U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2250 Mail: Stop SSOP, Washington, DC 20402–0001

32-202 PDF 2007

S. HRG. 109–772

NOMINATION OF ROBERT T. HOWARD TO BE

ASSISTANT SECRETARY FOR INFORMATION

AND TECHNOLOGY, DEPARTMENT OF

VETERANS AFFAIRS

HEARING

BEFORE THE

COMMITTEE ON VETERANS’ AFFAIRS 

UNITED STATES SENATE

ONE HUNDRED NINTH CONGRESS

SECOND SESSION

SEPTEMBER 26, 2006

Printed for the use of the Committee on Veterans’ Affairs

Available via the World Wide Web: http://www.access.gpo.gov/congress/senate 

(II)

COMMITTEE ON VETERANS’ AFFAIRS 

LARRY E. CRAIG, Idaho, Chairman 

ARLEN SPECTER, Pennsylvania 

KAY BAILEY HUTCHISON, Texas 

LINDSEY O. GRAHAM, South Carolina 

RICHARD M. BURR, North Carolina 

JOHN ENSIGN, Nevada 

JOHN THUNE, South Dakota 

JOHNNY ISAKSON, Georgia 

DANIEL K. AKAKA, Hawaii, Ranking Member 

JOHN D. ROCKEFELLER IV, West Virginia 

JAMES M. JEFFORDS, (I) Vermont 

PATTY MURRAY, Washington 

BARACK OBAMA, Illinois 

KEN SALAZAR, Colorado 

LUPE WISSEL, Majority Staff Director 

BILL BREW, Minority Staff Director 

(III)

C O N T E N T S 

SEPTEMBER 26, 2006

SENATORS 

Page 

Craig, Hon. Larry E., Chairman, U.S. Senator from Idaho ................................. 1

Isakson, Hon. Johnny, U.S. Senator from Georgia ............................................... 3

Murray, Hon. Patty, U.S. Senator from Washington ........................................... 3

Salazar, Hon. Ken, U.S. Senator from Colorado ................................................... 4

Prepared statement .......................................................................................... 5

WITNESSES 

Howard, General Robert T., Nominee to be Assistant Secretary for Information and Technology, Department of Veterans Affairs ...................................... 6

Prepared statement .......................................................................................... 7

Questionnaire .................................................................................................... 9

(1)

NOMINATION OF ROBERT T. HOWARD TO BE 

ASSISTANT SECRETARY FOR INFORMATION 

AND TECHNOLOGY, DEPARTMENT OF

VETERANS AFFAIRS 

TUESDAY, SEPTEMBER 26, 2006

U.S. SENATE, COMMITTEE ON VETERANS’ AFFAIRS, Washington, DC. 

The Committee met, pursuant to notice, at 10 a.m., in room SR–

418, Russell Senate Office Building, Hon. Larry E. Craig, Chairman of the Committee, presiding. 

Present: Senators Craig, Isakson, Murray, and Salazar. 

OPENING STATEMENT OF HON. LARRY E. CRAIG, CHAIRMAN, 

U.S. SENATOR FROM IDAHO 

Chairman CRAIG. Good morning, ladies and gentlemen, and welcome to the Senate Committee on Veterans’ Affairs. 

The Committee meets this morning to consider the nomination of 

Robert Howard to serve as Assistant Secretary for Information and 

Technology at the Department of Veterans Affairs. 

Not long ago, I think if I had asked a group of veterans or Senators what the most important positions at the Department were, 

I would probably have heard Secretary, Under Secretary for Health 

and Benefits, and maybe Assistant Secretary for Financial Management. And while all of those positions are still of utmost importance to the operation of VA, I think all of us here today would concede that the job for which we are now considering this nominee 

has taken an increased significance. 

I am not just speaking of the high-profile lapses of IT security 

that may have made the news lately. They are important, too, and 

I will touch upon them in a moment. But, I am talking about the 

reality that VA would probably come to a grinding halt without all 

of the IT services that make it run every single day. Whether it is 

online application for health care services and benefits, electronic 

transfers of payments to our deserving beneficiaries, or the highly 

touted electronic health records system that has brought VA national acclaim. VA simply cannot live without IT every moment of 

every day. It is, as they say in management terms, an essential 

support function. 

Having said that, General Howard, if you are confirmed, you will 

be expected to lead VA in certain areas, not just support the agency’s mission. Most importantly, you will be expected to bring VA up 

2

to the gold standard of Federal IT security that Secretary Nicholson has said he expects to achieve. 

The events of the past few months were disturbing to all of us. 

Employees carelessly putting sensitive information on portable 

hard drives and taking it home, VA contractors failing to adequately secure hardware containing VA’s information, and laptop 

computers in the hands of thousands of employees still present us 

with daily challenges. All of this is happening while VA is undergoing a massive management restructuring in the IT department. 

I want to make it clear that I am not suggesting that VA’s employees or contractors intentionally compromised VA data. But as 

you and I have discussed, General Howard, I think VA and the 

Federal Government as a whole need a wake-up call and a cultural 

change with respect to information security. 

We need to impress upon our employees and our contractors that 

information is not just power; it is a priceless commodity to many 

people. So we need to handle it, work with it, and guard it like the 

valuable commodity that it is. 

General Howard, today I hope to hear what your plan is to identify the shortcomings in VA’s IT programs, what needs to be done 

to correct those deficiencies, and what is a responsible timeframe 

for accomplishing those goals and bringing VA up to that gold 

standard. I also hope to be reassured that restructuring and IT security challenges will not tie the hands of the 200,000 VA employees. I understand, as do many of my colleagues, that we could have 

perfect security by ensuring no one uses VA’s data. But that, of 

course, would be unreasonable. 

