prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 1.

Report 1: To varying extents, Internet content providers—also called “edge providers”—and Internet service providers collect, use, and share information from their customers to enable their services, support advertising, and for other purposes  Many companies describe these and other privacy-related practices in privacy policies, to which consumers may be required to consent in order to use the service  Consumers access such services through a variety of devices, including mobile phones and tablets, computers, and other devices connected to the Internet by wired or wireless means  A nationwide survey that the U S  Census Bureau conducted for NTIA in 2017 found that 78 percent of Americans ages 3 and older used the Internet  Another nationwide survey that the Pew Research Center conducted in 2018 found that 69 percent of American adults reported that they use some kind of social media platform such as Facebook  No comprehensive federal privacy law governs the collection, use, and sale or other disclosure of personal information by private-sector companies in the United States  Rather, the federal privacy framework for private-sector companies is comprised partly of a set of tailored laws that govern the use and protection of personal information for specific purposes, in certain situations, or by certain sectors or types of entities  These laws include the Fair Credit Reporting Act, which protects the security and confidentiality of personal information collected or used to help make decisions about individuals’ eligibility for such products as credit or for insurance or employment; the Gramm-Leach-Bliley Act, which protects nonpublic personal information that individuals provide to financial institutions or that such institutions maintain; and the Health Insurance Portability and Accountability Act which establishes a set of national standards for the protection of certain health information  In addition, as detailed in this report, FTC addresses consumer concerns about Internet privacy using its broad authority to protect consumers from unfair and deceptive trade practices  We have reported on a variety of Internet privacy concerns in recent years that include the collection and use of data such as people’s Internet browsing histories, purchases, locations, and travel routes, including: Internet of things: In 2017, we found that as new and more devices become connected, they increase not only the opportunities for security and privacy breaches, but also the scale and scope of any resulting consequences  Vehicle data privacy: We found in 2017 that most selected automakers reported limiting their data collection, use, and sharing, but their written notices did not clearly identify data sharing and use practices  Information resellers: In a 2013 report on companies that collect and resell information on individuals, we found that no overarching federal privacy law governs the collection and sale of personal information among private-sector companies, including information resellers  We found that gaps exist in the federal privacy framework, which does not fully address changes in technology and the marketplace  Among the issues we noted were the potential need for changes to privacy controls for web tracking, mobile devices, and other technologies  We recommended that Congress consider strengthening the consumer privacy framework to reflect the effects of changes in technology and the marketplace  Such legislation has not been enacted to date  Mobile device location data: In 2012, we found that, according to privacy advocates, consumers are generally unaware of how their location data are shared with and used by third parties  We recommended that FTC consider issuing guidance establishing FTC’s views regarding mobile companies’ appropriate actions to protect location data privacy  FTC implemented that recommendation in 2013  To guide their privacy practices, many organizations and governments have used the Fair Information Practice Principles  As noted above, these principles—which are not limited to Internet privacy—address the collection and use of personal information, data quality and security, and transparency, among other things, and have served as the basis for many of the privacy recommendations federal agencies have made  The Organisation for Economic Co-Operation and Development developed a version of these principles in 1980 that has been widely adopted and was updated in 2013  In 2000, FTC recommended that Congress enact a consumer Internet privacy statute that would require companies to comply with broad and flexible definitions of the principles, and an FTC commissioner said in a 2014 speech that they are a solid framework and are flexible and effective  While they are principles, not legal requirements, they provide a possible approach for balancing the need for privacy with other interests  Table 1 provides more detailed information about the principles  FTC is primarily a law enforcement agency that, among other responsibilities, currently has the lead in overseeing Internet privacy at the federal level  Specifically, it addresses consumer concerns about Internet privacy, both for Internet service providers and content providers, using its general authority under section 5 of the FTC Act  Section 5, as amended in 1938, prohibits “unfair or deceptive acts or practices in or affecting commerce ” Although the FTC Act generally empowers FTC to take enforcement action, it prohibits FTC from taking action against common carriers such as telecommunication services, airlines, and railroads under certain circumstances  FTC also does not have jurisdiction over banks, credit unions, or savings and loans institutions  Even though the FTC Act does not speak in explicit terms about protecting consumer privacy, the Act authorizes such protection to the extent it involves practices FTC defines as unfair or deceptive  According to FTC, an act or practice is “unfair” if it causes, or is likely to cause, substantial injury not reasonably avoidable by consumers and not outweighed by countervailing benefits to consumers or competition as a result of the practice  FTC has used this “unfairness” authority to address situations where a company has allegedly failed to properly protect consumers’ data  According to FTC, a representation or omission is “deceptive” if it is material and is likely to mislead consumers acting reasonably under the circumstances  For example, the omission of terms in an advertisement would need to be material and likely to mislead consumers in order to be deceptive  FTC applies this “deceptive” authority to address deceptions or violations of written privacy policies and representations concerning data security  FTC’s Bureau of Consumer Protection investigates Internet privacy complaints from various sources, including consumers, other agencies, Congress, and industry, and also initiates investigations on its own  If the bureau has reason to believe that an entity is engaging in an unfair or deceptive practice, it may forward an enforcement recommendation to the commission  The commission then determines whether to pursue an enforcement action, which can include the following: litigating commission-filed administrative complaints before an FTC administrative law judge; filing and litigating complaints in federal district court seeking preliminary and permanent injunctions, monetary redress for consumers or other equitable relief; or referring complaints seeking civil penalties for violations of rules authorizing such penalties or for violations of administrative orders to the Department of Justice (DOJ) and assisting DOJ in litigating those cases (if DOJ does not take action, FTC can pursue the action on its own)  FTC’s Internet privacy enforcement cases may be settled without the imposition of civil penalties  Instead, FTC typically enters into settlement agreements requiring companies to take actions such as: implementing reasonable privacy and security programs; being subject to long-term monitoring of compliance with the settlements by outside entities; providing monetary redress to consumers; forfeiting any money gained from the unfair or deceptive conduct; deleting illegally obtained consumer information; and providing transparency and choice mechanisms to consumers  If a company violates an FTC final consent order, the agency can then request civil monetary penalties in court for the violations  In addition, as discussed below, FTC can seek to impose civil monetary penalties directly for violations of certain privacy statutes and regulations such as the statute pertaining to the Internet privacy of children and its implementing regulations  Although FTC can levy civil penalties up to $41,484 per violation, per day, against an entity that violates a trade regulation rule under the FTC Act, it has not promulgated trade regulation rules under section 5 specific to privacy  Although FTC has not implemented its section 5 authority by issuing regulations regarding Internet privacy, it has issued regulations to implement other statutory authorities  Likewise, other federal agencies use regulations to implement the statutes they are charged with administering  The process by which federal agencies typically develop and issue regulations is spelled out in the Administrative Procedure Act (APA)  Section 553 of the APA establishes procedures and requirements for what is known as “informal” rulemaking, also known as notice-and- comment rulemaking  Among other things, section 553 generally requires agencies to publish a notice of proposed rulemaking in the Federal Register  After giving interested persons an opportunity to comment on the proposal by providing “data, views, or arguments,” the statute then requires the agency to publish the final rule in the Federal Register  Regulations may be enforced in various ways, for example, by seeking civil penalties for non-compliance  FTC has authority to seek civil penalties, for example, when a company knowingly violates a regulation or, as discussed below, a final consent order  In contrast to the APA section 553 rulemaking process, the rulemaking process that FTC generally must follow to issue rules under the FTC Act is spelled out in the Magnuson-Moss Warranty Act amendments to the FTC Act (Magnuson-Moss)  The Magnuson-Moss amendments— enacted in 1975 partly in response to industry opposition to FTC’s trade regulations, and amended in 1980—require additional rulemaking steps beyond APA section 553  For example, Magnuson-Moss requires FTC to publish an advance notice of proposed rulemaking in addition to the notice of proposed rulemaking required by the APA, and to offer interested parties the opportunity for an informal hearing involving oral testimony  FTC has not promulgated any regulations using the Magnuson-Moss procedures since 1980; according to FTC staff, the additional steps required under Magnuson-Moss add time and complexity to the rulemaking process  The Children’s Online Privacy Protection Act (COPPA), enacted in 1998, governs the online collection of personal information from children under the age of 13 by operators of websites or online services, including mobile applications  COPPA required FTC to issue and enforce regulations concerning children’s online privacy and directed FTC to promulgate these regulations using the APA section 553 notice-and- comment rulemaking process  COPPA contained a number of specific requirements that FTC was directed to implement by regulation, such as requiring websites to post a complete privacy policy, to notify parents directly about their information collection practices, and to obtain verifiable parental consent before collecting personal information from their children or sharing it with others  The commission’s original COPPA regulations became effective on April 21, 2000, and amended COPPA regulations took effect on July 1, 2013  According to an FTC staff member, COPPA and FTC’s implementing regulations reflect various principles that are similar to the Fair Information Practice Principles  FCC regulates the telecommunications industry pursuant to the Communications Act of 1934, as amended (Communications Act)  FCC follows the APA section 553 notice-and-comment rulemaking process to promulgate regulations implementing the Communications Act  FCC also has an enforcement bureau that pursues violations of its regulations and the Communications Act  The Communications Act establishes separate definitions for “information services” and “telecommunications services” and treats these two types of services differently  Specifically, information services are subject to less regulation by FCC than telecommunications services under the Communications Act  However, FTC is prohibited from regulating telecommunications carriers (a provider of telecommunications services) under the common carrier exemption  Prior to 2015, Internet services were considered information services under the Communications Act, and thus FTC was not prohibited from considering the privacy practices of Internet service providers under its FTC Act authority to protect consumers from unfair and deceptive practices  This changed in 2015 when FCC classified broadband as a telecommunications service, which meant that broadband Internet service providers were considered telecommunications carriers and FCC asserted primary oversight over them  As a result of the reclassification, FTC no longer had jurisdiction over Internet service providers  Once FCC had asserted primary oversight over Internet service providers, FCC promulgated privacy regulations specific to them  However, before the privacy regulations went into effect, Congress repealed them under the Congressional Review Act  In December 2017, FCC reclassified broadband as an information service—reverting Internet service providers’ classification to what it had been prior to 2015  When that reclassification became effective in June 2018, jurisdiction of Internet privacy for Internet service providers was effectively transferred from FCC back to FTC  As a result, FCC currently has limited Internet privacy oversight responsibilities, as shown in figure 1  Perspectives on the benefits of and concerns about the collection and use of consumers’ data from the Internet varied somewhat across stakeholder groups  Various stakeholders we interviewed—including those from academia, industry, and government—said that there should be a balance between the freedom of companies to collect and use consumers’ data needed to provide services and the necessity to protect consumers’ privacy  In general, industry stakeholders highlighted the benefits of data collection and use, such as facilitating innovation, while consumer advocacy groups and other stakeholders emphasized concerns about consumers’ loss of control over their data and their lack of understanding of how companies collect and use their information  Additionally, surveys and other literature that we reviewed on Internet privacy highlighted concerns among consumers  The key benefits of information collection were identified as: Enables certain services  According to two industry stakeholders, the collection and use of consumer data from the Internet enable content providers to provide services  These stakeholders said that sometimes a content provider must collect and use information from consumers to provide the service  For example, a mapping service must collect and use consumers’ current location to provide them with up-to-date directions  Provides low-cost or free services  A representative from a content provider said that revenue from targeted advertising helps allow some content providers’ services to be offered to consumers at little or no charge  Instead of charging a subscription fee, a social media company may be able to provide free service because it uses information that it collects from consumers to target advertisements to users on a customized, user-by-user basis  These ads are targeted to users based on interests they express through their use of social media, among other things  According to a representative from an Internet search engine, using consumer data for targeted advertising may be relatively less important for some kinds of content providers, such as search engines  This company representative said that search engines may use keywords entered for a particular Internet search to provide advertisements relevant to the search  For example, a search for “car insurance” can offer the consumer advertisements from car insurance companies without any additional data from the consumer other than the search’s keywords  Supports innovation and customization  According to some stakeholders, the collection and use of data also benefit consumers through other means such as providing