HEARING ON THE REPEATED FAILURES 

OF VA’S INFORMATION TECHNOLOGY 

MANAGEMENT

Hearing

before the

Committee on 

Veterans’ Affairs

House of Representatives

one hundred ninth congress

second session

June 14, 2006

Printed for the use of the Committee on Veterans’ Affairs

Serial No. 109-51

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; DC area (202) 512-1800

Fax: (202) 512-2250 Mail: Stop SSOP, Washington, DC 20402-0001

u.s. government printing office

washington : 2007

28-127.PDF
Committee on Veterans’ Affairs

Steve Buyer, Indiana, Chairman

Michael Bilirakis, Florida Lane Evans, Illinois, Ranking

Terry Everett, Alabama Bob Filner, California

Cliff Stearns, Florida Luis V. Gutierrez, Illinois

dan burton, Indiana Corrine Brown, Florida

Jerry Moran, Kansas Vic Snyder, Arkansas

richard H. baker, Louisiana Michael H. Michaud, Maine

Henry E. Brown, Jr., South Carolina Stephanie Herseth, South 

Jeff Miller, Florida Dakota

John Boozman, Arkansas Ted Strickland, Ohio

Jeb Bradley, New Hampshire Darlene Hooley, Oregon

Ginny Brown-Waite, Florida Silvestre Reyes, Texas

Michael R. Turner, Ohio Shelley Berkley, Nevada

John Campbell, California Tom Udall, New Mexico

 John T. Salazar, Colorado

JAMES M. LARIVIERE, Staff Director

(II)
CONTENTS

June 14, 2006

 Page

1

 1

3

 5

34

7

36

8

46

Repeated Failures of VA’s Information Technology

 Management ....................................................................... 

OPENING STATEMENTS

Chairman Buyer ......................................................................

Hon. Bob Filner, Ranking Democratic Member ....................

Hon. Michael Michaud .............................................................

Hon. Jeff Miller, prepared statement of ................................

Witnesses

Staley, Michel L., Assistant Inspector General for Auditing,

  Office of Inspector General, U.S. Department of Veterans

 Affairs ...................................................................................

 Prepared statement of Mr. Staley..........................................

Koontz, Linda D., Director, Information Management Issues,

and Gregory C. Wilshusen, Director, Information Security

  Issues, U.S. Government Accountability Office....................

 Prepared statement of Linda Koontz and Gregory 

 Wilshusen...............................................................................

 

(III)
(1)

HEARING ON THE REPEATED FAILURES OF

VA’S INFORMATION TECHNOLOGY MANAGEMENT

 Wednesday, June 14, 2006

U.S. House of Representatives, 

Committee on Veterans’ Affairs,

Washington, D.C.

The committee met, pursuant to call, at 10:34 a.m., in Room 334, 

Cannon House Office Building, Hon. Steve Buyer [chairman of the

committee] presiding.

 Present: Representatives Buyer, Moran, Miller, Brown of South 

Carolina, Boozman, Bilirakis, Filner, Michaud, Herseth, Snyder, 

Salazar, Udall and Reyes. 

The Chairman. The House Committee on Veterans’ Affairs will 

come to order. Today is June 14, 2006.

 Good morning, ladies and gentlemen. We are here today to receive testimony from the Department of Veterans Affairs Inspector 

General and the Government Accounting Office about past problems

and recommendations in connection with information security and 

management at the VA.

 We are on a fast track here at the committee. With the security 

of personnel data compromised last month and the very trust of veterans and their families at stake, we cannot afford to let time pass. 

Already we have held one hearing to learn about the immediate impact of the theft from the Secretary last week, joined by the Military 

Quality of Life and Veterans’ Affairs Appropriations Subcommittee 

Chairman, Jim Walsh; and I have held a roundtable at which information technology experts from Goldman Sachs & Company, EMC 

Corporation, VISA, Citi Group, Tri-West, and the American Bankers 

Association offered very candid appraisals, all emphasizing the importance of a centralized management of key components of information and information systems.

 Today, we must establish how and why the second largest breach 

of personal data in American history occurred at the VA. Then, continuing an aggressive series of hearings over the next 2 weeks, we will 

hear testimony from experts, largely from the private sector and the 

academic world, which will provide best practices to further guide us. 
2

Finally, we will be hearing also from the VA General Counsel, Tim 

McClain, with an update on the progress being made at the Department as well as the legal ramifications of this breach. We will then

hear again from Secretary Jim Nicholson at the end of the month.