We also need to allow access to data while ensuring that we 

know exactly where it is going, who is viewing it, and whether it 

is being misused. That is an incredible challenge. But I think you 

are up to the job. 

General Howard comes before the Committee with an impressive 

resume and a very distinguished record of Government service. He 

holds a master’s degree in civil engineering, and is a highly decorated Vietnam veteran who rose to the level of Major General in 

the United States Army before retiring from active duty in 1996. 

He spent several years in the private sector after retiring from the 

Army. During this time, he worked with Eastern European countries to help them harness technology in order to emerge from communist hold and join the democratic capitalistic societies of the 

world. 

General Howard, we welcome you to the Committee. After my 

colleagues have given any opening comments, I will ask you to rise 

and be sworn in, as is required under the rules of the Committee, 

and, of course, to introduce any family member that you have with 

you today. 

With that, there we go. Order of entry, I will turn to my colleague from Georgia, Senator Isakson. 

Johnny?

3

STATEMENT OF HON. JOHNNY ISAKSON,

U.S. SENATOR FROM GEORGIA 

Senator ISAKSON. Thank you, Mr. Chairman. 

I had the privilege of meeting with General Howard last week on 

Thursday, and had an in-depth discussion based on the experiences 

I have had in the technology area in running a department of our 

State government as well as in a private sector business. And I 

have to tell you, I was very impressed with his knowledge of software, the potential pitfalls in terms of that, and also very much impressed with his understanding that the reporting of failures in 

technology need to be with the same speed that technology itself 

delivers information. And that was very important to me because 

of the experience we had at VA with the lost computer and the tardiness with which the chain of command responded. 

I just wanted to say at the outset before the testimony that I was 

very impressed with the meeting. I am very impressed with the 

General, and I think he will make an outstanding contribution to 

the Veterans’ Administration. 

Chairman CRAIG. Johnny, thank you very much. 

Now, let me turn to Senator Patty Murray of Washington. 

Patty? 

STATEMENT OF HON. PATTY MURRAY,

U.S. SENATOR FROM WASHINGTON 

Senator MURRAY. Thank you, Mr. Chairman. I want to thank you 

and Ranking Member Akaka, for holding today’s hearing. I know 

he is traveling back from Hawaii and wished he could have been 

here. 

General Howard, I want to thank you for coming before us today. 

I look forward to hearing about your plan to help build the IT system that our veterans need and deserve. 

But before I discuss your nomination, I wanted to mention to the 

Committee a recent article from the Associated Press that really 

should concern every one of us on this Committee. It suggests that 

the VA has no plan to deal with the influx of veterans from Iraq 

and Afghanistan. It states that, ‘‘More than one-third of Iraq and 

Afghanistan veterans seeking medical treatment from the Veterans 

Health Administration report symptoms of stress or other mental 

disorders, a tenfold increase in the last 18 months, according to a 

VA study.’’

The article says that veterans are facing ‘‘long waits for doctor 

appointments, staffing shortages, and lack of equipment and medical centers run by the Veterans Affairs Department. It mentions 

in the article that a soldier from Virginia Beach, Virginia, who was 

having a hard time sleeping after he returned from Iraq was told 

he would have to wait 21⁄2 months for an appointment at the VA 

facility. 

Now, here is a servicemember in need, and all the VA could say 

to him is, ‘‘Get in line and wait 75 days.’’ I find that pretty disgraceful. 

When you look at the numbers, you can really see a crisis in the 

making because just over half a million veterans have served in 

Iraq and Afghanistan and have separated from the military. Of 

those, 185,000 are currently seeking care at our VA medical cenVerDate 0ct 09 2002 10:36 Feb 09, 2007 Jkt 000000 PO 00000 Frm 00007 Fmt 6633 Sfmt 6633 H:\RD41451\DOCS\32202.TXT SENVETS PsN: ROWENA
4

ters; 150,000 of them are applying for benefits; and more than 

100,000 have sought help at our Vet Centers. If the system is already straining, as the AP article told us, then the bulk of the trouble is still yet to come. 

We have nearly a million servicemembers who have served in 

Iraq and Afghanistan but have yet to separate. They are coming 

down the pipeline into a VA system that is already overwhelmed, 

and we have to figure out how we are going to serve those veterans. 

The numbers are really staggering. The doctors at Walter Reed 

have stated that 16 percent of all injured servicemembers have eye 

injuries. Many of them have come with traumatic brain injuries. 

And we have one-third that are seeking mental health care. According to the VA’s own report, nearly 60,000 Iraq and Afghanistan 

vets have ill-defined conditions. And if you have been on this Committee long enough, you will know that some of those symptoms 

sound very familiar to what we later called the Gulf War syndrome 

in the first Gulf War. 

So, Mr. Chairman, I am very concerned. The numbers show that 

a crisis is coming, and so far we have not seen a plan from the VA 

on how we are going to deal with that. I hope that this Committee 

can bring Secretary Nicholson before us, find out what the plan is, 

and what help he needs from all of us to meet those needs. And 

I hope that we can have that hearing when we come back so that 

we can take steps that we need to meet our veterans’ needs. 

General Howard, you and I had a chance to visit. I really appreciate that. As you know, I have some concerns under the new reorganization that the VA is not collaborating with the Health Administration, the Benefits Administration, and Memorial Affairs. And 

I am also concerned that we are not bringing in the best IT staff 

to fill some of our current openings. I am also concerned that the 

VA leadership in Washington, DC, from what I am hearing, is disconnected from field operations. I hope to hear how you can help 

us address those situations. 

