You are given two reports by the government agency.  

Report 1:
According to the President’s budget, the federal government plans to invest more than $96 billion for IT in fiscal year 2018—the largest amount ever budgeted. Despite such large IT expenditures, we have previously reported that investments in federal IT too often result in failed projects that incur cost overruns and schedule slippages, while contributing little to the desired mission-related outcomes. For example: The tri-agency National Polar-orbiting Operational Environmental Satellite System was disbanded in February 2010 by the White House’s Office of Science and Technology Policy after the program spent 16 years and almost $5 billion. The Department of Homeland Security’s (DHS) Secure Border Initiative Network program was ended in January 2011, after the department obligated more than $1 billion for the program. The Department of Veterans Affairs’ Financial and Logistics Integrated Technology Enterprise program was intended to be delivered by 2014 at a total estimated cost of $609 million, but was terminated in October 2011. The Department of Defense’s Expeditionary Combat Support System was canceled in December 2012 after spending more than a billion dollars and failing to deploy within 5 years of initially obligating funds. The United States Coast Guard (Coast Guard) decided to terminate its Integrated Health Information System project in 2015. As reported by the agency in August 2017, the Coast Guard spent approximately $60 million over 7 years on this project, which resulted in no equipment or software that could be used for future efforts. Our past work has found that these and other failed IT projects often suffered from a lack of disciplined and effective management, such as project planning, requirements definition, and program oversight and governance. In many instances, agencies had not consistently applied best practices that are critical to successfully acquiring IT. Such projects have also failed due to a lack of oversight and governance. Executive-level governance and oversight across the government has often been ineffective, specifically from CIOs. For example, we have reported that some CIOs’ roles were limited because they did not have the authority to review and approve the entire agency IT portfolio. In addition to failures when acquiring IT, security deficiencies can threaten systems once they become operational. As we previously reported, in order to counter security threats, 23 civilian Chief Financial Officers Act agencies spent a combined total of approximately $4 billion on IT security-related activities in fiscal year 2016. Even so, our cybersecurity work at federal agencies continues to highlight information security deficiencies. The following examples describe the types of risks we have found at federal agencies. In November 2017, we reported that the Department of Education’s Office of Federal Student Aid did not consistently analyze privacy risks for its electronic information systems, and policies and procedures for protecting information systems were not always up to date. In August 2017, we reported that, since the 2015 data breaches, the Office of Personnel Management (OPM) had taken actions to prevent, mitigate, and respond to data breaches involving sensitive personal and background investigation information. However, we noted that the agency had not fully implemented recommendations made to OPM by DHS’s United States Computer Emergency Readiness Team to help the agency improve its overall security posture and improve its ability to protect its systems and information from security breaches. In July 2017, we reported that IT security at the Internal Revenue Service had weaknesses that limited its effectiveness in protecting the confidentiality, integrity, and availability of financial and sensitive taxpayer data. An underlying reason for these weaknesses was that the Internal Revenue Service had not effectively implemented elements of its information security program. In May 2016, we reported that the National Aeronautics and Space Administration, the Nuclear Regulatory Commission, OPM, and the Department of Veteran Affairs did not always control access to selected high-impact systems, patch known software vulnerabilities, and plan for contingencies. An underlying reason for these weaknesses was that the agencies had not fully implemented key elements of their information security programs. In August 2016, we reported that the IT security of the Food and Drug Administration had significant weaknesses that jeopardized the confidentiality, integrity, and availability of its information systems and industry and public health data. Congress and the President have enacted various key pieces of reform legislation to address IT management issues. These include the federal IT acquisition reform legislation commonly referred to as the Federal Information Technology Acquisition Reform Act (FITARA). This legislation was intended to improve covered agencies’ acquisitions of IT and enable Congress to monitor agencies’ progress and hold them accountable for reducing duplication and achieving cost savings. The law includes specific requirements related to seven areas: Agency CIO authority enhancements. CIOs at covered agencies have the authority to, among other things, (1) approve the IT budget requests of their respective agencies and (2) review and approve IT contracts. Federal data center consolidation initiative (FDCCI). Agencies covered by FITARA are required, among other things, to provide a strategy for consolidating and optimizing their data centers and issue quarterly updates on the progress made. Enhanced transparency and improved risk management. The Office of Management and Budget (OMB) and covered agencies are to make detailed information on federal IT investments publicly available, and agency CIOs are to categorize their investments by level of risk. Portfolio review. Covered agencies are to annually review IT investment portfolios in order to, among other things, increase efficiency and effectiveness and identify potential waste and duplication. Expansion of training and use of IT acquisition cadres. Covered agencies are to update their acquisition human capital plans to support timely and effective IT acquisitions. In doing so, the law calls for agencies to consider, among other things, establishing IT acquisition cadres (i.e., multi-functional groups of professionals to acquire and manage complex programs), or developing agreements with other agencies that have such cadres. Government-wide software purchasing program. The General Services Administration is to develop a strategic sourcing initiative to enhance government-wide acquisition and management of software. In doing so, the law requires that, to the maximum extent practicable, the General Services Administration should allow for the purchase of a software license agreement that is available for use by all executive branch agencies as a single user. Maximizing the benefit of the Federal Strategic Sourcing Initiative. Federal agencies are required to compare their purchases of services and supplies to what is offered under the Federal Strategic Sourcing Initiative. In June 2015, OMB released guidance describing how agencies are to implement FITARA. This guidance is intended to, among other things: assist agencies in aligning their IT resources with statutory establish government-wide IT management controls to meet the law’s requirements, while providing agencies with flexibility to adapt to unique agency processes and requirements; strengthen the relationship between agency CIOs and bureau CIOs; strengthen CIO accountability for IT costs, schedules, performance, and security. The guidance identifies a number of actions that agencies are to take to establish a basic set of roles and responsibilities (referred to as the common baseline) for CIOs and other senior agency officials; and thus, to implement the authorities described in the law. For example, agencies are to conduct a self-assessment and submit a plan describing the changes they intend to make to ensure that common baseline responsibilities are implemented. In addition, in August 2016, OMB released guidance intended to, among other things, define a framework for achieving the data center consolidation and optimization requirements of FITARA. The guidance directs agencies to develop a data center consolidation and optimization strategic plan that defines the agency’s data center strategy for fiscal years 2016, 2017, and 2018. This strategy is to include, among other things, a statement from the agency CIO indicating whether the agency has complied with all data center reporting requirements in FITARA. Further, the guidance indicates that OMB is to maintain a public dashboard to display consolidation-related costs savings and optimization performance information for the agencies. Congress has recognized the importance of agencies’ continued implementation of FITARA provisions, and has taken legislative action to extend selected provisions beyond their original dates of expiration. Specifically, Congress and the President enacted laws to: remove the expiration date for enhanced transparency and improved risk management provisions, which were set to expire in 2019; remove the expiration date for portfolio review, which was set to expire in 2019; and extend the expiration date for FDCCI from 2018 to 2020. In addition, Congress and the President enacted a law to authorize the availability of funding mechanisms to help further agencies’ efforts to modernize IT. The law, known as the Modernizing Government Technology (MGT) Act, authorizes agencies to establish working capital funds for use in transitioning from legacy IT systems, as well as for addressing evolving threats to information security. The law also creates the Technology Modernization Fund, within the Department of the Treasury, from which agencies can “borrow” money to retire and replace legacy systems, as well as acquire or develop systems. Further, in February 2018, OMB issued guidance for agencies to implement the MGT Act. The guidance was intended to provide agencies additional information regarding the Technology Modernization Fund, and the administration and funding of the related IT working capital funds. Specifically, the guidance allowed agencies to begin submitting initial project proposals for modernization on February 27, 2018. In addition, in accordance with the MGT Act, the guidance provides details regarding a Technology Modernization Board, which is to consist of (1) the Federal CIO; (2) a senior official from the General Services Administration; (3) a member of DHS’s National Protection and Program Directorate; and (4) four federal employees with technical expertise in IT development, financial management, cybersecurity and privacy, and acquisition, appointed by the Director of OMB. Congress and the President enacted the Federal Information Security Modernization Act of 2014 (FISMA) to improve federal cybersecurity and clarify government-wide responsibilities. The act addresses the increasing sophistication of cybersecurity attacks, promotes the use of automated security tools with the ability to continuously monitor and diagnose the security posture of federal agencies, and provides for improved oversight of federal agencies’ information security programs. Specifically, the act clarifies and assigns additional responsibilities to entities such as OMB, DHS, and the federal agencies. Table 1 describes a selection of OMB, DHS, and agency responsibilities. Beyond the implementation of FITARA, FISMA, and related actions, the current administration has also initiated other efforts intended to improve federal IT. Specifically, in March 2017, the administration established the Office of American Innovation, which has a mission to, among other things, make recommendations to the President on policies and plans aimed at improving federal government operations and services. In doing so, the office is to consult with both OMB and the Office of Science and Technology Policy on policies and plans intended to improve government operations and services, improve the quality of life for Americans, and spur job creation. In May 2017, the Administration also established the American Technology Council, which has a goal of helping to transform and modernize federal agency IT and how the federal government uses and delivers digital services. The President is the chairman of this council, and the Federal CIO and the United States Digital Service Administrator are among the members. In addition, on May 11, 2017, the President signed Executive Order 13800, Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure. This executive order outlined actions to enhance cybersecurity across federal agencies and critical infrastructure to improve the nation’s cyber posture and capabilities against cyber security threats. Among other things, the order