premise: GAO/AIMD00295, September 6, 2000) showed that in 24 agencies, physical and logical access controls were not effective in preventing or detecting system intrusions or misuse.
hypothesis: Logical access controls didn't do enough to stop people from abusing the system in at least 2 dozen agencies.