I am sure you are aware of the article from GovEx.com, dated 

August 1st, that raises many concerns about VA operations. It outlines a world where everyone is pointing fingers, and it says what 

the VA really needs is a world where everyone is working together. 

I look forward to hearing from you today on how you can help 

make that world work together and not point fingers. 

Thank you, Mr. Chairman. 

Chairman CRAIG. Patty, thank you very much. 

Now, let me turn to Senator Ken Salazar of Colorado. 

Ken? 

STATEMENT OF HON. KEN SALAZAR,

U.S. SENATOR FROM COLORADO 

Senator SALAZAR. Mr. Chairman, I have a statement that I will 

submit. 

Chairman CRAIG. Fine. 

Senator SALAZAR. I will just make two quick comments. 

First of all, General Howard, congratulations and I look forward 

to working with you as we deal with the information technology 

5

issues which have been so much at the forefront of what the VA 

has had to deal with in the last year. 

And, second of all, Mr. Chairman, I agree with Senator Murray 

that I think it would be a good thing for us, perhaps after the election, to get together with Secretary Nicholson and others from the 

VA so that we can look ahead to see what kinds of challenges we 

are going to be dealing with, with the influx of veterans coming 

home from both Iraq and Afghanistan. 

Thank you, Mr. Chairman. 

[The prepared statement of Senator Salazar follows:]

PREPARED STATEMENT OF HON. KEN SALAZAR, U.S. SENATOR FROM COLORADO

Thank you, Chairman Craig and Senator Akaka, for holding today’s hearing. I 

also want to acknowledge Mr. Robert Howard, the President’s nominee to be Assistant Secretary for Information and Technology in the Department of Veterans Affairs. Thank you, Mr. Howard, for coming before this Committee today to discuss 

several critical issues that directly impact veterans in Colorado and across the Nation. 

We have heard a lot about the VA’s handling of information and technology this 

year both about the greater opportunities it presents to us and the greater responsibility it demands from us. I look forward to hearing directly from the President’s 

nominee to be the Department’s Chief Information Officer about how the VA can 

better manage these opportunities and responsibilities. 

Specifically, we need to know what the Office of Information and Technology can 

do to help safeguard our veterans’ personal information. In addition to hearing 

about the steps OIT has taken in response to this spring’s data theft, I would like 

to know what impact the recent reorganization of the Office of Information and 

Technology will have on the ability of the Department to provide information security. 

I understand that this reorganization will involve consolidating many of the Department’s IT professionals under the OIT, increasing the number of personnel operating under your office from 350 to nearly 6,000. This is a huge increase, and I am 

interested in hearing about both the potential benefits and potential drawbacks of 

such a dramatic overhaul. 

Finally, I would like to discuss how the information and technology resources that 

OIT has at its disposal can be used to better serve veterans who are living in rural 

or geographically remote areas. 

With the technological advances we have seen over the past ten to twenty years, 

including the growth of the Internet, there is enormous potential for government to 

use technology to improve the way we provide services to our citizens. I believe we 

have only begun to scratch the surface of that potential. 

While I understand that VA’s Office of Information and Technology is only one 

piece of the puzzle, I would like to hear Mr. Howard’s ideas on how we can use technology to bridge the physical gap that exists between veterans living in rural communities and the VA facilities that are in some cases located hundreds of miles 

away. These tools have already begun to change the way the Americans interact 

with their government, and I am excited at the vast opportunities they present for 

the future. 

Again, I would like to thank Chairman Craig and Senator Akaka for holding this 

hearing, and to thank Mr. Howard for sharing his views with the Committee today. 

I look forward to discussing these and other issues that are important to our Nation’s veterans.

Chairman CRAIG. Well, thank you. I appreciate those suggestions 

from both of you. 

General Howard, Senator Akaka, our Ranking Member, is not 

with us today. As Patty mentioned, he is returning from a successful primary election in the State of Hawaii and will join us later 

on in the day. 

I want the Committee to know that I intend to convene the Committee off the floor this afternoon to vote to report the nominee to 

the full Senate. I do not think any of us, I would hope, would want 

to hold back getting this man on board and at work on an issue 

6

that all of us have opined about in our comments this morning as 

it relates to building a strong IT system within the VA. That is assuming that all goes well in the balance of the hearing, of course, 

and I would hope we could do that sometime today or, if we have 

a vote, around the noon hour. 

With that, General, if you will please rise. Do you swear or affirm that the testimony you are about to give to this Committee 

will be the truth, the whole truth, and nothing but the truth, so 

help you God? 

General HOWARD. I do. 

Chairman CRAIG. Thank you. Please proceed, and as I 

mentioned in my opening comment, if you have family with you, 

please introduce them to the Committee. 

General HOWARD. Sir, I have a statement. Do I have time to read 

that? 

Chairman CRAIG. You do have time to read that. 

STATEMENT OF ROBERT T. HOWARD, NOMINEE TO BE ASSISTANT SECRETARY FOR INFORMATION AND TECHNOLOGY,

DEPARTMENT OF VETERANS AFFAIRS 

General HOWARD. Mr. Chairman and Members of the Committee, 

good morning, and thank you for the opportunity to testify today. 

It is indeed an honor to be nominated by President Bush to be the 

Assistant Secretary for Information and Technology at the Department of Veterans Affairs and to appear before you today. I would 

like to thank the President for nominating me, and Secretary Nicholson for expressing confidence in my abilities by supporting this 

nomination. 