tasked the Director of the American Technology Council to coordinate a report to the President from the Secretary of DHS, the Director of OMB, and the Administrator of the General Services Administration, in consultation with the Secretary of Commerce, regarding the modernization of federal IT. As a result, the Report to the President on Federal IT Modernization was issued on December 13, 2017, and outlined the current and envisioned state of federal IT. The report focused on modernization efforts to improve the security posture of federal IT and recognized that agencies have attempted to modernize systems but have been stymied by a variety of factors, including resource prioritization, ability to procure services quickly, and technical issues. The report provided multiple recommendations intended to address these issues through the modernization and consolidation of networks and the use of shared services to enable future network architectures. Further, in March 2018, the Administration issued the President’s Management Agenda, which lays out a long-term vision for modernizing the federal government. The agenda identifies three related drivers of transformation—IT modernization; data, accountability, and transparency; and the workforce of the future—that are intended to push change across the federal government. The Administration also established 14 related Cross-Agency Priority goals, many of which have elements that involve IT. In particular, the Cross-Agency Priority goal on IT modernization states that modern IT must function as the backbone of how government serves the public in the digital age and provides three priorities that are to guide the Administration’s efforts to modernize federal IT: (1) enhancing mission effectiveness by improving the quality and efficiency of critical services, including the increased utilization of cloud-based solutions; (2) reducing cybersecurity risks to the federal mission by leveraging current commercial capabilities and implementing cutting edge cybersecurity capabilities; and (3) building a modern IT workforce by recruiting, reskilling, and retaining professionals able to help drive modernization with up-to-date technology. Most recently, on May 15, 2018, the President signed Executive Order 13833, Enhancing the Effectiveness of Agency Chief Information Officers. Among other things, this executive order is intended to better position agencies to modernize their IT systems, execute IT programs more efficiently, and reduce cybersecurity risks. The order pertains to 22 of the 24 Chief Financial Officer Act agencies: the Department of Defense and the Nuclear Regulatory Commission are exempt. For the covered agencies, the executive order strengthens the role of agency CIOs by, among other things, requiring to report directly to their agency head; to serve as their agency head’s primary IT strategic advisor; and to have a significant role in all management, governance, and oversight processes related to IT. In addition, one of the cybersecurity requirements directs agencies to ensure that the CIO works closely with an integrated team of senior executives, including those with expertise in IT, security, and privacy, to implement appropriate risk management measures. In the February 2017 update to our high-risk series, we reported that agencies still needed to complete significant work related to the management of IT acquisitions and operations We stressed that OMB and federal agencies should continue to expeditiously implement FITARA and OMB’s related guidance, which include enhancing CIO authority, consolidating data centers, and acquiring and managing software licenses. Our update to this high-risk area also stressed that OMB and agencies needed to continue to implement our prior recommendations in order to improve their ability to effectively and efficiently invest in IT. Specifically, from fiscal years 2010 through 2015, we made 803 recommendations to OMB and federal agencies to address shortcomings in IT acquisitions and operations. In addition, in fiscal year 2016, we made 202 new recommendations, thus, further reinforcing the need for OMB and agencies to address the shortcomings in IT acquisitions and operations. As stated in the update, OMB and agencies should demonstrate government-wide progress in the management of IT investments by, among other things, implementing at least 80 percent of our recommendations related to managing IT acquisitions and operations within 4 years. As of May 2018, OMB and agencies had fully implemented 489 (or about 61 percent) of the 803 recommendations. Figure 1 summarizes the progress that OMB and agencies have made in addressing our recommendations as compared to the 80 percent target. Overall, federal agencies would be better positioned to realize billions in cost savings and additional management improvements if they address these recommendations, including those aimed at implementing CIO responsibilities, review of IT acquisitions; improving data center consolidation; and managing software licenses. In all, the various laws, such as FITARA, and related guidance assign 35 IT management responsibilities to CIOs in six key areas. These areas are: leadership and accountability, budgeting, information security, investment management, workforce, and strategic planning. In a draft report on CIO responsibilities that we have provided to the agencies for comment and plan to issue in June 2018, our preliminary results suggest that none of the 24 agencies we reviewed had policies that fully addressed the role of their CIO, as called for by federal laws and guidance. In this regard, a majority of the agencies fully or substantially addressed the role of their CIOs for the area of leadership and accountability. In addition, a majority of the agencies substantially or partially addressed the role of their CIOs for two areas: information security and IT budgeting. However, most agencies partially or minimally addressed the role of their CIOs for two areas: investment management and strategic planning. These preliminary results are shown in figure 2. Despite these shortfalls, most agency officials stated that their CIOs are implementing the responsibilities even if the agencies do not have policies requiring implementation. Nevertheless, the CIOs of the 24 selected agencies acknowledged in responses to a survey that we administered for our draft report that they were not always very effective in implementing the six IT management areas. Specifically, our preliminary results show that at least 10 of the CIOs indicated that they were less than very effective for each of the six areas of responsibility. We believe that until agencies fully address the role of CIOs in their policies, agencies will be limited in addressing longstanding IT management challenges. Figure 3 depicts that extent to which the CIOs reported their effectiveness in implementing the six areas of responsibility. Beyond the actions of the agencies, however, our preliminary results indicate that shortcomings in agencies’ policies also are partially attributable to two weaknesses in OMB’s FITARA implementation guidance. First, the guidance does not comprehensively address all CIO responsibilities, such as those related to assessing the extent to which personnel meet IT management knowledge and skill requirements, and ensuring that personnel are held accountable for complying with the information security program. Correspondingly, the majority of the agencies’ policies did not fully address nearly all of the responsibilities that were not included in OMB’s guidance. Second, OMB’s guidance does not ensure that CIOs have a significant role in (1) IT planning, programming, and budgeting decisions and (2) execution decisions and the management, governance, and oversight processes related to IT, as required by federal law and guidance. In the absence of comprehensive guidance, CIOs will not be positioned to effectively acquire, maintain, and secure their IT systems. Based on our preliminary results, 24 agency CIOs also identified a number of factors that enabled and challenged their ability to effectively manage IT. As shown in figure 4, five factors were identified by at least half of the 24 CIOs as major enablers and three factors were identified by at least half of the CIOs as major challenges. Specifically, most agency CIOs cited five factors as being enablers to effectively carry out their responsibilities: (1) NIST guidance, (2) the CIO’s position in the agency hierarchy, (3) OMB guidance, (4) coordination with the Chief Acquisition Officer (CAO), and (5) legal authority. Further, three factors were cited by CIOs as major factors that have challenged their ability to effectively carry out responsibilities: (1) processes for hiring, recruiting, and retaining IT personnel; (2) financial resources; and (3) the availability of personnel/staff resources. As our draft report states, although OMB has issued guidance aimed at addressing the three factors that were identified by at least half of the CIOs as major challenges, the guidance does not fully address those challenges. Further, regarding the financial resources challenge, OMB recently required agencies to provide data on CIO authority over IT spending; however, its guidance does not provide a complete definition of the authority. We believe that in the absence of such guidance, agencies have created varying definitions of CIO authority. Further, until OMB updates its guidance to include a complete definition of the authority that CIOs are to have over IT spending, it will be difficult for OMB to identify any deficiencies in this area and to help agencies make any needed improvements. In order to address challenges in implementing CIO responsibilities, we intend to include in our draft report recommendations to OMB and each of the selected 24 federal agencies to improve the effectiveness of CIOs’ implementation of their responsibilities for each of the six IT management areas. FITARA includes a provision to enhance covered agency CIOs’ authority through, among other things, requiring agency heads to ensure that CIOs review and approve IT contracts. OMB’s FITARA implementation guidance expanded upon this aspect of the legislation in a number of ways. Specifically, according to the guidance: CIOs may review and approve IT acquisition strategies and plans, rather than individual IT contracts; CIOs can designate other agency officials to act as their representatives, but the CIOs must retain accountability; CAOs are responsible for ensuring that all IT contract actions are consistent with CIO-approved acquisition strategies and plans; and CAOs are to indicate to the CIOs when planned acquisition strategies and acquisition plans include IT. In January 2018, we reported that most of the CIOs at 22 selected agencies were not adequately involved in reviewing billions of dollars of IT acquisitions. For instance, most of the 22 agencies did not identify all of their IT contracts. In this regard, the agencies identified 78,249 IT- related contracts, to which they obligated $14.7 billion in fiscal year 2016. However, we identified 31,493 additional contracts with $4.5 billion obligated, raising the total amount obligated by these agencies to IT contracts in fiscal year 2016 to at least $19.2 billion. Figure 5 reflects the obligations that the 22 selected agencies reported to us relative to the obligations we identified. The percentage of additional IT contract obligations we identified varied among the selected agencies. For example, the Department of State did not identify 1 percent of its IT contract obligations. Conversely, 8 agencies did not identify over 40 percent of their IT contract obligations. Many of the selected agencies that did not identify these IT contract obligations did not follow OMB guidance. Specifically, 14 of the 22 agencies did not involve the acquisition office in their process to identify IT acquisitions for CIO review, as required by OMB. In addition, 7 agencies did not establish guidance to aid officials in recognizing IT. We concluded that until these agencies involve the acquisitions office in their IT acquisition identification processes and establish supporting guidance, they cannot ensure that they will identify all IT acquisitions. Without proper identification of IT acquisitions, these agencies and CIOs cannot effectively provide oversight of these acquisitions. In addition to not identifying all IT contracts, 14 of the 22 selected agencies did not fully satisfy OMB’s requirement that the CIO review and approve IT acquisition plans or strategies. Further, only 11 of 96 randomly selected IT contracts at 10 agencies that we evaluated were CIO-reviewed and approved as required by OMB’s guidance. The 85 IT contracts not reviewed had a total possible value of approximately $23.8 billion. We believe that until agencies ensure that CIOs are able to review and approve all IT acquisitions, CIOs will continue to have limited