[Senate Hearing 118-152]
[From the U.S. Government Publishing Office]
S. Hrg. 118-152
SECURING THE NATION: MODERNIZING DHS'S
MISSION - CRITICAL LEGACY IT SYSTEMS
=======================================================================
HEARING
before the
SUBCOMMITTEE ON
EMERGING THREATS AND SPENDING OVERSIGHT
of the
COMMITTEE ON
HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS
UNITED STATES SENATE
ONE HUNDRED EIGHTEENTH CONGRESS
FIRST SESSION
__________
MAY 31, 2023
__________
Available via the World Wide Web: http://www.govinfo.gov
Printed for the use of the
Committee on Homeland Security and Governmental Affairs
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
U.S. GOVERNMENT PUBLISHING OFFICE
52-438 PDF WASHINGTON : 2023
COMMITTEE ON HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS
GARY C. PETERS, Michigan, Chairman
THOMAS R. CARPER, Delaware RAND PAUL, Kentucky
MAGGIE HASSAN, New Hampshire RON JOHNSON, Wisconsin
KYRSTEN SINEMA, Arizona JAMES LANKFORD, Oklahoma
JACKY ROSEN, Nevada MITT ROMNEY, Utah
ALEX PADILLA, California RICK SCOTT, Florida
JON OSSOFF, Georgia JOSH HAWLEY, Missouri
RICHARD BLUMENTHAL, Connecticut ROGER MARSHALL, Kansas
David M. Weinberg, Staff Director
Zachary I. Schram, Chief Counsel
William E. Henderson III, Minority Staff Director
Laura W. Kilbride, Chief Clerk
Ashley A. Gonzalez, Hearing Clerk
SUBCOMMITTEE ON EMERGING THREATS AND SPENDING OVERSIGHT
MAGGIE HASSAN, New Hampshire, Chairman
KYRSTEN SINEMA, Arizona MITT ROMNEY, Utah
JACKY ROSEN, Nevada JAMES LANKFORD, Oklahoma
JON OSSOFF, Georgia RICK SCOTT, Florida
Jason M. Yanussi, Staff Director
Allison M. Tinsey, Senior Counsel
Scott Maclean Richardson, Minority Staff Director
Margaret E. Frankel, Minority Professional Staff Member
Kate Kielceski, Chief Clerk
C O N T E N T S
------
Opening statements:
Page
Senator Hassan............................................... 1
Senator Romney............................................... 2
Senator Lankford............................................. 13
Senator Rosen................................................ 15
Prepared statements:
Senator Hassan............................................... 25
Senator Romney............................................... 26
WITNESSES
Wednesday, May 31, 2023
Eric Hysen, Chief Information Officer, U.S. Department of
Homeland Security.............................................. 3
Charles R. Armstrong, Chief Information Officer, Federal
Emergency Management Agency, U.S. Department of Homeland
Security....................................................... 4
Yemi Oshinnaiye, Chief Information Officer, Transportation
Security Administration, U.S. Department of Homeland Security.. 6
Kevin Walsh, Director, Information Technology and Cybersecurity,
U.S. Government Accountability Office.......................... 7
Alphabetical List of Witnesses
Armstrong, Charles R.:
Testimony.................................................... 4
Joint prepared statement..................................... 27
Hysen, Eric:
Testimony.................................................... 3
Joint prepared statement..................................... 27
Oshinnaiye, Yemi:
Testimony.................................................... 6
Joint prepared statement..................................... 27
Walsh, Kevin:
Testimony.................................................... 7
Prepared statement........................................... 37
APPENDIX
Responses to post-hearing questions for the Record:
Mr. Hysen.................................................... 57
Mr. Armstrong................................................ 80
SECURING THE NATION: MODERNIZING DHS'S MISSION-CRITICAL LEGACY IT
SYSTEMS
----------
WEDNESDAY, MAY 31, 2023
U.S. Senate,
Subcommittee on Emerging Threats and
Spending Oversight,
of the Committee on Homeland Security
and Governmental Affairs,
Washington, DC.
The Subcommittee met, pursuant to notice, at 10:15 a.m., in
room SD-562, Dirksen Senate Office Building, Hon. Maggie
Hassan, Chairwoman of the Subcommittee, presiding.
Present: Senators Hassan [presiding], Sinema, Rosen,
Ossoff, Romney, Lankford, and Scott.
OPENING STATEMENT OF SENATOR HASSAN\1\
Senator Hassan. This hearing will come to order.
---------------------------------------------------------------------------
\1\ The prepared statement of Senator Hassan appears in the
Appendix on page 25.
---------------------------------------------------------------------------
Good morning and welcome to our distinguished panel of
witnesses. Thank you for appearing today to discuss the
Department of Homeland Security's (DHSs) reliance on aging
information technology (IT) systems as it works to secure the
Nation, and why it is crucial that the Department and its
component agencies modernize their mission-critical systems.
I also want to thank Ranking Member Romney and his staff
for working with us on this hearing and for our continued
partnership to address emerging threats and reduce wasteful
government spending.
Today's hearing continues our Subcommittee's work to
replace aging government technology that wastes taxpayer
dollars, undermines our security, and limits government's
efficiency and responsiveness. As our Subcommittee continues to
encourage agencies to adopt modern systems that are more
efficient, more cost effective, and frequently more capable, we
will hear today from senior DHS officials about their outdated
technology negatively impacts the Department's budget and our
nation's safety.
For example, if an aging system that DHS uses to vet
passengers or visitors traveling into or through the United
States goes offline there is a chance that a dangerous person
could enter our country. In such cases, workarounds can help
limit national security risks, but they can also cause
commercial delays or miss real-time intelligence.
The Government Accountability Office (GAO) and the DHS
inspector general (IG) have assessed DHS's IT modernization
efforts and in doing so have raised concerns about its reliance
on outdated IT systems that perform mission-critical
operations. They have looked at DHS IT systems that ensure the
security of air travel, support disaster mitigation and
preparedness activities, and enhance border security, and they
have asserted that the failure of any of these systems would
have a significant impact on public safety and national
security. That is why it is crucial that DHS modernize these
systems.
Today's hearing is an opportunity to examine how legacy
information technology is a threat to national security and how
DHS can responsibly update its systems. I look forward to
hearing from all of our witnesses about the risks posed by
legacy IT systems at DHS and how DHS can successfully modernize
these systems to keep the American people safe, secure, and
free.
I will now recognize Ranking Member Romney for his opening
remarks.
OPENING STATEMENT OF SENATOR ROMNEY\1\
Senator Romney. Thank you, Madam Chair. I appreciate the
opportunity to hear from the witnesses today. In the interest
of time I am going to ask for my comments to be included in the
record.
---------------------------------------------------------------------------
\1\ The prepared statement of Senator Romney appears in the
Appendix on page 26.
---------------------------------------------------------------------------
I would note that the vulnerability of our systems has
obviously changed in dramatic ways with the advent of
artificial intelligence (AI). There are probably two sides of
that issue, which is, one, we are more vulnerable, but two, the
capacity to update systems through the use of AI to do some
software development is probably enhanced. How this will change
our perspective I think is one of the topics we should discuss
today.
But I think we all recognize that intrusion into government
systems is a risk. It has been carried out a number of times by
the Chinese or by their cohorts and by Russians, and we need to
take special care to protect the information provided by the
American people.
With that I will turn to the questions that we have and the
testimony of our witnesses.