My dedication to the United States military is marked by a history of service and commitment. In 1963, I left Everett, Massachusetts, and entered the U.S. Army to embark upon a career spanning 33 years. During my time of service, I developed a deep respect and appreciation for those who serve in our Armed Forces—

and their families. Personal sacrifice and devotion to duty is routine among members of the military, so they deserve our unwavering support both while wearing the uniform and when they transition into the community of veterans. I am privileged to work for 

them and support that critically important mission stated many 

years ago by President Lincoln: ‘‘To care for him who shall have 

borne the battle and for his widow and orphan.’’ For me, time has 

come full circle—from a long career in active military service to 

now assisting our Nation’s veterans through public service. 

As you know, I have been the supervisor of the Office of Information and Technology within the VA since early May 2006, so I am 

very familiar with all the work that must be accomplished to form 

a new, significantly expanded organization and to also remedy the 

deficiencies that exist within the area of data security. I am confident that my experience in the U.S. Army and in the private sector with the Cubic Corporation, has helped hone the skills required 

to lead the organization effectively and contribute to the successful 

accomplishment of a wide variety of important tasks. 

The reorganization of IT within the VA is a major event that will 

result in more standard processes and better interoperability across 

the Department. I am totally committed to its successful implemenVerDate 0ct 09 2002 10:36 Feb 09, 2007 Jkt 000000 PO 00000 Frm 00010 Fmt 6633 Sfmt 6601 H:\RD41451\DOCS\32202.TXT SENVETS PsN: ROWENA
7

tation and improving our performance, not only in the area of operations and maintenance, but in developmental programs as well. 

The reorganization will assist us in many ways, including the 

area of data security where the most difficult work resides—work 

that is especially important to our veterans. Secretary Nicholson 

has clearly stated that he wants the Department of Veterans Affairs to become the gold standard for all of Government in the area 

of information security. Achievement of that goal involves many activities of the Department, but it must involve the completion of all 

actions associated with the Data Security-Assessment and 

Strengthening of Controls Program. 

This is VA’s high-priority program designed to remedy the many 

security deficiencies that have been uncovered. 

Because of its importance, I have provided the Committee staff 

copies of the action plan associated with this program. This is a living document that will guide our work. Its successful execution is, 

without question, my highest priority. In VA we want to create an 

environment where veteran and VA employee information is treated with respect and is protected with a high degree of rigor. 

I realize the position of Assistant Secretary for Information and 

Technology will involve very difficult work. I am fully prepared for 

this since I know I have the full support of the VA leadership. I 

also know that you are committed to helping us in any way you 

can. 

If confirmed, I will strive to position VA’s Office of Information 

and Technology to be the leader among Federal IT 

organizations in providing secure, high-quality, and responsive 

service to supported organizations in meeting business needs by 

leveraging state-of-the-art technologies and building a high-performing workforce dedicated to the success of those they serve. 

I will continue to remain thoroughly familiar with the issues facing the Department and give my very best effort to work diligently 

and to faithfully advise the Secretary and the Deputy Secretary 

and to keep you informed of progress on a timely basis. 

With me today are my wife, Ciretta, originally from Revere, Massachusetts, and my youngest daughter, Laura Glaub, from 

Woodbridge, Virginia. I am very grateful for their constant love and 

support and to many other family members and friends whose support has been steadfast for many years. 

Also present today is Deputy Secretary Mansfield, whose strong 

support is greatly appreciated. 

Thank you again, Mr. Chairman and Members of the Committee, 

for your consideration of my nomination. I would be happy to answer any questions you may have. 

[The prepared statement of General Howard follows:] 

PREPARED STATEMENT OF ROBERT T. HOWARD, NOMINEE TO BE ASSISTANT SECRETARY FOR INFORMATION AND TECHNOLOGY, DEPARTMENT OF VETERANS AFFAIRS

Mr. Chairman, Senator Akaka, and Members of the Committee, good morning, 

and thank you for the opportunity to testify today. It is indeed an honor to be nominated by President Bush to be the Assistant Secretary for Information and Technology at the Department of Veterans Affairs and to appear before you today. I 

would like to thank the President for nominating me, and Secretary Nicholson for 

expressing confidence in my abilities by supporting this nomination. 

My dedication to the United States military is marked by a history of service and 

commitment. In 1963, I left Everett, Massachusetts, and entered the U.S. Army to 

8

embark upon a career spanning 33 years. During my time of service, I developed 

a deep respect and appreciation for those who serve in our Armed Forces—and their 

families. Personal sacrifice and devotion to duty is routine among members of the 

military, so they deserve our unwavering support both while wearing the uniform 

and when they transition into the community of veterans. I am privileged to work 

for them and support that critically important mission stated many years ago by 

President Lincoln: ‘‘To care for him who shall have borne the battle and for his 

widow and orphan.’’ For me, time has come full circle—from a long career in active 

military service to now assisting our Nation’s veterans through public service. 

I have been the supervisor of the Office of Information and Technology within the 

VA since early May 2006, so I am very familiar with all the work that must be accomplished to form a new, significantly expanded organization and to also remedy 

the deficiencies that exist within the area of data security. I am confident that my 

experience in the U.S. Army and in the private sector with the Cubic Corporation, 

has helped hone the skills required to lead the organization effectively and contribute to the successful accomplishment of a wide variety of important tasks. 

The reorganization of IT within the VA is a major event that will result in more 

standard processes and better interoperability across the Department. I am totally 

committed to its successful implementation and improving our performance, not 

only in the area of operations and maintenance, but in developmental programs as 

well. 