visibility and input into their agencies’ planned IT expenditures and will not be able to use the increased authority that FITARA’s contract approval provision is intended to provide. Further, agencies will likely miss an opportunity to strengthen CIOs’ authority and the oversight of IT acquisitions. As a result, agencies may award IT contracts that are duplicative, wasteful, or poorly conceived. As a result of these findings, we made 39 recommendations in our January 2018 report. The recommendations included that agencies ensure that their acquisition offices are involved in identifying IT acquisitions and issuing related guidance, and that IT acquisitions are reviewed in accordance with OMB guidance. OMB and the majority of the agencies generally agreed with or did not comment on the recommendations. In our February 2017 high-risk update, we stated that OMB and agencies needed to demonstrate additional progress on achieving data center consolidation savings in order to improve the management of IT acquisitions and operations. Further, data center consolidation efforts are key to implementing FITARA. Specifically, OMB established the FDCCI in February 2010 to improve the efficiency, performance, and environmental footprint of federal data center activities. The enactment of FITARA in 2014 codified and expanded the initiative. In a series of reports that we issued from July 2011 through August 2017, we noted that, while data center consolidation could potentially save the federal government billions of dollars, weaknesses existed in several areas, including agencies’ data center consolidation plans, data center optimization, and OMB’s tracking and reporting on related cost savings. In these reports, we made a total of 160 recommendations to OMB and 24 agencies to improve the execution and oversight of the initiative. Most agencies and OMB agreed with our recommendations or had no comments. As of May 2018, 80 of these 160 recommendations remained unimplemented. Further, we recently reported in May 2018 that the 24 agencies participating in OMB’s Data Center Optimization Initiative (DCOI) had communicated mixed progress toward achieving OMB’s goals for closing data centers by September 2018. Over half of the agencies reported that they had either already met, or planned to meet, all of their OMB- assigned goals by the deadline. This would result in the closure of 7,221 of the 12,062 centers that agencies reported in August 2017. However, 4 agencies reported that they do not have plans to meet all of their assigned goals and 2 agencies are working with OMB to establish revised targets. With regard to agencies’ progress in achieving cost savings, 24 agencies reported $3.9 billion in cost savings through 2018. The 24 agencies also reported limited progress against OMB’s five data center optimization targets for server utilization and automated monitoring, energy metering, power usage effectiveness, facility utilization, and virtualization. As of August 2017, 1 agency reported that it had met four targets, 1 agency reported that it had met three targets, 6 agencies reported having met either one or two targets, and 14 agencies reported meeting none of the targets. Further, as of August 2017, most agencies were not planning to meet OMB’s fiscal year 2018 optimization targets. Specifically, 4 agencies reported plans to meet all of their applicable targets by the end of fiscal year 2018; 14 agencies reported plans to meet some of the targets; and 4 reported that they did not plan to meet any targets. Figure 6 summarizes agency-reported plans to meet or exceed the OMB’s data center optimization targets, as of August 2017. In 2016 and 2017, we made 81 recommendations to OMB and the 24 DCOI agencies to help improve the reporting of data center-related cost savings and to achieve optimization targets. As of May 2018, 71 of these 81 recommendations have not been fully addressed. In our 2015 high-risk report’s discussion of IT acquisitions and operations, we identified the management of software licenses as an area of concern, in part because of the potential for cost savings. Federal agencies engage in thousands of software licensing agreements annually. The objective of software license management is to manage, control, and protect an organization’s software assets. Effective management of these licenses can help avoid purchasing too many licenses, which can result in unused software, as well as too few licenses, which can result in noncompliance with license terms and cause the imposition of additional fees. As part of its PortfolioStat initiative, OMB has developed policy that addresses software licenses. This policy requires agencies to conduct an annual, agency-wide IT portfolio review to, among other things, reduce commodity IT spending. Such areas of spending could include software licenses. In May 2014, we reported on federal agencies’ management of software licenses and determined that better management was needed to achieve significant savings government-wide. Of the 24 selected agencies we reviewed, only 2 had comprehensive policies that included the establishment of clear roles and central oversight authority for managing enterprise software license agreements, among other things. Of the remaining 22 agencies, 18 had policies that were not comprehensive, and 4 had not developed any policies. Further, we found that only 2 of the 24 selected agencies had established comprehensive software license inventories, a leading practice that would help them to adequately manage their software licenses. The inadequate implementation of this and other leading practices in software license management was partially due to weaknesses in agencies’ policies. As a result, we concluded that agencies’ oversight of software license spending was limited or lacking, thus potentially leading to missed savings. However, the potential savings could be significant considering that, in fiscal year 2012, 1 major federal agency reported saving approximately $181 million by consolidating its enterprise license agreements, even when its oversight process was ad hoc. Accordingly, we recommended that OMB issue a directive to help guide agencies in managing software licenses. We also made 135 recommendations to the 24 agencies to improve their policies and practices for managing licenses. Among other things, we recommended that the agencies regularly track and maintain a comprehensive inventory of software licenses and analyze the inventory to identify opportunities to reduce costs and better inform investment decision making. Most agencies generally agreed with the recommendations or had no comments. As of May 2018, 78 of the 135 recommendations had not been implemented. Table 2 reflects the extent to which the 24 agencies implemented the recommendations in these two areas. Since information security was added to the high-risk list in 1997, we have consistently identified shortcomings in the federal government’s approach to cybersecurity. We have previously testified that, even though agencies have acted to improve the protections over federal and critical infrastructure information and information systems, the federal government needs to take the following actions to strengthen U.S. cybersecurity: Effectively implement risk-based entity-wide information security programs consistently over time. Among other things, agencies need to (1) implement sustainable processes for securely configuring operating systems, applications, workstations, servers, and network devices; (2) patch vulnerable systems and replace unsupported software; (3) develop comprehensive security test and evaluation procedures and conduct examinations on a regular and recurring basis; and (4) strengthen oversight of contractors providing IT services. Improve its cyber incident detection, response, and mitigation capabilities. DHS needs to expand the capabilities and support wider adoption of its government-wide intrusion detection and prevention system. In addition, the federal government needs to improve cyber incident response practices, update guidance on reporting data breaches, and develop consistent responses to breaches of personally identifiable information. Expand its cyber workforce planning and training efforts. The federal government needs to (1) enhance efforts for recruiting and retaining a qualified cybersecurity workforce and (2) improve cybersecurity workforce planning activities. Expand efforts to strengthen cybersecurity of the nation’s critical infrastructures. The federal government needs to develop metrics to (1) assess the effectiveness of efforts promoting the National Institute of Standards and Technology’s (NIST) Framework for Improving Critical Infrastructure Cybersecurity and (2) measure and report on the effectiveness of cyber risk mitigation activities and the cybersecurity posture of critical infrastructure sectors. Better oversee protection of personally identifiable information. The federal government needs to (1) protect the security and privacy of electronic health information, (2) ensure privacy when face recognition systems are used, and (3) protect the privacy of users’ data on state-based health insurance marketplaces. As we have previously noted, in order to take the preceding actions and strengthen the federal government’s cybersecurity posture, agencies should implement the information security programs required by FISMA. In this regard, FISMA provides a framework for ensuring the effectiveness of information security controls for federal information resources. The law requires each agency to develop, document, and implement an agency- wide information security program. Such a program includes risk assessments; the development and implementation of policies and procedures to cost-effectively reduce risks; plans for providing adequate information security for networks, facilities, and systems; security awareness and specialized training; the testing and evaluation of the effectiveness of controls; the planning, implementation, evaluation, and documentation of remedial actions to address information security deficiencies; procedures for detecting, reporting, and responding to security incidents; and plans and procedures to ensure continuity of operations. Since 2010, we have made 2,733 recommendations to agencies aimed at improving the security of federal systems and information. These recommendations have identified actions for agencies to take to strengthen technical security controls over their computer networks and systems. They also have included recommendations for agencies to fully implement aspects of their information security programs, as mandated by FISMA. Nevertheless, many agencies continue to be challenged in safeguarding their information systems and information, in part because many of these recommendations have not been implemented. As of May 2018, 793 of information security-related recommendations we have made have not been implemented. In order to determine the effectiveness of the agencies’ information security programs and practices, FISMA requires that federal agencies’ inspectors general conduct annual independent evaluations. The agencies are to report the results of these evaluations to OMB, and OMB is to summarize the results in annual reports to Congress. In these evaluations, the inspectors general frame the scope of their analysis, identify key findings, and detail recommendations to address the findings. The evaluations also are to capture maturity model ratings for their respective agencies. Toward this end, in fiscal year 2017, the inspector general community, in partnership with OMB and DHS, finalized a 3-year effort to create a maturity model for FISMA metrics that align to the five function areas in the NIST Framework for Improving Critical Infrastructure Cybersecurity (Cybersecurity Framework): identify, protect, detect, respond, and recover. This alignment is intended to help promote consistent and comparable metrics and criteria and provides agencies with a meaningful independent assessment of their information security programs. This maturity model is designed to summarize the status of agencies’ information security programs on a five-level capability maturity scale. The five maturity levels are defined as follows: Level 1 Ad-hoc: Policies, procedures, and strategy are not formalized; activities are performed in an ad-hoc, reactive manner. Level 2 Defined: Policies, procedures, and strategy are formalized and documented but not consistently implemented. Level 3 Consistently Implemented: Policies, procedures, and strategy are consistently implemented, but quantitative and qualitative effectiveness measures are lacking. Level 4 Managed and Measurable: Quantitative and qualitative measures on the effectiveness of policies, procedures, and strategy are collected across the organizations and used to assess them and make necessary changes. Level 5 Optimized: Policies, procedures, and strategy are fully