to map that to
the employee disruptions, but also just to highlight the
national numbers on performance do not really tell the story,
where if you can say it is at 70 or 80 percent, but, for
example, in Baltimore or New York it is getting closer to 60
percent a certain month, there is a huge disparity in the
performance that some communities have seen.
Senator Ossoff. Thank you. One final question, if I might.
I know that your mandate includes to assess where the efficacy
of Federal programs and the impact on the public is inadequate
and where harm results. One of the concerns that I have--and I
think there may be room for bipartisanship to resolve some of
these issues--is that the complexity and the number of
different Federal programs, different Federal support and
assistance programs, that people who are already in
economically precarious situations must navigate to access
support can be overwhelming for people who are already time-
poor.
For example, during this pandemic, to obtain federally
funded food assistance, a person has to apply for Supplemental
Nutrition Assistance Program (SNAP) benefits through a local
county Department of Children And Family Services (DFCS)
office. To obtain federally funded emergency rental or housing
assistance, a person must navigate their local government or
nonprofit websites to apply for help. To obtain federally
funded utility assistance under the Low Income Home Energy
Assistance Program (LIHEAP), you have to apply through a
community action agency. To obtain health care coverage in the
special open enrollment period, you have to go to the Federal
marketplace.
Navigating this bureaucracy is challenging for anyone even
in good times. For people who are short on money and short on
time, it can be overwhelming. What is your assessment of how
policymakers can make navigating the bureaucracy of Federal
assistance and Federal support more streamlined and easier for
people who need help?
Mr. Dodaro. There are ample opportunities to consolidate
and eliminate overlap, fragmentation, duplication in the
Federal Government. We have a special effort that was started
by a Senator from this Committee years ago, Senator Coburn from
Oklahoma, and we issue a regular report on that, and we look
forward opportunities across government.
In dealing with that issue, though, you also have to tackle
how the Federal Government is using intermediaries, whether it
be the State governments and whether or not the States use
county or local governments, and each State is set up
differently, and each health care department, their employment
services, their foster care, whatever the support services.
There is an extra level of complexity when the Federal
Government uses State and local governments to administer these
services. Many of these services you talked about are through
either State and local governments or nonprofits or others.
There is not direct Federal involvement.
There has to be some encouragement of States to combine
these activities and some ability of the Federal Government to
allow for that to happen while still retaining some sort of
accountability over those services.
We have a very complex, probably overly complex, as you are
pointing out, intergovernmental delivery system in the United
States, and it is very hard for people looking for these
services. Many people do not know which part of government is
funding their services, whether they are getting it--is it
Federal funding, State funding? They do not really care. They
just want the help and the service.
But it is a worthy issue to pursue, but it is very complex,
but there are opportunities there, and it is a very expensive
system. If you look at the administrative costs of these
systems and how much is going for administrative costs and not
going for actual service delivery, I think you would be
surprised.
Senator Ossoff. Thank you. I hope we can work together to
make it easier for people who need help to get it.
Thank you, Mr. Chairman.
Chairman Peters. Thank you, Senator Ossoff.
Senator Scott, you are recognized for your questions.
OPENING STATEMENT OF SENATOR SCOTT
Senator Scott. Thank you, Mr. Chairman.
First, Gene, I want to thank you and your team. The
information you put out is really helpful. Having been up here
a couple years, the reports you guys put out, you guys do a
good job. Thanks for doing it.
What do you think about the fact we now are sitting on $27
trillion worth of debt? If we pass the next reconciliation
bill, it will be another $2 trillion, so we are going to be
close to $30 trillion for the debt. We are already at 140
percent of gross domestic product (GDP). Our debt is 140
percent of GDP. We are already seeing interest rates go up
since November quite a bit, actually, 10 years, up quite a bit.
We are seeing a lot of inflation impacts. Families like mine
growing up, food prices are up, gas prices are up, impacts the
poorest families in the country.
What do you think about this?
Mr. Dodaro. The last four years I have called for the
Federal Government to have a plan to deal with the long-term
finances. We are basically on an unsustainable long-term fiscal
path. The pandemic has obviously complicated that situation,
and we need to deal with whatever we need to deal with to
protect the public health and get the economy back in. But as
soon as we achieve our public health goals and that the economy
is moving in the proper, stable, robust direction, we need to
quickly pivot to have a plan in place to deal with this long-
term situation. Some of these windows that we have had to deal
with these things are rapidly closing.