The reorganization will assist us in many ways,including the area of data security 

where the most difficult work resides—work that is especially important to our veterans. Secretary Nicholson has clearly stated that he wants the Department of Veterans Affairs to become the gold standard for all of Government in the area of information security. Achievement of that goal involves many activities of the Department, but it must involve the completion of all actions associated with the Data Security-Assessment and Strengthening of Controls Program (DS–ASC). 

This is VA’s high-priority program designed to remedy the many security deficiencies that have been uncovered. 

Because of its importance, I have provided the Committee staff copies of the action plan associated with this program—this is a living document that will guide 

our work. Its successful execution is, without question, my highest priority. In VA 

we want to create an environment where veteran and VA employee information is 

treated with respect and is protected with a high degree of rigor. 

I realize the position of Assistant Secretary for Information and Technology will 

involve very difficult work. I am fully prepared for this since I know I have the full 

support of the VA leadership. I also know that you are committed to helping us in 

any way you can. 

If confirmed, I will strive to position VA’s Office of Information and Technology 

to be the leader among Federal IT organizations in providing secure, high-quality, 

and responsive service to supported organizations in meeting business needs by 

leveraging state-of-the-art technologies and building a high-performing workforce 

dedicated to the success of those they serve. 

I will continue to remain thoroughly familiar with the issues facing the Department and give my very best effort to work diligently and to faithfully advise the 

Secretary and Deputy Secretary and to keep you informed of progress on a timely 

basis. 

With me today are my wife, Ciretta, originally from Revere, Massachusetts, and 

my youngest daughter, Laura Glaub, from Woodbridge, Virginia. I am very grateful 

for their constant love and support and to many other family members and friends 

whose support has been steadfast for many years. 

Thank you again, Mr. Chairman and Members of the Committee, for your consideration of my nomination. I would be happy to answer any questions you may have.

9


32202.001
10


32202.002
11


32202.003
12


32202.004
13


32202.005
14


32202.006
15

Chairman CRAIG. General, thank you very much for that testimony. Let us get to the questions because I think all of us are, as 

we have expressed, very concerned about the task at hand and before you. 

You have made available this printout that I find is fascinating. 

I wish I understood it. 

[Laughter.] 

Chairman CRAIG. Because I am not quite sure of the 322 tasks 

by number, where we are, and what it will mean when we get 

there. But I suspect you do, and maybe you will be able to tell us 

a bit about that. 

Certainly, your leadership credentials are not at question at this 

point at all. However, can you talk to us a bit about your technical 

qualifications for the position, what experiences do you have in the 

management of IT programs that will help us ensure VA’s Office 

of Information and Technology’s success, and what all of this 

means? 

General HOWARD. Yes, sir. Sir, actually, as an engineer, of 

course, I am very comfortable in the technical arena. But I have 

had a number of assignments over the years which directly relate 

to information technology and the production of computer-based 

products. One in particular was as a brigadier out at Fort Leavenworth, Kansas, where I led an organization called TRADOC Analysis Command. 

What we did there, we were responsible for the cost and operational effectiveness analysis for the U.S. Army dealing with modernization of weapons systems, and also assisting in the training 

area as well. 

What we did is we built computer models that were used to 

evaluate future weapons systems based against existing platforms. 

There were a number of types of these, and we not only wrote the 

code, we developed the mathematical algorithms in order to define 

the particular activity of the weapons system. And I had quite a 

few folks working for me out there, a large group, in fact, down at 

White Sands Missile Range, a number of them computer coders, 

and the systems engineers. 

So those 2 years out at Fort Leavenworth were very helpful in 

that regard in terms of the production of computer-based products. 

We also built training simulations and, again, this was in the 

late 1980s. In that time training simulations had really begun to 

be used by the military and it is routine today. We built a number 

of those simulations to include production of the scenarios, the 

scripting of the particular documentation that needed to be coded, 

and then go through the coding process to produce the various 

training products that were then used by field commanders to train 

their commanders and staffs. 

Most recently, with the Cubic Corporation, my division was involved in the production of educational and training technologies, 

computer-based products that we used, interactive products, Webbased products that were designed for both training and education 

in a number of areas. 

The other aspect of my division at Cubic, as you mentioned, was 

helping countries in Eastern and Central Europe become more 

Westernized and improve their systems in the military. A number 

16

of them were heavily involved in introduction of information technology systems. In particular, three countries—Czech Republic, 

Slovak Republic, and Hungary—we directly assisted them in bringing on more modern IT systems to support them in a number of 

areas, from personnel to logistics, force design, and a number of 

other areas as well. So that briefly is some background relating to 

information technology and the production of computer-based products. 

Sir, with respect to the plan itself, I have my copy. 

I do not have one under my pillow, but I probably should. 

Sir, quite frankly, as you have seen this——

Chairman CRAIG. Let’s cut to the chase. Some are arguing out 

there in the field that the 322 so designated tasks here are simply 

a rearranging of the deck chairs on the deck of the Titanic. 

General HOWARD. Sir, that is absolutely not the case. 

Chairman CRAIG. OK. 

General HOWARD. As you see, believe it not, they are actually 

100 percent indicated by some of these. 

This program began shortly after the breach in May. It was directed by the Deputy Secretary, and we began putting together a 

list of actions that needed to be taken, actions that needed to be 

completed. And more than anything else, that is what this is. At 

least we know what needs to be done. 

We began to lay down timelines, as you can see. Some of them, 

obviously, continue to be adjusted as we know more about what we 

are dealing with. But with respect to the completion of these, one 

of the most important facets of this was the first phase, the assessment phase. We began very early on, as the dates indicate, by assessment briefings from all the administrations and the staff sections within the VA. These briefings were chaired by the Deputy 

Secretary, and they had to be given by the principal in charge. 