institutionalized, repeatable, self-generating, consistently implemented and regularly updated based on a changing threat and technology landscape and business/mission needs. In March 2018, OMB issued its annual FISMA report to Congress, which showed the combined results of the inspectors general’s fiscal year 2017 evaluations. Based on data from 76 agency inspector general and independent auditor assessments, OMB determined that the government-wide median maturity model ratings across the five NIST Cybersecurity Framework areas did not exceed a level 3 (consistently implemented). Table 3 shows the inspectors general’s median ratings for each of the NIST Cybersecurity Framework areas. In its efforts toward strengthening the federal government’s cybersecurity, OMB also requires agencies to submit related cybersecurity metrics as part of its Cross-Agency Priority goals. In particular, OMB developed the IT modernization goal so that federal agencies will be able to build and maintain more modern, secure, and resilient IT. A key part of this goal is to reduce cybersecurity risks to the federal mission through three strategies: manage asset security, protect networks and data, and limit personnel access. The key targets supporting each of these strategies correspond to areas within the FISMA metrics. Table 4 outlines the strategies and their associated targets. In conclusion, FITARA and FISMA present opportunities for the federal government to address the high-risk areas on improving the management of IT acquisitions and operations, and ensuring the security of federal IT, thereby saving billions of dollars. Most agencies have taken steps to execute key IT management and cybersecurity initiatives, including implementing CIO responsibilities, requiring CIO review of IT acquisitions, realizing data center consolidation cost savings, managing software assets, and complying with FISMA requirements. The agencies have also continued to address the recommendations that we have made over the past several years. However, further efforts by OMB and federal agencies to implement our previous recommendations would better position them to improve the management and security of federal IT. To help ensure that these efforts succeed, we will continue to monitor agencies’ efforts toward implementing these recommendations. Chairmen Meadows and Hurd, Ranking Members Connolly and Kelly, and Members of the Subcommittees, this completes my prepared statement. I would be pleased to respond to any questions that you may have at this time. If you or your staff have any questions about this testimony, please contact David A. Powner, Director, Information Technology, at (202) 512- 9286 or pownerd@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. GAO staff who made key contributions to this testimony are Kevin Walsh (Assistant Director), Chris Businsky, Rebecca Eyler, Meredith Raymond, and Jessica Waselkow (Analyst in Charge). This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

 

 Report 2:
Many Members of Congress became actively engaged in foreign policy debates over U.S. intervention in the 1992-1995 war in Bosnia and Herzegovina (hereafter, "Bosnia"). Congress monitored and at times challenged the Bush and Clinton Administrations' response to the conflict through numerous hearings, resolutions, and legislative initiatives. Many observers contend that the United States is a stakeholder in Bosnia's future because of the strong impact of U.S. intervention on the postwar Bosnian state. Nearly 25 years after warring parties in Bosnia reached the Dayton Agreement (see below), Bosnia faces numerous internal and external challenges, and the country retains geopolitical importance to U.S. interests in the Western Balkans. As Congress assesses ongoing and emerging security issues in the region, including resilience against malign external influence, renewed conflict, and radicalization, Bosnia's internal politics and its role in Balkan stability may merit further examination. Bosnia has existed in various forms throughout its history: a medieval kingdom, territory held by two major empires, a federal unit, and, since 1992, an independent state. Bosnia's present international borders are largely consistent with its administrative boundaries under later periods of Ottoman Turkish rule. After World War I, Bosnia became part of the newly created Kingdom of Serbs, Croats, and Slovenes. It was one of the six constituent republics of the Socialist Federal Republic of Yugoslavia from 1945 until 1992. Bosnia's constitution stems from the U.S.-brokered Dayton Peace Agreement that ended the country's 1992-1995 war. It recognizes three "constituent peoples": Bosniaks, Croats, and Serbs. All three groups are Slavic. Religious tradition is considered a marker of difference among the three ethnic identities: Bosniaks are predominantly Muslim, Serbs are largely Orthodox Christian, and Croats are mostly Catholic. Although Bosnian, Croatian, and Serbian are recognized in Bosnia as distinct official languages, they are mutually intelligible. Bosniaks comprise approximately 50.1% of the population, Bosnian Serbs 30.8%, and Bosnian Croats 15.4%. In this report, Bosnian is used as a non-ethnic term for a person or institution from Bosnia. A Bosnian Serb is an ethnic Serb from Bosnia and a Bosnian Croat is an ethnic Croat from Bosnia. Bosniak refers to Slavic Muslims. Bosnia's religious and cultural diversity is one of its distinctive characteristics. Islam was introduced to part of Bosnia's population during the Ottoman period, although there were also large Catholic, Orthodox Christian, and Jewish communities. Bosnia was the most heterogeneous Yugoslav republic and the only one where no ethnic group formed an absolute majority. During the 1990s, some popular accounts of Bosnia (and the former Yugoslavia) depicted its ethnic relations as "ancient hatreds," implying that the country's ethnic groups cannot peacefully coexist and that the 1992-1995 war was unavoidable. However, many experts on the region reject this thesis. Although Bosnia has experienced episodes of communal violence and bloodshed, most recently during World War II and the 1992-1995 war, its heterogeneous population also has lived in mixed communities for periods of peace. Many experts contend that ethnic conflict often was stoked by domestic leaders who manipulated historical memory and grievances to further their own agendas, or by external powers seeking to rule Bosnia or annex its territory. In the 1980s, Yugoslavia's escalating political and economic crises fueled nationalist movements. Nationalist leaders in Serbia and Croatia appealed to Bosnian Serbs and Croats as ethnic "kin." The party that ruled Croatia for most of the 1990s, the Croatian Democratic Union (HDZ), established a sister party with the same name to mobilize Bosnian Croats and compete in Bosnia's elections. This gave Croatia an avenue of influence in Bosnian politics. Serbia, led by strongman Slobodan Milošević, likewise had influence over Bosnian Serb leaders. In Bosnia's November 1990 elections—the first competitive elections in decades—voters cast aside the ruling League of Communists party and elected ethnic parties that largely continue to dominate today. Bosnian voters backed independence in a 1992 referendum, following in the footsteps of Slovenia, Croatia, and Macedonia. Bosnian Serbs, who did not want to separate from Yugoslavia, boycotted the referendum. Bosnian Serb forces seized more than two-thirds of Bosnia's territory, and a three-year conflict followed that pitted Serb, Croat, and Bosniak forces against one another. Bosnian Serb leaders declared a "Serb Republic" ( Republika Srpska) in March 1992, while Bosnian Croat leaders proclaimed the Croat Community of Herceg-Bosnia in July. Some Bosnian Croat and Bosnian Serb leaders advocated unification with Croatia and Serbia, respectively, where government factions—including their strongman leaders—likewise wanted to carve a Greater Croatia and Greater Serbia out of Bosnia's territory. Bosniak leaders opposed dismemberment of the state. Bosnia's war was one of the most lethal conflicts in Europe since World War II. Bosnian Serb forces besieged Sarajevo for 44 months. More than 10,000 people, mostly civilians, died due to shelling, sniping, and blockade-related deprivation. Paramilitary factions from neighboring Croatia and Serbia—some of which reportedly had ties to the Croatian and Serbian government—fought alongside Bosnian Croats and Serbs. The Serb-dominated Yugoslav National Army also aided Bosnian Serb forces, giving them a military advantage. In many areas, combatants from the three groups killed or expelled members of other ethnic groups to "purify" territory that they wanted to claim as their own. This "ethnic cleansing" changed Bosnia's demographic landscape. An estimated 100,000 or more Bosnians were killed in the conflict, and roughly half of its population displaced. In addition, an estimated 20,000 or more women and girls were victims of sexual violence. Hundreds of Bosnians have been prosecuted for war crimes at the International Criminal Tribunal for the former Yugoslavia (ICTY) and in Bosnian courts. In 2016, the ICTY convicted wartime Bosnian Serb leader Radovan Karadžić of genocide and war crimes. In 2019, the tribunal rejected his appeal and increased his sentence from 40 years to life. Citizens of Croatia and Serbia have also been indicted for crimes committed in the Bosnian war. Highly publicized incidents in 1994 and 1995 underscored the war's human toll. Bosnian Serb forces bombarded a Sarajevo market in 1994 and 1995, resulting in over 100 civilian deaths. In July 1995, Serb forces commanded by Ratko Mladić seized and executed more than 8,000 Bosniak men and boys in a U.N.-designated safe area around the city of Srebrenica, an incident subsequently seen by some as a consequence of the international community's muddled, ineffectual response to the conflict. The International Court of Justice and ICTY subsequently ruled that the Srebrenica massacres constituted an act of genocide. Mladić was convicted of genocide and other crimes in 2017. These incidents increased pressure on U.S. policymakers to take a stronger role in resolving a conflict that had largely been left to the EU and the United Nations. Under U.S. command, NATO intervened in August and September 1995 with air strikes against Bosnian Serb targets, while allied Bosniak and Croat forces launched a simultaneous offensive in western Bosnia. The United States played a key role in brokering several agreements. The 1994 Washington Agreement ended the "war within a war" between Bosniaks and Croats. In November 1995, leaders from Croatia, Bosnia, and Serbia met at the Wright-Patterson Air Force base in Dayton, OH, to negotiate a peace agreement. U.S. diplomat Richard Holbrooke played a crucial role in brokering the General Framework Agreement for Peace in Bosnia and Herzegovina, more commonly known as the Dayton Peace Agreement. Bosnia's complex political system is a product of the Dayton Agreement; one of its annexes serves as Bosnia's constitution (Annex 4). Its provisions partly reflect the situation on the ground in 1995, including the subdivision of Bosnia into two ethnoterritorial entities ( Figure 1 ): Republika Srpska ("RS"), which Bosnian Serb leaders had proclaimed in 1992, and the Federation of Bosnia and Herzegovina ("FBiH," predominantly populated by Bosniaks and Croats), which was created by the 1994 Washington Agreement. Entity borders were largely drawn to form ethnic majorities, even though they also reflected territorial seizure and ethnic cleansing. Many Bosniaks view the division of Bosnia into these roughly equal entities as awarding the spoils of war to Bosnian Serbs, whom they regard as the aggressors. Many Bosnian Serbs, however, view the Serb-majority entity as a protection against marginalization. The designation of Bosniaks, Croats, and Serbs as Bosnia's three "constituent peoples" is a cornerstone of the Dayton system. Numerous government bodies have ethnic quotas requiring equal representation of the three groups. In these power-sharing institutions, delegates from each constituent group may veto measures that go against vital ethnic interests. While these arrangements make Bosnia's political system prone to gridlock, Dayton's negotiators viewed them as necessary to prevent any group from feeling marginalized in a context of low trust. Bosnia is a parliamentary republic with a high degree of decentralization. Its complex, tiered structure includes a central ("state-level") government, the two entities, the autonomous Brčko district, and cantonal and municipal governments. The central ("state-level") government covers the entirety of Bosnia. A three-member presidency is the head of state, and includes one Serb member who is elected by RS voters, and one Bosniak and one Croat member elected by FBiH voters. The Council of Ministers, led by a Chairperson, is roughly