USDA Telecommunications: More Effort Needed to Address Telephone Abuse
and Fraud (Letter Report, 04/16/96, GAO/AIMD-96-59).
Because of a lack of adequate controls over telephone use, the
Agriculture Department (USDA), which spends about $50 million annually
on commercial telecommunications services, is putting itself at risk for
fraud and abuse. GAO reviewed bills for all collect calls over a
four-month period at USDA offices in the Washington, D.C., area and
found that USDA had accepted more than 600 inappropriate collect
calls--about half of all collect calls accepted and paid for by the
agency during this time--from prisoners. USDA has been aware of
collect-calling abuse since 1994 but has not taken adequate steps to
stop it. USDA does not generally review telephone bills. As a result,
the agency cannot be certain whether international long-distance calls
originating from its Washington, D.C., offices--which total tens of
thousands of dollars each month--are authorized. GAO found several
instances in which persons had placed unauthorized calls to sex and
party lines abroad. Moreover, because of weaknesses in a USDA
contractor's voice mail equipment, hackers were able to break into
USDA's telephone system and make $40,000 to $50,000 worth of
international long-distance calls. USDA eventually paid the bill, even
though the contractor admitted responsibility. USDA has tried to correct
some of its telecommunications management weaknesses, including
automating its current paper-based billing system so that telephone
bills can be verified cost effectively. However, USDA has yet to respond
in writing to GAO's recommendations on resolving these problems.
--------------------------- Indexing Terms -----------------------------
REPORTNUM: AIMD-96-59
TITLE: USDA Telecommunications: More Effort Needed to Address
Telephone Abuse and Fraud
DATE: 04/16/96
SUBJECT: Telecommunication equipment
Cost control
Internal controls
Credit sales
Fraud
Federal employees
Program abuses
Correctional facilities
Telephone
IDENTIFIER: Federal Telecommunications System 2000
FTS 2000
District of Columbia
FTS 2000 Federal Calling Cards
******************************************************************
** This file contains an ASCII representation of the text of a **
** GAO report. Delineations within the text indicating chapter **
** titles, headings, and bullets are preserved. Major **
** divisions and subdivisions of the text, such as Chapters, **
** Sections, and Appendixes, are identified by double and **
** single lines. The numbers on the right end of these lines **
** indicate the position of each of the subsections in the **
** document outline. These numbers do NOT correspond with the **
** page numbers of the printed product. **
** **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced. Tables are included, but **
** may not resemble those in the printed version. **
** **
** Please see the PDF (Portable Document Format) file, when **
** available, for a complete electronic file of the printed **
** document's contents. **
** **
** A printed copy of this report may be obtained from the GAO **
** Document Distribution Center. For further details, please **
** send an e-mail message to: **
** **
** **
** **
** with the message 'info' in the body. **
******************************************************************
Cover
================================================================ COVER
Report to Congressional Requesters
April 1996
USDA TELECOMMUNICATIONS - MORE
EFFORT NEEDED TO ADDRESS TELEPHONE
ABUSE AND FRAUD
GAO/AIMD-96-59
USDA Telecommunications
(511410)
Abbreviations
=============================================================== ABBREV
CFO - Chief Financial Officer
DEA - Drug Enforcement Administration
FIRMR - Federal Information Resources Management Regulation
FMFIA - Federal Managers' Financial Integrity Act
FTS - Federal Telecommunications Service
NFC - National Finance Center
OIG - Office of Inspector General
OIRM - Office of Information Resources Management
TAI - Telecommunications Advisors, Incorporated
USDA - Department of Agriculture
Letter
=============================================================== LETTER
B-271347
April 16, 1996
The Honorable Richard G. Lugar
Chairman, Committee on Agriculture,
Nutrition and Forestry
United States Senate
The Honorable Carolyn B. Maloney
Ranking Minority Member
Subcommittee on Government Management,
Information and Technology
Committee on Government Reform and Oversight
House of Representatives
On September 22, 1995, we reported to you that the Department of
Agriculture (USDA) does not cost-effectively manage and plan its
telecommunications resources.\1 Specifically, we found that USDA
agencies waste millions of dollars each year paying for (1)
unnecessary telecommunications services, (2) leased equipment that is
not used and services billed for but never provided, and (3)
commercial carrier services that cost more than three times what they
would under the FTS (Federal Telecommunications System) 2000 program.
In large part, these problems existed because USDA had not
established effective management controls over the acquisition and
use of telecommunications resources, and we recommended necessary
improvements to correct USDA's telecommunications management and
planning weaknesses.
Following this report, we conducted additional work as part of your
request to determine whether USDA ensures that the commercial
telephone and long-distance services it pays for are used in
accordance with federal regulations and departmental policy. This
report discusses problems we identified involving fraud and abuse of
the Department's telephone resources and provides an update on USDA's
efforts to address recommendations from our past report.