There were some minor cases where deputies gave the presentation, but we insisted on senior officials standing up and telling 

us what were the conditions regarding information security within 

their organization. 

This was very revealing. We went through all of that, as you can 

see on the front page, and what we are into now is doing the same 

thing with all the administrations and staff agencies, staff sections, 

with non-VA organizations. 

For example, we have contractors working for us. What are the 

conditions under which they operate? Do they work with sensitive 

information? Is it properly protected? 

We are in the process of having these briefings right now. In fact, 

just yesterday, we had two more, and the day before, we had VBA. 

There are just a couple left. 

We left VHA for last because they have got a huge amount of 

contracts, a very difficult situation, so we let them have as much 

time as they could to prepare for that. 

We are moving through the assessment phase, but we are also 

moving into other areas as well. You will notice the second phase 

of this program is the strengthening of controls portion, and that 

is broken down into three sections: 

• Management activities, like, for example, updating our directives, and we have got several of those complete and a number alVerDate 0ct 09 2002 10:36 Feb 09, 2007 Jkt 000000 PO 00000 Frm 00020 Fmt 6633 Sfmt 6601 H:\RD41451\DOCS\32202.TXT SENVETS PsN: ROWENA
17

ready in draft form, and we will share those with you as they get 

completed. That is in the management area. • In the technical area, we have a number of activities going on, 

particularly in the area of encryption and understanding additional 

actions that can be taken to better control the communications and 

the passing of sensitive information within the VA, but do that in 

a way that we do not shut down the operation. Sir, you mentioned 

that yourself as a key concern, and you are exactly right. That is 

a difficult balance. We need to tighten up, but at the same time we 

have got things we have got to accomplish. And we recognize that. • The laptop encryption is just about complete. In fact, we have 

encrypted almost 15,000 laptops over the last couple of weeks. 

There is a small number that we were not able to encrypt, less 

than a hundred, and one of the reasons for that, particular computers were not able to accept the Guardian Edge software. We are 

working both with the manufacturer of the computer—Micron and 

Guardian Edge—trying to solve that. But in the meantime, those 

laptops are secure. They are not being used. These are VA laptops. 

As you know, we have non-VA laptops that are being used, and 

our objective there ultimately is to replace those with Governmentfurnished equipment. That is going to take a while. It is a task on 

this plan for fiscal year 2007. The reason it is in 2007 is we know 

that would cost us money, but we also need to think through how 

we actually want to do that. 

So that is the goal, but those individuals using personal laptops 

already know that they are required to protect sensitive information that passes through those laptops. That is per a directive that 

we have already published, Directive 6504, which in fact, prescribes that. 

There are a number of other activities further down the list that 

we are already working on. A big area that we are thinking 

through is additional technologies to bring into the VA to further 

protect computers and the infrastructure, techniques that are already out there. We have been talking to a number of companies. 

We have not put out any RFPs yet. But there are technologies 

available that you do not even know they are there, that help us 

visualize what is happening with respect to the passing of information. 

But these are technologies that we must understand to be sure 

we go forward and ask for any additional support. So that is important. 

There are also abilities to shut down USB ports. In fact, that is 

already going on at various facilities throughout the VA where you 

can control the use of USB devices simply by shutting down the 

port. People are not able to plug in a thumb drive and pull out the 

information. 

Now, again, you have got to be careful with that because people 

have to operate, and you cannot shut the hospital down by just 

turning off all the access that physicians and other staff members 

might need. 

So, sir, that is kind of a summary of what this is all about. 

Chairman CRAIG. Thank you very much. 

Let me turn to Senator Isakson. Johnny? 

Senator ISAKSON. Thank you, Mr. Chairman. 

18

The breach that came to our attention earlier this year was the 

physical transfer of a hard drive or a laptop off the VA premises 

to a home. That is not an electronic transfer. That is a physical 

transfer. I assume the control has been put in place to no longer 

allow that to take place within the VA. Is that correct? 

General HOWARD. Sir, that is not allowed unless you have specific permission, for example, if we are transferring files from one 

hospital to another and, in fact, that does happen. You are actually 

physically moving media, whether they are CDs or back-up tapes 

or whatever. But it must be approved, and it must be done under 

certain circumstances. Those are now spelled out in Directive 6504, 

which I mentioned. We have a lot of directives we need to clean up 

and to publish. Directive 6504 was one of the first ones right after 

the breach that we put in place as quick as we could. And, we may 

need to adjust it in some ways, but, quite frankly, it is a very good 

directive, and the folks in the field are paying attention to it. 

Senator ISAKSON. If I remember correctly, it was 21 or 22 days 

from the time the laptop was lost and the time Secretary Nicholson 

was advised of the breach. What has been put in place in terms of 

the chain of command to ensure that lapses or breaches like that 

quickly rise to the level they should in terms of the administration? 

General HOWARD. Sir, right now we have a much improved reporting process. Quite frankly, at the time there really was not a 

very good reporting process at all. It was haphazard. There was no 

structure to it. Since that time, we have established a very good 

process for reporting incidents. In fact, our guidance to the field is 

when in doubt, report it. No matter how small it is, no matter how 

insignificant, get it reported and then we will deal with it. 

We have also insisted that security incidents and privacy incidents get reported to one place, and that is the Security Operations 

Center, which produces daily reports. 

These daily reports go all the way to the Secretary and the Deputy Secretary and a number of other senior officials each day. 

There are certain mandates in place, like, for example, we must report incidents to the US–CERT within 1 hour, and we meet that. 