 We must identify and understand the scope of this problem. Then 

we can determine how to correct the problems at the Department. 

We will then act on that determination.

 Today is essentially about the past, about context. Without the advantage of this historical context, the theft of an analyst’s computer 

might appear to be an aberration, something unusual that can be 

corrected with a new policy or an official rule.

 The context shows something entirely different. VA’s internal controls and data security have been grossly inadequate for years. Both 

the VA IG and the GAO have indicated VA’s decentralized management and the lack of accountability as major shortcomings which 

have led to 16 recurring, unmitigated information security vulnerabilities over the past 8 years.

 Since May of 2000, this committee has held six hearings where 

VA information security has been specifically addressed and where

lapses have been repeatedly identified. We have continued to hold

three more hearings this Congress to review VA information technology and monitor the Department’s actions with respect to IG and 

GAO recommendations and even directives from Department leadership. In the upcoming hearings, we will continue to obtain insights 

from witnesses, which will help us develop a bipartisan approach to 

this problem.

 The next hearing will be on June 20, when the Subcommittee on 

Disability Assistance and Memorial Affairs and the Subcommittee on 

Economic Opportunities will hold a joint hearing on the VA data theft 

and cyber security procedures at the Veterans Benefits Administration. This hearing will include an examination of security measures 

to ensure fiduciaries are protecting sensitive client information.

 On June 21, the Subcommittee on Health will be meeting to examine the Department of Veterans Affairs efforts to maintain security and integrity of the electronic health records of enrolled veterans 

while safeguarding sensitive personal veteran information from internal and external security threats.

 On June 22, the full committee will meet to hear from academic 

and industry experts on operational aspects of IT security, as well as 

the VA General Counsel on legal implications.

 On June 28, we will examine the role of VA’s Chief Information 

Officer and the Department’s Office of Information and Technology

Structure and Operations. We will receive testimony from two of the 

former CIOs at the VA.
3

And, finally, on June 29, we will bring back VA Secretary Jim Nicholson to testify before the full committee to provide us with an update 

of the status of the VA data theft.

 Please make sure, my colleagues, that you mark these important 

dates on your schedules. To the extent that information security is a 

critical priority throughout government, what we hear today and the 

successive hearings on this issue will, I believe, be of a broad value 

that transcends any one agency.

 I now recognize Mr. Filner for an opening statement.

Mr. Filner. Thank you, Mr. Chairman.

 You used the words “aggressive” and “fast track” in these series of 

hearings, and I certainly appreciate that, and we will give you our 

full support. I think you have mapped out a fine approach from this

committee, and we thank you.

 If it were possible to approach the theft of veterans’ and service 

members’ records without the emotions triggered by this theft, and 

what I can only call a pathetic response from the Veterans’ Administration, the emotions of disbelief, anger, frustration that we all feel, 

this situation might be even an interesting case study of lax policies, 

failed leadership, and organizational arrogance. I can only call this 

situation the Katrina of the Veterans’ Administration. A disaster occurred presumably not of their own doing, and yet the response was 

clearly inadequate, causing more suffering, and a presidential crony 

at the top of the administration unable to respond in an adequate 

way. I know that Mr. Nicholson doesn’t want to hear this phrase 

from President Bush, that he is doing a heck of a job.

 We have 26.5 million veterans and over 2.2 million active and reserve service members at risk of identity theft, their lives now requiring a new and constant vigilance. Sensitive disability codes pinpointing health and medical information on service-connected disabled 

veterans, their most private personal information, is poised to enter 

the public domain, with the steady drip, drip, drip of information each 

time adding more bad news. A lot of sensitive information is involved 

here, with a baseless spin by Secretary Nicholson and the other VA

officials that the stolen data, and I quote, “may have been erased by

teenagers who sold the computer equipment.”

 Reaching for outcomes that are less than tragic is not helpful in 

this situation, when the street value of this information probably exceeds half a billion dollars, quite an incentive for bad guys to get 

ahold of this data.

  We are collectively angered by the 19-day-long lag between the

data theft and public announcement. When we questioned what happened, we find that the employee who took the data home told his

supervisors almost immediately about the theft, but it took 6 days for 

the VA Chief of Staff to find out and another 6 days for the Deputy

Chief of Staff, the Deputy Secretary, and the VA General Counsel to 
4

get around to notifying the Secretary. Don’t some of these folks work 

in the same office suite as the Secretary? Wouldn’t it be reasonable to

tell the boss immediately about the possibility of a great compromise 

of records?