equivalent to a cabinet government and prime minister in other parliamentary systems. The Parliamentary Assembly is a state-level legislature with two chambers: a directly elected House of Representatives (42 members) and an indirectly elected House of Peoples (5 Serbs, 5 Croats, and 5 Bosniaks). The state-level government is considered to be weak, despite some expansion of its functions in the 2000s. Its major responsibilities include foreign relations; trade, customs, and monetary policy; migration and asylum policy; defense; and intelligence. Bosnia is further subdivided into two ethnoterritorial entities: Republika Srpska (RS), where Serbs are the largest ethnic group (82%), and the Federation entity (FBiH), where Bosniaks (70%) and Croats (22%) are the largest groups. The two entities have broader policy jurisdiction than the state-level government. Governing functions that are not assigned to the state-level government fall to the entities. These include civilian policing, economic policy, fiscal policy, energy policy, and health and social policy, as well as other issues. Each entity has its own constitution, as well as a president, vice presidents, legislature, and cabinet government with a prime minister. Each entity may establish "special parallel relationships" with neighboring states (i.e., Croatia and Serbia). Numerous entity bodies also incorporate ethnic quotas. Brčko district, a border region in northeastern Bosnia, was initially administered by the international community to allay concerns about RS secession. Brčko's location interrupts RS's contiguity, and both entities initially claimed it. Brčko was later awarded to both entities, but remains a self-governing district whose population is a mix of all three constituent peoples. Some analysts believe it has been relatively more successful than the entities in passing reforms and reintegrating its divided population (e.g., ethnically mixed schools with a common curriculum). FBiH entity is further divided into ten cantons, many of which were drawn to form ethnic Bosniak or Croat majorities. The cantons have jurisdiction in many policy areas, including policing, housing, culture, and education. They also have their own constitutions—based on the FBiH constitution—as well as legislatures and cabinet-style governments. FBiH and RS are further divided into 79 and 64 municipalities, respectively. The Dayton Agreement established a strong oversight role for the international community. The Office of the High Representative (OHR) was created to monitor the implementation of civilian aspects of Dayton. The High Representative is supported by the Peace Implementation Council (PIC), a group of 55 countries and agencies. A 1997 PIC conference empowered the High Representative to impose binding decisions and sanction politicians who obstruct Dayton. Until the mid-2000s, the High Representative used these powers to remove officials deemed to be obstructive to peace and to promote what are considered among the most constructive reforms since Dayton, including merging the entities' armed forces and intelligence services and putting them under new state-level ministries. However, the High Representative's proactive role has since decreased. This is partly due to criticism that the OHR lacks democratic legitimacy and accountability. Bosnian Serb politicians have claimed that the OHR's interventions support Bosniak leaders' preference for a more centralized state. At the same time, some U.S. and EU policymakers believed that the attraction of EU membership could incentivize reforms in place of the OHR's more top-down approach. The international community also plays an ongoing security role. NATO led the Implementation Force (IFOR) and the smaller Stabilization Force (SFOR) that monitored security aspects of the Dayton Peace Agreement. The initial deployment of NATO ground forces to Bosnia numbered nearly 60,000, of which the largest share (approximately one-third) was from the United States. The number of troops subsequently decreased. In 2004, NATO's peacekeeping role was transferred to the EU with the understanding that NATO would assist if necessary. The size of the EU operation (EUFOR Althea) decreased from 7,000 troops in 2004 to roughly 600 troops today. Many analysts contend that the Dayton Agreement helped hold Bosnia together after the war; they point to the absence of widespread violence since 1995 as an indicator of its success. However, observers also question whether Bosnia can function much longer under the Dayton system. They identify several key challenges: Critics claim that Bosnia's political system reinforces the country's ethnic divisions and makes ethnicity a core basis of political identity. The ethnic parties that have dominated politics since the war generally appeal to voters from their respective ethnic communities rather than all Bosnians. Critics accuse ethnic party leaders of inflaming nationalist tensions and manipulating historical memory to distract from corruption and win elections, thus aggravating rather than bridging the deep wounds that remain from the war. In some parts of Bosnia, divisions are further reproduced at the societal level through institutions like segregated schools, which separate schoolchildren from different ethnic groups and teach them different curriculum. Some analysts also contend that the system is too gridlock-prone to pass major political and economic reforms to be passed, even with the incentive of potential EU membership. Bosnia's fractured, overlapping institutions sometimes muddle policymaking jurisdiction and impede coordinated response. Furthermore, power-sharing arrangements create numerous veto points in the legislative process. Government coalitions are typically ideologically broad and unwieldy, creating a further source of potential dysfunction. One of the consequences of these barriers is that it is difficult to pass legislation. The previous state-level Parliament, for example, adopted twelve new laws over the course of its 2014-2018 term. Corruption in Bosnia has roots in the country's wartime economy. A 2000 Government Accountability Office (GAO) report stated that "organized crime and corruption pervade Bosnia's national political parties, civil service, law enforcement and judicial systems. [Ethnic] parties control all aspects of the government, the judiciary, and the economy, and in so doing maintain the personal and financial power of their members." Many observers claim that the situation has improved little since then. In 2018, the High Representative warned that the rule of law has deteriorated, while the U.S. State Department describes the rule of law as "an existential issue." Bosnia's major parties allegedly siphon from the state apparatus and public enterprises in their strongholds to amass wealth and power. Furthermore, parties in power reportedly politicize hiring in Bosnia's public sector, which employs an estimated third or more of the working population. For many Bosnians, satisfactory employment depends on having the right political connections, which creates a dependence that reportedly is exploited during elections. In 2018, the outgoing U.S. ambassador to Bosnia decried the "[Bosnian] politicians who seek to destabilize the country in order to remain in power at all costs for personal profit and protection." Many analysts believe that Bosnia's entrenched ethnic parties benefit tremendously from the status quo and have little incentive to reform the system. Bosnia's MPs are among the best-paid in Europe relative to local incomes, commanding six to eight times the average Bosnian salary. Parties and politicians who gain office in the government or administration often find "a remarkably efficient path to personal enrichment." Politicians are skilled at using veto points to block legislation that threatens their position in Bosnia's patronage system. According to one analyst, Bosnia's patronage system is "the raison d'etre of the political elites and is the main cause of the state's dysfunctionality and resistance to reform." Bosnia's entrenched political class may also fear penalty if serious reforms are enacted and shine the spotlight on malfeasance. Criminal indictments against leaders in neighborhood countries like Romania, Croatia, and North Macedonia highlight this risk. Analysts believe these disincentives make entrenched politicians resistant to external pressure for reform. Several major rounds of U.S.- and EU-brokered constitutional reform efforts, including in 2006, 2008, and 2009, ultimately failed. Germany and the United Kingdom launched a major initiative in 2014 to shift the focus from difficult constitutional reforms to seemingly more feasible socioeconomic reforms that they hoped would improve Bosnia's economy and dismantle patronage networks. The 2015 "Reform Agenda" identified economic, administrative, and legal measures to be adopted by entity- and state-level governments. The process, which required the major parties to commit in writing to the reform framework, was supported by the EU, the International Monetary Fund, the World Bank Group, and the United States. As an incentive for politicians to agree to the Agenda, the EU offered the entry into force of Bosnia's long-stalled Stabilization and Association Agreement, which marked the first step toward EU membership. However, most observers view the Reform Agenda as largely unsuccessful; many of its provisions failed when entrenched parties objected to measures that would undercut their dominance. While many officials recognize that Bosnia's political system needs reform, there is little consensus on how to change it or to generate the political will to find common ground so long as the dominant parties remain entrenched. Bosnian Serb leaders have expressed a desire to return to the "original" Dayton system, when the entities had greater competencies in security and justice. Milorad Dodik, who has dominated politics in Republika Srpska since the 2000s, has gone further by repeatedly threatening RS secession. Bosnian Croat leaders from the largest Croat party, the Croatian Democratic Union of Bosnia (HDZ-BiH), call for more autonomy for Croats, and have raised the prospect of splitting FBiH to create a third Croat-majority entity. By contrast, Bosniak leaders generally prefer more centralization and the removal of some of the institutional arrangements that they believe contribute to dysfunction and gridlock. Some Bosniak officials also have proposed dismantling the entities or eliminating FBiH's cantons. Survey research documents Bosnian citizens' anger toward the political class and their distrust of political institutions. In a 2018 International Republican Institute survey, 86% of respondents expressed belief that Bosnia is heading in the wrong direction. An estimated 170,000 individuals—disproportionately young and skilled—have emigrated since 2013. Dissatisfaction with education and healthcare, insecurity, and nepotism are cited as key motives to emigrate. Nevertheless, some analysts believe that periods of social discontent in 2014 and 2018, which challenged the system but appeared to transcend ethnic divides, suggest that strengthening Bosnian civil society could increase pressure for reform, and perhaps cultivate a new generation of party leaders. Other observers have put their hopes for reform in Bosnia's so-called "civic parties," which do not have nationalist platforms and typically mobilize voters on the basis of socioeconomic interests rather than ethnicity. While these parties have not matched the results of the ethnic parties, their electoral performance has improved in recent years. Bosnia's challenges came to the forefront during its most recent general election on October 7, 2018 (see Table 1 ). The Central Election Commission (CEC) registered 60 parties and over 3,500 candidates for state-level, entity, and cantonal offices. Observers noted that the campaign climate was more divisive and nationalist in tone than usual. Despite broad voter dissatisfaction, entrenched ethnic parties won the largest vote shares. Almost six months after the election, the parties are still negotiating over government formation at the state level and in FBiH; however, it appears that entrenched ethnic parties will continue to dominate. In March 2019, the leaders of the largest Bosniak, Croat, and Serb parties stated that they had agreed to a set of principles to guide forming the state-level government (the Council of Ministers). Some observers viewed the improved result of civic parties (one-third of the vote in FBiH) as a positive development. Some of the most controversial outcomes concern the elections to the state-level presidency, composed of three members (one Bosniak, one Croat, and one Serb). In a closely fought race, Šefik Džaferović, candidate of the ethnic Bosniak SDA party, narrowly defeated the candidate of the civic SDP party (36.6% and 33.5%, respectively), retaining the lock that the SDA has had