Senator Hassan. Thank you very much, Senator Romney.
It is the practice of the Homeland Security and
Governmental Affairs Committee (HSGAC) to swear in witnesses.
If you will all please stand and raise your right hands.
Do you swear that the testimony you give before this
Subcommittee will be the truth, the whole truth, and nothing
but the truth, so help you, God?
Mr. Hysen. I do.
Mr. Armstrong. I do.
Mr. Oshinnaiye. I do.
Mr. Walsh. I do.
Senator Hassan. Thank you. Please be seated.
Our first witness today is Eric Hysen. Mr. Hysen serves as
the Chief Information Officer (CIO) for the Department of
Homeland Security. He is responsible for strategically aligning
the Department's technology resources to support DHS's missions
and activities. He was a founding member of the U.S. Digital
Service (USDS) at the Office of Management and Budget (OMB) and
worked as a software engineer for Google before joining the
Federal Government.
Welcome, Mr. Hysen. You are recognized for your opening
statement.
TESTIMONY OF ERIC HYSEN,\1\ CHIEF INFORMATION OFFICER, U.S.
DEPARTMENT OF HOMELAND SECURITY
Mr. Hysen. Chair Hassan, Ranking Member Romney, and
distinguished Members of the Subcommittee, thank you for the
opportunity to testify today.
---------------------------------------------------------------------------
\1\ The joint prepared statement of Mr. Hysen appears in the
Appendix on page 27.
---------------------------------------------------------------------------
The Department of Homeland Security interacts with the
American people on a daily basis more than any other Federal
agency, from travelers moving through our air, land, and sea
ports, to businesses importing goods into our country, to
disaster survivors applying for assistance in their hour of
need.
An increasing portion of these interactions occur through
our information technology systems. Modernizing our legacy IT
systems is essential to improving the experience of those that
rely on our department for critical services and of
strengthening our ability to carry out our vital homeland
security missions. Modernization further offers opportunities
to strengthen our cybersecurity posture and reduce spending.
I have worked to improve service delivery at all levels of
government throughout my career. As you noted, Chair, I worked
in Silicon Valley as an engineer and product manager to launch
tools in over 30 countries to help people vote and engage with
their representatives. I worked in philanthropy and State
government to improve social service delivery at the State and
local level. I left the private sector to cofound the United
States Digital Service, where I worked to improve key services
across DHS, and I bring those perspectives to my current role
as the Department's Chief Information Officer.
Historically, agencies across the Federal Government,
including DHS, took a ``big bang'' approach to IT
modernization. At its most basic level, we attempted to acquire
and deploy IT systems in the same way that we acquire and
deploy ships. Government staff spent years gathering
requirements, awarding a large contract to a single system
integrator to build to those exact requirements, extensively
test against them, and then launch. In theory, everything would
go well, the new system would replace the old one, and then go
into ongoing maintenance for several years until it was time to
start the entire process over and modernize again.
In practice, however, this approach, known as ``waterfall''
software development, leads to modernization programs going
over budget and behind schedule at alarming rates. Single,
``big bang'' releases of new systems lead to massively
increased risk.
At DHS today, we reject this approach in favor of a more
incremental, iterative, and measured strategy based on private
sector best practices that enable us to successfully modernize
key services and retire costly legacy systems. Our newly
initiated modernization programs focus on defining a minimum
viable product, initial functionality that can be launched
within months, not years. From there, we follow an agile
software development methodology that gathers requirements,
builds, tests, and launches software, in rapid, iterative
cycles. Modernized systems are deployed and implemented in
parallel to the old legacy ones, to buy down risk over time.
For our existing modernization programs, started under the
old model, we are focused on transitioning as much of the work
to the new approach as possible. A critical element of this
approach is that government, not any one vendor, must serve as
the integrator ultimately responsible for successful delivery
of an IT system. We depend on our industry partnerships but
require strong technical expertise in Federal service to
oversee contracts and ensure results. I am focused on
strengthening our IT workforce to enable this, both by bringing
in talent from the private sector and creating new
opportunities for our workforce to develop and gain new skills.
Our written testimony provides examples of our transition
of legacy modernization programs into this new approach as well
as of newer initiatives started under this model.
This work is showing results in strengthening
cybersecurity, reducing spending, and most importantly,
improving customer experience. Just yesterday we announced that
the Department had reached its target of eliminating 20 million
of the 190 million hours of administrative burden that we place
on the public each year through modernizing our IT systems and
simplifying our services.
We still have much work to do, but I am proud of the work
done by my colleagues here today and the entire DHS IT
community to deliver modernized, secure, effective, and usable
systems to support our Department's critical missions.
Thank you again for the opportunity to testify today, and I
look forward to your questions.
Senator Hassan. Thank you very much.
Our next witness is Charles Armstrong. Mr. Armstrong serves
as the Chief Information Officer for the Federal Emergency
Management Agency (FEMA). His role is to ensure that the
agency's technology can support its mission to prevent, prepare
for, and recover from domestic disasters. He previously served
in the Customs and Border Protection (CBP) Office of
Information and Technology and was Deputy Chief Information
Officer of DHS.
Welcome, Mr. Armstrong. You are recognized for your opening
statement.
TESTIMONY OF CHARLES R. ARMSTRONG,\1\ CHIEF INFORMATION
OFFICER, FEDERAL EMERGENCY MANAGEMENT AGENCY, U.S. DEPARTMENT
OF HOMELAND SECURITY
Mr. Armstrong. Thank you. Good morning Chair Hassan,
Ranking Member Romney, and distinguished Members of the
Subcommittee. Thank you for the opportunity to testify today in
support of the agency's information technology modernization
program.
---------------------------------------------------------------------------
\1\ The joint prepared statement of Mr. Armstrong appears in the
Appendix on page 27.
---------------------------------------------------------------------------
FEMA is utilizing an agile development and delivering small
segments and providing an opportunity for customers to interact
with systems in a rapid fashion. This approach allows our
developers to receive real-time feedback from customers on
their experience.
FEMA requires continuous modernization to maintain mission
readiness. The overarching goal is to modernize and streamline
processes through the consolidation of systems and platforms.
As Stafford Act-related disasters increase, our system must be
able to scale to support the magnitude of the disaster.
Today I will highlight three FEMA modernization programs:
Grants Management Modernization (GMM), the National Flood
Insurance Program (NFIP), and Individual Assistance (IA).
First, let me begin with Grants Management.
Based on prioritizing customer experience, FEMA is
consolidating eight disparate legacy systems into the FEMA
Grants Outcomes (FEMA GO) System. The new IT platform is
targeted toward the entire grants community of users, including
FEMA personnel, the grants recipients, the sub-recipients
across State, local governments, Tribal, and territorial
partners. GMM, through FEMA GO, has migrated 5 programs to the
new system in fiscal years (FY) 2018 through 2022, and has on
boarded 14 additional grant programs in fiscal year 2023. FEMA
plans to onboard approximately 20 additional grant programs by
April 2024, and decommission all the old systems by 2025.
Next I am going to discuss the National Flood Insurance
Program, or the Pivot system. As a goal for making wise land
use decisions, Congress established the NFIP to encourage
communities to enact floodplain management ordinances
consistent with Federal standards. Pivot facilities and
consolidates the NFIP core business processes from the legacy
system and services program. Pivot was an agile modernization
program in the newer mold of technology modernization,
replacing the old NFIP system and services program.