innovative products or customized services  According to a representative from a content provider, the collection of personal information, with consent, for commercial purposes can at times have benefits  The representative said, for example, that collection of images containing identifiable information, like faces, can help in the development of new technologies such as object and facial recognition  According to two content providers, consumers may also benefit from customized services and content  For example, according to a representative from a travel-related company, that company can collect information about a consumer to suggest travel itineraries and suggestions for activities  Additionally, representatives from a consumer advocacy group and a content provider stated that direct-marketing approaches are enabled through data collection  Such marketing approaches allow consumers to receive advertisements that are uniquely tailored to their interests  For example, a consumer that a content provider has identified as being a hiker may receive advertisements for hiking boots  Despite these benefits, public opinion surveys have shown concerns about the collection and use of consumers’ information on the Internet  For instance, recent analyses based on surveys by the Pew Research Center and NTIA showed that the public lacks trust in Internet privacy, a concern that may limit economic activities  NTIA’s survey results show that privacy concerns may lead to lower levels of economic productivity as people decline to make financial transactions on the Internet  According to the NTIA analysis, in 2017, 24 percent of American households surveyed avoided making financial transactions on the Internet due to privacy or security concerns  Consumers NTIA surveyed indicated that their specific concerns were identity theft, credit card or banking fraud, data collection by online services, loss of control over personal information, data collection by government, and threats to personal safety  Stakeholders we interviewed elaborated on some of these concerns: Public disclosure and data breaches  Some stakeholders, including representatives from content providers, said that personal information from the Internet can be publicly disclosed, including through data breaches  An academic and a former FCC commissioner told us that such disclosures are becoming more frequent  Various consumer advocacy groups and state governments continue to report data breaches  This personal information can include financial information such as credit card information, the disclosure of which can result in financial harm to the consumer  It can also include other kinds of sensitive information such as political views or medical conditions, the disclosure of which can cause non-financial harms such as embarrassment or harassment  According to public reports, the 2017 breach of consumer information from Equifax, a credit-reporting agency, resulted in the disclosure of 143 million American consumers’ sensitive information  According to NTIA’s 2017 survey, 45 percent of households surveyed reported major concerns about credit card fraud  Regarding non-financial information, in a recent case FTC alleged that an Internet-based company publicly disclosed patients’ sensitive medical information without their knowledge after patients submitted what they thought were confidential reviews of physicians  According to FTC, these reviews were then publicly posted on the company’s website  Financial and other harms  Stakeholders identified both potential financial and non-financial harms associated with misuse of personal information from the Internet  A former FTC acting chair has said that privacy and data-security incidents can cause injuries that do not only involve financial loss and that it may be difficult to measure this type of non-financial injury  In a February 2018 speech, this former acting FTC chair cited a case that the agency filed involving the misuse of personal information from the Internet that resulted in people losing jobs or job opportunities or being threatened, stalked, and harassed  The acting chair said that in another case, there was evidence that several people committed suicide after their names and other data were disclosed  The commission can, by bringing suit in district court, obtain an order compelling content providers to provide monetary relief to consumers if a data disclosure results in financial harm to a consumer  However, an academic noted that many data disclosures of sensitive information cannot be financially redressed; information can indefinitely persist on the Internet once it is disclosed  Consumers’ lack of understanding  A range of stakeholders we interviewed, including those from industry, said that consumers lack an understanding of how their data are collected and used  Some stakeholders said content providers are insufficiently transparent about how they collect and use data  For instance, content providers’ privacy policies, according to various stakeholders, may contain technical language that is difficult for typical consumers to understand, may be located in a difficult-to-access or inconspicuous part of the content provider’s website, or may be lengthy to the point where it becomes prohibitively difficult for a consumer to set aside enough time to read  Furthermore, according to an academic, companies may have an incentive to intentionally obscure their privacy practices, since clarity could put the companies at a competitive disadvantage  The academic also stated that different privacy policies may apply to different parts of a consumer’s experience on a single website  For example, the academic described how a website may have contracts with third-party vendors for specific services included on the website that consumers use, such as an online shopping cart’s features  The privacy policy for the website and the third-party shopping cart can be separate and unrelated to each other, and consumers may not be aware of this since these policies may never appear to consumers or be hard to obtain  A representative from a consumer advocacy group also mentioned that consumers may be unaware that companies track consumers’ Internet activity in order to target those consumers with customized prices  An academic said that these practices may disproportionately affect people with low computer literacy, as they may not be aware of tracking or know of ways to counteract it  In 2015, we found that the lack of computer and Internet skills is one of the primary barriers people face in using the Internet and that this is a particular problem for certain demographic segments who may lack exposure to or knowledge about computers, such as those of age 65 and older and those with low levels of income and education  Consumer lack of control  Some academics and consumer advocacy groups also identified a lack of control as a concern with respect to Internet privacy—consumers have little or no control over how their information is collected, used, and shared  In a 2015 survey conducted by Pew Research Center, 65 percent of respondents said it is very important to be in control of what information is collected about them  However, according to an academic and a consumer advocacy group we interviewed, privacy policies offer consumers little or no bargaining power, and consumers may be forced to either accept the terms of the policy as written or not use the application or service at all  Furthermore, we recently reported that sometimes consumers’ information is used for purposes that are altogether separate from what those consumers originally anticipated  For example, FTC alleged in an enforcement action that in 2009 and 2010, a company told consumers that it would track the websites they visited in order to provide them with personalized offers, when in fact the company was also transmitting credit card information it collected through such tracking to third parties  The company settled with FTC  We also recently reported on how devices that comprise the Internet of Things pose privacy concerns for consumers, including that information collected by such Internet-connected devices can be used in ways to which the consumer was not given the option to opt out  As discussed above, stakeholders described various types of harm that could result from Internet privacy violations  Regardless of whether violations involve financial or other types of harm, a challenging factor in providing Internet privacy oversight is identifying the responsible parties  A former federal government official with experience in privacy issues said that it frequently is difficult to identify which Internet entity in the chain is ultimately responsible for a privacy-related harm  For example, if a consumer is harmed by the theft of his or her Social Security number, it can be difficult to determine which entity is responsible if multiple entities have suffered data breaches of information systems that contained the Social Security number  In addition to the challenges in identifying responsible parties, the federal government has faced challenges in providing Internet privacy oversight  Our prior work has found that such efforts lack clearly defined roles, goals and performance measures, and that gaps exist in the current privacy framework  We found that during the last decade, FTC filed 101 Internet privacy enforcement actions for practices that the agency alleged were unfair, deceptive, a violation of COPPA, a violation of a settlement agreement, or a combination of those reasons  Most of these actions pertained to first-time violations of the FTC Act for which FTC does not have the authority to levy civil penalties  In those cases where a party violated an FTC regulation or settlement agreement, however, FTC does have the authority to impose civil penalties  The 101 cases—filed between July 1, 2008 and June 30, 2018—involved a variety of products, services, and industries that collect and use personal information from the Internet  During the years for which we examined full-year data, the number of enforcement actions taken per year ranged from 5 in 2010 and 2016 to 23 in 2015  For example, in recent years, FTC took enforcement action against the following entities for alleged conduct that the agency contended violated section 5 or COPPA: a toy manufacturer for collecting personal information from children online without providing direct notice and obtaining their parents’ consent; a computer manufacturer for pre-loading laptops with software that compromised security protections in order to deliver ads to consumers; a mobile ride-hailing business for misrepresenting the extent to which it monitored its employees’ access to personal information about users; a television manufacturer for installing software on its televisions to collect viewing data on 11 million consumers without their knowledge or consent and providing the viewing data to third parties; and a mobile advertising network for deceptively tracking the locations of hundreds of millions of consumers, including children, without their knowledge or consent, to serve them geographically targeted advertising  Of the 101 actions filed during the 10-year period, 51 involved Internet content providers, 21 involved software developers, 12 involved the sale of information or its use in advertising, 5 involved manufacturers, 1 involved an Internet service provider, and 11 involved a variety of different products, such as those provided by rent-to-own companies or certification services  In nearly all 101 cases, companies settled with FTC, which required the companies to make changes in their policies or practices as part of the settlement  FTC levied civil penalties against two of those companies for violating their settlement agreements  Also during this 10-year period, FTC levied civil penalties against 15 companies (a total of $12 7 million) for alleged violations of the COPPA regulations  The COPPA civil penalties ranged from $50,000 to $4 million and the average amount was $847,333  FTC can also seek to compel companies to provide monetary relief to those they have harmed  During this time period, FTC levied civil penalties against companies for violations of consent decrees or ordered monetary relief to consumers from companies for a total of $136 1 million  These payment orders ranged from $200,000 to $104 5 million and the average amount was $17 million  In the majority of these 101 enforcement actions that FTC settled, FTC alleged that companies engaged in practices that were deceptive  Examples of the charges FTC brought include: “Deceptive practices” cases (61 cases): In 2016, FTC alleged that Turn, Inc , an Internet advertising company, continued to track the Internet activities of consumers for targeted advertising purposes after the company had made representations that it would stop doing so  According to FTC, the company led consumers to believe they could turn off such tracking when in fact they were unable to do so  “Unfair practices” cases (4 cases): In 2014, FTC alleged that LeapLab, a data broker, knowingly provided scammers with hundreds of thousands of consumers’ sensitive personal information, including Social Security and bank account numbers  “Unfair and deceptive” practices cases (19 cases): In 2015, FTC alleged that Equiliv Investments, a software developer, lured consumers into downloading its “rewards” application, saying it would be free of malware, when the application’s main purpose was actually to load the consumers’ mobile phones with malicious software to mine virtual currencies for the developer  COPPA and COPPA regulations cases (6 cases): In 2011, FTC alleged that Broken Thumbs Apps, a software developer, had collected information from Internet applications that the developer specifically targeted toward children under the age of 13  FTC’s complaint stated that the company had, among other things, failed to provide notice of what information it collected and how it was used and also had failed to inform parents of these practices and receive their consent as COPPA required  Violation of settlement agreement cases (2 cases): In 2012, Google agreed to pay a $22 5 million civil penalty to settle FTC charges that it misrepresented to users of Apple’s Safari Internet browser that Google would not place tracking cookies or provide targeted ads to those users, violating an earlier settlement agreement between the company and FTC  In 14 of the 101 cases, FTC required companies to be audited by outside entities to monitor compliance with the terms of the settlement  The audit period ranged from 5 years to 20 years, with an average of 17 5 years  As noted above, 2 of the 101 cases involved a violation of FTC settlement agreements  In addition, in March 2018, FTC announced that it is investigating whether Facebook’s privacy practices violate a 2012 Facebook settlement agreement with FTC  In the case that resulted in the 2012 settlement, FTC charged Facebook with deceiving consumers by telling them they could keep their information private, but then allowing it to be shared and made public  Appendix II contains more detailed information about the 101 cases  As stated earlier, in 2015, FCC classified broadband Internet service as a telecommunications service, placing primary oversight of broadband Internet service providers’ privacy practices under FCC’s jurisdiction instead of FTC’s jurisdiction  In 2016, FCC filed a privacy enforcement action against a mobile Internet service provider, alleging, in part, violation of section 222 of the Communications Act and FCC’s Open Internet Transparency Rule  Section 222 requires telecommunications carriers to protect the confidentiality of customers’ proprietary information  In that case, FCC fined Verizon Wireless $1 4 million for failing to disclose that it was inserting “unique identifier headers,” also called “perma- cookies” or “super cookies” (mobile web tracking cookies that users cannot remove), into customers’ Internet traffic over its wireless network  Although the settlement was finalized during the 2015-2017 period when FCC had asserted jurisdiction over the privacy practices of Internet providers, the Verizon Wireless practices occurred prior to the classification of Internet service providers as telecommunications carriers  The investigation therefore did not rely upon FCC’s subsequent assertion of authority over Internet service providers’ privacy practices  In October 2016, after FCC had reclassified broadband as a telecommunications service, the commission issued Internet service provider privacy regulations, asserting its authority under section 222 of the Communications Act  In April 2017, however, Congress repealed these regulations under the Congressional Review Act before they took effect  In December 2017, FCC then reversed