on the Bosniak seat in most elections since 1996, but perhaps auguring a future victory by a civic party candidate. Prior to the election, some analysts expressed concern at the prospect of two of the three seats on the presidency being held by the nationalist Bosnian Serb leader Milorad Dodik and his ally, the nationalist Bosnian Croat politician Dragan Čović. Both politicians have explicitly or implicitly challenged the legitimacy of Bosnian statehood and called for greater ethnoterritorial autonomy. However, to the surprise of some observers, Željko Komšić of the civic Democratic Front defeated incumbent Čović for the Croat seat with 53% of the vote. Komšić was previously elected as the Croat member of the presidency in 2006 and 2010, and is considered to be a moderate political figure who generally supports centralizing reforms. In contrast to HDZ-BiH leader Čović, he does not have strong ties to the Croatian government. Komšić's election as the Croat member of the presidency in 2006 and 2010 was mired in controversy amid complaints that he only won with the support of Bosniaks who voted in the election for the Croat member on the presidency rather than the Bosniak member. Komšić identifies as Croat but has been leader of several civic parties. He comes from central Bosnia, and not from the Croat-majority western regions that are the stronghold of the HDZ. Although it is not illegal for Bosniaks to vote for the Croat seat on the presidency rather than the Bosniak seat, some Croat leaders (especially HDZ-BiH and HDZ-1990) claim that it violates the spirit of Dayton and results in illegitimate representation of Croats. Similar accusations of ethnic cross-voting surfaced after Komšić's victory in 2018. Some analysts expect Komšić's victory to harden the HDZ-BiH position on electoral reform (see "Legal Challenges," above) and possibly embolden politicians who seek a separate entity. As most pre-election polls anticipated, RS strongman Milorad Dodik defeated the more moderate incumbent Serb member of the presidency with 54% of the vote. Dodik has dominated entity politics in RS since the mid-2000s as entity prime minister and president. Analysts note that RS's political environment grew more closed as Dodik consolidated power. Dodik has run afoul of the United States and the EU by frequently threatening to hold a referendum on RS secession, questioning the legitimacy of Bosnian statehood, and cultivating close ties to Russia (see below). The U.S. Treasury Department sanctioned him in 2017 for actively obstructing Dayton. Many analysts have expressed concern that Dodik will use his new position to obstruct the workings of the central government while continuing to dictate politics in RS through loyal allies. Shortly after the election he vowed to "work above all and only for the interests of Serbs." One of his first acts as head of state was to call for Bosnia to recognize Ukraine's Crimea region as Russian territory. In December 2018, the National Assembly of RS approved the creation of several new ministries, an act that some view as an attempt to wrest competencies from the state-level government. In early 2019, the RS parliament courted controversy when it passed legislation to create a new commission to reinvestigate the events of Srebrenica, which many view as an attempt to deny or downplay the massacres. Since the election, the formation of governments has proceeded piecemeal, and legal challenges to election law in FBiH (see above, "Legal Challenges") initially cast doubt over the formation of that entity's government. The RS National Assembly approved the new entity government in December 2018. Party leaders continue to negotiate over forming governments in FBiH and the state-level Council of Ministers. Because the FBiH government did not fix electoral legislation before the election, the Electoral Commission adopted a decision to assign delegates to the House of Peoples based on the 2013 census. (The Electoral Commission's actions reportedly came amid strong pressure from U.S. and EU officials). Several Bosniak parties challenged the decision before the Constitutional Court; however, the Court declined to take on the case. Bosnia is one of Europe's poorest countries. The 1992-1995 war caused an estimated $110 billion in damage, and Bosnia's economy contracted to one-eighth of its prewar level. Despite significant reconstruction and recovery since 1995, GDP per capita was $5,148 in 2017, well below the EU average ($33,715) and that of Bulgaria ($8,031), its lowest-ranking member. Nearly one in five Bosnians lives below the poverty level. Bosnia's unemployment rate was 18% in 2018, down from 28% in 2015. Youth unemployment also declined in recent years from 60% to 46%. Nevertheless, these rates are still high by European standards. Since 2015, annual GDP growth has averaged around 3%, but it is largely driven by consumption (much of which in turn is fueled by migrant remittances). The IMF has urged Bosnia to privatize or restructure the nearly 550 state-owned enterprises that comprise roughly 20% of its economy; many of them are unprofitable but allegedly are used by politicians as "cash cows and workplaces for loyal cadres." Bosnia participates in several free trade schemes. In 2006, it joined the Central European Free Trade Agreement (CEFTA) alongside other non-EU countries in the region, including other ex-Yugoslav neighbors. Bosnia's Stabilization and Association Agreement (SAA) with the European Union, which entered into force in 2015, provides for almost fully free trade. A free trade agreement with the European Free Trade Association (EFTA) also entered into force in 2015. The EU is Bosnia's primary trade partner. Germany, Italy, Croatia, Slovenia, and Austria are Bosnia's key EU export markets, accounting for more than half of its exports in 2017. Serbia, another CEFTA signatory, is also an important export market. Bosnia's major exports include vehicle seats, raw materials, leather products, textiles, energy, and wood products. The EU is also Bosnia's primary source of foreign direct investment (FDI). In 2016, 63% of Bosnia's FDI came from EU countries, with Austria, Croatia, and Slovenia the top sources. Serbia is also a significant source of FDI (16.3%). However, Bosnia's fragmented legal and administrative structure create a challenging investment climate. Many relevant laws differ between the two entities. Corruption, entrenched economic interests, and political instability also deter investment. As a result, FDI amounts to just 2% of Bosnia's GDP, well below the Western Balkan average of 5%. Bosnia was the region's lowest-rated country in the World Bank's 2019 Ease of Doing Business Index. U.S. and EU policymakers view the NATO and EU accession processes as a positive force for democratization and reform in the Western Balkans, including Bosnia. According to analysts, this assessment informed the United States' partial retreat from the region in the 2000s and 2010s. EU membership is one of the few policy issues for which there is relatively broad consensus among Bosnia's politicians and population. The EU's "fundamentals first" approach to enlargement in the Western Balkans frontloads the accession process with meeting the core requirements of having a democratic political system and functioning market economy; in Bosnia, the EU is currently focused on issues relating to the rule of law, public administration reform, and economic development. In 2016, Bosnia submitted its application to join the EU. Its current status is potential candidate , which entitles it to receive financial assistance from the EU's Instrument for Pre-Accession Assistance II (IPA II). Between 2014 and 2020, Bosnia is expected to receive €552 million in IPA II allocations, making the EU Bosnia's largest source of foreign assistance. Many EU member states provide additional aid to Bosnia through domestic foreign assistance programs. Bosnia's EU membership prospects are uncertain. In a 2018 progress report, the European Commission (the EU's executive) flagged Bosnia's slow implementation of reforms, including the 2015 Reform Agenda (a flagship EU initiative in Bosnia) and numerous domestic and international court rulings (see "Legal Challenges," above). Some analysts question whether Bosnia, under its current political system, would be capable of meeting the membership requirement of harmonizing domestic legislation with the many thousands of provisions in the acquis communautaire, the cumulative body of EU legislation, case law, and regulations. In comparison to EU membership, Bosnian leaders are more divided over the issue of joining NATO. These divisions largely fall along Bosnian Serb and Bosnian Croat/Bosniak lines. Bosnian Serb opposition is rooted in resentment over NATO's role in the Bosnian war, and may also reflect a desire to remain in lockstep with neighboring Serbia, which also does not seek NATO membership. Bosnia joined NATO's Partnership for Peace in 2006 and secured an Individual Partnership Action Plan in 2008. In 2010, NATO indicated that it would launch a Membership Action Plan (MAP)—a program to help aspiring members meet membership requirements—once Bosnia meets several conditions, the most challenging of which is the reregistration of permanent defense installations from entity to state-level government. RS officials have resisted ceding control over defense installations on entity territory. Although Bosnia does not yet meet these requirements, in December 2018 NATO foreign ministers invited Bosnia to activate its MAP by submitting its first Annual National Program. Some analysts interpreted this invitation as a gesture to generate reform momentum in Bosnia's fragile post-election period. The Bosniak and Croat members of the presidency responded positively, but Bosnian Serb leaders (and most Bosnian Serbs) do not want Bosnia to join NATO. In October 2017, the RS National Assembly passed a resolution supporting military neutrality. RS President Željka Cvijanović reiterated this stance after NATO's invitation, and Dodik—now a member of the state-level presidency—also has vowed to pursue military neutrality. Bosnia's relations with Croatia and Serbia are seen as an important component of regional stability. However, bilateral relations have often been fraught as a legacy of the Bosnian war, as well as sensitivities over Croatia and Serbia's relations with Bosnian Croats and Serbs. While democratic gains in Croatia and Serbia after 2000 contributed to improved relations with Bosnia, they remain reluctant to examine or acknowledge their role in the Bosnian war. At times, Bosnian leaders have objected to what they describe as Croatian and Serbian meddling in Bosnia's affairs. Ex-Bosnian Croat member of the presidency Dragan Čović and current Bosnian Serb member of the presidency Milorad Dodik draw support from leaders in Croatia and Serbia and reportedly hold Croatian and Serbian citizenship, respectively, alongside their Bosnian citizenship. The Croatian government financially and politically backed Čović in Bosnia's 2018 elections, and Croatian politicians have raised the issue of Bosnian Croats' constitutional challenges (see above, "Legal Challenges") in forums like the European Parliament, NATO, and the United Nations. These moves prompted three former High Representatives to Bosnia to issue a joint letter expressing alarm over Croatia's "meddling" in Bosnia's internal affairs. The Croatian government also challenged the legitimacy of Željko Komšić as the Croat member of the Bosnian presidency (see above, "2018 General Election"). Some parties in Croatia hold Croatian election campaign events on Bosnian territory to mobilize Bosnian Croat voters with dual citizenship to vote in Croatia's elections. The Serbian government likewise supports Dodik, who is a frequent visitor to Belgrade. Some Serbian politicians have made statements supporting convicted Bosnian Serb war criminals, inflaming an issue that remains highly sensitive in Bosnia. Bosnia and Serbia have an unresolved demarcation dispute over approximately 40 square kilometers of border area, including a railway segment and hydroelectric power stations. Bosnia has dual citizenship treaties with Croatia and Serbia, resulting in hundreds of thousands of Bosnian Croats and Bosnian Serbs acquiring dual citizenship. This has raised jurisdictional issues in cases in which indicted war criminals hold dual citizenship. Despite occasional tensions in their relations, Croatia and Serbia are important economic partners for Bosnia. Both countries are among Bosnia's top export markets and top sources of FDI. As part of its enlargement strategy in the Western Balkans, the EU has embraced a connectivity agenda to improve regional transportation, energy, and infrastructural linkages, reserving up to €1 billion in grants for projects for the period 2015-2020. Officials believe that improved connectivity could benefit bilateral relations and contribute to regional