--------------------
\1 USDA Telecommunications: Better Management and Network Planning
Could Save Millions (GAO/AIMD-95-203, Sept. 22, 1995).
RESULTS IN BRIEF
------------------------------------------------------------ Letter :1
USDA does not have adequate controls for ensuring that its telephones
are used properly. As a result, the Department, which spends about
$50 million each year on commercial telecommunications services, is
putting itself at risk to telephone abuse and fraud. We reviewed
bills for all collect calls over a 4-month period for USDA agencies
and offices in the Washington, D.C., metropolitan area and found that
they accepted over 600 inappropriate collect calls--about 50 percent
of all collect calls accepted and paid for by USDA during this
time--from individuals at 18 correctional institutions. Although
these collect calls cost USDA only about $2,600, thousands more may
have been lost because individuals at USDA who accepted the collect
calls may have transferred the callers to other USDA long-distance
lines. USDA has been aware of cases of collect calling abuse since
1994, but has not taken adequate action to stop it.
USDA agencies and offices in the Washington, D.C., metropolitan area
also pay tens of thousands of dollars each month for long-distance
calls to locations all over the world without knowing whether these
calls are authorized because telephone bills are generally not
reviewed. We reviewed bills for a few of these calls and found
several cases where individuals placed unauthorized calls to adult
entertainment lines, such as sex and party lines in other countries.
We also found that USDA is vulnerable to other fraud and abuse
because it does not track and monitor employees' use of telephone
company credit cards. Moreover, there has been at least one instance
where hackers broke into USDA's telephone system because of
vulnerabilities in a USDA contractor's voice mail equipment and,
according to USDA records, made an estimated $40,000 to $50,000 in
international long-distance calls. USDA did not seek reimbursement
for the cost of the fraudulent calls it paid for, even though the
contractor acknowledged that it was responsible for the
vulnerabilities in the voice mail equipment.
USDA does not know how widespread telephone abuse and fraud is at the
Department. Until it determines the extent of these problems, USDA
is not in a position to develop an appropriate plan with
cost-effective controls to mitigate the risk of telephone abuse and
fraud or take necessary action to cost-effectively address abuses
that have occurred.
USDA has begun to take positive steps to correct some of the
telecommunications management weaknesses we identified in past
reports, such as planning an effort to reengineer and automate its
current paper-based billing system so that telephone billing data can
be cost-effectively verified. However, the Department has not yet
responded to our September 1995 report with a written statement in
accordance with 31 U.S.C. 720 on actions taken to implement our
recommendations to resolve these problems.
BACKGROUND
------------------------------------------------------------ Letter :2
"Every telecommunication user suffers from telabuse. The only
question is how much
each loses each month."\2
"There are two kinds of customers: those who have been
victims of toll fraud, and
those who will be."\3
The abuse and theft of telecommunications services is one of the
fastest growing crimes in the United States.\4 According to
Telecommunications Advisors, Incorporated (TAI), a consulting firm
that has done extensive research on telephone fraud and abuse
problems, these crimes cost industry and government an estimated $9
billion each year.\5 Telephone abuse or "telabuse" is the misuse or
waste of telephone resources by employees from within an organization
or by their relatives or acquaintances. This typically involves
personal long-distance calls made by employees at an organization's
expense. Toll fraud is the theft of an organization's long-distance
services by individuals from the outside. This can involve fraud
committed by experienced telephone hackers who are able to penetrate
an organization's voice message systems and private networks. It
also involves the fraudulent use of telephone company calling cards
and cellular telephones by hackers or others who steal calling card
numbers and cellular telephone services.
A security manager for one major telephone company attributed a large
part of the ever-increasing levels of toll fraud and telabuse to user
neglect and inattention. According to the security manager, the
attention and consideration industry and government organizations
give to telephone equipment and services often stop after the initial
purchase, leaving them more vulnerable to the risk of telephone abuse
and fraud. Furthermore, it is commonplace, in industry and
government, that bills for telecommunications services are often not
reviewed to ensure that charges incurred are appropriate and
justified. For most organizations, controls over telephone services,
as expected, are secondary to many of the more pressing daily
business functions. According to TAI, organizations often treat
their telephone bills like other bills, such as rent and electric,
and simply pay them without examination.
Cases reported by TAI have also shown that failure to establish
adequate controls over the use of telecommunications resources can
have costly consequences. For example, one toll fraud incident at
the Drug Enforcement Administration (DEA) reportedly cost the
government over $2 million because DEA, which did not monitor
telephone activity and review billing records, did not detect
fraudulent calls by telephone hackers for 18 months. In another
case, not adequately monitoring telephone calling activity at New
York City's Human Resources Administration offices cost the city over
$200,000 for thousands of employee calls to party lines and other
personal services over several years. These problems are not
confined to government. For example, a private company in Texas was
billed $25,000 in 1 month for improper calls and, by instituting
minor controls over employee use of telephones, a major utility
company in the southeast was able to reduce its telephone bill by
over $60,000 per year.