This year the Highway Trust Fund is insolvent except for
some of the revenues that they will collect. But for the past
few years, instead of having the gas tax revenue support it,
there has been general appropriations to the tune of $155
billion. For the next 10 years, if you want to maintain
spending for the Highway Trust Fund, you have to come up with
$195 billion, and that is going to be general appropriations
unless there is another revenue source. It was initially
intended to be self-financing.
The Medicare Hospital Insurance Fund by 2024--now, this
might even change depending on how the economy goes in the next
few years--will only have 83 cents on the dollar to make
payments for the hospital Part A part of that program.
The date for Social Security to not have enough revenues to
make full payments, the latest estimate is 2031. Again, that
may change depending on economics. In that case, the Social
Security Administration, the trust fund revenues would only be
enough to pay 75 cents on the dollar. It would be like a 25
percent cut. If you combine that for people who are elderly
with Medicare and Social Security, I mean, you are talking
about now our government will probably never let that happen,
but it shows the magnitude of the change that has to be made
and the weighty decisions that have to be made, and the sooner
we make those decisions, the better off we are going to be,
because compounding is working against us.
One of the things that has actually saved us is, while the
interest rates are creeping up a little bit, they have been
relatively low by historic records. But we pay to finance our
debt, in 2019 we paid $360 billion just for interest rate cost.
Now, if interest rates go up in the future, they conceivably
could get in the next 10 years to where we are almost paying $1
trillion a year just for interest costs. Our Social Security
program is already $1 trillion a year by itself, all the Social
Security program. Medicare and Medicaid are each heading in
that direction.
This is a huge problem, and we need to deal it. The sooner
we deal with it, the better options that we have. I will again
be issuing a report in another month or two that will call for
this plan. I think we also need to change how we set the debt
ceiling, Senator. The approach we have now does nothing to
control the debt. All it does is authorize Treasury to borrow
the money necessary to pay the bills Congress has appropriated
and the President has signed into law. When that is not done,
when there are questions about it being done in time, it roils
the markets. We end up paying more interest to borrow the
money.
The other danger in this whole thing is we are relying on a
lot of foreign sources to lend us money to finance our debt,
and given global uncertainties and issues, I do not think this
is a time you want to be dependent on others.
Now, we have learned this lesson in the pandemic, being
dependent on foreign sources for our drugs and medical products
and things. But there is not much difference to leap to go to
being dependent on them to lend us money to finance our debt.
Senator Scott. Have you ever done a report on the impact on
a poor family of rising gas prices and rising inflation, like
what we saw back in the 1970s?
Mr. Dodaro. Not recently. I can go back. We can take a look
at doing that. I think it would have a lot of advantages. I am
sure we have done it in the past, and, so I would be happy to
do something like that again.
Senator Scott. My biggest concern is that is who is going
to get hurt the most. This spending without a return is that--
inflation is going--interest rates are going to go up,
inflation is going to go up, and the poorest families pay the
most.
Mr. Dodaro. Right.
Senator Scott. Whether it is paying for their mortgage,
paying the rent, or paying for their food.
When you take Medicare as an example, what are the options
then? I mean, we have what, three years to go and we are not
going to have enough money to pay our providers? Is that what
is going to happen?
Mr. Dodaro. Yes, to pay the hospitals and the providers,
right. The question about what kind of co-pays you are going to
have in these areas. Now, we have some recommendations that
would save money, save billions of dollars if Congress would
implement them, but, part of the issue is there has been
reluctance to implement some of these recommendations for fear
that it may interfere with the provision of services, and that
has been the preeminent issue, is making sure people have a lot
of options and get whatever services they want. But that comes
at a cost, and we are about ready to cross that threshold.
The biggest problem we have--and this is immutable for the
large part--is demographics. We are moving to a situation where
we only have two people working for every one retired person in
the United States. When Social Security and Medicare were set
up in their financing arrangements, we had five, six, seven
people working for every one retired person. The payroll taxes
were enough for current workers to pay for retirees. That is
inverted now, and this whole thing, we need a whole new
financing arrangement for Medicare and Social Security to be
sustainable over the next several decades.
Senator Scott. All right. Thank you.
Thank you, Mr. Chairman.
Chairman Peters. Thank you, Senator Scott.