Pivot processes millions of transactions of flood insurance
applications, policies, and claims, and provides business
workflow to automate manual processes and provides reporting
and data analytics for financial and business requirements.
Pivot met its full operational capability in October 2020,
ahead of schedule and under budget.
Finally, the Individual Assistance Technology Support
Services program. FEMA is planning to migrate 9 disparate
systems into the Individual Recovery Information System (IRIS),
and will be replatforming into the recovery cloud environment.
The IRIS full operational capability is projected for July
2027, contingent on out year funding. FEMA's Individual
Assistance also implemented Login.gov as a multifactor
authentication and to support State, local, and Tribal access
in 2023, and plans to place this integrated component in the
beginning of the registration intake process once streamlined
disaster assistance intake is rolled out in August.
In closing, again, FEMA thanks the Committee for the
opportunity to be a witness at today's hearing. The agency
looks forward to continued partnership and is open to any
questions that you may have. Thank you.
Senator Hassan. Thank you, Mr. Armstrong.
Our third witness is Yemi Oshinnaiye. Mr. Oshinnaiye is the
Chief Information Officer for the Transportation Security
Administration (TSA). He works to ensure that TSA's technology
capabilities meet the agency's task of keeping highways,
railroads, mass transit, and air travel safe. He previously
served as the Deputy Chief Information Officer at U.S.
Citizenship and Immigration Services (USCIS).
Welcome, Mr. Oshinnaiye. You are recognized for your
opening statement.
TESTIMONY OF YEMI OSHINNAIYE,\1\ CHIEF INFORMATION OFFICER,
TRANSPORTATION SECURITY ADMINISTRATION, U.S. DEPARTMENT OF
HOMELAND SECURITY
Mr. Oshinnaiye. Good morning, Chair Hassan, Ranking Member
Romney, and distinguished Members of the Subcommittee. Thank
you for the opportunity to appear before you today and discuss
the modernization of DHS's critical legacy IT systems.
---------------------------------------------------------------------------
\1\ The joint prepared statement of Mr. Oshinnaiye appears in the
Appendix on page 27.
---------------------------------------------------------------------------
I have the honor of serving as the CIO for TSA. In this
role, I am responsible for technology management, including
technology delivery and support, innovation, cybersecurity, and
all facets of IT resourcing that TSA uses to enable its
mission. Prior to TSA, I served as the Deputy CIO for the U.S.
Citizenship and Immigration Services, where I led innovative
practices and solutions to address the challenges of legacy
systems and the processes used to modernize them. These
practices are still in use today, to enable modern systems and
continue innovation for the nation's immigration benefit system
and across Federal Government.
Prior to my Federal service, I worked as a Chief Technology
Officer in the private sector, and as an entrepreneur,
providing software development and systems engineering
services.
At TSA, we are responsible for the security of over 430
Federalized airports, and routinely screen more than 2 million
passengers, 5 million carry-on bags, 1.4 million pieces of
checked luggage daily for explosives and other prohibitive
items.
TSA IT systems enable TSA to provide world-class security
for the American traveling public while ensuring
confidentiality, integrity, and availability of TSA data and
resources. I am proud of how TSA is approaching modernization
to ensure our infrastructure, systems, and IT solutions remain
resilient and effective.
Our strategy for modernization at TSA is in line with the
DHS overall approach. Our focus is on leveraging human-centered
design for problem-solving technique we use to engage our
customers. This technique allows us to leverage user experience
and incorporate this feedback into our overall modernization
strategy. When we operate this way, we provide a better
opportunity for the user community to influence the final
product, which improves the final product.
TSA's IT modernization strategy enables the agency to use
outsourced, critical portions of the modernization to industry
partners, such as cloud vendors, who invest heavily in modern
services and infrastructure. Leveraging this investment
empowers TSA to focus more of our talent and resources on
process improvement and strategies for continued mission
success.
Two great examples of this are the Performance and Results
Information System (PARIS). This system manages compliance and
inspection activities. We recently successfully migrated to the
cloud platform which enables us to grow, scale, and provide
robust analytics for TSA compliance activities.
Another example is the Mission Scheduling Notification
System (MSNS). This system scheduled Federal air marshals to
protect in-flight travel. MSNS is a collection of systems with
integration to many other systems, but currently includes a lot
of extensive manual processing. We prototyped the modern
process using cloud platforms with an intuitive design in a
matter of months using agile, that alleviates manual
processing. Our solution delivers rapidly over time by taking
an iterative approach.
These two examples show how TSA IT delivers effective
technology to the mission and the strategy to sustain its
capability.
Chair Hassan, Ranking Member Romney, and distinguished
Members of the Subcommittee, thank you for the opportunity to
testify before you today and for your continued support of TSA.
I look forward to this discussion and your questions.
Senator Hassan. Thank you very much.
Our final witness is Kevin Walsh. Mr. Walsh is the Director
of the Government Accountability Office's Information
Technology and Cybersecurity reviews. He has led GAO's work to
identify challenges associated with the Federal Government's
use of aging technology, coordination of IT acquisitions, and
IT-related risk assessments. His work has specifically focused
on making recommendations to improve DHS's IT systems.
Welcome, Mr. Walsh. You are recognized for your opening
statement.
TESTIMONY OF KEVIN WALSH,\1\ DIRECTOR, INFORMATION TECHNOLOGY
AND CYBERSECURITY, U.S. GOVERNMENT ACCOUNTABILITY OFFICE
Mr. Walsh. Chair Hassan, Ranking Member Romney, and Members
of the Subcommittee, thank you for inviting GAO to testify on
this important issue.
---------------------------------------------------------------------------
\1\ The prepared statement of Mr. Walsh appears in the Appendix on
page 37.
---------------------------------------------------------------------------
As you have heard, DHS plays a pivotal role in safeguarding
the United States and its citizens from a variety of threats,
and its IT systems are critical to that mission. Among other
things, DHS prevents and responds to acts of terror, its IT
systems help to coordinate intelligence gathering and analysis,
secure transportation systems, and collaborate with Federal,
State, and local law enforcement. DHS also secures our borders.
This technology has intercepted illegal activities, combats
human trafficking, and identifies unauthorized individuals,
illicit drugs, and contraband.
DHS also protects our infrastructure. Its IT defends
against cyber threats to our essential services, sensitive
information, and national security. DHS also responds to
natural disasters. Its tech coordinates our emergency response,
supports affected communities, and aids in their eventual
recovery.
In 2023, the Department expects to spend about $10 billion
on IT. Operating and maintaining existing systems is about $9
billion of that. In many cases, those existing systems are not
the newest. However, because they are old does not mean they
are at risk or in need of retirement. The systems to focus on
are those that we would flag as legacy IT, systems that are
outdated or obsolete that may have heightened security risks or
are not meeting mission needs.
Worryingly, the Department's efforts to modernize such
systems have a history of costing more than planned and taking
longer than promised. We have reported that the Department is
on its third attempt at modernizing its financial systems,
which recently breached schedule and performance goals. Its
biometric identity management services, handling fingerprinting
and facial recognition, are outdated, and the replacement
project is years behind schedule. The system it uses to award
billions in grants to prepare and respond to disasters is also
outdated, and the replacement project is also years behind.
While all is not quite right in the Land of Oz, DHS has
been taking promising steps to address these issues. For
example, they have halted or suspended projects that are going
poorly, they have addressed our recommendations at a better-
than-average rate, documented lessons learned, and used modern
development technologies like agile and incremental. They have
also been working diligently to address the associated high-
risk area on IT and financial management functions.