USDA and its 29 component agencies spend over $100 million on
telecommunications annually, including more than $50 million for
commercial telecommunications services obtained from over 1,500
telephone companies. These companies provide local telephone service
as well as international and domestic long-distance services that are
not available on the FTS 2000 network.\6
USDA headquarters offices and other USDA agency and staff offices
within the Washington, D.C., metropolitan area pay for over 24,000
separate telephone lines each month.
The Federal Information Resources Management Regulation governs use
of telecommunications services for all government agencies and states
that telephone calls paid for by the government shall be used to
conduct official business only.\7 Unauthorized calls, which are calls
that are not necessary in the interest of the government, are
prohibited, and agencies are required to collect for any unauthorized
calls if it is cost-effective to do so. USDA's telecommunications
policy (DR-3300-1) requires that USDA agencies ensure that
government-provided telephones are used only for official business
and for calls the agency considers necessary. Under DR-3300-1, the
Office of Information Resources Management (OIRM) is responsible for
establishing policy and procedures for the management and cost
control of telecommunication systems and each component agency and
staff office is responsible for ensuring compliance with departmental
policy and that government telephones are used for authorized
purposes only in accordance with this policy. USDA's Chief Financial
Officer (CFO) is responsible for overseeing all financial management
activities relating to the programs and operations of the Department,
including managing USDA's National Finance Center (NFC).
--------------------
\2 Toll Fraud and Telabuse: A Multibillion Dollar National Problem,
Volume I, Telecommunications Advisors, Incorporated, Feb. 1992.
\3 MCI, 1991 as quoted in Toll Fraud and Telabuse: A Multibillion
Dollar National Problem, Volume I, Feb. 1992.
\4 Review of the Internal Revenue Service's Controls Over Voice
Telecommunications Charges, Internal Revenue Service Internal Audit,
Office of Regional Inspector, Sept. 1, 1993.
\5 Toll Fraud and Telabuse: A Multibillion Dollar National Problem,
Volume I, Feb.1992.
\6 USDA is required to use FTS 2000 network services for basic
long-distance communications.
\7 41 CFR Ch. 201-21.6 - Use of Government Telephone Systems (1995).
See also 31 U.S.C. Sec. 1348 (b).
SCOPE AND METHODOLOGY
------------------------------------------------------------ Letter :3
To assess USDA's controls over telephone use, we examined USDA's
policies and procedures governing the use of government telephones.
We also obtained and reviewed commercial telephone billing records
for USDA agency offices in the Washington, D.C., metropolitan area
for 4 months in fiscal year 1995, which totaled about $580,000 or 1
percent of the $50 million USDA spends annually for commercial
telecommunications costs. The 4 months were selected from early,
mid, and late parts of the fiscal year to adjust for any seasonal
variations in calling patterns, and we reviewed billing records of
all collect calls accepted by the Department during the 4 months as
well as selected long-distance calls made during the month of August
1995.\8 In cases where billing records disclosed instances of
telephone abuse, we discussed these cases with USDA officials and
telephone company representatives and provided billing records of the
calls to USDA officials for appropriate action. We also discussed
cases involving collect calls from prisons with correctional facility
personnel and USDA officials. In addition, we reviewed telephone
company records and USDA documentation pertaining to a March 1995
hacker case at the Department and examined USDA actions taken in
response to this attack. Appendix I provides further details on our
scope and methodology.
We conducted our review from October 1995 through February 1996 in
accordance with generally accepted government auditing standards. We
discussed the facts in our report with USDA officials, including the
Assistant Secretary and the Deputy Assistant Secretary for
Administration, the acting Chief Financial Officer, the Director of
USDA's Office of Information Resources Management, and the Assistant
Inspector General for Investigations and have incorporated their
comments where appropriate. We also provided a draft of the report
to USDA for comment. USDA's comments are discussed in the report and
are included in full in appendix II.
--------------------
\8 We were unable to review all of USDA's telephone bills for the
periods covered by our review because, as discussed in appendix I,
the Department did not provide all the bills to us by the end of our
audit work in February 1996.
HUNDREDS OF CASES OF TELEPHONE
ABUSE FOUND AT USDA
------------------------------------------------------------ Letter :4
Our review of four monthly telephone bills for USDA agencies and
offices in the Washington, D.C., metropolitan area found that 652
collect calls, or about 50 percent of all collect calls accepted and
paid for by USDA during this 4-month period, were from individuals at
18 correctional institutions. In these cases, USDA paid about $2,600
for collect calls accepted from correctional centers in addition to
unknown charges for subsequent calls placed by USDA on behalf of
individuals at these centers. Because these subsequent calls cannot
be easily differentiated from other calls on telephone bills, it is
difficult to determine the extent to which this occurred and the
total charges that resulted from all collect calls. Additionally,
our review of just a few calls from the thousands of long-distance
calls made by USDA agencies and offices in the Washington, D.C.,
metropolitan area each month found several other cases of telephone
abuse involving personal long-distance calls outside the country to
adult entertainment services and companies advertising jobs.