I am going to go to a brief second round. The Ranking
Member and I have a few questions. But we are going to go to
five minutes instead of the normal seven for this second round.
There may be a Senator that will join us during that time. We
will have the seven minutes for that particular Senator. But I
will start.
Under the Federal Information Security Modernization Act
(FISMA), OMB and the DHS set minimum standards that Federal
agencies must meet. But each Federal agency is given full
authority and responsibility for their own cybersecurity
protections, as you are well aware.
My question is: Given that we just continue to see these
breaches, as you have discussed throughout this hearing, across
Federal agencies, do you believe that this is the right
framework and balance of responsibility? Or would the GAO
recommend a more centralized Federal approach?
Mr. Dodaro. Unfortunately, I think a more centralized
approach has merit for consideration. However, it is going to
be very difficult to implement it given the state of the
systems right now. It is hard even for some of these agencies
to consolidate and centralize within their own department and
agency let alone to do it across the government. I think there
needs to be greater enforcement of the standards as a first
starting point, but I would ask Nick Marinos, our expert, to
see if he has any other thoughts, Senator. But I think the
problem is IT in particular and IT security broadly is viewed
as a technical issue, and it is really not as much as it is a
management issue. It is not on the radar screen of top agency
officials the way it should be, in my opinion. If you take that
responsibility further away from them, I think it would be
difficult to be able to hold them accountable for some of the
programs and activities.
Nick.
Mr. Marinos. Yes, Chair Peters, I think what I would add to
the Comptroller General's statements regarding the importance
of agency leadership having responsibility, the reality is our
current situation is that agency leadership has authority,
statutory responsibility, in addition to the Chief Information
Officer, for protecting information and also holding others
accountable for protecting it as well. Obviously, our Federal
agencies rely on contractors; they rely on vendors. Ultimately
it is the agency's responsibility to protect.
Now, that does not mean they should be doing it alone, and
you can just look at, obviously, the NDAA and the multitudes of
provisions that were placed intended to help improve
cybersecurity, help to assert additional authorities to CISA. I
think that is a good step in the right direction. We saw the
most recent legislation in 2014, the FISMA version in 2014,
articulate a more central role for DHS in providing supporting
services to other Federal agencies. We think that that is
important.
We do actually have a report coming out next week,
actually, that was requested by yourself and by several other
Members of the Committee looking specifically at CISA's
transformation. I think that is really important here. If we
are going to see CISA take a more centralized role in not only
helping Federal agencies get better at cybersecurity but also
interfacing with the private sector, they are going to need to
get to that full transformation, and we will be coming out with
some recommendations on how they can do that next week.
Chairman Peters. Thank you. We are going to look forward to
that report and look forward to continuing to work with you on
that area because it is something we clearly have to focus on.
The other area related to the cyber challenges is the
workforce, and despite more than 20 years of laws and guidance
that have prioritized the recruitment and expanding and
maintaining of a strong cohort of cybersecurity and IT
professionals, strengthening our cyber workforce just continues
to be an ongoing and a significant challenge. That was in your
report, and you were very clear in the one that you are
presenting here today that that is the case. GAO found that
many agencies do not even prioritize IT and cybersecurity
workforce planning, which is somewhat shocking given the
importance of it.
How can we strengthen existing programs to meet the gap in
cybersecurity talent at the Federal Government? What would be
your main recommendations for us after 20 years of still not
getting it right?
Mr. Dodaro. Yes, this whole thing is kind of baffling to
me, but I will tell you, every year I send a letter to each
major head of a department and agency outlining priority
recommendations that I think they need to implement, and
cybersecurity is always on that issue. But if you go to try to
talk to anybody about it, there was a famous Senator from this
Committee, Senator John Glenn, who I had the privilege of
testifying before and working with, and he would say some of
these management issues are like watching mud dry. A lot of
managers do not understand the issues, and so they do not
understand the importance of it.
But, clearly, here I think that we need to look beyond the
Federal Government and how do we increase the size of the
workforce throughout the United States in the cyber areas and
turn more to our universities and colleges? I met with the
University of Maryland. They have started a cybersecurity
program, so they are generating graduates now where they never
had a cybersecurity line of academic study before. Virginia
Tech is doing the same thing, and other universities. I think
we need to find ways to support our university system, and to
go to Senator Portman--even community colleges and vocational
schools to teach people how to do these areas, to increase the
whole size of the pie. The competition with the private sector
is keen. But unless we generate more of a pool of cyber
workforce in these areas, we are not really going to gain much,
in my opinion. This is a nationwide need, and the Federal
Government has the leverage to create the incentives to create
more people that have these skills.