We might miss it every now and then, but that is an objective that 

we have. 

So with this reporting mechanism, we believe we do have visibility over activities that are taking place that should not be. Quite 

frankly, as I have talked with a number of your staff, there is always the concern about what do you do in terms of follow-up and 

punishment and that sort of thing. We have, in fact, taken action 

in some cases, but we have also got to be very careful about that 

because we do not want to shut down and make people too concerned about reporting things. That is a balance issue. 

We have to look at every case. But clearly, in cases where it was 

not just a careless act but a deliberately negligent act, that they 

knew they should not do, in that case we have taken action. 

Senator ISAKSON. One last question. The physical transfer of information which we have been addressing is one way to lose it. The 

electronic transfer is another way, and that can happen in two 

ways—either from within the agency to the outside or a hacker 

coming into the inside. 

19

Just briefly, are you monitoring the internal operations to catch 

any transfer out? And do we have a security system in terms of the 

hacking incident? 

General HOWARD. Sir, we do not have a system where you have 

100 percent visibility over every single thing that goes on in transfer of information from computers. That is a very difficult environment to put in place. Do we have total control over someone being 

able to go into a sensitive database, pull information out, put it on 

a piece of media or a thumb drive or whatever and walk out the 

door? That can happen. There are directives in place, though, that 

prohibit that. As I mentioned to you, in some cases we have begun 

to shut down USB ports and things like that to better control. But, 

quite frankly, sir, the best way to really achieve 100 percent compliance to ensure the situation where that does not occur, is 

through making sure every single employee understands and lives 

up to their responsibilities. This is a people issue. It really is. 

We can go nuts with technical solutions, but the bottom line is 

the people involved. And some of them are pretty clever. They will 

figure out a way to get at it unless we make sure we continue to 

communicate to them. And they understand how important it is, 

and my feeling right now throughout the VA there is heightened 

awareness. There is no question about that. We see it in some of 

the reports coming in and, in fact, the actions that are being taken. 

So 100 percent, probably impossible. But we do need to do all we 

can to prevent that from happening. 

Senator ISAKSON. Well, my time is up, but I think you are saying 

what I was trying to—100 percent is impossible for practical reasons. However, random monitoring is not, and it is important that 

the people within the agency understand that random monitoring 

is going on, just to protect the integrity of the system. And I assume you are doing that. 

General HOWARD. Sir, you are exactly right. In fact, we are actually doing random cyber penetration as well. So those activities do 

go on, but it is sporadic. 

Senator ISAKSON. Thank you. 

Chairman CRAIG. Thank you very much, Senator Isakson. 

Senator Murray? 

Senator MURRAY. Thank you. 

General Howard, I understand that there was recently an incident in the VA system that put eight of our VA medical centers in 

the Northwest network at risk. Apparently, there was some untested software that was added to the system, and as a result, it broke 

many of the VA applications, including the VA’s health data repository. 

From what I understand, that still has not been fixed. Could you 

tell the Committee what happened, why it has not been fixed, and 

what we are doing to ensure it will not happen again? 

General HOWARD. Ma’am, I am not familiar with that in great 

detail. I believe I know the situation you are talking about, though, 

where a patch was put in place on the network which caused some 

problems with CPRS. 

I believe that has been fixed, but I cannot be sure. I will get back 

with you on that, if you do not mind. 

20

Senator MURRAY. My understanding is that it has not been fixed 

yet, so if you could get back to me and let me know why and, more 

importantly, how can we make sure that does not happen again. 

General HOWARD. Right. 

Senator MURRAY. I understand that the new model of reorganization that you are talking about can create quite a divide between 

the IT folks at headquarters and people who work out in the field. 

How are you going to ensure that our veterans who are counting 

on getting services get seamless, uninterrupted service? 

General HOWARD. Ma’am, first of all, there is a strong communication effort going on right now with respect to making sure the 

folks understand what is about to happen, and to reassure those 

who need the IT support that the IT individuals who supported 

them in the past are not going anywhere. They are still there. They 

are dedicated to the support of the mission, that is, whether it is 

health or benefits or actually the core missions of the Department. 

We have communicated that to the IT individuals who, at least 

up to now, have been detailed to us and come October 1 the permanent transfer will take place. 

Continuous communication, both through the IT community and 

through the three administrations and staff sections is very, very 

important. But the fact of the matter is it is going to boil down to 

performance. We can talk and explain all we want, but the physicians out there, they want support, they want performance, and we 

understand that. And I am committed to make sure that they get 

the support, the same response, and hopefully, better response 

than they got before. 

Senator MURRAY. Since you are going to have a more centralized 

model, how are you going to ensure that some of the field-level 

CIOs and directors are going to have input? 

General HOWARD. We are already in communication—again, they 

have been detailed to me already, so we have dialogue going on. 

We have broken the country into four regions. We have regional directors for each of those locations. They, in turn, supervise CIOs, 

who were formerly VISN CIOs or RO CIOs. And those individuals 

have further connectivity down into the facilities. So there is an organization already in place that will become permanent on October 

1 to help organize that. 

We have set things up so we have a reasonable span of control. 

For example, there are four regions, and in each of those regions 

we have a number of CIOs reporting to that regional director. 

Senator MURRAY. I hope as you implement it you keep that in 

mind and make sure that those lines of communication are open. 

General HOWARD. Extremely important. You are absolutely right, 

and believe me, I understand that and am committed to that. 

Senator MURRAY. Are you bringing in the best of the best when 

it comes to IT and IT management? 