USDA has been aware of cases of collect calling abuse since at least
1994, but has not taken adequate action to stop it. Although USDA
policy does not specifically address collect calls placed from a
nongovernment number to a government number,\9 it states that USDA
should ensure that government telephones are used only for authorized
purposes. However, as discussed later in this report, USDA generally
does not review its telephone bills to make such determinations.
--------------------
\9 An October 1995 draft of USDA's revised policy due out in March
1996 states that collect calls may be accepted if the call is for
official business or at the discretion of the supervisor.
USDA ACCEPTS AND PAYS FOR
COLLECT CALLS FROM
INDIVIDUALS AT CORRECTIONAL
CENTERS
---------------------------------------------------------- Letter :4.1
Individuals in at least 20 different USDA agencies or offices in the
Washington, D.C., metropolitan area have accepted, at USDA's expense,
collect calls from individuals at federal, state, and county
correctional institutions. This problem is exacerbated because
individuals who accept these collect calls can use USDA telephones to
place long-distance calls for the callers and transfer them to these
calls. However, it is difficult to determine to what extent this has
occurred or the total cost involved because charges for these
additional calls cannot be easily identified. According to telephone
company representatives, charges for these long-distance calls may
appear on any one of many separate carriers' bills and, because the
termination point of the call is unknown, it is difficult to identify
these calls on bills. As discussed later, cases of telephone abuse
in 1994 investigated by the Office of the Inspector General (OIG)
found that collect calls from inmates at correctional centers were
transferred to other calls.
Table 1 shows the number of collect calls made from correctional
centers to USDA agencies and offices located in the Washington, D.C.,
metropolitan area. However, this may not represent all the collect
calls made to USDA from correctional centers during this 4-month
period because USDA could not provide us with complete billing
records for these periods.
Table 1
Number of Collect Calls From
Correctional Institutions Found
Decemb
er March July August Total
Correctional facility location 1994 1995 1995 1995 s
-------------------------------- ------ ------ ----- ------ =====
Alexandria, VA 6 34 40
Baltimore, MD 1 1
Bowling Green, VA 66 1 67
Culpeper, VA 1 25 24 50
Elkridge, MD 2 10 12
Fairfax, VA 46 2 48
Fort Dix, NJ 4 4
Fredericksburg, VA 12 49 61
Hagerstown, MD 3 1 4
Leonardtown, MD 9 2 11
Lewisburg, PA 6 2 8
Lorton, VA 51 36 106 28 221
Montgomery, PA 15 15
Prince Frederick, MD 3 3
Princess Anne, MD 2 1 3
Upper Marlboro, MD 33 9 18 8 68
Waldorf, MD 3 3
Waterloo, MD 29 1 3 33
======================================================================
Total Calls 255 139 149 109 652\a
======================================================================
Total Charged $ $ 610 $ 305 $ 327 $
1,366 2,608
----------------------------------------------------------------------
\a The 652 collect calls from prisons represent almost 50 percent of
the total 1,372 collect calls we found in the 4 months' bills we
reviewed. We did not attempt to determine whether or not the
remaining 720 collect calls were authorized.
At the correctional facility in Upper Marlboro, Maryland, the
facility operations manager told us that he was not surprised about
the number of collect calls we found. His facility has over 1,200
inmates, most of whom have access to telephones. According to this
official, a typical case is described as follows:
An inmate uses a telephone in a correctional facility to place
a collect call to a
government agency or private company office telephone number.
Upon answering the
telephone, an individual at that agency or office hears a
recorded message giving
the inmate's name and the name of the correctional facility.
The individual is
then asked whether he/she will accept the charge for the
collect call. An
individual, who is cooperating with the inmate, will accept
the unauthorized call.
In many cases, after accepting the call, the cooperating
individual will in turn
make other long-distance calls for the inmate, which are also
charged to the agency
or office.
The facility operations manager stated that he is often contacted by
individuals, government agencies, and private companies, who detect
abuse on their telephones and arrange to have certain telephone
numbers blocked.\10 Blocking the numbers prevents inmates from
placing calls to these telephones. The operations manager added
that, with large organizations such as USDA, this may not be a viable
solution to the problem because there are often many different agency
telephones involved. Although the operations manager told us he has
never been contacted by USDA about any inmate collect calls, he
stated that at least four other federal agencies over the past 6
years have contacted him about this problem. According to the
operations manager, agencies have had success stopping some abuse by
blocking agency telephone numbers and taking punitive action against
employees responsible for this abuse.
While we were able to identify the cost of the collect calls (as
shown in the table), charges for calls that are transferred were not
identified. However, because many of these collect calls could have
been transferred to long-distance lines, thousands more could have
been added to USDA's telephone bills.