its 2015 classification of broadband, and oversight of broadband Internet service providers’ privacy practices reverted to FTC once the decision took effect in June 2018  In explaining the December 2017 decision, FCC’s new chair said that FTC’s privacy oversight approach regarding Internet service providers—using its authority to protect consumers against unfair, deceptive, and anti- competitive practices—had worked well in the past and that this action would “put the nation’s most experienced privacy cop back on the beat ” Under FCC’s new legal approach, it no longer asserts jurisdiction to take enforcement action against Internet service providers for privacy-related matters, including mobile Internet service providers  As part of FTC’s resumption of Internet service provider oversight, FCC and FTC entered into a memorandum of understanding in December 2017 spelling out their roles and responsibilities regarding oversight of these companies  FTC staff said that they regularly communicate with FCC and have an agreement to share Internet privacy complaints  As previously discussed, no federal statute comprehensively and specifically governs Internet privacy across all sectors  FTC oversees some aspects of Internet privacy by using its FTC Act section 5 authority to protect consumers from unfair and deceptive practices  FTC also uses its specific COPPA authority to police the collection and use of personal information from children by online services  Some industry representatives said that FTC’s enforcement has been effective because the agency has expertise and experience in privacy issues and has the flexibility to take enforcement action on a case-by-case basis  In addition, a content provider said that FTC has taken enforcement actions against companies of various sizes in different sectors and has a powerful tool by being able to require companies to be audited by outside entities for up to 20 years  Industry stakeholders we interviewed generally said that “direct enforcement” of a statute is preferable to promulgating and enforcing regulations implementing that statute (which constitutes enforcement of the statute as well)  These stakeholders noted several key concerns they believe exist with regulatory versus statutory enforcement of Internet privacy: Regulations can stifle innovation  Two industry stakeholders said that regulations can hinder companies’ ability to innovate  For example, representatives from an Internet service provider said that innovation can stop during the rulemaking process as the industry waits for the regulation to be finalized  Regulations may create loopholes  Representatives from an Internet industry group and a content provider said that regulations can also contain loopholes that can be legally exploited because imprecise language in a regulation may allow a company to legally engage in an action that was originally unforeseen by the regulator  Regulations can become obsolete  Several industry stakeholders said regulations also may become obsolete quickly because the Internet industry is rapidly changing  An Internet industry representative noted that there can be large shifts in the Internet industry from year to year, while it often takes an agency much longer than a year to adopt a rule  Industry stakeholders said the flexibility of FTC’s approach allows FTC to adapt continuously to changing market conditions  Rulemakings can be lengthy  FCC officials said that in some cases, rulemakings can take a long time, especially when the issues are complex and there is no statutory deadline  Our previous work on rulemaking found that length of time required for the development and issuance of final rules varied both within and among agencies  Additionally, while some stakeholders suggested that regulations can clarify acceptable practices, other stakeholders, including from industry and academia, said that enforcement actions can send a similar message  According to both a representative from a content provider and an academic, enforcement actions such as settlement agreements, for example, establish precedents that companies can follow, similar to the way that case law developed by courts provides guidance for companies  Although some industry representatives we interviewed said that FTC’s use of settlement agreements provides companies with guidance, certain trade associations took a different position in a recent case brought before the U S  Court of Appeals for the Third Circuit, FTC v  Wyndham Worldwide Corp  799 F 3d 236 (3d Cir  2015)  However, the court did not agree with the associations’ arguments  The case involved an enforcement action against Wyndham Worldwide Corporation where FTC alleged that data security failures led to three data breaches at the company in less than 2 years  The court considered whether FTC could bring an enforcement case involving cybersecurity using FTC’s section 5 “unfair practices” authority and, if so, whether Wyndham had “fair notice” that its specific cybersecurity practices could be deemed “unfair ” A group of companies and the U S  Chamber of Commerce wrote a friend- of-the-court brief supporting Wyndham, criticizing FTC’s “regulation- through-settlements” approach  The companies argued this approach subjects businesses to “vague, unknowable, and constantly changing data-security standards” and businesses often are unaware of the standards to which they are held until after they receive a notice of investigation from FTC, at which point they must settle or expend considerable resources fighting the agency  Potential Limits on Federal Trade Commission (FTC) Remedies A recently decided federal appeals court case illustrates potential limits on the remedies that FTC can order in an “unfair practices” enforcement proceeding  In this 2018 case, LabMD, Inc  v  FTC, 891 F 3d 1286 (11th Cir  2018), the U S  Court of Appeals for the Eleventh Circuit found that FTC could not direct a medical laboratory to create and implement wholesale data-security protective measures as a remedy to the laboratory’s alleged unfair practices  FTC had filed a complaint against LabMD under section 5 of the FTC Act for allegedly committing an unfair act or practice by failing to provide reasonable and appropriate security for personal information on its computer networks  The commission found that LabMD’s inadequate security constituted an unfair act or practice and ordered LabMD to take various actions, including establishing and maintaining a reasonable and comprehensive information security program  On appeal, the Eleventh Circuit ruled that FTC’s order exceeded its authority because it did not prohibit a specific act or practice but instead, mandated a complete overhaul of the company’s data-security program  FTC had argued that the FTC Act gives it broad discretion to prevent unfair or deceptive acts or practices that injure the general public and that FTC had spelled out standards for LabMD to craft a reasonable security program  The court ruled, however, that such a general approach would make it difficult for a reviewing court to determine if LabMD had complied with the order, in the event of a future FTC challenge  company can reasonably foresee that a court could construe its conduct as falling within the meaning of the statute ” A majority of non-industry stakeholders we interviewed identified limitations in the current Internet privacy oversight approach because they view regulations in conjunction with enforcement as being more effective  These stakeholders include all of the former FTC commissioners we interviewed, three of the four former FCC commissioners we interviewed, and representatives from consumer advocacy groups we interviewed  In addition, a former FCC commissioner said that the current Internet privacy oversight approach is limited in part because he viewed regulations applying equally to all players in the Internet ecosystem in conjunction with enforcement as being more effective  A representative from a consumer advocacy group also said that regulations in conjunction with enforcement are essential for effective privacy protection  Some of these stakeholders noted key ways that they believe Internet privacy regulations can provide clarity to industry and consumers, as well as fairness and flexibility in enforcement: Regulations can provide clarity  An Internet industry group representative said that various companies have favorable views of regulations because they can provide clear expectations about what actions are permissible  Similarly, a former congressional staff member with expertise on privacy issues said that some companies have favorable views of regulations because the regulations often provide clearer expectations about what the companies can do  FCC officials said that with respect to telephone privacy provisions of the Communications Act, the telephone industry wanted rules because it sought greater clarity about what it should be doing, what constituted a violation, how to comply, and what behaviors were acceptable  Regulations may promote fairness  Some other stakeholders discussed the ability of regulations to provide fairness  For example, a former federal enforcement official described regulations as creating a fair and consistent oversight regime across the entire industry in a way that case-by-case enforcement actions do not  Another former federal enforcement official said that regulations give companies fair notice of what actions may be violations and thus help those companies avoid surprising or unexpected enforcement  Regulations can be flexible  An academic said that by targeting behaviors and not specific technologies, regulations can be written in such a way that they do not become obsolete  An academic also said that regulations based on broad performance-standards principles can avoid being overly prescriptive  FCC officials also noted that regulations can be amended to adapt to changes in technology often faster than new laws can be enacted  Furthermore, regulations determined to be obsolete can be repealed  FTC staff told us that the agency systematically reviews all of its regulations every 10 years, even though it is only legally required to review its most significant ones, and that the number of FTC regulations has decreased because the agency determined prior ones were obsolete  The Regulatory Flexibility Act requires federal agencies to analyze the effect of their regulations on small entities  Regulations can be a deterrent  FCC officials said that rules can have a deterrent effect on bad practices in the industry or have a role in mitigating the negative effects of bad practices after they occur  They said, for example, that the practice of pretexting (improperly obtaining people’s telephone records) was greatly curtailed by an FCC regulation prohibiting such practices  They also said that rules can foreclose arguments by companies claiming that because no rule was in place, they had no reasonable notice or awareness that they should behave in a particular way  Consumer advocacy groups and other stakeholders, including some former FTC and FCC commissioners, had concerns about the efficacy of an enforcement approach such as FTC’s approach to Internet privacy oversight, which focuses on enforcing a statute rather than implementing regulations  They said that FTC’s enforcement approach limits the ability of the agency to affect companies’ behavior, and that any enforcement activity occurs after the violation, undesirable behavior, harm, or illegal action has already occurred  A former federal enforcement official also said that regulations can prevent companies from engaging in bad practices in the first instance and thus have a preventive effect  A former FCC commissioner said that by the nature of a direct statutory- enforcement approach (as opposed to rulemaking), an agency would only address a harm after it has occurred  As discussed above, for example, data often cannot be removed from the Internet because copies of the data can exist among many bad actors, and it can be difficult to identify the entity responsible for unwanted disclosures  Therefore, it may be more important to avoid such Internet privacy harms from occurring in the first place  Another former FCC commissioner told us that Internet privacy oversight should be returned to FCC because it has APA section 553 notice-and-comment rulemaking authority and considerable enforcement experience  Representatives from consumer advocacy groups said that FTC’s enforcement action has been insufficient because it investigates only a small portion of actual Internet-privacy violations or takes action regarding only the most egregious or outrageous cases that it can win  FTC has also stated in its strategic plan that it focuses on investigating and litigating cases that cause or are likely to cause substantial injury to consumers and that by focusing on practices that are actually harming or likely to harm consumers, FTC can best use its limited resources  Representatives from an Internet association said that FTC’s Internet- privacy enforcement actions should focus on concrete harms  An FTC staff member from the Division of Privacy and Identity Protection said that the agency has been effective with the limited enforcement resources it has available  Furthermore, the staff member said the agency uses no formal written criteria or template to assess individual cases but considers the size and scale of a company’s effect on consumer privacy when deciding whether to take enforcement action  However, a former FTC commissioner told us that the agency needs more resources to effectively oversee Internet privacy  We asked stakeholders whether it was clear under what circumstances FTC will take Internet privacy enforcement action  In response, some stakeholders said that FTC’s enforcement priorities are reflected in its settlement agreements, which provide information that is similar to a body of case law  Individual commissioners also may issue statements explaining their decisions  Two stakeholders also said that FTC’s closing letters, which the agency sends to companies and posts on its website when it closes an investigation without taking enforcement action, may explain its decisions  Other stakeholders said that more guidance would be helpful to provide additional clarity on how the agency uses its Internet privacy enforcement authority  FTC staff and other stakeholders also said that FTC has provided useful Internet privacy guidance  For example, in 2015, FTC published guidance for businesses on complying with COPPA  Various stakeholders we interviewed said that opportunities exist for enhancing Internet privacy oversight  A key component of FTC’s mission, as specified by the FTC Act, is to protect consumers against unfair and deceptive practices  As discussed earlier, some stakeholders believe that FTC’s reliance on its unfair and deceptive practices authority to address Internet privacy issues has limitations  In addition, although the Fair Information Practice Principles provide internationally recognized principles for protecting the privacy and security of personal information, they are not legal requirements and FTC cannot rely on them to define what constitutes unfair and deceptive practices related to privacy and data security  We stated in our 2013 information resellers report that the current U S  privacy framework is not always aligned with the Fair Information Practice Principles and that these principles provide a framework for balancing the need for privacy with other interests  We found that there are limited privacy protections under federal law for consumer data used for marketing purposes  We said that although the Fair Information Practice Principles call for restraint in the collection and use of personal information, the scope of protections provided under current law has been narrow in relation to: (1) individuals’ ability to access, control, and correct their personal data; (2) collection methods and sources and types of consumer information collected; and (3) new technologies, such as tracking of web activity and the use of mobile devices  Although we recommended in that report that Congress consider strengthening the consumer privacy framework to reflect the effects of changes in technology and the marketplace, this matter for congressional consideration was not specific to Internet privacy or to the oversight authorities of any particular agency or agencies  As noted above, various stakeholders expressed concern about the ability of consumers to control their data and understand how that data are used  These concerns suggest that companies are not always following the Fair Information Practice Principles, such as that companies’ data practices should be transparent, allow consumers the right to access and edit their data, and