Chairman Peters. Absolutely. I could not agree with you
more. Thank you for that response.
We are going to deviate from our 5-minute second round
briefly. Senator Sinema has joined us for her first round, so,
Senator Sinema, you are recognized for seven minutes to deliver
your questions.
OPENING STATEMENT OF SENATOR SINEMA
Senator Sinema. Thank you, Chair Peters, and thank you to
Ranking Member Portman for holding this hearing.
Arizonans expect a government that is efficient, effective,
responsive, and transparent. The GAO High-Risk List report is
critical to help Congress identify and track progress on
vulnerable Federal Government programs to prevent waste, fraud,
and mismanagement of the American people's money.
The need to ensure the cybersecurity of our Nation was
highlighted in Arizona with the recent cyber attack against the
computer systems for the city of Kingman. This attack shows
clearly the disruption and damage that cyber criminals can
inflict on local communities. While there were some areas of
limited improvement since the 2019 review, this cyber attack
lays bare the need for continued action.
Mr. Dodaro, ensuring the cybersecurity of the Nation is an
area that remains on the GAO's High-Risk List. Friday's cyber
attack against the computer systems for the city of Kingman
highlights how pressing this need is from a local level.
Federal, State, local, and tribal entities need to take urgent
actions to implement comprehensive cybersecurity strategies,
perform effective oversight, secure their systems, and protect
privacy and sensitive data of its people.
As highlighted in the GAO report, can you expand upon the
importance of the Federal response to cyber attacks and its
coordination with State, local, and tribal entities such as in
places like the city of Kingman and what gaps continue to need
attention?
Mr. Dodaro. Thank you, Senator, for that question. I will
ask Nick Marinos to add to my comments, but this is an area
where, as troubled as the Federal Government is in terms of its
security vulnerabilities, I believe the State and local sector
and others are even potentially more vulnerable and in need of
help and support and assistance.
Now, the CISA organization at DHS was helpful recently with
the elections issue and securing our election systems, which
are administered, as you know, at the State and local level. I
believe we need greater that type of assistance at the State
and local level more broadly in the cyber arena.
Nick, do you have anything to add?
Mr. Marinos. Yes, I would just express, Senator Sinema, it
is a major challenge for a lot of these smaller organizations
to be able to protect themselves, so to think that they have to
do it alone is almost untenable. Seeing what happened just
within your respective State just last week, unfortunately it
is becoming more and more common. We are seeing ransomware
double in terms of the number of attacks that have taken place
just in the last three years.
It is going to take an all-of-government effort to really
make sure that we are not only supporting the Federal but the
State and local levels as well. We are seeing CISA try to build
out their capabilities. It is going to require careful
attention and oversight from this Committee as well as from
others to make sure that they can actually get to full
capability that will allow them to have the resources and
technical expertise to help States and local municipalities.
But this is also a workforce issue. We ultimately see that
many of those municipalities were, in fact, doing work on
behalf of yourself, a request that we got from you and Senator
Rosen and Senator Hassan, looking at K-12 cybersecurity as a
good example. We organizations have finite resources, and so
ultimately if they have to constantly be sort of on the
defensive as opposed to proactive, they are going to be
challenged.
It is going to really require CISA and the Federal
Government to step up and provide additional support and
effort.
Senator Sinema. Thank you. The report also focuses in part
on challenges of hiring and retaining cybersecurity risk
management personnel, highlighted that many agencies have not
done a full needs assessment for their cybersecurity workforce.
I am sure this is in large part keeping them from bringing on
the right talent in both numbers and skill set.
How do you recommend the agencies address this? Is there a
role for the Chief Human Capital Officers (CHCO) Council and
Chief Information Officers Council to play working together to
do these assessments?
Mr. Dodaro. I believe that there is a role for the Chief
Human Capital Officers in the individual agencies and also at
the Office of Personnel Management. We have talked to them in
the past about the skill across government, the skill gaps
across government in the cybersecurity area. They could be
providing much greater leadership in helping develop the
workforce through contacts with colleges, universities,
community colleges, trade schools, et cetera, if they so desire
to do that.