Going forward, DHS needs to continue addressing its legacy
systems, cataloging those systems, identifying what is not
performing, and prioritizing the work ahead. They should also
make sure to turn off the old systems.
It is worth noting that this should not be a one-time
effort. It should be part of every agency's portfolio
management to consider what IT is not doing well. Ideally, we
should also be forecasting when this will occur so that the
government's responses are proactive instead of reactive. The
Chair's Legacy IT Reduction Act includes provisions along those
lines.
Finally, this probably is not what you want to hear, given
the current fiscal environment. However, modernization may not
be a cost-saving endeavor. What we do get are newer systems
that are more efficient, with better functionality, and
stronger security.
This concludes my statement, and I look forward to your
questions.
Senator Hassan. Thank you, Mr. Walsh. We will now proceed
with our first round of questions, and I will start with a few
and then turn it over to the Ranking Member.
The first question is to you, Mr. Walsh. This Subcommittee
has led efforts to save taxpayer dollars by encouraging
agencies to modernize their outdated and obsolete IT systems.
These aging systems not only increase costs, they can also
jeopardize our national security.
What specific risks has GAO identified that are presented
by DHS's aging IT infrastructure, and can you provide an
example, please.
Mr. Walsh. The general risks to running legacy systems are
risks to your security, mission needs, staffing, and cost. In a
specific example, as has already been mentioned, FEMA is
working on its Grants Management modernization program. That
program is to replace a series of legacy systems that currently
are experiencing the problems we are describing today. They
have manual processes that are a burden for recipients, a
burden for the agency, and are slowing down the response to
disasters. If that legacy system were to fully go off the
rails, a disaster without grants from the government would be
very difficult for our citizens.
Senator Hassan. Thank you. This is a question to Mr. Hysen
and to Mr. Walsh. It is deeply concerning that DHS relies on
outdated technology for some of its most important work. I
heard the testimony about progress you are making, but there is
still really important work where we are using outdated
technology. Mission-critical systems should be an IT
modernization priority, but different agencies have different
ideas about what makes an IT system mission critical.
Mr. Hysen, how does DHS currently prioritize which systems
to modernize?
Mr. Hysen. Chair, thank you. As we look at establishing
modernization priorities we are looking to those that fit into
three categories, those that present significant cybersecurity
risk, those that present opportunities to improve the
experience the public has interacting with DHS services, and
those that present opportunities to improve how our employees
do their job every day and enable them to do that more
effectively.
On the cyber front, one tool that we have developed to aid
us in this is a unified cybersecurity maturity model that
evaluates all of our IT systems across the Department on a
number of different cyber axes, and enables us to best identify
areas of risk to prioritize our modernization efforts.
Senator Hassan. Thank you. Mr. Walsh, what is GAO's
criteria for determining if something is mission critical?
Mr. Walsh. We have a two-tiered test. The first looks at
whether the functions of a given system are unique to the
agency. If it is unique, then any sort of damage or disruption,
what kind of impact it would have to the mission of that
agency.
Second tier, systems who, if they were damaged or the data
were lost, misused, or disclosed, would have a debilitating
impact upon the agency.
Senator Hassan. OK. Mr. Hysen, could DHS adopt GAO's
mission-critical criteria to help decide what IT modernization
projects to prioritize?
Mr. Hysen. Absolutely, Chair, and I believe we look at very
similar criteria across our planning efforts.
Senator Hassan. I think it is a really important area to
focus on and really try to make sure that that is, in fact, how
the agency is approaching it.
Mr. Oshinnaiye and Mr. Armstrong, a question for the two of
you. Let us discuss a couple of examples of systems that are
critical to DHS's mission but rely on aging technology. Since
2009, TSA has used the Secure Flight System to spot potential
threats to commercial airline travel within and outside of the
United States. This system connects to many other agency
systems to identify individuals who are ineligible to fly.
Mr. Oshinnaiye, can you walk us through what would happen
if the Secure Flight System were to go offline, fail, or be
even partially inaccessible?
Mr. Oshinnaiye. Thank you, Chair. Similar to what Mr. Walsh
said, the system has been in existence for a while, but calling
it a legacy system would not be the same as a mainframe. That
system is constantly updated, and if that system would go
offline we do have an offline policy or process where we can
operate for a certain amount of time. We also test that
scenario for COOP, to make sure that if we did have an outage
we would still be able to operate and protect travelers.
Senator Hassan. But what would happen? I understand there
is a workaround, and I made that comment in my opening, but a
workaround has its costs too. What, if it were to go offline,
or fail, or be even partially inaccessible, and let's say your
workaround did not work, what happens?
Mr. Oshinnaiye. In a catastrophic event or if you would
exceed the COOP timeframe, it would hinder our ability to see
travelers who are dangerous to other travelers.
Senator Hassan. OK. Thank you.
Another example of DHS's aging IT infrastructure is FEMA
system that enables the flows of funds and services to disaster
survivors, and Mr. Walsh was just getting at that. Mr.
Armstrong, if this system went down, how would Americans in
need because of a natural disaster, access FEMA services?
Mr. Armstrong. Chair Hassan, can I ask to clarify that,
because Mr. Walsh talked about Grants Management, and I want to
make sure you are not referring to Individual Assistance.
Senator Hassan. Let us talk about Individual Assistance.
What would happen, in a natural disaster, access to the
Individual Assistance system goes down?
Mr. Armstrong. Individual Assistance, as you can imagine,
is critical to the mission of FEMA. It is one of the systems
that we rely on to give immediate recovery to that survivor
during the recovery and response period of a disaster. Without
that capability in place we would have to resort to manual
processes, which could either slow things down or prevent us
from adequately addressing the needs of the individual during
that critical time.
Senator Hassan. It could have a really significant, and at
times, really dangerous impact, right?
Mr. Armstrong. Yes, ma'am.
Senator Hassan. Thank you.
I will now turn to Senator Romney for his questions.
Senator Romney. Thank you, Chair. I appreciate the chance
to listen to each of you and to hear your perspectives and
update on our systems. I am curious, as we begin, Mr. Hysen, do
Mr. Armstrong and Mr. Oshinnaiye both report to you? What is
the organizational structure within DHS for the various
agencies that are part of the entire entity?
Mr. Hysen. Thank you, Ranking Member. Under the Federal IT
Acquisition Reform Act (FITARA), the component CIOs under DHS
report in to me. However, they also maintain a reporting
structure into their component agencies.
Senator Romney. It is a matrix reporting system. Do they
follow the same approach that you described? I am curious as to
how widespread your approach is, which, as you described, I
will call it the ``big bang'' approach, which is a big contract
going out and waiting for a full system being delivered by an
outside contractor, versus something now which I do not know
how you would describe it incremental, which is you begin with
a system and then add onto it as time goes on, improve it as
time goes on.
How much of what is being done follows the latter approach
as opposed to the former ``big bang'' approach?
Mr. Hysen. At this point, Ranking Member, agile delivery
and this newer approach to modernization is widespread across
DHS. This has been a journey over really the last decade. Some
of our component agencies were earlier adopters of this
approach, some have made that transition more recently, but it
is now the norm.
Senator Romney. Do you know whether that is the case also
more broadly through our government? I presume you interact
with CIOs in other departments as well. Is the agile approach
being adopted on a widespread basis?