limit the collection of data to the extent feasible  Those stakeholders who believe that FTC’s current authority and enforcement approach is unduly limited identified three main actions that could better protect Internet privacy: (1) enactment of an overarching federal privacy statute to establish general requirements governing Internet privacy practices of all sectors; (2) APA section 553 notice-and- comment rulemaking authority; and (3) civil penalty authority for any violation of a statutory or regulatory requirement, rather than allowing penalties only for violations of settlement agreements or consent decrees that themselves seek redress for a statutory or regulatory violation  Stakeholders from a variety of perspectives—including from academia, industry, consumer advocacy groups, and former FTC and FCC commissioners—told us that a privacy statute could enhance Internet privacy oversight by, for example, clearly articulating to consumers, industry, and privacy enforcers what behaviors are prohibited, among other things  In addition, a former FCC commissioner said that a new privacy statute could enhance Internet privacy oversight by creating uniform standards for all players in the Internet ecosystem that is focused on the consumer rather than the regulatory legacy of the companies involved (regulations that apply to specific types of companies based on what they are or used to be, such as telecommunications carriers, cable companies, broadcasters, and mobile wireless providers)  The former FCC commissioner said that as companies, technologies, and markets change, there is a question about whether existing law should be modernized  In 2015, FTC staff recommended that Congress enact broad-based legislation that is flexible and technology-neutral, while also providing clear rules of the road for companies about such issues as how to provide choices to consumers about data collection and use practices  Some stakeholders suggested that such a framework could either designate an existing agency as responsible for privacy oversight (such as FTC) or create a new privacy-oriented agency  A representative from a consumer advocacy group mentioned that the European Union, for example, has established the European Data Protection Supervisor, an independent data protection authority, to monitor and ensure the protection of personal data and privacy  Similarly, in Canada, the Office of the Privacy Commissioner, an independent body that reports directly to the Parliament, was established to protect and promote individuals’ privacy rights  Some stakeholders also stated that the absence of a comprehensive Internet privacy statute affects FTC’s enforcement  For example, a former federal enforcement official said that FTC is limited in how it can use its authority to take action against companies’ unfair and deceptive trade practices for problematic Internet privacy practices  Similarly, another former federal enforcement official said that FTC is limited in how and against whom it can use its unfair and deceptive practices authority noting, for example, that it cannot pursue Internet privacy enforcement over exempted industries such as common carriers  In addition, a former FCC commissioner said that it is more difficult for FTC to take effective action because its enforcement comes only after a complaint and after an often lengthy review process  The former FCC commissioner also said that without “ex ante” rules (rules that define prohibited activity before it has occurred), there inevitably will be delay, confusion, and lack of knowledge about what is and is not acceptable behavior  In addition, some stakeholders—including a representative from a consumer group, a former federal enforcement official, and a former FCC commissioner—said FTC’s section 5 “unfair or deceptive practices” authority may not enable it to fully protect consumers’ Internet privacy because it can be difficult for FTC to establish that Internet privacy practices are legally “unfair ” For example, under section 5, FTC has charged companies with committing a “deceptive” practice if their privacy policies said they would not collect or use consumers’ personal information but then did so  However, a former congressional staff member said that companies often write broad and vague policy statements, making it difficult for FTC to charge companies with committing deceptive practices  Instead, according to a representative from a consumer advocacy group, FTC would have to show the companies’ actions were “unfair,” which, according to the representative, is legally difficult to establish  We found in our 2017 report on vehicle data privacy that most automakers’ written privacy notices used vague language  Similarly, we found in our 2012 report on mobile device location data that although companies’ policies stated that they shared location data with third parties, they were sometimes vague about which types of companies these were and why they were sharing the data  Some stakeholders said that FTC relies more heavily on its authority to take enforcement action against deceptive trade practices compared with the agency’s unfair trade practices authority  This was confirmed in our analysis of FTC’s Internet privacy enforcement actions discussed previously  However, a representative from a consumer advocacy group said that FTC’s ability to take such action is limited practically to instances where a company violates its own privacy policy—companies generally can collect and use data in any way they want if they include language in their policies asserting their intent to do so  According to a former FCC commissioner, a privacy statute could clarify the situations in which FTC could take enforcement action  Various stakeholders said that there are advantages to overseeing Internet privacy with a statute that provides APA section 553 notice-and- comment rulemaking authority  As discussed above, that provision lays out the basic process by which so-called informal agency rulemaking shall be conducted, namely, publication of proposed regulations in the Federal Register; an opportunity for public comment (written and possibly oral submission of data and views); and publication of final regulations in the Federal Register with an explanation of the rules’ basis and purpose  Also as noted above, Congress imposed additional rulemaking steps on FTC in the Magnuson-Moss Act when FTC is promulgating rules under section 5 of the FTC Act  These additional steps include providing the public and certain congressional committees with advance notice of proposed rulemaking (in addition to notice of proposed rulemaking)  FTC’s rulemaking under Magnuson-Moss also calls for, among other things, oral hearings, if requested, presided over by an independent hearing officer, and preparation of a staff report after the conclusion of public hearings, giving the public the opportunity to comment on the report  Finally, Congress made it easier for the public to appeal FTC’s Magnuson-Moss rules by making the agency meet a higher standard when the rules are challenged in court  FTC staff said that these additional steps add time and complexity to the rulemaking process  In congressional testimony in 2010, the then-Director of FTC’s Bureau of Consumer Protection said that “if Congress enacts privacy legislation, the commission agrees that such legislation should provide APA rulemaking authority to the commission ” According to FTC, this testimony was voted on and approved by the commissioners and, therefore, constituted the commission’s official position at the time  Moreover, according to stakeholders, in many cases regulations can be used to implement statutes  Officials from other consumer and worker protection agencies we interviewed described their enforcement authorities and approaches  For example, officials from the CFPB and the FDA, both of which use APA section 553 notice-and-comment rulemaking, said that their rulemaking authority assists in their oversight approaches and works together with enforcement actions  OSHA officials said that the standards that the agency promulgates under its authority specify what employers are required to do to reduce safety and health risks to workers  Such standards lay out the workplace conditions that must be maintained by employers and require that employers implement certain practices, operations, or processes that ensure worker protections  EEOC officials said that regulations are used to guide investigations that establish whether enforcement action is appropriate  CPSC officials said that the agency conducts consumer protection not only by establishing and enforcing mandatory regulations, but also through collaborative actions such as educating industry, developing consensus voluntary safety standards, removing defective products from the marketplace through voluntary corrective actions, and litigating when necessary  In addition, in contrast to FTC’s approach, FCC has APA section 553 notice-and-comment rulemaking authority and has issued regulations implementing section 222 of the Communications Act using that rulemaking authority to protect the privacy of telephone users  Some stakeholders suggested that FTC’s current ability to levy civil penalties could also be enhanced  Currently, FTC can levy civil penalties against companies for violating certain regulations, such as COPPA regulations, or if the company violates the terms of a settlement agreement already in place  According to most former FTC commissioners and some other stakeholders we interviewed, FTC should be able to levy fines for initial violations of section 5 of the FTC Act  An academic told us that the power of an agency to levy a fine is a tangible way to hold industries accountable  Another academic noted, however, that fines may be relatively less effective in industries where there is limited competition because the costs of those fines may be more effectively passed on to consumers in the form of higher prices for services  In addition, some stakeholders said that payments required by FTC orders are not large enough to act as a deterrent and that companies may consider them to be a cost of doing business  There is a growing debate about the federal government’s role in overseeing Internet privacy  In a July 2018 congressional hearing, FTC’s new chair testified that the FTC Act cannot address all privacy and data- security concerns in the marketplace  The chair said, for example, that FTC’s lack of civil penalty authority for violations of the FTC Act reduces its deterrent capability  He also noted the agency lacks authority over non-profits and over common carrier activity, even though those entities and activities often have serious implications for consumer privacy and data security  In November 2018, FTC’s chair testified before Congress and urged Congress to consider enacting privacy legislation that would be enforced by FTC  A majority of the commission has indicated support for APA rulemaking and civil penalty authority for privacy  FTC also held hearings in September, November, and December 2018 to advance the discussion around privacy issues, among other topics, and FTC plans to hold an additional hearing on data security and consumer privacy in February 2019  In a Federal Register notice, FTC announced that it is interested in the benefits and costs of various state, federal and international privacy laws and regulations, including the potential conflicts among those standards  FTC also indicated that it is particularly interested in the efficacy of the commission’s use of its current authority and the identification of any additional tools or authorities the commission may need to adequately deter unfair and deceptive conduct related to privacy and data security  Also in July 2018, an NTIA official announced that NTIA, in coordination with the Commerce Department’s International Trade Administration and National Institute of Standards and Technology, had recently started holding stakeholder meetings to identify common ground and formulate core, high-level principles on data privacy  Regarding the development of the Administration’s approach to consumer privacy, in September 2018, NTIA requested comments on ways to advance consumer privacy while protecting prosperity and innovation  Our 2009 report on a framework for assessing proposals for modernizing the financial regulatory system similarly found that regulators should have the authority to carry out and enforce their statutory missions  We further said that a regulatory system should be flexible and forward looking, allowing regulators to readily adapt to market innovations and changes, including identifying and acting on emerging risks in a timely way without hindering innovation  These factors are useful considerations as the federal government explores how it can better oversee privacy and data security  Having sufficient and appropriate authorities and providing flexibility to address a rapidly evolving Internet environment could better ensure that the federal government can protect consumers’ privacy  Recent developments regarding Internet privacy suggest that this is an appropriate time for Congress to consider comprehensive Internet privacy legislation  Although FTC has been addressing Internet privacy through its unfair and deceptive practices authority, among other statutes, and other agencies have been addressing this issue using industry-specific statutes, there is no comprehensive federal privacy statute with specific standards  Debate over such a statute could provide a vehicle for consideration of the Fair Information Practice Principles, which are intended to balance privacy concerns with the need for using consumers’ data  Such a law could also empower a specific agency or agencies to provide oversight through means such as APA section 553 rulemaking, civil penalties for first time violations of a statute, and other enforcement tools  Comprehensive legislation addressing Internet privacy that establishes specific standards and includes APA notice-and-comment rulemaking and first-time violation civil penalty authorities could help enhance the federal government’s ability to protect consumer privacy, provide more certainty in the marketplace as companies innovate and develop new products using consumer data, and provide better assurance to consumers that their privacy will be protected  Congress should consider developing comprehensive legislation on Internet privacy that would enhance consumer protections and provide flexibility to address a rapidly evolving Internet environment  Issues that should be considered include: which agency or agencies should oversee Internet privacy; what authorities an agency or agencies should have to oversee Internet privacy, including notice-and-comment rulemaking authority and first-time violation civil penalty authority; and how to balance consumers’ need for Internet privacy with industry’s ability to provide services and innovate  We provided a draft of this report to FTC, FCC, and the Department of Commerce for their review and comment  FTC and FCC provided technical comments, which we incorporated as appropriate  The Department of Commerce indicated that it did not have comments  As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date  At that time, we will send copies to the FTC chair, the FCC chair, the Secretary of Commerce, and interested congressional committees  In addition, the report will be available at no charge on the GAO website at http://www gao gov  If you or members of your staff have any questions about this report, please contact Alicia Puente Cackley at (202) 512-8678 or cackleya@gao gov or Mark Goldstein at (202) 512-2834 or goldsteinm@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  Major contributors to this report are listed in appendix III  For this review, we interviewed staff from agencies with roles in Internet privacy; officials from other consumer- and worker-protection agencies; stakeholders from consumer advocacy groups, industry groups, Internet service providers, and Internet content providers; academics; and former government officials  To obtain a variety of perspectives, we selected Internet service providers that represented different industry sectors and Internet content providers that provide a variety of information and social media services  Academic stakeholders were selected because of their expertise in privacy, consumer protection, and regulatory issues  We also interviewed former Federal Trade Commission (FTC) and Federal Communications Commission (FCC) commissioners who served during the Barack Obama and George W  Bush administrations and are from different political parties  Consumer Financial Protection Bureau (CFPB) Consumer Product Safety Commission (CPSC) Department of Commerce, National Telecommunications and Information Administration (NTIA) Equal Employment Opportunity Commission (EEOC) Federal Communications Commission (FCC) Federal Trade Commission (FTC) Food and Drug Administration (FDA) Occupational Safety and Health Administration (OSHA) The following table identifies 101 Federal Trade Commission (FTC) Internet privacy enforcement actions filed between July 1, 2008 and June 30, 2018 in which the agency alleged a violation of either the Federal Trade Commission Act (FTC Act) or the Children’s Online Privacy Protection Act (COPPA) and implementing COPPA regulations and subsequently entered into a settlement agreement with the target entity  Although some of these cases may involve both Internet data privacy and security issues, this table does not include cases that involved data security issues only  In addition to the contact names above, Andrew Huddleston, Assistant Director; Kay Kuhlman, Assistant Director; Bob Homan, Analyst-in- Charge; Melissa Bodeau; John de Ferrari; Camilo Flores; Erica Miles; Josh Ormond; and Sean Standley made significant contributions to this report 