But, also, there needs to be some more education to the
Chief Human Capital Officers and people about the specific
needs that agencies need in the cyber arena. It is not a well-
established discipline like if you are hiring accountants or
economists or things of that nature. And so it is a new terrain
for them, and they need to understand the different aspects of
cybersecurity and what kind of skills they are looking for.
So if properly supported and brought up to speed, the Human
Capital Officers can be important leverage to help the agencies
acquire the skills that they need. But I would also encourage
this Committee, when they have the nominee for the Office of
Personnel Management, to talk to them about their important
leadership role potentially in this area as well.
Senator Sinema. Thank you.
Mr. Dodaro, regarding the emerging issues of leadership and
coordination of public health emergencies at the Department of
Health and Human Services (HHS), in early January 2021 then-
Secretary Azar announced that the administration would no
longer hold second vaccine doses in reserve and would
immediately make them available to States along with the first-
shot doses. The Secretary urged States to expand prioritization
to those 65 and older, warning that States could see their
future allocations reduced if they did not immediately get
shots into arms.
I worked immediately with the Arizona leaders at all levels
to do this. But days later, it was reported that no such
reserve even existed. The administration had already been
shipping out second doses beginning in December, and States had
told seniors to get in line for vaccines and then were told
that they would see minimal increases, if any at all, in their
doses.
Has GAO looked into incidents such as this one as part of
its planned review of HHS leadership and coordination of public
health emergencies?
Mr. Dodaro. Yes, we are working on this very closely. I
will ask Nikki Clowers to add to my comments, but we made a
recommendation, Senator, in September 2020 that HHS create a
vaccine communication and distribution plan with milestones in
communication. They never have--until this day that has not
been fully implemented. Congress has mandated they do so.
This is an area that was a classic example of
miscommunication and is in need of attention going forward. We
are on that case. We are working on it carefully.
Senator Sinema. Thank you.
Mr. Chairman, I see that my time has expired. Thank you.
Chairman Peters. Thank you, Senator Sinema.
The Chair now recognizes Senator Romney for his questions.
OPENING STATEMENT OF SENATOR ROMNEY
Senator Romney. Thank you. I very much appreciate the
benefit of this hearing, and, Mr. Dodaro, your testimony in
response to the questions that came from Senator Scott was most
revealing to me. We seem like we have a national emergency we
ought to be concerned about, which is the amount of our
national debt yielding interest costs, I think you said $390
billion with the potential of going to almost $1 trillion. At
this stage we are talking about another $1.9 trillion in COVID
relief measures. We are looking down the road at an
infrastructure bill which might be an extra $2 or $3 trillion.
We keep on adding to the debt.
At what point do you consider this to be a real national
emergency and something that we need to address and, that is
the mounting amount of debt we have and the interest associated
with it?
Mr. Dodaro. Yes, what I have been trying to do, Senator
Romney, is to get the government's attention to this, both the
Congress and the administration, so it does not become a
national emergency. If there is a spike in interest rate cost
or there is an unwillingness of foreign investors to purchase
our debt, there could be concerns ultimately down the road.
One of the other advantages we have is we are the world's
reserve currency, but that does not always have to be the case
in the future, if people lose confidence, and we have
competitors in these areas. Right now we are in a good position
to begin dealing with this issue before it becomes a crisis and
before we have to take draconian measures.
I am very concerned that we quickly pivot to this issue as
soon as we deal with the public health emergencies that we have
right now and get the economy on a stable basis. We need to
quickly turn our attention to this area. I mentioned to Senator
Scott, if you heard that, all the impending issues to deal with
these trust funds, and I know you have been concerned about the
trust funds and have some legislation to deal with that. Those
are very important services that our citizens rely on and count
on the government to keep on good financial footing. They are
going to be teetering here, if not right now, teetering soon on
that issue. We need a plan. We need a long-term plan. The plan
has to be rooted in law.
I have suggested that part of the plan is we need to
target, a debt-to-GDP target. Right now we do not have a
national policy. How much debt do we think we should service
over a period of time? We have no targets, no goals, no
guardrails. We just decide how much we are going to spend, and,
fortunately, we have been a wealthy country and we have able to
operate that way. But that is not going to be the case going
forward with these issues.
I have been working with the Senate Budget Committee. You
need a debt-to-GDP target. Then you need some interim
safeguards in place to make sure you could move toward that
target over time. You need some relief valves, if we have an
emergency that we have not been able to plan for comes up, so
that you have some flexibility. But you need to have these
things and have a regular score kept on how well you're doing
in achieving your goals and objectives.