--------------------
\10 A representative from the company which provides telephone
service at the correctional facility in Upper Marlboro, Maryland, and
at over 600 other correctional facilities throughout the country
stated that inmates attempt to make about 1.8 million collect calls
in these facilities each month.
COLLECT CALLING ABUSE
IDENTIFIED BY USDA IN 1994,
BUT INADEQUATE ACTION TAKEN
TO STOP IT
---------------------------------------------------------- Letter :4.2
In the past, USDA identified abuses involving collect calls from
inmates similar to the cases we found. However, the Department did
not take adequate action to stop the problem. According to USDA
documentation, in August 1994, an OIRM telecommunications specialist
uncovered cases of telabuse at the Department dating back to 1993,
which involved collect calls from inmates at the Federal Corrections
Center in Lorton, Virginia. This individual found these cases while
examining monthly telephone charges on commercial carrier telephone
bills. He told us he had made a special request for the billing
records to review telephone charges for a contractor working on-site
at USDA headquarters offices. Generally, as we discuss later in this
report, USDA officials do not review commercial carrier telephone
bills.
OIRM referred the matter to the Department's OIG in August 1994. The
OIG conducted a preliminary inquiry and determined from billing
records prior to December 1994 that employees working in several USDA
agency offices in the Washington, D.C., metropolitan area were
improperly accepting collect calls placed from six correctional
institutions. These institutions are located in Lorton and Oakwood,
Virginia; Waldorf and La Plata, Maryland; and New Bern and Bayboro,
North Carolina. The OIG also found that, after accepting collect
calls from inmates, USDA employees made other unauthorized
long-distance calls for the inmates and transferred the inmates to
those calls. Costs for these calls were also charged to the
Department. According to the OIG, it determined that individuals in
multiple USDA agencies and offices had accepted more than $4,500 in
collect calls from inmates. In one case, the OIG identified a
contractor employee who had been accepting collect calls from a
correctional facility while working in the OIG's Washington, D.C.,
office. This individual, who had left USDA at the time of the
inquiry, reimbursed the Department $177 for these unauthorized
collect calls.
The OIG referred all the remaining open cases to OIRM for action.
Specifically, in a May 1995 letter to the Director of the OIRM's
Washington Service Center, the Deputy Assistant Inspector General for
Investigations turned these cases over to OIRM for "handling and
further distribution, as this type of misconduct matter is
appropriately handled by the personnel investigators within each of
the affected agencies." However, the Director could not explain why
no further action on these specific cases was taken.
The OIG also tried to have some of the collect calls it identified
from Lorton blocked, but USDA records indicate that collect calls
continued because the carrier did not keep these blocks in place. As
a result, the carrier agreed to reimburse USDA for collect calls from
Lorton identified during the period investigated by the OIG. USDA
received credit for some collect calls from Lorton. However, at the
time of our review, USDA had not followed up to determine whether the
Department received reimbursement for all the collect calls from
Lorton because no one had reviewed the bills to match records of the
calls with the credits being given.
Moreover, OIRM took no action to determine whether there were other
collect calling abuses at the Department. Consequently, as shown by
our review, collect calls from correctional centers to the Department
have persisted. In fact, our review found at least seven cases where
the same office telephones identified by the OIG in 1994 were still
being used to accept collect calls.
OTHER TYPES OF TELEPHONE
ABUSE
---------------------------------------------------------- Letter :4.3
In reviewing USDA's Washington, D.C., telephone bills, we noted that
agencies and offices spend over $30,000 per month for long-distance
calls. We selected a few records from August 1995 bills for detailed
examination of long-distance calls and identified several cases where
unauthorized calls were made to the Dominican Republic. Some of
these calls involved connections to adult entertainment lines, such
as sex and party lines, and to companies advertising jobs. In one
case, for example, USDA paid over $33 for four calls made from one
office to a party line "chat" service in the Dominican Republic. In
another case, the Department also paid for international calls made
from several agency offices to job advertisement lines where
home-based business and other employment opportunities are discussed.
In addition, we found one case where a sex entertainment line in the
Dominican Republic was called at USDA's expense.
COLLECT CALLING AND OTHER
ABUSES GO UNDETECTED BECAUSE
TELEPHONE BILLS ARE NOT
REVIEWED
---------------------------------------------------------- Letter :4.4
In large part, these problems exist at USDA because bills for the
tens of millions of dollars in commercial telephone services paid
annually by USDA are generally not reviewed to monitor calling
activity. USDA pays over 23,000 bills each month for commercial
telephone services obtained from over 1,500 private vendors across
the country. This includes the bills from telephone companies that
provide commercial telephone and long-distance services to USDA
offices in the Washington, D.C., metropolitan area. Vendors send
these bills directly to USDA's NFC in New Orleans, Louisiana, where
they are processed and paid.
USDA policy requires agencies and staff offices to ensure that
government telephones are used for authorized purposes only.