 Then we learn that the Inspector General’s initial involvement was 

not a result of direct notification by the leadership at the VA but

because someone from the IG’s office happened to attend a regularly

scheduled information security meeting. We have to question why 

the leadership of the VA would not be more proactive in getting the 

issue to the investigators at the IG.

 In addition, it seems that the VA’s senior leadership was more focusing on communicating with the White House than on notifying 

the FBI. That task fell on the IG. While the most important action 

should have been to recover the stolen data, message management 

was more important to these political appointees than getting the 

FBI involved in the investigation of the burglary. When the FBI was 

finally brought into the investigation, the trail was already 2 weeks

old. Talk about misplaced priorities!

 Not until this point did the VA Secretary notify the Nation’s veterans, on May 22, fully 19 days after the theft.

 The Secretary now clamors for stiffer penalties for government 

employees who mishandle personal information that is entrusted to 

them. Yet this organization failed to update in any meaningful way 

the internal policies and regulations of information security before 

the theft. VA just simply ignored a host of findings and recommendations over the years and never fixed any of the data control and

information security problems; and, unbelievably, after the theft, the 

Secretary waited for over a month to implement an updated and substantive policy on information security. Even that policy is somewhat 

light on enforcement and on specific liabilities and punitive actions

when an individual fails to protect sensitive information.

 I believe, and I think the Chairman has said many times, this ID

theft would not have happened if VA leaders since 2001 had cared 

about protecting sensitive data or could get the job done. This would 

not have happened if this Congress was more of a co-equal oversight 

mechanism for the executive branch. So we will learn today the history of information security and information technology problems at 

the VA, which the Chairman has amply outlined.

 There still is avoidance of accountability and responsibility at the 

VA. One wayward employee alone did not give birth to this massive data compromise. It was born of a culture of indifference and 

fathered by VA leaders who philosophically skipped town during the 

last 5 years in their collective attempts to avoid accountability.

 Anyone at VA who waited or delayed over 24 hours to report this 

compromise should be held accountable and fired. From the first day,

it was clear this was not a minor issue. Likewise, anyone who inter-
5

fered, blocked or undercut the numerous attempts to improve substantive, enforceable information security and IT policies should be 

held accountable. I am looking forward to the testimony today to see 

how we may deal with that.

 Lastly, Mr. Chairman, I spent the last days of May, and the early 

part of June, talking to people all over my district. Veterans were not 

only angry but scared. They have the potential compromise of their 

most sensitive data. They got a letter from the VA just recently, and 

they see a Web page from the VA, which says, basically go talk to 

your credit bureau.

 The VA should be proactive in response to this crisis, making sure 

veterans know that the data breech will not be a cost to them, either 

in money or in psychological anxiety. We have an obligation, given 

what happened, to be comforting in every way possible, and the VA

simply is not doing this. I hope over the course of your month-long 

hearings, Mr. Chairman, I think that the VA should sit down with 

the credit bureaus and ask them to voluntarily provide, as a national 

service, a way to mark these 26 or 28 million records so if any undue 

activity occurs we know about it right away, and it is not left up to the 

individual veterans to figure out how to deal with it.

 My colleagues, Mr. Salazar and Ms. Hooley, have legislation which 

calls for monitoring of the credit reports; and also Mr. Salazar has 

recently introduced legislation for an ombudsman at the VA to begin 

to deal with this data breach.

 Let us be proactive and not wait for more disasters to occur.

 Thank you, Mr. Chairman.

The Chairman. I thank the gentleman.

 As far as I know, the committee, on a bipartisan basis, Mr. Filner, 

has gone back to 1997, according to GAO testimony, from their audit.

That was in submitted testimony.

  Does anyone have any other opening statements?

 Mr. Michaud, you are recognized.

Mr. Michaud. Thank you, Mr. Chairman.

  Just briefly, I want to thank you for staying focused on this very

important issue. I commend you and Ranking Member Evans for 

your leadership and having the committee explore this fully with an 

aggressive schedule over the next month. I really appreciate it.

 I also want to thank Congressman Salazar for introducing legislation to look at this issue.

