United States Government Publishing Office publisher pbl distributor dst United States Government Accountability Office Accounting and Information Management Division author aut Government Organization text government publication eng GAOREPORTS Legislative Agency Publications gao legislative 2010-08-12 U.S. Government Printing Office 1999-12-23 monographic deposited born digital 44 p. GA 1.13:AIMD-00-55 https://www.govinfo.gov/app/details/GAOREPORTS-AIMD-00-55 P0b002ee18038f709 f:ai00055 DGPO 2010-08-12 2011-03-28 GAOREPORTS-AIMD-00-55 machine generated eng fdlp REPORT GAOREPORTS-AIMD-00-55 AIMD-00-55 Computer security Data integrity Y2K Computer software verification and validation Contractor personnel Air traffic control systems Security clearances Contract administration Internal controls Aliens Y2K FAA Display System Replacement FAA Automated Radar Terminal System IIIA FAA Voice Switching and Control System FAA Year 2000 Program Letter Report AIMD Pursuant to a congressional request, GAO provided information on the Federal Aviation Administration's (FAA) security controls over information on the foreign nationals involved in remediating and reviewing software, focusing on: (1) the extent to which foreign nationals were involved in year 2000 code remediation and subsequent code review activities at FAA; and (2) FAA's policies covering this involvement.<p/>GAO noted that: (1) FAA policy requires system owners and users to prepare risk assessments for all contractor tasks, and to have background investigations conducted for all contractor employees in high-risk positions; (2) FAA also requires more limited background checks for moderate- and low-risk positions; (3) FAA's mission-critical systems requiring year 2000 repairs--including some of the most important systems supporting the air traffic control system--were remediated by a mix of FAA and contractor employees and, in the case of commercial-off-the-shelf products, by the product vendors; (4) while FAA did not maintain detailed information on individuals assigned to perform year 2000 code remediation, FAA compiled some of this information in response to GAO's request; (5) in doing so, FAA identified instances where foreign nationals, employed by contractors, performed year 2000 code remediation activities; (6) of 153 mission-critical systems that were remediated, 15 had foreign national involvement--including Chinese, Ukrainian, and Pakistani nationals; (7) FAA was unable to provide any information about the individuals who performed code remediation for 4 of the 153 systems; (8) with regard to code reviews, 20 key mission-critical systems have been, or are in the process of being, reviewed by two contractors who have foreign national employees; (9) one code review contractor employed 36 mainland Chinese nationals while the other employed one Canadian national; (10) FAA, however, did not perform background searches on all of its contractor employees, as required by policy; (11) the agency did not perform risk assessments and was unaware of whether it or the contractor had performed background searches on all the contractor employees, including the foreign nationals; (12) during GAO's review, GAO found instances where background searches of foreign nationals were not performed; (13) FAA's failure to perform risk assessments, its lack of complete information on whether background searches were performed, and the fact that some foreign nationals did not undergo background searches have increased the risk that inappropriate individuals may have gained access to FAA's facilities, information, or resources; and (14) as a result, the air traffic control system may be more susceptible to intrusion and malicious attacks. https://www.govinfo.gov/content/pkg/GAOREPORTS-AIMD-00-55/html/GAOREPORTS-AIMD-00-55.htm https://www.govinfo.gov/content/pkg/GAOREPORTS-AIMD-00-55/pdf/GAOREPORTS-AIMD-00-55.pdf GAO/AIMD-00-55 https://www.govinfo.gov/app/details/GAOREPORTS-AIMD-00-55 Letter Report GAO/AIMD-00-55; Computer Security: FAA Needs to Improve Controls Over Use; Computer security Data integrity Y2K Computer software verification and validation Contractor personnel Air traffic control systems Security clearances Contract administration Internal controls Aliens Y2K FAA Display System Replacement FAA Automated Radar Terminal System IIIA FAA Voice Switching and Control System FAA Year 2000 Program