Mr. Hysen. I believe so. That has been a transition that
has been discussed across the Federal CIO council and among my
colleagues over the last many years.
Senator Romney. We have a history of spending a lot more
than the private sector to get an updated modernization of our
systems. Is that because of the prior approach, or is it just
endemic to the way government works?
Mr. Hysen. I believe it is, in many ways, tied to that
approach. One of the results of that ``big bang'' approach with
single-system integrators was that every IT system would build
everything from the ground up. They would have their own
infrastructure, their own support teams, their own log-in
systems, for example. As we have moved to modernize, we are
looking to break that down, offer up common enterprise services
for common pieces of functionality--that was the norm, for
example, when I worked in Silicon Valley--and enable each
individual system to only focus on their unique functionality
needs.
Senator Romney. I cannot resist asking you a personal
question, which is you were in Silicon Valley. I read stories
about the billionaires, the popcorn in Silicon Valley. What led
you to leave Silicon Valley and go to work in the government?
Are you happy you made that decision? [Laughter.]
Are you looking for a ticket back, or is this a
responsibility that you particularly feel is important and that
you enjoy?
Mr. Hysen. No, sir, I am not looking for a ticket back. I
have been thrilled to make this transition. I come from a
family of public servants. My father is a retired public
servant at the General Services Administration (GSA). When the
healthcare.gov disaster occurred in 2014, was looking at the
work I was doing in Silicon Valley and saw the opportunity to
use my skills for a bigger purpose. I was thrilled to be able
to cofound the U.S. Digital Service and have since helped
recruit dozens of other technologists from the private sector
into government and look to bring on many more in the years to
come.
Senator Romney. I very much appreciate that, as a citizen.
You described the priorities. The Chair asked about which
systems you modernize. It struck me that one of those was
perhaps the highest, which is protecting national security,
protecting personal information that individuals might have,
that there is a high degree of sensitivity there.
Are we fully modernized in that category or are we still
operating some legacy systems that present a real risk, either
to national security or to the personal privacy of our
citizens?
Mr. Hysen. Senator, we certainly have more work to do.
Several of the systems that my colleagues here have mentioned
do present cybersecurity risks through the ongoing operation of
our legacy systems, and we are focused on modernizing those as
rapidly as possible.
Senator Romney. Let me turn now to something I mentioned in
my opening statement which is AI and the impact of AI on your
respective responsibilities. I am aware of the writing today
and the discussion today about how vulnerable we are to machine
learning to be able to break into our systems.
What is your sense of that? What are we going to need to do
to protect the most critical information that we have from
attack, from malign interests that would seek to undermine our
national security or our personal privacy?
Mr. Hysen. Ranking Member, thank you. As you noted, AI
presents significant opportunities in modernizing our systems
as well as better harnessing AI to advance our mission
delivery, but the risk of adversarial use of AI is real as is
the risk of disparate bias or unintended disparate impact from
our use of AI.
Secretary Mayorkas recently launched a Department-wide AI
Task Force that I am co-chairing, along with our Under
Secretary for Science and Technology (S&T), that is looking at
exactly those questions. We are still early in our work but are
taking this work very seriously and have it as a major focus
for the year to come.
Senator Romney. Maybe it is a conjecture at this point, but
any sense of what we might need to do to protect critical
information from an AI attack? Do we need to almost go offline
in some respects with some databases? I wonder how you can
protect our systems, given the power of an AI approach.
Mr. Hysen. Senator, one area I would start with is a little
more basic than that, is even AI literacy among our employees
and those with access to our data. We expect to see an
increasing number of AI-generated phishing emails that are
attempting to trick our employees and other users into giving
up information, and we need to be able to ensure that our
employees know what AI is capable of and are on the lookout as
they are executing their responsibilities first.
Senator Romney. Thank you.
Senator Hassan. Thank you, Senator Romney.
I will recognize Senator Lankford for his questions.
OPENING STATEMENT OF SENATOR LANKFORD
Senator Lankford. Thanks for doing this hearing, and
gentlemen, thanks for your testimony as we walk through this.
Mr. Hysen, I want to continue the conversation with you. USCIS
still uses paper for a lot of the immigration processing, so
tell me the status of where we are moving right now. Obviously,
there are a lot of things that are changing along the border
and trying to update data systems there. USCIS seems to be
lagging in some of that. Where are we?
Mr. Hysen. Senator, thank you. I actually believe USCIS is
now a success story in their digitization journey. The first
project that I was assigned to work on when I joined the U.S.
Digital Service was USCIS's transformation program that was
seeking to digitize their nearly 7 million immigration benefits
applications every year.
When we started that effort they were characteristic of the
old ``big bang'' approach, a single vendor with proprietary
technology that had been working for years and only digitized a
handful of forms, and processing of those digital forms ended
up being slower than paper.
We worked with USCIS to restructure the program, implement
agile development, move to the cloud, and implement human-
centered design practices to ensure that today a significant
majority of USCIS's benefits applications are processed
digitally, and they are using those capabilities to reduce
their backlogs and improve their efficiency.
Senator Lankford. USCIS, U.S. Immigration and Customs
Enforcement (ICE), and CBP, their systems do not necessarily
all talk to each other in moments that they need to be able to
talk to each other. Do you know of an area between the three of
them, as they are trying to be more interoperable in their
systems and their data links, where you do not have to actually
contact somebody else to get that information? They can
actually pull it as they need to.
Mr. Hysen. Yes, Senator. Historically that has been
correct, and that has been something that we have worked very
hard to address over the last several years. Through our
Southwest Border Technology Integration Program we have been
working to digitize the processes for non-citizens encountered
at the border, to include issuing Notices to Appear (NTA)
digitally as well as handing off information between agencies.
One example there is ICE's new Case Acceptance System
(CAS), which allows CBP to refer a case to ICE for custody
digitally rather than waiting hours for ICE to come pick up a
paper file and make a custody determination. This has saved
millions of hours in transfer time, moving people through our
process more efficiently.
Senator Lankford. Yes, it has been helpful. What has been
interesting is there are still a couple of moments there where
they still have to contact each other, and we can talk offline
about some of those. I am sure your team is already making
contact with you about it.
I was in Arizona, actually last week, as I am regularly
down there for my responsibilities from this Committee,
actually. In that dialog it was interesting to hear several
folks say this system, the technology piece of it, is so much
better than what it used to be, and I can see that and see the
processing and the speed of that, where you have actually got
people trying to input the data and to get them out.
The challenge now is that we have more and more people that
are data input folks at the border, and that is always the
challenge as the human piece now. I will have a different set
of questions for DHS on who should be the person actually
entering all that data. Right now it is a person with a badge
and a gun is also the person that is sitting there entering all
the data. That is maybe not the best use of their time, to do
that. But that has been a real help, but finding other ways
that we can connect.
It was interesting, as well, just on a vulnerability issue,
how many areas of the border where we still do not have cell
coverage and are very remote. You have folks out there with a
portable device trying to connect in, and obviously there is no
connection. That is a larger issue to be solved. Or that when
you are on the border and you get to a Border Patrol station,
immediately you open your phone and it says, ``Welcome to
Mexico,'' when I am 50 feet from Mexico and you suddenly
realize all the information that I am processing is processing
through a cell tower on the Mexican side, not on the American
side.
There are some clear vulnerabilities there. How are we
handling some of those vulnerabilities with our data?