Specifically, the policy states that the use of government telephones
shall be limited to the conduct of official business and other
authorized uses, which can also include such things as making a brief
daily telephone call to a spouse and children within a local
commuting area. However, as we recently reported,\11 agency managers
rarely review telephone bills. Consequently, agency managers lack
the information they need to determine whether telephones and
long-distance services are used properly in accordance with
departmental policy.
In our prior reports, we also found that USDA wasted tens of
thousands of dollars because it had not established adequate
procedures for reviewing bills to verify the appropriateness of
telephone charges by private vendors.\12 To help ensure that controls
are appropriate and cost-effective, agencies need to consider the
extent and cost of controls relative to the importance and risk
associated with a given program. Because USDA rarely reviews its
telephone bills, we reported in September 1995 that the Department
had paid tens of thousands of dollars each year to lease telephone
equipment, such as rotary telephones and outdated modems that were
either no longer used or could not be located. In addition, USDA
wasted thousands more paying for telephone services for field offices
that had been closed more than a year.
USDA has begun to take positive steps in response to our previous
reports to improve controls over payments for commercial telephone
services. Specifically, USDA stopped payments for leased
telecommunications equipment it no longer uses and is seeking
reimbursement from carriers for overcharges. In addition, in October
1995, USDA formed a task force to investigate and develop action
plans to correct telecommunications management deficiencies at the
Department. In December 1995, the task force agreed with GAO's
findings and reported that "the process of planning, acquiring,
ordering, billing, invoicing, inventory control, payments, and
management of telecommunications services and equipment is chaotic at
best and totally out of control at the very least." Therefore, the
task force recommended that USDA's current paper-based billing system
be reengineered and subsequently automated so that billing data can
be cost-effectively verified. On March 1, 1996, USDA's acting Chief
Financial Officer told us that the Department agreed to implement the
task force's recommendations which the Department estimates will take
about 2 years to complete.
While this action is encouraging, USDA has not specifically responded
to our September 22, 1995, report recommending, among other things,
that the Secretary of Agriculture report the Department's management
of telecommunications as a material internal control weakness under
the Federal Managers' Financial Integrity Act (FMFIA) and that this
weakness remain outstanding until USDA fully complies with federal
regulations for managing telecommunications and institutes effective
management controls. USDA's fiscal year 1995 FMFIA report did not
identify the Department's management of telecommunications as a
material internal control weakness, and on March 1, 1996, USDA's
acting Chief Financial Officer and Assistant Secretary for
Administration told us that the Department had not determined whether
to report telecommunications management as an material internal
control weakness for fiscal year 1996.
Since USDA has not yet established adequate and cost-effective
controls for ensuring that its telephones are used properly, it is
putting itself at continuing risk of telephone abuse and fraud.
Moreover, because USDA does not know how widespread telephone abuse
is at the Department or the total cost, it is not in a position to
develop a plan defining cost-effective controls to mitigate the risk
of telephone abuse and fraud or take appropriate action to address
abuses that have occurred.
--------------------
\11 (GAO/AIMD-95-203, Sept. 22, 1995).
\12 (GAO/AIMD-95-219R, Sept. 5, 1995) and (GAO/AIMD-95-203, Sept.
22, 1995).
RISK OF OTHER TYPES OF
TELEPHONE FRAUD, WASTE, AND
ABUSE IS SIGNIFICANT
------------------------------------------------------------ Letter :5
We also found indications that USDA is vulnerable to other types of
telephone fraud, waste, and abuse because bills are not reviewed.
Billing records show that USDA agencies and offices in the
Washington, D.C., metropolitan area pay tens of thousands of dollars
each month for international calls. However, because these bills are
generally not reviewed, USDA does not know whether these calls are
authorized and it cannot detect instances where telephone fraud and
abuse may have occurred.
USDA is at risk of further waste and abuse by employees who use
telephone company credit cards, instead of FTS 2000 Federal Calling
Cards, to charge thousands of dollars in long-distance calls each
month which are paid by USDA. These cards, which have been issued to
USDA offices by commercial carriers, are not approved for use by the
Department. USDA's telecommunications policy DR 3100-1 states that
the only telephone credit card approved for use by USDA employees is
the FTS 2000 Federal Calling Card. Even though this policy has been
in place over 2 years, some USDA employees have continued to use
telephone company credit cards to charge their long-distance calls.
Consequently, employees may be using these cards to charge
long-distance calls at commercial rates, which are, according to
USDA, as much as three times higher than FTS 2000 rates.
Moreover, USDA does not know whether calls charged to telephone
company credit cards are authorized because, like other commercial
telephone bills, credit card bills are generally paid by the
Department without being reviewed. Also, USDA does not know whether
there have been any cases of telephone fraud involving telephone
company credit cards by individuals outside USDA because the
Department has no inventory of these cards and it performs no
periodic checks to ensure proper accountability over their use.