Report 2:  A JCL is an integrated analysis of a project’s cost, schedule, risk, and uncertainty whose result indicates the probability of a project’s success of meeting cost and schedule targets  NASA policy states that a JCL should be recalculated and approved as a part of the rebaselining approval process, but it is not required  In its replan decision memo, NASA’s associate administrator explained that he did not require the project to update the JCL because project costs are almost entirely related to the workforce and most of the remaining planned activities will be performed generally in sequence  Therefore, according to NASA’s associate administrator, the total cost would be driven almost entirely by the schedule because the workforce levels will remain the same through delivery of the observatory  Both the project and independent estimators used multiple schedule estimating methods to analyze the schedule for the remaining work, and NASA’s associate administrator said these analyses returned consistent, high confidence launch dates  The project’s ability to execute to its new schedule will be tested as it progresses through the remainder of challenging integration and test work  The project has yet to complete three of five integration and test phases  The remaining phases include integration and test of OTIS, the spacecraft element, and the observatory  Our prior work has shown that integration and testing is the phase in which problems are most likely to be found and schedules tend to slip  For a uniquely complex project such as JWST, this risk is magnified as events start to become more sequential in nature  As a result, it will continue to become more difficult for the project to avoid schedule delays by mitigating issues in parallel  As of November 2018, the project is about a week behind its replanned schedule because repairs on the membrane cover assembly took longer than planned  Completing the membrane cover assembly repairs and returning the spacecraft to vibration testing was a key event for the project to demonstrate that it could execute to its new schedule  When the project developed its 2018 replanned schedule, it had planned to complete the membrane cover assembly repairs and reinstall the assembly onto the sunshield and restart spacecraft element integration and test activities by November 6, 2018  The project allocated 4 weeks of schedule reserves specifically for these repairs  However, the membrane cover repairs proved more difficult than anticipated  For example, the program had to address unanticipated technical challenges on the membrane cover assemblies, including repairing tears and pin holes in the covers discovered after the covers were removed  The project also had to allot time to install bumpers, which are kapton tubes, to the assembly to protect the composite material on a sunshield structure during launch  The project identified the need to add the bumpers during subassembly vibration testing  As a result, as of November 2018, the project had used about 4 5 weeks of schedule reserves to cover delays associated with these activities  The use of reserves beyond what the project had planned for the repairs pushed the restart of spacecraft element integration and test activities out about a week to November 14, 2018  Figure 6 compares the project’s initial membrane cover assembly schedule in June 2018 to the actual schedule in November 2018  While the project repaired the membrane cover assembly, it also used this time to conduct risk mitigation activities on OTIS  For example, the project worked to mitigate a design issue on the frill connections  The frill is composed of a single layer of blankets placed around the outside of the primary mirror used to block stray light (see figure 7)  A combination of modeling and inspections revealed that most of the frill sections did not have as much slack as expected at the near-absolute zero cryogenic temperatures of space  This caused shrinkage that put stress on the edges of the outer ring of mirrors, which could affect the stability of the optical mirror and image quality  The project loosened these outer connections by adding a ring to the connecting points  As of November 2018, project officials said they were in the process of verifying the fix through inspections  Examples of technical issues and risks that the project continues to face during the remaining phases of integration and test include: The project is working to mitigate a design issue on the sunshield membrane tensioning system—which helps deploy the sunshield and maintain its correct shape  In our February 2018 report, we found that Northrop Grumman was planning to modify the design of the membrane tensioning system after one of the sunshield’s six membrane tensioning systems experienced a snag when conducting folding and deployment exercises on the sunshield in October 2017  The project and Northrop Grumman determined that a design modification was necessary to fully mitigate the issue, which includes modifying clips used to progressively release the cable tension and adding guards to control the excess cable  The project identified a concern that the depressurization of trapped air in the folded sunshield membrane when the fairing separates to release the JWST observatory may overly stress the membrane material  The project is working with Arianespace—the company responsible for operating JWST’s launch vehicle—and experts at the Kennedy Space Center to resolve this concern  Officials estimated that a design solution would be in place in mid-2019  However, if the project determines that it needs to reinforce the membrane covers to survive excessive residual pressure as it works on this design solution, a multi-month schedule delay could occur  As of November 2018, the project has mitigated 21 of its 47 hardware and software risks to acceptable levels, and reviews these risks monthly for any changes that might affect the continued acceptability of the risk  Five of these 21 risks are related to the project’s more than 300 potential single point failures—several of which are related to the deployment of the sunshield  The project is actively working to mitigate the remaining 26 risks to acceptable levels or closure prior to launching  The project also has several first-time and challenging integration and test activities remaining  For example, the project must integrate OTIS and the completed spacecraft element and test the full observatory in the final integration phase, which includes another set of challenging environmental tests  See figure 8 for an image of OTIS and the spacecraft element prior to being integrated  As previously discussed, the project also has two remaining deployments of the sunshield, and prior deployments have taken longer than planned  To help mitigate the risks associated with the deployments, the project added additional time for deployments in the 2018 replanned schedule based on lessons learned from prior deployments  The two remaining deployments are to occur after spacecraft element integration and test and again after observatory integration and test  The JWST project office is required to evaluate whether the project can complete development within its revised cost and schedule commitments at its next major review—the system integration review—planned for August 2019  This review is to occur after the project has completed two major tasks—OTIS and spacecraft element integration and test  The review is to evaluate whether the project (1) is ready to enter observatory integration and test, and (2) can complete remaining project development with acceptable risk and within its cost and schedule constraints  NASA guidance does not require projects to conduct a JCL at this review  However, project officials said that they plan to conduct another schedule risk analysis in the future  They do not intend to complete a new JCL for the same reasons they did not complete one for the 2018 replan— because costs are almost entirely related to the workforce and can be derived from a schedule that takes into account known risk  While not required, conducting a JCL prior to the system integration review would inform NASA about the probability of meeting both its cost and schedule commitments  If the project proceeds with its plan to conduct only a schedule risk analysis, NASA would be provided only with an updated probability of meeting its schedule commitments  Our cost estimating best practices recommend that cost estimates should be updated to reflect changes to a program or kept current as it moves through milestones and as new risks emerge  In addition, government and industry cost and schedule experts we spoke with noted that integration and testing is a critical time for a project when problems can develop  These experts told us that completing a JCL is a best practice for analyzing major risks at the most uncertain part of project execution  Conducting a JCL at system integration review—a review that occurs during the riskiest phase of development, the integration and test phase— would allow the project to update its assumptions of risk and uncertainty based on its experiences in OTIS and spacecraft element integration and test  The project could then determine how those updated assumptions affect overall cost and schedule for the JWST project  As noted above, the project has many risks to mitigate, technical challenges to overcome, and challenging test events to complete, which could affect the project’s schedule and risk posture  Further, the project has an established history of significant cost growth and schedule delays  In its June 2018 letter notifying an appropriate congressional committee of its updated cost and schedule commitments, NASA acknowledged that recent cost growth for the project will likely impact other science missions  Conducting a JCL at system integration review would provide NASA and Congress with critical information for making informed resource decisions on the JWST project and its affordability within NASA’s portfolio of projects more broadly  NASA has taken steps to augment oversight of the contractor and project following the discovery of the embedded design flaws and workmanship errors that contributed to the project’s most recent schedule delays and cost increases  See table 1 for examples of changes NASA has made to contractor and project oversight—some of which NASA self-identified and others that were in response to IRB recommendations  The IRB made 31 recommendations that ranged from improving employee morale to improving security during transporting JWST to its launch site  NASA has also used award fees to try to incentivize Northrop Grumman to improve its performance  In a July 2018 hearing on the JWST program before the House Science, Space, and Technology Committee, Administrator Bridenstine stated that NASA had reduced the available award fee through commissioning by $28 million out of a total of about $60 million  Northrop Grumman also did not earn its full award fee in the two most recent periods of performance that NASA assessed  For the performance period of April 1, 2017 to September 30, 2017, Northrop Grumman earned approximately 56 percent of the available award fee  Reasons that NASA cited for its evaluation of award fees in this period included workmanship errors on the propulsion system, schedule delays, as well as issues with schedule execution, management, and quality control  For the period of October 1, 2017 to March 31, 2018, Northrop Grumman earned none of the available award fee  Northrop Grumman’s overall score was driven by an “unacceptable” rating in schedule and cost due to delays and in anticipation of exceeding the project’s $8 billion cost cap  Northrop Grumman received an “excellent” rating under the technical category, but the evaluation noted ongoing issues with quality controls, which resulted in delays  For example, the process steps for applying voltage to the spacecraft’s pressure transducers were not clear enough, which resulted in technician error and irreparable damage to the hardware  According to Northrop Grumman officials, the contractor has started to take action to try to improve its quality assurance processes  Officials described actions that ranged from rewriting hardware integration and test procedures to starting efforts to change aspects of the company’s culture that contributed to quality control issues  For example, in July 2018, Northrop Grumman initiated a JWST mission assurance culture change campaign to increase focus on product quality and process compliance  This effort includes having inspectors affirm by signature that they have personally inspected, verified, and confirmed that all aspects of an activity meet quality standards  According to the form instructions, if the inspector is uncertain on compliance or if instructions are unclear, workers are to halt work, investigate and assess the situation, and request help to resolve the situation  Project and Northrop Grumman officials provided an example of these changes working  During a manual deployment of a radiator panel, a Northrop Grumman employee discovered that a flap used as thermal protection for a radiator was installed incorrectly and reported the error  Northrop Grumman technicians found that this flap had been swapped with another flap in the process of moving them to be installed and corrected the problem before work proceeded  Further, NASA and Northrop Grumman are conducting audits to try to minimize the risk of failures during the remaining phases of integration and test  These audits are conducted on items that have not been fully tested, are in workmanship-sensitive areas, or have had a late design change  The first phase of the audit was completed in September 2018 and found no major design issues or hardware rework required  The project plans to audit other areas through at least spring 2019, but will add audits if needed  The JWST oversight structure includes a number of positions that could be responsible for ensuring that the recent augmentations to contractor and project oversight are sustained through launch (see table 2)  In response to our review, NASA officials clarified that the project manager has sole responsibility for ensuring that these improvements are sustained through launch  Further, these officials stated that the project office is responsible for monitoring these changes at the project level and at Northrop Grumman  The project manager’s continued focus on these efforts will be important because: The project is implementing a wide span of improvement efforts, ranging from more on-site coverage at the contractor facility to cultural improvements, which will now need to be sustained for an additional 29 months  The project has had recurring issues with effective internal and external communication as well as defining key management and oversight responsibilities, both of which are important to sustaining oversight  For example, the Independent Comprehensive Review Panel identified communication problems—between the JWST project and Science Mission Directorate management as well as between NASA and Northrop Grumman—and that the project’s governance structure lacked clear lines of authority and accountability  In December 2012, we found the JWST project had taken several steps to improve communication—such as instituting meetings that include various levels of NASA, contractor, and subcontractor management— but the IRB’s findings in 2018 indicate that communication and governance issues have resurfaced in some areas  For example, the IRB found that communication with key stakeholders including the science community, Congress, and NASA leadership, has been variable and at times inconsistent  The