But we do not have these guardrails in place going forward.
I think we could find ourselves in a very chaotic situation if
world events change that we are not prepared for. We have to
get our fiscal house in order.
Senator Romney. I would be one of many, I am sure, that
would welcome your recommendations as to what some of those
targets might be.
Let me turn also to the trust funds which you described.
Obviously, each of them is coming to a point where they are
going to become insolvent or rely on a massive infusion from
the general fund. Is there a pathway to solvency for these
funds? Simpson-Bowles tried to make an effort. It was not
successful. Other than raising taxes--and if one raises taxes,
of course, you are going to have a reduction in economic
growth, and at some point you find yourself chasing your tail.
I wonder, as you look at these various trust funds, is
there a realistic solution to get them on a basis where they
are, at least over the next several decades, not going to
become insolvent?
Mr. Dodaro. Yes, I think as it relates to the Highway Trust
Fund, there is debate about using miles traveled rather than
the gas tax as a means of dealing with that. I think there are
some alternatives for the Highway Trust Fund, particularly with
the advent of electronic vehicles and things. The concept of
user pay, which is what we had been operating on in the Highway
Trust Fund, I think is a salvageable concept if we think
outside the box and move away from gas taxes as the sole
provider. We have not raised that tax since 1993, but given the
fuel efficiencies of cars and the move to hybrid electronic
vehicles, that was not going to be our solution anyway in the
highway area.
Social Security, I think there are a lot of good options on
the table to deal with that aside from the revenue side. I
think you have to look at the revenue side. In all fairness,
the problem is so big you have to deal with that problem as
well, and maybe, it needs--there have been proposals about
doing some more means-testing, to eliminate the cap on Social
Security benefits for higher wage earners. There is a wide
variety of things because it is a social insurance program, and
we have to figure out how to craft it properly to provide
safeguards.
I am very concerned about the retirement security of
Americans, writ large, because it is not just Social Security,
but the private sector has been moving away from defined
benefit plans to defined contribution plans, if they have any
options, they are availing their workers to at all in those
areas. The burden is more shifted to individuals to plan for
their own retirement, and the pillars that had been there
before are a little shaky right now, both in the employer-based
systems as well as the government systems, as we were talking
about, and many people have not saved themselves, which is the
third pillar that we have relied on over time. That is very
important.
The one that is, I think, the most complex to solve is
Medicare and our health programs. Those are the fastest-growing
programs. We have been unable as a country to contain health
care costs. They keep growing faster than the economy is
growing, so our ability to pay for them is not there. The costs
are shifted to the government. This is the most perplexing
area. I do not have as many ready solutions. We have some
recommendations at GAO that would save billions of dollars, but
this is beyond that. That is the one that I think we are going
to require a lot of expertise and discussion and debate on, and
I think the sooner we get started trying to deal with
containing these health care costs, the better off we are going
to be, because that is the one area that I think can cause us
the most problems long term, particularly given our changing
demographics.
Senator Romney. Thank you very much. I appreciate your
testimony and counsel.
Mr. Chairman, thank you.
Chairman Peters. Thank you, Senator Romney.
The Chair recognizes Senator Padilla for your questions.
OPENING STATEMENT OF SENATOR PADILLA
Senator Padilla. Thank you, Mr. Chairman. Mr. Dodaro, thank
you for your participation, testimony, and information today. I
know we have covered a lot of different topics, subject matter,
so I will be focused on the census, the decennial census we are
still working to complete, and looking forward to the 2030
decennial census as well.
In the interest of time, I will spare us all the chronology
of the number of challenges faced in trying to complete a
fairly accurate national population count in 2020. I do not
know if we all would agree, but I certainly believe that there
was a lot of political attacks undermining the 2020 census,
both the years of underfunding and understaffing as the Bureau
was preparing for the 2020 census. We saw the back and forth on
the prior administration's attempt to question the citizenship
of every person in America. That was, thankfully, not
successful. But add to all that the restrictions and
limitations posed by the COVID-19 pandemic requiring extensions
and changing of deadlines, and so we find ourselves in a place
with compressed timetables for the Bureau to complete its work
and record its data, not just to Federal partners but to States
so they can proceed with the work of the redistricting process,
let alone the funding formulas for State and Federal funds that
are disbursed on a per capita basis, et cetera.