Mr. Hysen. Senator, thank you. I have had that exact same
experience during my trips down to the border. We are working
to expand connectivity infrastructure along the border. It is
challenging given the geography. Some of the areas we are
looking at include CBP's use of mesh networking kits that can
extend the coverage of their devices, as well as satellite
connectivity, and in other cases looking at partnerships with
other Federal agencies as well as State agencies that have land
rights along the border, including in parks, that we need to
look at to put up more cell towers and expand coverage. We
still have work to do there, but it is something we are looking
at very closely.
Senator Lankford. Yes, that is very helpful. Thanks for the
progress on that, but we obviously still have a little bit of
progress to go on it. But it is nice to see the work that is
going on.
I also appreciate the off-the-shelf focus, to say if there
is some technology that already exists to do this then let's
invest our dollars in other areas, in other technologies, I
think is where you are trying to get at as well, to say that we
do not have to create this ourselves. When I am along the
border, and last week, when I was there many of the agents that
were there, both at the ports of entry (POEs) and between the
ports of entry, their first comment was, ``A lot of the folks
that are coming are non-Spanish speakers.'' They had 1,000
people from Mauritania that came in, in the last 2 weeks, that
are adult males from Mauritania that are coming in, in large
numbers. Russians that are coming in, in large numbers.
Pakistanis, Middle Eastern men that are coming in, that we have
no criminal records for at all and have no background
information. But we also have no translator that is there.
I said, ``OK. How is that going?'' and they all said,
``Everyone shows up with their phone and with Google Translate
on, and we stand there and Google Translate, communicate back
and forth to each other.''
I am sure there has been a push with DHS saying we need to
develop our own system to be able to do this, but currently the
Google Translate is working, and everyone seems to be fine with
it, and it allows us to use monies in other areas that are
really must-need, to develop new software technologies. In
places where we can do that, we have a lot of catching up to
do.
I continue to encourage you and your team to use off-the-
shelf, tested software and technologies where we can, to make
sure that we are investing dollars, trying to get us completely
caught up with where we are not paper-based in other areas.
Does that make sense?
Mr. Hysen. Yes, sir.
Senator Lankford. OK. Thank you. Thanks for all the work.
Senator Hassan. Senator Rosen.
OPENING STATEMENT OF SENATOR ROSEN
Senator Rosen. Thank you, Chair Hassan and Ranking Member
Romney. A really important hearing and I thank you all for
being here today. Mr. Hysen, as a former tech person myself who
now serves in government, I appreciate your work and your
willingness to serve.
But I want to move right into workforce challenges because
we know that they are, well, every area in our country has
workforce challenges, but really particularly in legacy IT.
Maintaining legacy IT systems requires a specialized workforce
capable, of course, of supporting technology no longer
utilized, or I would not say no longer utilized, because it is
utilized, it is there, but not as nimble as we can be with
newer technologies. In many cases you cannot find the skilled
workers trained in dated systems. I hate to use the words
``dated systems and technologies'' but those kinds of things
that I programmed in--Common Business Oriented Language
(COBOL), FORTRAN, Assembler--from the 1980s and 1990s, you are
trying to find a workforce that can maintain while you still
have it, that can develop new systems, and then unload and
reload, make that transition. It is really important. While we
transition we have to train our IT younger generation coming up
on how to do those things.
Mr. Hysen, for maintenance development, for transition
design and planning, and for unloading a database and reloading
it to the new system, if you will, or databases, however they
are, how are you approaching this expected modernization, and
what are you doing to prepare the workforce that is going to
live in both of these worlds, and needs to for a little bit
longer?
After that Mr. Armstrong and Mr. Oshinnaiye, if you want to
talk about it as well.
Mr. Hysen. Senator, thank you. It certainly is always an
experience when I bring a new engineer or IT professional in
from Silicon Valley and introduce them to how things do work in
the government.
Senator Rosen. The wonders of COBOL.
Mr. Hysen. We are, thankfully, largely free of COBOL at
DHS. I think there is probably a pocket or two there.
Senator Rosen. The lovely Assembler, 16 bit.
Mr. Hysen. Yes. But it certainly is a different experience
than working in the private sector. We are focused on training
across the board. One of the areas that I and my fellow CIOs at
DHS have identified as a priority is standing up a department-
wide IT academy that will include standardized training for all
new IT hires into the Department as well as ongoing development
opportunities for our employees to develop new skills, whether
that be in AI and data science, customer experience, agile
development or the like.
The IT workforce at DHS is a tremendous asset. We have over
5,000 talented and committed professionals. While we are also
looking to bring in more talent from the private sector, we
have opportunities and are focused on enabling our existing
workforce to grow and continue to increase their impact.
Senator Rosen. You may have to work with the private sector
who is still using legacy systems in order to share data or do
some of that, so it is important.
Mr. Armstrong? You laughed at my 16 bits. I appreciate
that.
Mr. Armstrong. I happen to be one of those legacy COBOL
programmers.
Senator Rosen. I have a hexadecimal calculator on my desk
still, so there you go.
Mr. Armstrong. It might have helped put my kids through
college.
At FEMA--and admittedly, I have only been there about 8
months now, so I am still learning a lot about FEMA--we have a
pretty aggressive program in place for retraining some of the
existing staff on things like cloud technology and trying to
get them, I would say, retooled for the newer technologies. But
we are also in the process, unfortunately, because we have lost
so many folks through attrition, of hiring a little over 100
people in IT. We are looking for newer skill sets as we are
bringing people on board.
The challenge is attracting them away from industry, and
you do not come into government jobs for the money, obviously.
You have to really get them wanting to come in and do the
mission and be part of something bigger than themselves. That
is kind of our approach.
Senator Rosen. Thank you. Mr. Oshinnaiye.
Mr. Oshinnaiye. Thank you, Senator Rosen. What we have done
at TSA, in addition to what my colleagues mentioned, is kind of
reducing the fear of getting your hands dirty. Myself and my
deputy are also former developers, so we allow folks to come in
and use a technology. We have noticed that very new and very
tenured staff, if you give them a chance to work with vendors
and come in and just spend the time, they will be open to it
and then use that process.
We actually had a staff member build a system themselves in
the last 30 days that we are actually using internally. Once
you reduce that fear factor and let everyone learn and then
fail forward, we are able to build out what I call the IT IQ.
We even have, in our airports, what we call LIFT cells,
innovation cells, which allow folks in the airports to come up
with ideas and build on platforms. The more you let folks work
and use it, the smarter they become.
Senator Rosen. I like that IT IQ. I am going to use that
one, but thank you.
I am going to move back over to you, Mr. Armstrong, and
talk about FEMA disaster grants, because last month I led
several of my Nevada delegation colleagues in urging the
Administration to grant our Governor's request to declare a
major disaster in Nevada due to severe winter storms that
caused extreme flooding, rockslides, and landslides. I was
pleased to see a disaster later declared, so it allows our
Nevada residents, our local businesses, our Tribal communities
the access to the Federal resources that they need.
But as Nevadans start to access these vital FEMA resources
I want to ensure that your systems are up-to-date and secure so
that my constituents can get what they need to rebuild their
lives, in many cases.
Mr. Armstrong, what is the status of the FEMA Grants
Management modernization, which was started in 2017, and FEMA's
Individual Assistance and technical support modernization,
which is really that interface that began last year?