project may encounter new schedule pressures as it proceeds through integration and test  A senior NASA official with expertise in workmanship issues told us that schedule pressure is a key reason for increased quality problems on projects  For example, this official said that companies tend to give experts leniency to operate without the burden of quality assurance paperwork when schedule pressures arise, which can lead to workmanship errors  While JWST project officials told us they do not view this as applicable to their project, the perspective regarding potential schedule pressures and workmanship is important to keep focus on given the magnitude of technical challenges and delays the project has faced  We will continue to monitor the project’s efforts at maintaining these oversight augmentations in future reviews, given that less than a year has passed since the project began implementing many of them  Moreover, the project may find that some actions will be required of officials outside the project, particularly since the communication problems identified by the IRB may well extend to headquarters’ interaction with stakeholders from the science community, industry, and the Congress  JWST is one of NASA’s most expensive and complex science projects, and NASA has invested considerable time and resources on it  The project first established its cost and schedule baseline in 2009  Since then, the project made progress by completing two of five phases of integration and test, but has also experienced significant cost growth and schedule delays  However, the project did not complete a JCL analysis as part of its second replan  Between now and its system integration review planned for August 2019, the JWST program will have to continue to address technical challenges and mitigate risks  Conducting a JCL would better inform decision makers on the status of the project as they determine whether the project can complete remaining project development with acceptable risk and within its cost and schedule constraints  Given the project is now on its third iteration of cost and schedule commitments, conducting a JCL is a small step that NASA can take to demonstrate it is on track to meet these new commitments  We are making the following recommendation to NASA: The NASA Administrator should direct the JWST project office to conduct a JCL prior to its system integration review  (Recommendation 1) We provided a draft of this report to NASA for comment  In written comments, NASA agreed with our recommendation  NASA expects to complete the JCL by September 2019, prior to the system integration review  The comments are reprinted in appendix II  NASA also provided technical comments, which have been addressed in the report, as appropriate  We are sending copies of this report to the appropriate congressional committees, the NASA Administrator, and other interested parties  In addition, the report is available at no charge on the GAO website at http://www gao gov  If you or your staff have any questions on matters discussed in this report, please contact me at (202) 512-4841 or chaplainc@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  GAO staff who made key contributions to this report are listed in appendix III  In addition to the contact named above, Molly Traci (Assistant Director), Karen Richey (Assistant Director), Jay Tallon (Assistant Director), Brian Bothwell, Daniel Emirkhanian, Laura Greifner, Erin Kennedy, Jose Ramos, Sylvia Schatz, Roxanna Sun, and Alyssa Weir made key contributions to this report 

ground_truth: In April 2018, Facebook disclosed that a Cambridge University researcher may have improperly shared the data of up to 87 million of its users with a political consulting firm. This disclosure followed other recent incidents involving the misuse of consumers' personal information from the Internet, which is used by about three-quarters of Americans. GAO was asked to review federal oversight of Internet privacy. This report addresses, among other objectives: (1) how FTC and FCC have overseen consumers' Internet privacy and (2) selected stakeholders' views on the strengths and limitations of how Internet privacy currently is overseen and how, if it all, this approach could be enhanced. GAO evaluated FTC and FCC Internet privacy enforcement actions and authorities and interviewed representatives from industry, consumer advocacy groups, and academia; FTC and FCC staff; former FTC and FCC commissioners; and officials from other federal oversight agencies. Industry stakeholders were selected to represent different sectors, and academics were selected because of their expertise in privacy, consumer protection, and regulatory issues. The United States does not have a comprehensive Internet privacy law governing the collection, use, and sale or other disclosure of consumers' personal information. At the federal level, the Federal Trade Commission (FTC) currently has the lead in overseeing Internet privacy, using its statutory authority under the FTC Act to protect consumers from unfair and deceptive trade practices. However, to date FTC has not issued regulations for Internet privacy other than those protecting financial privacy and the Internet privacy of children, which were required by law. For FTC Act violations, FTC may promulgate regulations but is required to use procedures that differ from traditional notice-and-comment processes and that FTC staff said add time and complexity. In the last decade, FTC has filed 101 enforcement actions regarding Internet privacy; nearly all actions resulted in settlement agreements requiring action by the companies. In most of these cases, FTC did not levy civil penalties because it lacked such authority for those particular violations. The Federal Communications Commission (FCC) has had a limited role in overseeing Internet privacy. From 2015 to 2017, FCC asserted jurisdiction over the privacy practices of Internet service providers. In 2016, FCC promulgated privacy rules for Internet service providers that Congress later repealed. FTC resumed privacy oversight of Internet service providers in June 2018. Stakeholders GAO interviewed had varied views on the current Internet privacy enforcement approach and how it could be enhanced. Most Internet industry stakeholders said they favored FTC's current approach—direct enforcement of its unfair and deceptive practices statutory authority, rather than promulgating and enforcing regulations implementing that authority. These stakeholders said that the current approach allows for flexibility and that regulations could hinder innovation. Other stakeholders, including consumer advocates and most former FTC and FCC commissioners GAO interviewed, favored having FTC issue and enforce regulations. Some stakeholders said a new data-protection agency was needed to oversee consumer privacy. Stakeholders identified three main areas in which Internet privacy oversight could be enhanced: Statute . Some stakeholders told GAO that an overarching Internet privacy statute could enhance consumer protection by clearly articulating to consumers, industry, and agencies what behaviors are prohibited. Rulemaking . Some stakeholders said that regulations can provide clarity, enforcement fairness, and flexibility. Officials from two other consumer protection agencies said their rulemaking authority assists in their oversight efforts and works together with enforcement actions. Civil penalty authority. Some stakeholders said FTC's Internet privacy enforcement could be more effective with authority to levy civil penalties for first-time violations of the FTC Act. Comprehensive Internet privacy legislation that establishes specific standards and includes traditional notice-and-comment rulemaking and broader civil penalty authority could enhance the federal government's ability to protect consumer privacy. Congress should consider developing comprehensive legislation on Internet privacy that would enhance consumer protections and provide flexibility to address a rapidly evolving Internet environment. Issues that should be considered include what authorities agencies should have in order to oversee Internet privacy, including appropriate rulemaking authority.

prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 2.



Report 2: This report provides background information and issues for Congress on the John Lewis (TAO-205) class oiler shipbuilding program, a program to build a new class of 20 fleet oilers for the Navy  The Navy's proposed FY2020 budget requests the procurement of the fifth and sixth ships in the program  Issues for Congress regarding the TAO-205 program include the following: whether to approve, reject, or modify the Navy's FY2020 procurement funding request for the program; the number of oilers the Navy will require in coming years to support its operations; and whether to encourage or direct the Navy to build TAO-205s with more ship self-defense equipment than currently planned by the Navy  Decisions that Congress makes regarding the program could affect Navy capabilities and funding requirements and the U S  shipbuilding industrial base  For an overview of the strategic and budgetary context in which the TAO-205 program and other Navy shipbuilding programs may be considered, see CRS Report RL32665, Navy Force Structure and Shipbuilding Plans: Background and Issues for Congress , by Ronald O'Rourke  The primary role of Navy fleet oilers is to transfer fuel to Navy surface ships that are operating at sea, so as to extend the operating endurance of these surface ships and their embarked aircraft  Fleet oilers also provide other surface ships with lubricants, fresh water, and small amounts of dry cargo  Fleet oilers transfer fuel and other supplies to other surface ships in operations called underway replenishments (UNREPs)  During an UNREP, an oiler steams next to the receiving ship and transfers fuel by hose (see Figure 1 , Figure 2 , and Figure 3 )  Oilers are one kind of Navy UNREP ship; other Navy UNREP ships include ammunition ships, dry cargo ships, and multiproduct replenishment ships  The Navy's UNREP ships are known more formally as the Navy's combat logistics force (CLF)  Most of the Navy's CLF ships are operated by the Military Sealift Command (MSC)  Navy oilers carry the designation TAO (sometimes written as T-AO)  The T means that the ships are operated by MSC with a mostly civilian crew; the A means it is an auxiliary ship of some kind; and the O means that it is, specifically, an oiler  Although the role of fleet oilers might not be considered as glamorous as that of other Navy ships, fleet oilers are critical to the Navy's ability to operate in forward-deployed areas around the world on a sustained basis  The U S  Navy's ability to perform UNREP operations in a safe and efficient manner on a routine basis is a skill that many other navies lack  An absence of fleet oilers would significantly complicate the Navy's ability to operate at sea on a sustained basis in areas such as the Western Pacific or the Indian Ocean/Persian Gulf region  The Navy states that the ability to rearm, refuel and re-provision our ships at sea, independent of any restrictions placed on it by a foreign country, is critical to the Navy's ability to project warfighting power from the sea  As the lifeline of resupply to Navy operating forces underway, the ships of the Navy's Combat Logistic Force (CLF) enable Carrier Strike Groups and Amphibious Ready Groups to operate forward and remain on station during peacetime and war, with minimal reliance on host nation support  The Navy's existing force of fleet oilers consists of 15 Henry J  Kaiser (TAO-187) class ships ( Figure 4 )  These ships were procured between FY1982 and FY1989 and entered service between 1986 and 1996  They have an expected service life of 35 years; the first ship in the class will reach that age in 2021  The ships are about 677 feet long and have a full load displacement of about 41,000 tons, including about 26,500 tons of fuel and other cargo  The ships were built by Avondale Shipyards of New Orleans, LA, a shipyard that eventually became part of the shipbuilding firm Huntington Ingalls Industries (HII)  HII subsequently wound down Navy shipbuilding operations at Avondale, and the facility no longer builds ships  (HII continues to operate two other shipyards that build Navy ships ) The TAO-205 class program was originally called the TAO(X) program, with the (X) meaning that the exact design of the ship had not yet been determined  On January 6, 2015, then-Secretary of the Navy Ray Mabus announced that ships in the class will be named for "people who fought for civil rights and human rights," and that the first ship in the class, TAO-205, which was procured in FY2016, will be named for Representative John Lewis  The class consequently is now known as the John Lewis (TAO-205) class  As part of its goal for achieving a fleet of 355 ships, the Navy wants to procure a total of 20 TAO-205 class ships  The required number of oilers largely depends on the numbers and types of other surface ships (and their embarked aircraft) to be refueled, and the projected operational patterns for these ships and aircraft  The first TAO-205 class ship was procured in FY2016, the second in FY2018, and the third and fourth in FY2019  The Navy's FY2020 five-year (FY2020-FY2023) shipbuilding plan calls for procuring the next seven ships in the class in annual quantities of 2-1-1-2-1  The Navy's FY2020 30-year (FY2020-FY2049) shipbuilding plan calls for procuring the remaining nine ships in the program at a rate of one per year starting in FY2025  The first TAO-205 is scheduled for delivery in November 2020  Table 1 shows procurement funding for the TAO-205 program in the Navy's FY2020 budget submission  The Navy's FY2020 budget submission estimates the total procurement cost of the 20 planned TAO-205s at $12,196 1 million (i e , about 12 2 billion) in then-year dollars, or an average of $609 8 million each  Since the figure of $12,196 1 million is in then-year dollars, it incorporates estimated annual inflation rates for TAO-205s to be procured out to FY2033  The TAO-205 class design ( Figure 5 ) will have capabilities similar to those of the Kaiser-class ships, and will rely on existing technologies rather than new technologies  To guard against oil spills, TAO-205s are to be double-hulled, like modern commercial oil tankers, with a space between the two hulls to protect the inner hull against events that puncture the outer hull  (The final Kaiser-class ships are double-hulled, but earlier ships in the class are single-hulled ) TAO-205s are being built by General Dynamics/National Steel and Shipbuilding Company (GD/NASSCO) of San Diego, CA, a shipyard that builds Navy auxiliaries and DOD sealift ships  On June 25, 2015, the Navy, as part of its acquisition strategy for TAO-205 program, issued a combined solicitation consisting of separate Requests for Proposals (RFPs) for the detailed design and construction (DD&C) of the first six TAO-205s; the DD&C in FY2017 (and also procurement of long lead-time materials in FY2016) for an amphibious assault ship called LHA-8 that the Navy procured in FY2017; and contract design support for the LPD-17 Flight II program (previously called the LX[R] program), a program to procure a new class of 13 amphibious ships  The Navy limited bidding in this combined solicitation to two bidders—Ingalls Shipbuilding of Huntington Ingalls Industries (HII/Ingalls) and GD/NASSCO—on the grounds that these are the only two shipbuilders that have the capability to build both TAO-205s and LHA-8  Under the Navy's plan for the combined solicitation, one of these two yards was to be awarded the DD&C contract for the first six TAO-205s, the other yard was to be awarded the DD&C contract (and procurement of long lead-time materials) for LHA-8, and the shipyard with the lowest combined evaluated price was to receive a higher profit on its DD&C contract and was to be awarded the majority of the LPD-17 Flight II contract design engineering man-hours  On June 30, 2016, the Navy announced its awards in the above-described combined solicitation, awarding a fixed price incentive block buy contract for the DD&C of the first six TAO-205s to GD/NASSCO  (The Navy awarded the contract for the DD&C of LHA-8 to HII/Ingalls  HII/Ingalls was also awarded the majority of the LPD-17 Flight II contract design engineering man-hours ) The Navy was granted authority for using a block buy contract to procure the first six TAO-205s by Section 127 of the FY2016 National Defense Authorization Act ( S  1356 / P L  114-92 of November 25, 2015)  It was earlier estimated that the block buy contract would reduce the procurement cost of the second through sixth TAO-205s by an average of about $45 million each, compared to costs under