My question is really in two parts. First, what lessons
could we, should we have learned from the 2020 census
experience? The GAO report does call out the concerns about the
compressed timeframe. What lessons learned do we draw from the
2020 single census experience as we will begin to prepare for
the 2030 census soon enough? Then maybe even more short term,
what can be done to try to ensure the maximum accuracy and
quality of data for the 2020 census?
Mr. Dodaro. Senator, we are both in luck today. Our census
expert, Chris Mihm, has been involved in every census since the
1990 census. He is with us today and can best respond to those
questions.
I would also note that Chris will be retiring from GAO this
year after 36 years of distinguished Federal service, and he,
in addition to the census work, headed up all our High-Risk
programs at GAO. I will turn it to him, and he can give you
terrific answers here.
Senator Padilla. Thank you.
Mr. Mihm. Thank you, Comptroller General, and thank you,
Senator, for the question. You outlined perfectly, I think all
the challenges that the Bureau ran into both in terms of the
changes in the schedule at an Executive Branch level as well as
the forced changes as a result of COVID-19, going into the
field and coming out and then going back in.
I think there are a couple of big lessons that we can learn
from that. Perhaps at the most macro level is that there is
only so much time that you can squeeze out of the schedule. The
Bureau had said, for example, it would take them--or, rather,
in 2010 it took them 150 days to process the data after field
data colleague was done. They then this time were at least
initially saying that they were going to have to use 90 days,
and it went down to 70. It turned out that they said, we are
going to find things that in the data, what they call
``anomalies,'' that are going to need to be investigated. We
cannot get it down to that, to the quality of historical
standards of the census. Indeed they could not.
But, more on point to your question is that we believe that
the Bureau ought to be doing two things. One is that they need
to be making sure that they are evaluating the impact of the
operational changes that they made to data collection and data
processing. Some of those may be good ideas in order to carry
forward, but some of them may have consequences for the quality
of the data. Second, and perhaps more importantly, is that we
believe that the Census Bureau, when they release apportionment
data and when they release the redistricting data, needs to
provide stakeholders, including the Congress and the public,
high-level data that is indicative of the type of quality of
the data of the underlying data--for example, proxy data, the
extent to which they used information not from the actual
respondent but from a neighbor or other trusted source, and not
just at the national level, but breaking that down to sub-
demographics by racial categories, local jurisdictions, and all
the rest.
They to provide information to us in real time that shows
us the quality of the data while they are doing their longer
evaluations of the impact of the design changes.
Mr. Dodaro. I think the other lessons learned is that the
Internet response rate worked, the Internet option worked. I
think in future years, as our population becomes more computer
connected, that offers some lessons learned, Senator, for the
future as well.
Senator Padilla. All right. Any final comments on
salvaging, to the best of our ability, the quality and accuracy
of the 2020 census data?
Mr. Dodaro. I think the best option at this point is to let
Census do its normal thing that it has done before and look at
the coverage evaluation and to take the time that they think
they need to give us the best data they can within the
timeframes that are available. I do think that vetting it at
the State and local level and allowing them to comment on it
has always been a good quality check, and we do not want to
shortchange that process either.
Chris, anything else there?
Mr. Mihm. No, other than, Gene, that they will be doing
their big independent assessment of the quality of the census
called the ``Post-Enumeration Survey.'' That data will not come
out until later this year or even spring of 2022. We are going
to continue to be evaluating and monitoring that on behalf of
the Congress, and obviously we will be reporting out anything
we see on that.
Senator Padilla. OK. Thank you both.
Mr. Chairman, I yield back the balance of my time.
Chairman Peters. Thank you, Senator.
That concludes the questions for today. Mr. Dodaro, you had
a long day today. I started with you this morning at a press
availability. I know you had a long day with our friends over
at the House testifying on this report, and you have been with
us for a period of time as well. But I want to thank you for
your accessibility. I want to thank you for your work on this
report, plus your 40-plus years of service to the government. I
certainly want to thank all the members of your team and the
members who joined us here virtually, but who show up every day
and work hard for the American taxpayers.
With that, this hearing record will remain open for 15
days, until March 17th at 5 p.m., for submission of statements
and questions for the record. With that this hearing is
adjourned.
Whereupon, at 4:36 p.m., the Committee was adjourned.]
A P P E N D I X
----------
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
[all]