Therefore, USDA cannot tell whether any of these cards have been lost
or stolen. Although USDA officials were unable to tell us how many
employees have telephone company calling cards, one official told us
hundreds of agency staff have been using them regularly to charge
long-distance services.
USDA also does not know the extent to which it has been the victim of
toll fraud committed by outside hackers. In this regard, USDA has
had at least one instance where hackers broke into USDA's telephone
system and, according to USDA records, made an estimated $40,000 to
$50,000 in international long-distance calls over one weekend in
March 1995. In this case, the hacker penetrated the Department's
telephone system by successfully exploiting vulnerabilities in a USDA
contractor's voice mail system. USDA only became aware of this
incident after it was identified by a long-distance carrier and
brought to the Department's attention. To make matters worse, USDA
did not seek reimbursement for any of the fraudulent calls it paid
for from the voice mail contractor even though the contractor
acknowledged that it was to blame for the vulnerabilities in the
voice mail system.
CONCLUSIONS
------------------------------------------------------------ Letter :6
The extent of USDA's telephone abuse and fraud problem is unknown and
could be costing the Department thousands of dollars each month.
Like other problems we identified in earlier reports, the Department
lacks adequate management controls over the $50 million it spends
each year for commercial telecommunications services. To its credit,
the Department has begun to take positive steps toward addressing
some of its telecommunications management weaknesses by planning an
effort to reengineer telecommunications management and making billing
data more accessible to agency managers for review. If successful,
this effort, which will take about 2 years to implement according to
USDA, should also help deter telephone abuse and fraud. However,
without taking interim steps to determine its vulnerability to
telephone abuse and fraud, identify cost-effective ways to enforce
current policies and procedures, and investigate and take action on
past abuses, the Department is at risk of continued losses to
telephone abuse and fraud.
RECOMMENDATIONS
------------------------------------------------------------ Letter :7
We recommend that the Secretary direct the Assistant Secretary for
Administration and the Chief Financial Officer, in cooperation with
the Under Secretaries and the Office of Inspector General, to
determine the risk of and vulnerability to telephone fraud, waste,
and abuse departmentwide, develop an appropriate plan with
cost-effective controls to mitigate these risks, and expeditiously
implement this plan. In developing this plan, among other things the
Department should consider determining whether there is a need to
continue to accept collect calls and, if deemed necessary, evaluate
the viability and cost-effectiveness of alternatives to collect calls
such as offering toll free numbers.
In the interim, the Department should identify and implement actions
necessary, but at the same time cost-effective, to minimize USDA's
exposure to telephone abuse. Alternatives that the Department might
consider could include blocking collect calls to the Department,
notifying commercial carriers to cancel all telephone company credit
cards issued to USDA personnel, and/or identifying methods that other
large organizations employ to combat telephone abuse and fraud.
The Secretary should also direct the Assistant Secretary for
Administration and the Chief Financial Officer, in cooperation with
the Under Secretaries and the Office of Inspector General, to take
appropriate disciplinary actions against employees involved in the
telabuse cases we identified to ensure that these abuses are stopped
immediately and recover losses where it is cost-effective to do so.
We also recommend that the Secretary direct that billing records be
reviewed to identify all long-distance and other service charges
associated with the March 1995 hacker incident and expeditiously seek
restitution for these amounts from the contractor responsible for the
defective voice mail equipment that led to these charges.
We further recommend that the Secretary of Agriculture, in accordance
with 31 U.S.C. 720, provide a written statement on actions taken on
recommendations contained in our prior report, USDA
Telecommunications: Better Management and Network Planning Could
Save Millions (GAO/AIMD-95-203), to the Senate Committee on
Governmental Affairs and the House Committee on Government Reform and
Oversight. A written statement also must be sent to the House and
Senate Committees on Appropriations. In addition, the Secretary
should provide the appropriate congressional oversight committees
with a report on the Department's planned actions to correct its
telecommunications management weaknesses and mitigate the risk of
telephone fraud, waste, and abuse.
AGENCY COMMENTS AND OUR
EVALUATION
------------------------------------------------------------ Letter :8
USDA's Assistant Secretary for Administration provided written
comments on April 1, 1996, on a draft of this report. USDA's
comments are summarized below and reproduced in appendix II.
The Assistant Secretary agreed with the need to strengthen
telecommunications management controls in the Department and to
prevent fraud and abuse of telecommunications services. Regarding
cases of abuse that we identified involving collect calls from
correctional centers, the Assistant Secretary stated that on March
13, 1996, the deputy administrators for management within each USDA
agency in the Washington, D.C., area were briefed on telephone abuse
and provided copies of the past 6 months' commercial telephone bills
to review. In addition, the Assistant Secretary stated that the
deputy administrators were also given telephone numbers to
investigate and were instructed to pursue disciplinary action against
employees who are found to have abused the use of USDA telephones.