the standard or default DOD approach of annual contracting  The Navy states that about $35 million of the $45 million in per-ship savings will come from using advance procurement (AP) funding for batch-ordering TAO-205 components  The Navy states that this use of AP funding could have occurred under annual contracting, and that the savings that are intrinsic to the block buy contract are thus about $10 million per ship  Section 8117 of the FY2019 Appropriations Act (Division A of H R  6157 / P L  115-245 of September 28, 2018) states the following: Sec  8117  None of the funds provided in this Act for the TAO Fleet Oiler program shall be used to award a new contract that provides for the acquisition of the following components unless those components are manufactured in the United States: Auxiliary equipment (including pumps) for shipboard services; propulsion equipment (including engines, reduction gears, and propellers); shipboard cranes; and spreaders for shipboard cranes  The Appendix presents the Government Accountability Office's (GAO's) assessment of the TAO-205 class program from GAO's annual report surveying DOD major acquisition programs  The Navy's proposed FY2020 budget requests the procurement of the 5th and 6th ships in the program  The Navy estimates the combined procurement cost of the two ships at $1,056 3 million, or an average of $528 1 million each  The two ships have received $75 0 million in prior-year advance procurement (AP) funding, and the Navy's proposed FY2020 budget requests the remaining $981 2 million in procurement funding needed to complete the two ships' estimated combined procurement cost  The Navy's proposed FY2020 budget also requests $73 0 million in AP funding for TAO-205s to be procured in future fiscal years, and $3 7 million in cost-to-complete procurement funding to cover cost growth on TAO-205s procured in prior fiscal years, bringing the total FY2020 procurement funding request for the TAO-205 program (aside from outfitting and post-delivery costs) to $1,057 9 million  One issue for Congress is whether to approve, reject, or modify the Navy's FY2020 procurement funding request for the TAO-205 program  In assessing this issue, Congress may consider, among other things, whether the Navy has accurately priced the work that it is requesting to fund in FY2020  Another issue for Congress concerns the number of oilers the Navy will require in coming years to support its operations  The Navy is implementing a new operational concept, called Distributed Maritime Operations (DMO), that could lead to the development of a fleet with larger numbers of individually smaller ships, and to more-widely dispersed Navy operations  DMO could affect requirements for Navy logistics, including oilers  The Navy states that Recapitalizing the auxiliary and sealift fleet in support of DMO has become a top priority  The initial reviews of the requirements to support this operational maritime concept indicate potential growth across the five lines of effort: refuel, rearm, resupply, repair, and revive  Coincident is the review of the level of effort needed to distribute logistics into a contested maritime environment following safe transfer by the logistics fleet—smaller, faster, multi-mission transports likely resident within the future battle force  The work to fully flesh out the requirement is ongoing, but the aggregate is expected to be no less than the current requirement, reinforcing the urgency to recapitalize the current fleet  An August 2017 GAO report states the following: The readiness of the surge sealift and combat logistics fleets has trended downward since 2012  For example, GAO found that mission-limiting equipment casualties—incidents of degraded or out-of-service equipment—have increased over the past 5 years, and maintenance periods are running longer than planned, indicating declining materiel readiness across both fleets     The Navy has not assessed the effects of widely distributed operations, which could affect the required number and type of combat logistics ships  The Navy released its new operational concept of more widely distributed operations—ships traveling farther distances and operating more days to support a more distributed fleet—in 2017  The Navy has not assessed the effects that implementing this concept will have on the required number and type of combat logistics ships  These effects could be exacerbated in the event that the Navy is less able to rely on in-port refueling—which has comprised about 30 percent of all refuelings over the past 3 years—placing greater demand on the combat logistics fleet  Given the fleet's dependence on the combat logistics force, waiting until 2019 or 2020 to conduct an assessment, as planned, could result in poor investment decisions as the Navy continues to build and modernize its fleet  Furthermore, without assessing the effects of widely distributed operations on logistics force requirements and modifying its force structure plans accordingly, the Navy risks being unprepared to provide required fuel and other supplies  Another issue for Congress is whether to encourage or direct the Navy to build TAO-205s with more ship self-defense equipment than currently planned by the Navy  The issue relates to how changes in the international security environment might affect how the Navy operates and equips its underway replenishment ships  During the Cold War, the Navy procured underway replenishment ships to support a two-stage approach to underway replenishment in which single-product "shuttle" ships (such as oilers, ammunition ships, and dry stores ships) would take their supplies from secure ports to relatively safe midocean areas, where they would then transfer them to multiproduct "station" ships called TAOEs and AORs  The TAOEs and AORs would then travel to Navy carrier strike groups operating in higher-threat areas and transfer their combined supplies to the carrier strike group ships  As a result, single-product shuttle ships were equipped with lesser amounts of ship self-defense equipment, and TAOEs and AORs were equipped with greater amounts of such equipment  When the Cold War ended and transitioned to the post-Cold War era, threats to U S  Navy ships operating at sea were substantially reduced  As a consequence, the amount of ship self-defense equipment on the TAOEs and AORs was reduced, and a single-stage approach to underway replenishment, in which oilers and dry stores ships took supplies from secure ports all the way to carrier strike group ships, was sometimes used  Now that the post-Cold War era has transitioned to a new strategic environment featuring renewed great power competition with countries like China and Russia, and a consequent renewal of potential threats to U S  Navy ships operating at sea, the question is whether TAO-205s should be equipped with lesser amounts of ship self-defense equipment, like oilers were during both the Cold War and post-Cold War eras, or with greater amounts of ship self-defense equipment, like TAOEs and AORs were during the Cold War  Building TAO-205s with more ship self-defense equipment than currently planned by the Navy could increase TAO-205 procurement costs by tens of millions of dollars per ship, depending on the amount of additional ship self-defense equipment  Section 1026 of the FY2016 National Defense Authorization Act ( S  1356 / P L  114-92 of November 25, 2015) required an independent assessment of the Navy's combat logistics force ships  The report was delivered to Congress in February 2016  A copy of the report was posted by the media outlet Politico on March 11, 2016  The report states the following: The T-AO(X) will only have a limited capability to defeat a submarine launched torpedo attack and no capability to defeat a missile attack  When delivered, the TAO(X) will have: —[the] NIXIE Torpedo Countermeasure System [for decoying certain types of torpedoes] —[the] Advanced Degaussing System (Anti-Mine) [for reducing the ship's magnetic signature, so as to reduce the likelihood of attack by magnetically fused mines] When required, the T-AO(X) will also have ability to embark Navy Expeditionary Combat Command Expeditionary Security Teams (EST)  The ESTs will embark with several crew served weapons and are designed to provide limited self-defense against a small boat attack  The T-AO(X) will have Space, Weight, Power and Cooling (SWAP-C) margins for future installations of the following systems: —[the] Close In Weapon System (CIWS) or SeaRAM (Rolling Airframe Missile) [for defense against missile attack] —[the] Anti-Torpedo Torpedo Defense System (ATTDS) [for destroying torpedoes] Even after the installation of a CIWS or ATTDS, if the T-AO(X) was to operate in anything other than a benign environment, the ship will require both air and surface escorts  The decision to rely on [other] Fleet assets to provide force protection [i e , defense against attacks] for the T-AO(X) was validated by the JROC [in June 2015]  Table 2 summarizes congressional action on the Navy's request for FY2020 procurement funding for the TAO-205 program  A May 2019 GAO report—the 2019 edition of GAO's annual report surveying DOD major acquisition programs—stated the following regarding the TAO-205 program: Technology Maturity and Design Stability The Navy has matured all Lewis class critical technologies and stabilized the ships' design  In 2014, the Navy identified three critical technologies for the Lewis class, all of which involved a new system for transferring cargo at sea  Prior to initiating detail design activities in June 2016, the Navy completed prototype tests of the critical technologies and found that they were fully mature—an approach consistent with shipbuilding best practices  In 2017, the Navy removed one critical technology—the Heavy e-STREAM cargo delivery system—from the Lewis class design  The Navy had intended to use this system to deliver F-35 Lightning II power modules  The Navy subsequently decided to deliver these by air, which precluded any need for the Heavy system  Lead ship construction began in September 2018 with 95 percent of the ship's total design effort complete  Program officials stated that this figure meant that 100 percent of the ship's basic and functional design were by then complete—an approach consistent with best practices  Throughout detail design and now into construction, the Navy has not changed the Lewis class program's performance requirements  The Navy also leveraged commercial vessel designs to minimize design and construction risks  The Lewis class features a modern double-hull construction, an environmental-based design standard for commercial tankers, to ensure the ships can dock at ports-of-call  This design was included in the final three Kaiser class oilers  Production Readiness The program office has largely kept to its construction schedule to date for the first ship, but a flooding incident at a NASSCO graving dock in July 2018 has affected the delivery of future ships  The program office stated that this incident has not affected current ship fabrication activities  However, the dock's unavailability while repairs are planned and implemented has disrupted the contractor's schedule for future ships  According to the program office, the incident has resulted in some delays to certain delivery dates for ships two through six  Other Program Issues As part of the Navy's plan to expand the fleet, the Navy concluded that it would need an additional three Lewis class ships  The Navy's budget request for fiscal year 2019 increased its planned one-ship-per-year buy to two for fiscal years 2019, 2021, and 2023  The Congress provided appropriations for the additional fiscal year 2019 ship in support of the Navy's request  To account for the additional ships in fiscal years 2019 and 2021, the Navy plans to add two more ships to the low-rate initial production phase  Subsequently, program officials stated that they plan to compete a new contract for the remaining 12 ships using the construction knowledge gained from efforts under the existing contract  Program Office Comments We provided a draft of this assessment to the program office for review and comment  The program office provided technical comments, which we incorporated where appropriate  The program office stated that it continues to follow GAO shipbuilding best practices and has leveraged commercial vessel design practices to minimize risk  The program office also stated that it is currently revising its acquisition baseline to reflect the update in total quantities to 20 ships  In addition, the program office noted that, in fiscal year 2019, it fully funded the third and fourth ships and funded advance procurement for the fifth ship 
Report 2:  A JCL is an integrated analysis of a project’s cost, schedule, risk, and uncertainty whose result indicates the probability of a project’s success of meeting cost and schedule targets  NASA policy states that a JCL should be recalculated and approved as a part of the rebaselining approval process, but it is not required  In its replan decision memo, NASA’s associate administrator explained that he did not require the project to update the JCL because project costs are almost entirely related to the workforce and most of the remaining planned activities will be performed generally in sequence  Therefore, according to NASA’s associate administrator, the total cost would be driven almost entirely by the schedule because the workforce levels will remain the same through delivery of the observatory  Both the project and independent estimators used multiple schedule estimating methods to analyze the schedule for the remaining work, and NASA’s associate administrator said these analyses returned consistent, high confidence launch dates  The project’s ability to execute to its new schedule will be tested as it progresses through the remainder of challenging integration and test work  The project has yet to complete three of five integration and test phases  The remaining phases include integration and test of OTIS, the spacecraft element, and the observatory  Our prior work has shown that integration and testing is the phase in which problems are most likely to be found and schedules tend to slip  For a uniquely complex project such as JWST, this risk is magnified as events start to become more sequential in nature  As a result, it will continue to become more difficult for the project to avoid schedule delays by mitigating issues in parallel  As of November 2018, the project is about a week behind its replanned schedule because repairs on the membrane cover assembly took longer than planned  Completing the membrane cover assembly repairs and returning the spacecraft to vibration testing was a key event for the project to demonstrate that it could execute to its new schedule  When the project developed its 2018 replanned schedule, it had planned to complete the membrane cover assembly repairs and reinstall the assembly onto the sunshield and restart spacecraft element integration and test activities by November 6, 2018  The project allocated 4 weeks of schedule reserves specifically for these repairs  However, the membrane cover repairs proved more difficult than anticipated  For example, the program had to address unanticipated technical challenges on the membrane cover assemblies, including repairing tears and pin holes in the covers discovered after the covers were removed  The project also had to allot time to install bumpers, which are kapton tubes, to the assembly to protect the composite material on a sunshield structure during launch  The project identified the need to add the bumpers during subassembly vibration testing  As a result, as of November 2018, the project had used about 4 5 weeks of schedule reserves to cover delays associated with these activities  The use of reserves beyond what the project had planned for the repairs pushed the restart of spacecraft element integration and test activities out about a week to November 14, 2018  Figure 6 compares the project’s initial membrane cover assembly schedule in June 2018 to the actual schedule in November 2018  While the project repaired the membrane cover assembly, it also used this time to conduct risk mitigation activities on OTIS  For example, the project worked to mitigate a design issue on the frill connections  The frill is composed of a single layer of blankets placed around the outside of the primary mirror used to block stray light (see figure 7)  A combination of modeling and inspections revealed that most of the frill sections did not have as much slack as expected at the near-absolute zero cryogenic temperatures of space  This caused shrinkage that put stress on the edges of the outer ring of mirrors, which could affect the stability of the optical mirror and image quality  The project