General HOWARD. We are in the hiring process right now. As 

part of the IT realignment, I have been provided over 500 FTE 

empty spaces that we are now in the process of filling. Finding 

quality people, of course, is always difficult, but we have several 

that are moving and are being hired. But we have a great deal 

more to do in that area. 

21

Senator MURRAY. One last question. I think this whole unfortunate data loss system really showed us that the VA lacks some 

strong policies and directives regarding information technology acquisition and usage. How is this reorganization that you are talking about going to solve problems like the lack of strong IT architecture and cyber security concerns and the ability to invest soundly in IT? 

General HOWARD. Ma’am, no question that the IT reorganization 

is going to help a lot. I control the network now—at least come effective October 1. The network, the activities are not permitted to 

plug into the network without our authorization. There is no 

doubt—in fact, I have seen already some of the impact that we are 

going to feel in the months and years to come. 

A good example is the laptop encryption. In the last several 

weeks, we have encrypted almost 15,000 laptops. That went 

smooth as can be. We had a great deal of cooperation from facility 

IT people, the VISN CIOs, all of the folks that we were just talking 

about. There were teams put together, tremendous dialogue back 

and forth, e-mails flying all over the place, a great deal of cooperation and organization that permitted us to do that. 

Now, I do not know for sure, but my guess is if we had not had 

this organization in place, even from a detailed standpoint, we 

would have had a much difficult job. We have much better control 

and are making sure encryption is put in place where it is needed, 

patches are put in place; they cannot resist because we control the 

network. 

Senator MURRAY. Thank you, Mr. Chairman. 

Chairman CRAIG. Thank you, Senator Murray. 

General, most of the attention VA’s IT program has received lately has been centered around IT security and its development. However, the issue of VA–DOD information sharing and exchange still 

remains, to my understanding, an unsolved problem. 

Are we ever going to see the day when VA’s records and DOD’s 

records can be freely exchanged from one system to another in a 

secure manner? And from your perspective, why have we not accomplished that goal yet? 

General HOWARD. Sir, I believe that is possible. I am not intimately familiar with the DOD system, ALDA. I am familiar with 

HealtheVet, the system in the VA. Those two systems are not 

interoperable, but there is a great deal of interaction going on with 

DOD. We have the JEC Committee and a number of other committees in place where there is a good deal of dialogue regarding that 

particular issue. 

Why hasn’t it been done? We probably have not put enough emphasis on it. We probably have not really focused on a particular 

subset. In the case of HealtheVet, there are a number of sub-applications that we can perhaps focus on and really get a success story 

there, working with DOD. Hopefully, we will be able to do that. To 

the degree I can influence that, I will, and to demonstrate that we 

really can produce an electronic health record that is interoperable, 

where data can be exchanged. I believe it is possible, but not without a lot of hard work. 

22

I think you know that in the case of VA, our system is based on 

an older code that we want to bring into a more modernized environment and work with DOD as we move forward in that respect. 

The President’s Executive Order is a pretty clear mandate with 

respect to interoperability. So to speak, the burner has been turned 

up on making things more interoperable. 

Chairman CRAIG. I think if we really want to claim seamless 

transition, part of the fabric in that seam, if you will, is this ability 

to move records and not duplicate and have them applicable. It 

simply makes an awful lot of sense to me, and I am quite sure it 

does to the active member/veteran in their transition. 

I know the FBI recovered the stolen laptop and all of the data 

we originally feared might be lost, and the FBI is confident the information was not accessed or compromised. 

Still, some veterans out there are worried that their personal information will be used to steal their money, their ID, and their privacy. 

What do you say to those veterans who come to you with that 

concern? 

General HOWARD. Sir, in that particular case, I, too, have a very 

high degree of confidence that the information was not disturbed. 

I do not think they have to worry about that at all. 

Chairman CRAIG. Well, there are other questions I could ask you, 

but in general, I think you have covered the waterfront of the issue 

in response to either me or my colleagues. So let me ask you two 

remaining questions. 

Do you have any conflicts of interest that you have not fully disclosed to the Committee? 

General HOWARD. None, sir. 

Chairman CRAIG. Do you know of any other matters which, if 

known to the Committee, might affect the Committee’s recommendations to the Senate with respect to your nomination? 

General HOWARD. None, sir. 

Chairman CRAIG. Do you agree to appear before the Committee 

at such times and concerning such matters as the Committee might 

request for as long as you serve in the position for which you seek 

nomination? 

General HOWARD. Yes, I do, sir. 

Chairman CRAIG. Well, I thank you very much for your openness 

and your frankness. It appears that you are living up to your reputation of understanding not only what has been accomplished, but 

what is to be accomplished over the next while, because I, too, 

agree with the Secretary. We want to make the IT of VA a gold 

standard for our Government to follow. We are proud of the success 

with our electronic medical records. They represent to the health 

care systems of this country a leadership position, a role, and it is 

now recognized that through those, quality health care has been 

dramatically enhanced. We want to be able to turn to the veterans 

in very short order and say that we have transformed the culture 

and the systems of the VA, and to assure them that their information that is held by VA is safe and secure, usable, accessible, and 

all of the other values for its presence. 

So we thank you very much again for your attendance this morning, and as I said in my opening comments, we will attempt over 

23

the course of the day to move expeditiously so that your nomination can be considered by the whole Senate before we recess. 

Again, General Howard, thank you very much, and to your wife 

and daughter, we are pleased that they were able to attend your 

confirmation hearing. 

General HOWARD. Thank you, Mr. Chairman. 

Chairman CRAIG. Thank you. The Committee will stand adjourned. 

[Whereupon, at 10:55 a.m., the Committee was adjourned.]

Æ