The Assistant Secretary also stated that USDA is exploring the
potential for blocking all third party and collect calls in the
Washington, D.C., metropolitan area and nationwide, and replacing
these services with the expanded use of "1-800" service and FTS 2000
telephone credit cards as a way of reducing telephone abuse and
fraud. In addition, the Assistant Secretary stated that USDA will,
as we recommended, seek reimbursement for the cost of all calls paid
for by the Department during the March 1995 telephone hacker
incident.
The Assistant Secretary also agreed that telephone abuse and fraud at
USDA is indicative of systemic weaknesses in the Department's
existing processes for billing and paying for telecommunications
services. In this regard, the Assistant Secretary stated that a team
is now being assembled to begin work on implementing the
telecommunications task force's recommendation which we discussed.
We are encouraged by the actions described by the Assistant Secretary
for Administration to prevent fraudulent use of government telephones
at USDA. While the Assistant Secretary did not respond to our
specific recommendations, it is important for the Department to
address actions it plans to take on each recommendation as it moves
ahead in preventing telephone fraud and abuse. It is especially
important for the Department to implement our first recommendation
that the Secretary direct the Assistant Secretary for Administration
and the CFO, in cooperation with the Under Secretaries and the OIG,
to determine the risk of and vulnerability to telephone fraud, waste,
and abuse departmentwide, develop an appropriate plan with
cost-effective controls to mitigate these risks, and expeditiously
implement this plan.
---------------------------------------------------------- Letter :8.1
We are sending copies of this report to the Secretary of Agriculture;
the Chairmen and Ranking Minority Members of the Senate Committee on
Governmental Affairs, the Senate and House Committees on
Appropriations, the House Committee on Agriculture, and the House
Committee on Government Reform and Oversight; the Director of the
Office of Management and Budget; the Administrator of the General
Services Administration; and other interested parties. Copies will
also be made available to others upon request.
Please contact me or Steve Schwartz at (202) 512-6240 if you or your
staff have any questions concerning the report.
Jack L. Brock, Jr.
Director, Information Resources
Management/Resources, Community,
and Economic Development
SCOPE AND METHODOLOGY
=========================================================== Appendix I
To assess USDA's controls over telephone use, we obtained and
reviewed commercial telephone billing records representing 4 monthly
billing periods during fiscal year 1995 for USDA agency offices in
the Washington, D.C., metropolitan area. Our 4-month sample of
commercial telephone billing records totaled about $580,000 or 1
percent of the $50 million USDA spends annually for commercial
telecommunications costs. The four months in our review--December
1994, March 1995, July 1995, and August 1995--were selected from
early, mid, and late parts of the fiscal year to adjust for any
seasonal variations in calling patterns. We reviewed billing records
of all collect calls accepted by the Department during these 4 months
as well as selected long-distance calls made during the month of
August 1995.
We were unable to review all of USDA's telephone bills for the
periods covered by our review because the Department did not provide
all the bills to us by the end of our audit work in February 1996.
According to the official at USDA's National Finance Center
responsible for handling our request for bills, there were delays
because complex computer runs were necessary to identify commercial
billing accounts associated with all the 24,000 separate telephone
lines in the Washington, D.C., metropolitan area and because a manual
process is used at the National Finance Center for tracking down each
paper bill. USDA subsequently provided additional bills in March
1996, but since this information was submitted after we had completed
our audit work, it was not included in our report.
To confirm that the cases we identified involved telephone abuse, we
also discussed them with officials in USDA's Office of Information
Resources Management as well as telephone company representatives and
we provided records for these calls to USDA officials for appropriate
action. To obtain detailed information on cases of collect calling
abuse we found, we interviewed correctional facility personnel about
cases involving collect calls from correctional centers and discussed
these cases with officials in USDA's Office of Inspector General and
Office of Information Resources Management. In addition, we reviewed
telephone company records and USDA documentation pertaining to a
March 1995 hacker case at the Department and interviewed telephone
company representatives, voice mail vendor staff, and USDA officials
involved in the incident.
To identify USDA's procedures for processing commercial telephone
bills for its offices in the Washington, D.C., metropolitan area, we
interviewed officials from USDA Office of Information Resources
Management and General Services Administration. We also reviewed
industry publications and reports on telabuse and toll fraud. We
examined the Department's policies and procedures for managing the
use of government telephones and commercial telephone and
long-distance services and USDA plans for improving
telecommunications management controls.
We performed our audit work from October 1995 through February 1996,
in accordance with generally accepted government auditing standards.
Our work was primarily done at USDA headquarters in Washington, D.C.
We also conducted work at the General Services Administration in
Washington, D.C.; Prince George's County Correctional Center in Upper
Marlboro, Maryland; and the Animal and Plant Health Inspection
Service in College Park, Maryland.
(See figure in printed edition.)Appendix II
COMMENTS FROM THE DEPARTMENT OF
AGRICULTURE
=========================================================== Appendix I
(See figure in printed edition.)
(See figure in printed edition.)
*** End of document. ***