Mr. Armstrong. Sorry. The IT guy forgot to turn on his
microphone.
With respect to Grants Management modernization, we have
moved over 19 grant types so far. We have another 20 to move,
and those are projected to be moved by April 2024. In addition
to that, the program is in the process of getting a new vendor
on board to start to transition data from the legacy systems
into the new systems, and that is projected to start in the
fall of this year.
The goal would be to get all the grants up and running by
the spring of next year, data migrated over by mid-summer of
next year, and decommissioning to happen sometime in 2025, of
the legacy system.
Then with respect to your second question about Individual
Assistance, that planning is still early on. There is some
initial work that has been done to stand up a cloud environment
instance as part of our bigger FEMA cloud environment. That
work should be completed in the fall. Currently the program is
in the planning/looking-for-funding stage to really get off the
ground.
Senator Rosen. That is our trigger, looking for funding.
But I would urge putting an app as well, because most people,
if they are in a disaster, what do they leave with? Just a
phone. They do not maybe have the other things with them, and
that is an easy way for them.
Mr. Armstrong. Yes. I do not want you to get the impression
that nothing is going on. There is still some work to try to
help modernize some of the legacy processes that are there
today. We recently, led by the Administrator, had a dogfooding
session, where we brought in our executives and put them
through scenarios where they get to the kick the tires on both
Grants Management and Individual Assistance. We also had
scenarios where we different types of survivors or different
types of grant users, and had to interact with the system and
give feedback to the programs. It was a good opportunity to
step outside of your comfort zone and put yourself in the shoes
of someone that actually has to use the system.
Senator Rosen. Thank you. I appreciate that.
I do have one more question, Madam Chair, if there is no
one waiting. Is that OK?
Senator Hassan. Go right ahead.
Senator Rosen. I know that Senator Romney talked about the
vast amounts of data that we have and how do we keep it secure,
and some of the things that are really important to us. I want
to talk about the concept of Federal data centers, because in
2014, OMB launched an initiative to consolidate our Federal
data centers, which has resulted in a cost savings of $5.8
billion. The Department of Homeland Security began its own data
center consolidation efforts long before governmentwide Federal
data consolidation efforts were launched.
DHS, you undertook this project with the objective of
fostering productive collaboration and facilitating improved
data sharing. In March, this Committee, we are very proud to
have marked up the Federal Data Center Enhancement Act,
bipartisan legislation I introduced, that requires OMB to
coordinate a governmentwide effort to develop minimum
requirements for Federal data centers related to cyber
intrusions, data center availability, and resilience against
both physical attacks and natural disasters.
Mr. Walsh, how do you assess the success of the Department
of Homeland Security data center consolidation efforts?
Mr. Walsh. As you noted, data center consolidation has been
a great source of cost savings in the government, and DHS, with
the emphasis that they have placed on enterprise-wide services
has been working toward that. A prior colleague of mine once
said that if you cannot consolidate, if you cannot do it well,
up to snuff, to the metrics that you are talking about, then
maybe it is time for us to get out of the business. I think the
government, in many cases over the past 7 or 8 years, has been
doing exactly that, getting out of the business. I think DHS
has been doing a good job, as you noted, toward the forefront
of the government, to eliminating its data centers.
Senator Rosen. Thank you. Thank you, Madam Chair.
Senator Hassan. Thank you, Senator Rosen.
I have a few more questions, and then we will likely wrap
up unless other Senators come on in.
Mr. Walsh, before I start with a question to you I want to
note, for Mr. Hysen and all of the DHS folks here, Senator
Lankford talked about the lack of cell service, for instance,
on the Southern Border and the challenges that creates. It is
also creating a huge challenge, as you know, on the Northern
Border. I want to raise that and make sure that we are focused
on trying to make sure that wherever our personnel are they
have the connectivity that they need to keep us safe. I hope
you will take that emphasis back with you.
Now to Mr. Walsh, Federal IT modernization projects take
many years and considerable resources to plan and execute. We
have been talking about that. They often face significant
barriers too. For example, since 2015, DHS has been working to
update its aging system that in order to assist Federal law
enforcement in identifying threats integrates biometric data
from across government, and I believe you commented on that in
your testimony. However, this project has run into several
challenges, causing Congress to request an independent
evaluation of the project.
Mr. Walsh, you mentioned that GAO has done some monitoring
of DHS's progress on this particular progress. What challenges
have you identified that are preventing DHS from completing
this project?
Mr. Walsh. First, we are currently doing work on the
Homeland Advanced Recognition Technology (HART) program, on
your behalf. We are happy to chat with you at any point on the
status of that work.
Our prior issued work identified a series of issues related
to the HART program, and we made a total of seven
recommendations. Three of those recommendations remain open.
They are related to reviewing contract deliverables from
contractors before accepting them, tracking and monitoring
costs, defining and monitoring stakeholder involvement. Those
are the three remaining recommendations--making sure that you
involve your stakeholders, track your costs, and do not carte
blanche accept what the contractor gives you and tells you.
However, as we have been talking, HART is one of these
``big bang'' approaches. It is not one of these new, smaller,
fail fast, get a product out the door quick. That is a problem.
I think DHS has identified their 2020 breach of this program
due to overly complex and potentially high-risk design as well
as disagreements with the contractors.
Senator Hassan. Thank you.
This is a question for the three DHS representatives here.
In 2020 and 2022, I wrote to DHS requesting a department-wide
IT modernization plan. The Department still has not provided
one. IT modernization plans play an important role in an
agency's ability to make progress on their IT goals, control
costs, and provide transparency.
As much as I appreciate the progress you all have reported
about today I am still concerned that without an agency-wide IT
modernization plan DHS will continue to struggle to prioritize
updating its most critical systems.
Mr. Hysen, without a department-wide IT modernization plan,
how do you ensure that the agency is meeting its goals,
especially in regard to mission-critical systems?
Mr. Hysen. Thank you. First, we are currently finalizing
our updated IT strategic plan for the Department. Our current
plan expires at the end of this fiscal year, and we will be
releasing the new one prior to its expiration that will
identify our overall modernization priorities.
But ultimately, in government, the truest sign of your
priorities is where you align your budget. I have been focused,
along with our acting Chief Financial Officer (CFO), on
strengthening the IT oversight of our budget request. Over the
last 3 years, we have progressively increased IT involvement in
the annual budgeting process, under the spirit of FITARA, such
that now, as we are preparing our 2025 budget request, every IT
investment proposal by any part of the Department is evaluated
against the IT modernization priorities that I have set out for
the Department, and then we are ensuring that my component CIOs
and then ultimately I have full review and approval over the IT
budget request.
Ultimately I believe that our budget request becomes the
modernization plan, as that is where we intend to align our
resources.
Senator Hassan. OK. Thank you. We will follow up with you
on that.
Mr. Oshinnaiye and Mr. Armstrong, how would a department-
wide modernization strategy help inform TSA's or FEMA's
modernization efforts? Mr. Oshinnaiye.
Mr. Oshinnaiye. Thank you, Chair. As CIO Hysen mentioned,
we actually follow in tandem with the Department on some of the
components. We are also building out our strategic plan as well
and working to align with the Department. Some of the things
that we have adopted, in addition to technology advancement, is
technology context, making sure that when we put new technology
out it actually aligns to the mission. As a part of saving
money on the mission is making sure we put the right technology
out so people can use it, and we are not iteratively trying to
change technology because it does not adapt to what the user
needs.