stability. Given its strategic location and relatively small, weak states, the Balkan region has long drawn in more powerful states. Many analysts maintain that as the United States and the European Union have both scaled back their presence in the Balkans to address other issues since the late 2000s, Russia, Turkey, and China partly filled the vacuum. U.S. and EU officials have expressed concern over Russian influence in the Western Balkans, particularly after Russia occupied Ukraine's Crimea region in 2014. Many analysts maintain that Russia does not have a grand strategy in the Western Balkans, but rather aims to prevent Euro-Atlantic integration and shore up its claims to great power status by asserting itself in the EU's "inner courtyard." Analysts have identified several Russian tools in the region, including playing a "spoiler" role, projecting soft power, and leveraging energy dominance. Observers contend that Russia plays a "spoiler" role in Bosnia by exacerbating ethnic divisions, backing illiberal or anti-Western political factions, and helping to militarize RS. They claim that these actions help sustain the dysfunction and gridlock that undermine Bosnia's Euro-Atlantic reform efforts. Russia has supported Bosnian Serb and Bosnian Croat nationalist leaders Milorad Dodik and Dragan Čović. Dodik's meeting with Russian President Vladimir Putin just before Bosnia's October 7, 2018 general election was one of nearly ten meetings between the two over the past three years, signaling high-level Russian support. Many experts assert that Russia has been a key ally to Dodik in resisting Western pressure to cooperate on reforms. Moscow has also supported divisive RS policies. When Dodik violated a Bosnian Constitutional Court ruling in 2016 by holding a referendum to establish a controversial "Statehood Day," Russia stood apart from the High Representative and Western diplomats by supporting the initiative. More recently, Russia stated its support for RS's controversial Srebrenica commission (see above). Analysts have also expressed concern at Russia's apparent support for Čović, who has advocated greater autonomy for Croats and the creation of a third Croat entity. Some analysts have expressed concern at Russia's role in RS's security sector. Russian forces have trained RS police special forces on counterterrorism and intelligence. Some observers believe that these exercises contribute to militarization in RS, potentially pushing the police force beyond its civilian law enforcement mandate. Analysts caution that militarization could increase the scale of violence in any confrontation between RS and the Bosnian government. Some Bosnian Serb ultranationalist and veterans groups have fought alongside pro-Russia combatants in Ukraine, and analysts believe they could be mobilized to support RS leaders as well. Russian soft power draws upon religious and cultural kinship with Bosnian Serbs, as well as Russia's history of support during the wars of Yugoslav disintegration. Kremlin-linked media, like Sputnik and RT , amplify existing anti-Western narratives and positively shape public opinion toward Russia. Some local media further propagate Sputnik and RT articles. A 2018 National Democratic Institute media study found that RS media stories about Russia were overwhelmingly positive, while the tone of most stories about the United States and NATO was negative. Pro-Russian media glorifies the Russian military, highlights cultural and religious links between Serbs and Russians, and documents high-level meetings between RS and Russian officials. Economic relations between Russia and RS have deepened in recent years. Russia is the largest source of FDI in RS, and it is largely concentrated in the energy sector. In 2007, Russian state-owned oil company Zarubezhneft bought RS's Bosanski Brod oil refinery, motor oil processing facilities in nearby Modrica, and retailer Banjaluka Petrol. Some analysts believe that these assets—which were purchased without an open tender—give Zarubezhneft influence in RS. In addition to being an important employer, Zarubezhneft is RS's biggest taxpayer; its value-added tax and excise duty contributions reportedly account for 25% of RS budget revenue. Bosnia depends upon Russian natural gas imports via Ukraine. Energy policy is vested in the entities, and Russian natural gas provider Gazprom reportedly has used its market dominance to pit the two entities against one another and undermine projects that would diversify supplies. Many analysts believe that Turkey's influence in Bosnia has increased over the last two decades due to Ankara's close relationship with Bosniak leaders. Some Turkish officials reportedly view Bosnia as a natural sphere of influence given geographic and historical connections. Observers note that Turkish President Recep Tayyip Erdogan has at times invoked Ottoman-era ties to Bosnia and religious kinship with Bosniaks as soft power tools. Turkish influence in Bosnia has expanded since Yugoslavia's collapse. During the 1992-1995 war, Turkey gained prestige among Bosniaks by condemning the international arms embargo against Bosnia, arguing that it prevented Bosniaks from defending themselves. Turkey, as well as other predominantly Muslim countries like Iran and Saudi Arabia, reportedly supplied Bosniak forces with arms. Turkish influence has continued since the war's end. Bosnia is one of the top recipients of Turkish Cooperation and Coordination Agency assistance; much of this support is earmarked for projects to restore Ottoman-era buildings and monuments. A Turkish Cultural Center was established in Bosnia in 2003, and in 2009 the Yunus Emre Foundation, an NGO founded by the Turkish government, opened an office in Sarajevo to promote Turkish language and culture. Turkey has popular support among Bosniaks. In a 2018 International Republican Institute survey, 76% of Bosniak respondents had positive views of Turkey—the strongest support among Bosniaks for any foreign state. Many Bosnian Croats and Bosnian Serbs look to Croatia and Serbia as external protectors, and some analysts believe that Turkey has attempted to establish a similar role for itself vis-à-vis Bosniaks. Observers contend that Erdogan's ruling party has particularly strong ties to the largest Bosniak ethnic party, the SDA. Erdogan and Turkish state-owned media openly supported SDA candidate Bakir Izetbegović in his bid for the Bosniak seat on the presidency in 2014. Some observers believe that Izetbegović's clout within the SDA rests in part on his support from Erdogan. Economic relations between Bosnia and Turkey have deepened in recent years. Turkish FDI in Bosnia accounted for 5.6% of FDI flows in 2016. One notable project is a highway to connect Sarajevo to Belgrade, Serbia. After years of disagreement, Bosnian officials approved the route in February 2019. Turkey is expected to provide funding for some of the expected €3 billion in costs, although the terms of the contract are not yet resolved. Some officials, including French President Emmanuel Macron, have expressed concern over Turkey's alleged ambitions as part of broader EU concern over external influence in the Balkans. However, analysts caution that Turkey's ambitions and capabilities in the Balkans may be overstated. They note that the scope of Turkish investment is sometimes exaggerated in the media, and that proposed projects do not always come to fruition. While Russian and Turkish influence in Bosnia relies in part on soft power, China's presence in Bosnia is primarily economic. Between 2011 and 2019, Chinese investments in Bosnia amounted to an estimated $3.6 billion, primarily in the form of direct lending for energy and transportation projects. Chinese firms have contracts to construct or expand energy plants, including a €350 million loan to construct a coal-fired plant in Stanari, RS. A €1.4 billion deal was signed to construct a highway between Banja Luka and Mlinište. In March 2019, the EU Energy Community criticized the FBiH entity government's decision to guarantee a €600 million loan from China's Exim Bank to build a coal-fired power plant in Tuzla. However, some analysts caution that China's economic influence in Bosnia may be overstated at present. While China's pledged investments in high-visibility projects garner media attention, the actual amount of Chinese FDI is far less than that of the EU. Moreover, many pledged projects do not come to fruition. Nevertheless, EU and U.S. officials have voiced concern over the scope of China's investments in the Balkans, as well as Chinese lending practices. Chinese loans often require recipient state governments to assume the loan burden, potentially leading to high external debt. The EU has also raised concerns that Chinese lending practices violate EU rules in public procurement because they frequently require use of Chinese contractors, laborers, or supplies. In contrast to EU funds, which are partly designed to spur reform, Chinese loans have few conditions and rules linked to transparency or reform. Finally, EU officials have expressed concern that China's economic might could be a source of leverage over recipient states that are candidates or potential candidates for EU membership and thus impede the EU's ability to speak with one voice on relations with China if they do become members. Bosnia was not a core transit country in the "Balkan Route" that hundreds of thousands of migrants and refugees followed in an attempt to reach the EU during heightened flows in 2015 and early 2016. However, recent route shifts have brought more migrant and refugee traffic through Bosnia. Since early 2018, an estimated 23,000 migrants and refugees have entered Bosnia; approximately 25% of them remain in the country. Most of them hope to enter EU territory via Bosnia's neighbor, Croatia, and from there move on and enter the EU's visa- and passport-free Schengen Area. However, the Croatian government has expanded border policing, and apprehended individuals are sent back to Bosnia. The EU provided €2 million in 2018 to help Bosnia respond to the crisis and provide shelter to migrants and refugees who are effectively stranded in Bosnia. The migration crisis has triggered a backlash from some Bosnians, particularly in Una-Sana Canton, which borders Croatia and has the highest concentration of migrants and refugees. Some residents of Bihać, Una-Sana's administrative center, protested against camps situated in their municipality in October 2018, while local authorities in Velika Kladuša, another city in the canton, reportedly obstructed the Ministry of Security's plans to house migrants in a local building. The incident illustrates local backlash as well as the state-level government's difficulty enforcing its decisions, even when it has jurisdiction. Islam was introduced to part of Bosnia's population during Ottoman rule. In socialist Yugoslavia, the semi-official Islamic Religious Community played a key role in religious affairs, including legal rulings and religious education. It was renamed the Islamic Community of Bosnia and Herzegovina in 1992, and remains an important religious institution. Islamic tradition in the Balkans, including Bosnia, is generally moderate and secular. The majority of Bosnia's practicing Muslims follow the Hanafi school of Sunni Islam. However, some analysts have expressed concern over the emergence of groups influenced or funded by state and non-state entities in the Arab Gulf states, where more conservative Hanbali Sunni practices are common. Aid workers, missionaries, and "mujahedeen" fighters from the Gulf States promoted transnational Islamist militancy and Salafist Hanbali religious doctrine during Bosnia's 1992-1995 war; Iran's government also supported Bosniak leaders and forces. After the war, Saudi Arabia provided an estimated $600 million in aid to repair and build hundreds of mosques and establish schools and cultural centers that promote socially conservative Sunni views. Iran has also maintained active cultural outreach and other ties to some Bosnian Muslims. Many analysts contend that Salafi groups have limited support in Bosnia because of the traditionally high level of secularism among Bosnian Muslims. They also note that few Bosnian Muslims who subscribe to Salafist ideas and practices have violent intentions, and many of them live in remote rural communities. While most of these groups were not originally affiliated with official religious organizations in Bosnia, the Grand Mufti of Bosnia's Islamic Community exerted pressure on them to acknowledge his authority and his right to monitor religious content. As a result, an estimated 90% of Salafi groups were brought under official structures. Nevertheless, some experts caution that radicalized groups and individuals may pose a terrorist threat despite their small numbers. Radicalized Muslims were implicated in the bombing of a police station in Bugojno in 2010 and a lone-gunman attack on the U.S. Embassy in