loosened these outer connections by adding a ring to the connecting points  As of November 2018, project officials said they were in the process of verifying the fix through inspections  Examples of technical issues and risks that the project continues to face during the remaining phases of integration and test include: The project is working to mitigate a design issue on the sunshield membrane tensioning system—which helps deploy the sunshield and maintain its correct shape  In our February 2018 report, we found that Northrop Grumman was planning to modify the design of the membrane tensioning system after one of the sunshield’s six membrane tensioning systems experienced a snag when conducting folding and deployment exercises on the sunshield in October 2017  The project and Northrop Grumman determined that a design modification was necessary to fully mitigate the issue, which includes modifying clips used to progressively release the cable tension and adding guards to control the excess cable  The project identified a concern that the depressurization of trapped air in the folded sunshield membrane when the fairing separates to release the JWST observatory may overly stress the membrane material  The project is working with Arianespace—the company responsible for operating JWST’s launch vehicle—and experts at the Kennedy Space Center to resolve this concern  Officials estimated that a design solution would be in place in mid-2019  However, if the project determines that it needs to reinforce the membrane covers to survive excessive residual pressure as it works on this design solution, a multi-month schedule delay could occur  As of November 2018, the project has mitigated 21 of its 47 hardware and software risks to acceptable levels, and reviews these risks monthly for any changes that might affect the continued acceptability of the risk  Five of these 21 risks are related to the project’s more than 300 potential single point failures—several of which are related to the deployment of the sunshield  The project is actively working to mitigate the remaining 26 risks to acceptable levels or closure prior to launching  The project also has several first-time and challenging integration and test activities remaining  For example, the project must integrate OTIS and the completed spacecraft element and test the full observatory in the final integration phase, which includes another set of challenging environmental tests  See figure 8 for an image of OTIS and the spacecraft element prior to being integrated  As previously discussed, the project also has two remaining deployments of the sunshield, and prior deployments have taken longer than planned  To help mitigate the risks associated with the deployments, the project added additional time for deployments in the 2018 replanned schedule based on lessons learned from prior deployments  The two remaining deployments are to occur after spacecraft element integration and test and again after observatory integration and test  The JWST project office is required to evaluate whether the project can complete development within its revised cost and schedule commitments at its next major review—the system integration review—planned for August 2019  This review is to occur after the project has completed two major tasks—OTIS and spacecraft element integration and test  The review is to evaluate whether the project (1) is ready to enter observatory integration and test, and (2) can complete remaining project development with acceptable risk and within its cost and schedule constraints  NASA guidance does not require projects to conduct a JCL at this review  However, project officials said that they plan to conduct another schedule risk analysis in the future  They do not intend to complete a new JCL for the same reasons they did not complete one for the 2018 replan— because costs are almost entirely related to the workforce and can be derived from a schedule that takes into account known risk  While not required, conducting a JCL prior to the system integration review would inform NASA about the probability of meeting both its cost and schedule commitments  If the project proceeds with its plan to conduct only a schedule risk analysis, NASA would be provided only with an updated probability of meeting its schedule commitments  Our cost estimating best practices recommend that cost estimates should be updated to reflect changes to a program or kept current as it moves through milestones and as new risks emerge  In addition, government and industry cost and schedule experts we spoke with noted that integration and testing is a critical time for a project when problems can develop  These experts told us that completing a JCL is a best practice for analyzing major risks at the most uncertain part of project execution  Conducting a JCL at system integration review—a review that occurs during the riskiest phase of development, the integration and test phase— would allow the project to update its assumptions of risk and uncertainty based on its experiences in OTIS and spacecraft element integration and test  The project could then determine how those updated assumptions affect overall cost and schedule for the JWST project  As noted above, the project has many risks to mitigate, technical challenges to overcome, and challenging test events to complete, which could affect the project’s schedule and risk posture  Further, the project has an established history of significant cost growth and schedule delays  In its June 2018 letter notifying an appropriate congressional committee of its updated cost and schedule commitments, NASA acknowledged that recent cost growth for the project will likely impact other science missions  Conducting a JCL at system integration review would provide NASA and Congress with critical information for making informed resource decisions on the JWST project and its affordability within NASA’s portfolio of projects more broadly  NASA has taken steps to augment oversight of the contractor and project following the discovery of the embedded design flaws and workmanship errors that contributed to the project’s most recent schedule delays and cost increases  See table 1 for examples of changes NASA has made to contractor and project oversight—some of which NASA self-identified and others that were in response to IRB recommendations  The IRB made 31 recommendations that ranged from improving employee morale to improving security during transporting JWST to its launch site  NASA has also used award fees to try to incentivize Northrop Grumman to improve its performance  In a July 2018 hearing on the JWST program before the House Science, Space, and Technology Committee, Administrator Bridenstine stated that NASA had reduced the available award fee through commissioning by $28 million out of a total of about $60 million  Northrop Grumman also did not earn its full award fee in the two most recent periods of performance that NASA assessed  For the performance period of April 1, 2017 to September 30, 2017, Northrop Grumman earned approximately 56 percent of the available award fee  Reasons that NASA cited for its evaluation of award fees in this period included workmanship errors on the propulsion system, schedule delays, as well as issues with schedule execution, management, and quality control  For the period of October 1, 2017 to March 31, 2018, Northrop Grumman earned none of the available award fee  Northrop Grumman’s overall score was driven by an “unacceptable” rating in schedule and cost due to delays and in anticipation of exceeding the project’s $8 billion cost cap  Northrop Grumman received an “excellent” rating under the technical category, but the evaluation noted ongoing issues with quality controls, which resulted in delays  For example, the process steps for applying voltage to the spacecraft’s pressure transducers were not clear enough, which resulted in technician error and irreparable damage to the hardware  According to Northrop Grumman officials, the contractor has started to take action to try to improve its quality assurance processes  Officials described actions that ranged from rewriting hardware integration and test procedures to starting efforts to change aspects of the company’s culture that contributed to quality control issues  For example, in July 2018, Northrop Grumman initiated a JWST mission assurance culture change campaign to increase focus on product quality and process compliance  This effort includes having inspectors affirm by signature that they have personally inspected, verified, and confirmed that all aspects of an activity meet quality standards  According to the form instructions, if the inspector is uncertain on compliance or if instructions are unclear, workers are to halt work, investigate and assess the situation, and request help to resolve the situation  Project and Northrop Grumman officials provided an example of these changes working  During a manual deployment of a radiator panel, a Northrop Grumman employee discovered that a flap used as thermal protection for a radiator was installed incorrectly and reported the error  Northrop Grumman technicians found that this flap had been swapped with another flap in the process of moving them to be installed and corrected the problem before work proceeded  Further, NASA and Northrop Grumman are conducting audits to try to minimize the risk of failures during the remaining phases of integration and test  These audits are conducted on items that have not been fully tested, are in workmanship-sensitive areas, or have had a late design change  The first phase of the audit was completed in September 2018 and found no major design issues or hardware rework required  The project plans to audit other areas through at least spring 2019, but will add audits if needed  The JWST oversight structure includes a number of positions that could be responsible for ensuring that the recent augmentations to contractor and project oversight are sustained through launch (see table 2)  In response to our review, NASA officials clarified that the project manager has sole responsibility for ensuring that these improvements are sustained through launch  Further, these officials stated that the project office is responsible for monitoring these changes at the project level and at Northrop Grumman  The project manager’s continued focus on these efforts will be important because: The project is implementing a wide span of improvement efforts, ranging from more on-site coverage at the contractor facility to cultural improvements, which will now need to be sustained for an additional 29 months  The project has had recurring issues with effective internal and external communication as well as defining key management and oversight responsibilities, both of which are important to sustaining oversight  For example, the Independent Comprehensive Review Panel identified communication problems—between the JWST project and Science Mission Directorate management as well as between NASA and Northrop Grumman—and that the project’s governance structure lacked clear lines of authority and accountability  In December 2012, we found the JWST project had taken several steps to improve communication—such as instituting meetings that include various levels of NASA, contractor, and subcontractor management— but the IRB’s findings in 2018 indicate that communication and governance issues have resurfaced in some areas  For example, the IRB found that communication with key stakeholders including the science community, Congress, and NASA leadership, has been variable and at times inconsistent  The project may encounter new schedule pressures as it proceeds through integration and test  A senior NASA official with expertise in workmanship issues told us that schedule pressure is a key reason for increased quality problems on projects  For example, this official said that companies tend to give experts leniency to operate without the burden of quality assurance paperwork when schedule pressures arise, which can lead to workmanship errors  While JWST project officials told us they do not view this as applicable to their project, the perspective regarding potential schedule pressures and workmanship is important to keep focus on given the magnitude of technical challenges and delays the project has faced  We will continue to monitor the project’s efforts at maintaining these oversight augmentations in future reviews, given that less than a year has passed since the project began implementing many of them  Moreover, the project may find that some actions will be required of officials outside the project, particularly since the communication problems identified by the IRB may well extend to headquarters’ interaction with stakeholders from the science community, industry, and the Congress  JWST is one of NASA’s most expensive and complex science projects, and NASA has invested considerable time and resources on it  The project first established its cost and schedule baseline in 2009  Since then, the project made progress by completing two of five phases of integration and test, but has also experienced significant cost growth and schedule delays  However, the project did not complete a JCL analysis as part of its second replan  Between now and its system integration review planned for August 2019, the JWST program will have to continue to address technical challenges and mitigate risks  Conducting a JCL would better inform decision makers on the status of the project as they determine whether the project can complete remaining project development with acceptable risk and within its cost and schedule constraints  Given the project is now on its third iteration of cost and schedule commitments, conducting a JCL is a small step that NASA can take to demonstrate it is on track to meet these new commitments  We are making the following recommendation to NASA: The NASA Administrator should direct the JWST project office to conduct a JCL prior to its system integration review  (Recommendation 1) We provided a draft of this report to NASA for comment  In written comments, NASA agreed with our recommendation  NASA expects to complete the JCL by September 2019, prior to the system integration review  The comments are reprinted in appendix II  NASA also provided technical comments, which have been addressed in the report, as appropriate  We are sending copies of this report to the appropriate congressional committees, the NASA Administrator, and other interested parties  In addition, the report is available at no charge on the GAO website at http://www gao gov  If you or your staff have any questions on matters discussed in this report, please contact me at (202) 512-4841 or chaplainc@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  GAO staff who made key contributions to this report are listed in appendix III  In addition to the contact named above, Molly Traci (Assistant Director), Karen Richey (Assistant Director), Jay Tallon (Assistant Director), Brian Bothwell, Daniel Emirkhanian, Laura Greifner, Erin Kennedy, Jose Ramos, Sylvia Schatz, Roxanna Sun, and Alyssa Weir made key contributions to this report 

ground_truth: The Navy began procuring John Lewis (TAO-205) class oilers in FY2016, and a total of four have been procured through FY2019, including two in FY2019. The first six ships are being procured under a block buy contract that was authorized by Section 127 of the FY2016 National Defense Authorization Act (S. 1356/P.L. 114-92 of November 25, 2015). The Navy wants to procure a total of 20 TAO-205s. The Navy's proposed FY2020 budget requests the procurement of the fifth and sixth ships in the program. The Navy estimates the combined procurement cost of the two ships at $1,056.3 million, or an average of $528.1 million each. The two ships have received $75.0 million in prior-year advance procurement (AP) funding, and the Navy's proposed FY2020 budget requests the remaining $981.2 million in procurement funding needed to complete the two ships' estimated combined procurement cost. The Navy's proposed FY2020 budget also requests $73.0 million in AP funding for TAO-205s to be procured in future fiscal years, and $3.7 million in cost-to-complete procurement funding to cover cost growth on TAO-205s procured in prior fiscal years, bringing the total FY2020 procurement funding request for the TAO-205 program (aside from outfitting and post-delivery costs) to $1,057.9 million. Issues for Congress include the following: whether to approve, reject, or modify the Navy's FY2020 procurement funding request for the TAO-205 program; the number of oilers the Navy will require in coming years to support its operations; and whether to encourage or direct the Navy to build TAO-205s with more ship self-defense equipment than currently planned by the Navy.