We use that, and we work with the Department on all of our
upgrades and our processes so that we are in alignment, not
only to the Department but with other components. Then when we
find an opportunity to share technology, we do that so we can
consolidate what we are using.
Senator Hassan. What I am hearing you say is a department-
wide modernization plan will help you all align and be more
efficient, more effective, get the technology you need. I am
trying to understand what the benefits are.
Mr. Oshinnaiye. Absolutely. When we are in alignment it
will help us be more effective and optimal.
Senator Hassan. OK. Mr. Armstrong.
Mr. Armstrong. Thank you, Madam Chair. Traditionally, the
components have been a key part of helping develop the
departmental strategic plan, so I would anticipate we would be
all providing input into that plan, as we all have different
mission needs, different technology baselines, and so that
would get incorporated into the plan.
Certainly, FEMA would benefit from having an overarching
plan. We have a strategy from 2022, which will probably need to
be updated in the next year, after the DHS plan is developed.
But certainly it helps, one, communicate to the non-IT
leadership across the Department where are we headed, and two,
it is critical, as we pointed out, about identifying mission-
critical systems. It also helps identify mission-critical
strategies about those systems so that throughout that budget
formulation process we have a strategy to point back to, to say
that this initiative is supported by this overarching strategy
to help justify where we are headed, from a funding standpoint.
Senator Hassan. Thank you.
Mr. Hysen, another question. Having adequate financial
resources is obviously a key component of any IT modernization
project, and in turn, smart investments in modernizing legacy
IT can save taxpayer dollars. It is important that agencies
have flexibility for multiyear IT modernization projects to
help them navigate unpredictable appropriation cycles and to
keep projects running on time and on budget.
An example of this flexibility is having an IT working
capital fund. DHS maintains what it calls a ``non-recurring
expenses fund.'' Can you describe the similarities and
differences between that fund and a traditional IT working
capital fund?
Mr. Hysen. Thank you, Chair. Yes. Since Congress passed the
Modernizing Government Technology Act, DHS had been requesting
budgetary authority to establish an IT working capital fund. In
the fiscal year 2022 budget, we were granted the authority to
create this nonrecurring expenditures fund (NEF), that takes
expired funds and allows us to spend those both on IT
modernization projects but also on modernizing our facilities,
which has been a critical priority for Secretary Mayorkas, to
improve the experience of our employees.
We have stood that fund up. The funds there will be split
50/50 across IT and facilities. The initial investments there
are on some facilities improvement projects, and we are
preparing now to begin considering the first round of IT
projects. We believe it does meet the intent of an IT working
capital fund, even though it is technically a little different.
Senator Hassan. It is still taking some of those resources
and using them for non-IT purposes.
Mr. Hysen. My understanding from the budget discussions,
when it was being enacted, were that when we expanded the scope
of the fund to facilities, we also increased the total portion
of expired funds that were being transferred. Ultimately our
CFO, our chief readiness support officer, and I viewed the
proposal as a win-win for the Department.
Senator Hassan. OK. But you still do not have an IT working
capital fund that is devoted over years to improving the IT and
modernizing IT.
Mr. Hysen. Technically, no, but we believe that the NEF
will grow considerably as funds expire, year over year, and
with the intended 50/50 split with IT funding there, that that
will be a long-term source of much-needed IT modernization
funding for us.
Senator Hassan. All right. Thank you.
Now to Mr. Hysen, Mr. Oshinnaiye, and Mr. Armstrong, you
are all CIOs. Agency chief information officers play an
important role in advocating for the IT needs of the agency. As
we discussed today, you and your peers work to ensure that DHS
has the technology it needs. That is obviously critical so that
the agency can fulfill its mission to keep the American people
safe.
Mr. Hysen, are there additional authorities that would help
you do your job more effectively?
Mr. Hysen. Chair, I believe that FITARA gave us, as CIOs,
sufficient authority to effectively oversee our IT at our
departments. My focus is on strengthening our internal
processes to best leverage those authorities, to ensure that I
am able to carry out those responsibilities fully.
Senator Hassan. OK. Mr. Armstrong and Mr. Oshinnaiye, as
the CIOs of agencies within DHS, what resources or guidance
could Mr. Hysen's office provide to support your work and meet
the unique needs of FEMA and TSA? We will start with you, Mr.
Armstrong.
Mr. Armstrong. I have to also agree with Mr. Hysen. Having
been at the Department for quite some time, I will tell you
FITARA has really made a significant difference in the
authorities that the CIO has. To give you an example, I come
from a community where I had a lot of centralized IT under me,
to an environment where IT is more spread out across the agency
and more federated. However, I have a lot of checks and
balances in place, and processes, so that I get to influence
decisionmaking across the agency with respect to the planning
of IT, the budgeting of IT, the execution piece of IT. A lot of
that is through the chief acquisition executive doing regular
reviews and providing oversight. But I am certainly at the
table to help move that needle one way or another, where it
needs to go.
I feel we have the authorities at this point in time. It is
a matter of maturing them and executing them.
Senator Hassan. Thank you. Mr. Oshinnaiye.
Mr. Oshinnaiye. I will add, I will say FITARA has helped
support my job and my role in my agency. I will say that at a
Department level, CIO Hysen and staff, working with other
counterparts across DHS headquarters, gives a credibility to
the component to be able to have the authority to sit at a
table with counterparts like the CFO or the component
acquisition executive. When we want to make a change or make a
mandate, if we have to, for the agency, they look to the
Department, and when they see the collaboration they echo that
at the component level. That has been very helpful.
Senator Hassan. Thank you. Before we close I have asked a
series of questions to the three CIOs at DHS, but Mr. Walsh,
anything that you want to add or weigh in on here?
Mr. Walsh. Thank you. I would like to chime in on that last
bit about CIO authorities. We took a look in GAO-22-104603 at
the authorities that private sector CIOs had and compared those
to our Federal CIOs, and found that, for the most part, private
sector CIOs and Federal CIOs had similar authorities.
However, we did make a pair of recommendations, one of
which was to OMB to enhance the coordination not between CIOs
but between the other C-suite executives, so making sure that
the C-suite plays nice together. I do think that is relevant
here. The CIOs perhaps have the authority. Now getting the C-
suite all on the same page is the next challenge.
Senator Hassan. I appreciate that very much because that
has been my experience too. Even when the authorities may be in
place, making sure that everybody is actually recognizing that
they exist, and including your voices in the planning and
budgeting process and prioritizing work in the agency is really
important.
I will also just note that if there are authorities that
you realize you need and do not have, or ambiguity about your
authority creates barriers, we need to know about that because
that is obviously something we can work with you to address.
But if you all do not speak up and let us know, we cannot help
you with that.
I want to thank all of you--Mr. Hysen, Mr. Oshinnaiye, and
Mr. Armstrong--for your testimony today, and to the three of
you for the important work that you do for the Department of
Homeland Security. The first job of government is to keep
people safe, and I am very grateful that you are working to do
that, along with your colleagues each and every day. Thank you,
Mr. Walsh, to you and your colleagues at the Government
Accountability Office, for providing accountability and
guidance to make DHS's work more successful.
The hearing record will remain open for 15 days, until 5
p.m. on June 15th, for submissions of statements and questions
for the record, and this hearing is now adjourned.
[Whereupon, at 11:26 a.m., the hearing was adjourned.]
A P P E N D I X
----------
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
[all]