Sarajevo in 2011. The Islamic State (IS) and Nusra Front's gains in Syria and Iraq in the 2010s altered the dynamic of the terrorism threat in Bosnia and broadened the use of social media in recruitment. Between 2012 and 2017, an estimated 350 Bosnian citizens traveled from Bosnia or Bosnian diaspora communities to fight with armed groups in Iraq and Syria. More recently, returned foreign fighters are seen as a potential threat as the position of the IS and other armed groups has weakened. Bosnia's stock of illegal weapons, mines, and explosives may exacerbate the risk posed by returnees. As of December 2017, officials believed that just over 100 Bosnians remained in Syria (including women and children), roughly 50 had returned to Bosnia, and 70 had been killed in the conflict. In 2014, the Bosnian government introduced new criminal offenses to prosecute foreign terrorist fighters and recruiters. Several dozen returned fighters and domestic recruiters have been convicted of these offenses. While the U.S. State Department describes Bosnia as a "cooperative counterterrorism partner," it warns that Bosnia's political fragmentation and dysfunction could undermine counterterrorism efforts. For example, in 2017 several ministries proposed new measures to tighten counterterrorism efforts; however, they were not enacted due to political gridlock in state-level and FBiH governments. Initially viewed as a "European problem," the Bosnian conflict eventually helped shape the post-Cold War role of the United States and NATO in European security. When the United States assumed greater responsibilities in resolving the conflict, its role was considerable: leading NATO airstrikes, garnering diplomatic support from Russia and European allies, persuading warring parties to agree to a ceasefire, brokering the Dayton Peace Agreement, and deploying 20,000 troops to Bosnia. According to Richard Holbrooke, the U.S. official who brokered the talks, the Bosnian war was a pivotal period in U.S. foreign policy in Europe: "The three main pillars of [policy]—U.S.-Russian relations, NATO enlargement into Central Europe, and Bosnia—had often worked against each other. Now they reinforced each other: NATO sent its forces out of area for the first time in its history, and Russian troops, under an American commander, were deployed alongside them." Some analysts and policymakers believe that the United States' strong hand in resolving the conflict and in shaping Bosnia's political system have made it a stakeholder in Bosnia's future. U.S. officials, often in cooperation with the EU, have intervened to defuse crises and broker reform talks. The United States also has imposed sanctions against Bosnian officials: in addition to Dodik (see above), the U.S. State Department publicly designated Bosnian Serb politician Nikola Špirić (Dodik's associate) for "significant corruption or gross violation of human rights." U.S. policymakers attach strategic importance to Bosnia's stability; many analysts believe turbulence in Bosnia could reverberate in the Balkans and potentially draw in Croatia and Serbia, while instability in other parts of the region could spill over into Bosnia. When the Trump Administration indicated in 2018 that it would consider supporting a potential Serbia-Kosovo agreement to "adjust borders" between the two—a major break with the long-standing EU and U.S. policy to oppose redrawing borders in the Balkans along ethnic lines—some analysts expressed concern that the Administration could reshape long-standing U.S. policy toward Bosnia. However, the new U.S. Ambassador to Bosnia stated in February 2019 that the U.S. will continue to be "guarantor of Bosnia and Herzegovina's sovereignty and territorial integrity." On the other hand, many observers also note that U.S. engagement in Bosnia (and the Western Balkans) decreased under the administrations of President George W. Bush and President Barack Obama. During this time U.S. policymakers turned their focus to geopolitical crises and challenges in other parts of the globe while ceding the regional lead to the EU. Indeed, some analysts have urged the United States to assume a greater role in Bosnia, arguing that Bosnia's current crises warrant it, and that the EU and the United States are more effective in the region when they work together. Congressional interest in Bosnia dates back to the 1992-1995 war. Many Members featured prominently in foreign policy debates over U.S. intervention in the conflict. In 2015, the House passed a resolution describing the Srebrenica massacres as a genocide and urging the United States to continue to support Bosnia's territorial integrity ( H.Res. 310 , 114 th Congress). In the 114 th and 115 th Congresses, a bill was introduced in the Senate to establish an enterprise fund to promote economic development and the private sector in Bosnia ( S. 2307 and S. 864 ). In April 2018, the House Foreign Affairs Committee's Subcommittee on Europe, Eurasia, and Emerging Threats held a hearing on Bosnia's prospects ahead of its October 2018 elections. Congress's engagement with Bosnia also continues within the broader context of policy concern over the external influence of China, Turkey, and Russia in the Western Balkans and energy security. As a potential candidate for EU membership and NATO partner, Bosnia is eligible for assistance through the Countering Russian Influence Funds under the Countering America's Adversaries Through Sanctions Act (CAATSA) enacted in 2017 ( P.L. 115-44 ). Through congressionally approved (and sometimes expanded) foreign assistance appropriations, Bosnia has received more than $2 billion in aid since 1995. Between 1996 and 1999, the United States pledged $1 billion of the $4 billion international commitment to implementing Dayton's civilian provisions and helping to rebuild Bosnia. The cost of U.S. military operations in Bosnia since 1992 is estimated at more than $10 billion ( Appendix I ). Bosnia continues to receive U.S. foreign assistance, although the amount has decreased in recent years. Assistance to Bosnia in FY2015 and FY2016 was approximately $33 million each year. In FY2017, it was $53.5 million, and $41.5 million in FY2018. The Administration requested $21 million for FY2019 and $16.9 million for FY2020. Nearly 25 years after the Dayton Peace Agreement, Bosnia faces many challenges. In considering U.S. relations with Bosnia, Members of Congress may consider the following questions: How can the United States encourage Bosnia's government to incorporate the legal rulings of the Bosnian Constitutional Court and the European Court of Human Rights into election legislation and the constitution? How can U.S. foreign assistance be used to counter Russian influence in Republika Srpska, in particular Russia's close ties to Bosnian Serb politicians and its use of local media and Sputnik to amplify anti-U.S. narratives and project pro-Russia soft power? What are the implications of potential militarization in Republika Srpska? How can the United States effectively address this alleged trend? How can the United States support a successful reform initiative that secures transparency and accountability, and facilitates a political community in which politicians and voters are committed to the Bosnian state and socioeconomic challenges that transcend all three ethnic groups? Can the Germany-U.K. initiative from 2015 be revived, or is it better to start from scratch? Are the approximately 600 troops in the European Union Force mission in Bosnia sufficient to stabilize Bosnia if violence breaks out? If Serbia and Kosovo agree to normalize relations by redrawing their borders, how can U.S. policymakers prevent this development from destabilizing Bosnia, particularly given Milorad Dodik's threats to seek RS secession if Kosovo is "partitioned"? How can the United States encourage Croatia and Serbia to engage in Bosnia in a manner that helps bridge ethnic divisions and contributes to Bosnia's territorial integrity and sovereignty? Given the pervasiveness of corruption in Bosnia, how can U.S. assistance most effectively be used to counter it? Does foreign assistance contribute to civic groups and independent media that could serve as a check against corruption? 

Question: Write a one-page summary of the report 1.

Answer: The federal government plans to invest almost $96 billion in IT in fiscal year 2018. Historically, IT investments have too often failed or contributed little to mission-related outcomes. Further, increasingly sophisticated threats and frequent cyber incidents underscore the need for effective information security. As a result, GAO added two areas to its high-risk list: IT security in 1997 and the management of IT acquisitions and operations in 2015. This statement summarizes agencies' progress in improving IT management and ensuring the security of federal IT. It is primarily based on GAO's prior reports issued between February 1997 and May 2018 (and an ongoing review) on (1) CIO responsibilities, (2) agency CIOs' involvement in approving IT contracts, (3) data center consolidation efforts, (4) the management of software licenses, and (5) compliance with cybersecurity requirements. The Office of Management and Budget (OMB) and federal agencies have taken steps to improve the management of information technology (IT) acquisitions and operations and ensure the security of federal IT through a series of initiatives. As of May 2018, agencies had fully implemented about 61 percent of the approximately 800 IT management-related recommendations that GAO made from fiscal years 2010 through 2015. Likewise, since 2010, agencies had implemented about 66 percent of the approximately 2,700 security-related recommendations as of May 2018. Even with this progress, significant actions remain to be completed. Chief Information Officer (CIO) responsibilities . Laws such as the Federal Information Technology Acquisition Reform Act (FITARA) and related guidance assigned 35 key IT management responsibilities to CIOs to help address longstanding challenges. However, in a draft report on CIO responsibilities, GAO's preliminary results suggest that none of the 24 selected agencies have policies that fully address the role of their CIO, as called for by federal laws and guidance. GAO intends to recommend that OMB and each of the selected 24 agencies take actions to improve the effectiveness of CIO's implementation of their responsibilities. IT contract approval . According to FITARA, covered agencies' CIOs are required to review and approve IT contracts. Nevertheless, in January 2018, GAO reported that most of the CIOs at 22 selected agencies were not adequately involved in reviewing billions of dollars of IT acquisitions. Consequently, GAO made 39 recommendations to improve CIO oversight over IT acquisitions. Consolidating data centers . OMB launched an initiative in 2010 to reduce data centers, which was codified and expanded in FITARA. According to agencies, data center consolidation and optimization efforts have resulted in approximately $3.9 billion of cost savings through 2018. Even so, additional work remains. GAO has made 160 recommendations to OMB and agencies to improve the reporting of related cost savings and to achieve optimization targets; however, as of May 2018, 80 of the recommendations have not been fully addressed. Managing software licenses . Effective management of software licenses can help avoid purchasing too many licenses that result in unused software. In May 2014, GAO reported that better management of licenses was needed to achieve savings, and made 135 recommendations to improve such management. Four years later, 78 of the recommendations remained open. Improving the security of federal IT systems . While the government has acted to protect federal information systems, agencies need to improve security programs, cyber capabilities, and the protection of personally identifiable information. Over the last several years, GAO has made about 2,700 recommendations to agencies aimed at improving the security of federal systems and information. These recommendations identified actions for agencies to take to strengthen their information security programs and technical controls over their computer networks and systems. As of May 2018, about 800 of the information security-related recommendations had not been implemented. From fiscal years 2010 through 2015, GAO made about 800 recommendations to OMB and federal agencies to address shortcomings in IT acquisitions and operations. Since 2010, GAO also made about 2,700 recommendations to federal agencies to improve the security of federal systems. These recommendations include those to improve the implementation of CIO responsibilities, the oversight of the data center consolidation initiative, software license management efforts, and the strength of security programs and technical controls. Most agencies agreed with these recommendations, and GAO will continue to monitor their implementation.