 I look forward to hearing the witnesses testify here today, and I

would ask that my opening statement be submitted fully for the record.

 The Chairman. All written statements will be submitted for the 

record, and members will have 3 business days to do so.

  [No statement was submitted.]

  [A statement for the record of Jeff Miller appears on p. 34.]
6

The Chairman. Any other opening statements?

 All right, we will go to the witnesses.

 Today, we welcome Michael Staley, the Assistant Inspector General for Audit at the Department of Veterans Affairs. Mr. Staley served 

with the Second Battalion Ninth Marines in Vietnam in 1968. Upon

returning from Vietnam, he devoted his career to helping veterans 

and their beneficiaries. He held several positions of responsibility at

the Veterans Benefit Administration upon joining them in 1971.

 Michael Staley was appointed the Assistant Inspector General for 

Auditing in December of 2003. He directs a nationwide staff of over 

185 auditors and support staff located in offices across the Nation.

His office conducts audits and evaluations of the Department of Veterans Affairs programs and functions and provides audit support to 

criminal and administrative investigations.

 Also before us is Ms. Linda Koontz. You have been before us quite 

often over the years, and we appreciate your testimony. She is the 

Director of Information Management Issues at the U.S. Government 

Accounting Office.

 We also have Gregory Wilshusen, Director of Information Security 

Issues at the U.S. Government Accountability Office.

 Ms. Koontz is responsible for government-wide telecommunications issues as well as issues concerning the collection, use, and dissemination of government information in an era of rapidly changing 

technology.

  Mr. Wilshusen has over 22 years of auditing and financial management information technology management experience and is the acting director on GAO’s information technology team, where he leads 

information security audits at several Federal agencies.

 We also have Mr. Raponi with the VA IG; and I will leave that, Mr. 

Staley, for any further introductions.

STATEMENTS OF MICHAEL L. STALEY, ASSISTANT INSPECTOR GENERAL FOR AUDIT, OFFICE OF INSPECTOR 

GENERAL, U.S. DEPARTMENT OF VETERANS AFFAIRS, 

ACCOMPANIED BY MICHAEL RAPONI, REGION DIRECTOR, ST. PETERSBURG AUDIT OPERATION DIVISION, 

U.S. DEPARTMENT OF VETERANS AFFAIRS; LINDA D. 

KOONTZ, DIRECTOR, INFORMATION MANAGEMENT ISSUES, U.S. GOVERNMENT ACCOUNTABILITY OFFICE; 

AND GREGORY C. WILSHUSEN, DIRECTOR, INFORMATION SECURITY ISSUES, U.S. GOVERNMENT ACCOUNTABILITY OFFICE 

The Chairman. Mr. Staley, you are now recognized.
7

STATEMENT OF MICHAEL STALEY

Mr. Staley. Thank you, Mr. Chairman.

 Mr. Chairman, members of the committee, thank you for the opportunity to testify today on the results of our reviews, which continue to 

address information and security vulnerabilities in VA, and to report 

on the status of VA’s implementation of our recommendations.

 As you said, Mr. Mike Raponi is next to me today. He served as the 

project manager on the IT security audits, as well as I have Steven 

Gaskell in the audience, who also served as a project manager on 

these audits.

 We have conducted a number of audits and evaluations on information management security and information technology systems 

that have shown the need for continued improvements in addressing 

security vulnerabilities. As such, we have included IT security as a 

major management challenge for the Department in all of the major 

management challenge reports since the year 2000.

  In our annual financial statement audits, we have reported VA information security controls as a material weakness since our fiscal

year 1997 audit. Specifically, we reported that VA’s financial data

and sensitive veteran medical and benefits information are at risk

due to vulnerabilities related to access controls, change controls, the 

need to segregate duties, and the need to improve service continuity 

practices.

  My IT security program auditors have identified and reported on

significant information security weaknesses since 2001. All four of

these annual audits have reported on similar issues; and the recurring themes in these reports are the need for a centralized approach 

to achieve standardization, remediation of identified weaknesses,

and accountability in VA information security. We have continued 

to report control weaknesses in physical security, electronic security, 

reporting, wireless security and employee security. Additionally, we 

have reported significant issues with the implementation of IT initiatives by VA.

 Our combined assessment program reviews continue to report 

physical security and access control security vulnerabilities at VA

health care facilities and VA regional offices where security issues

were evaluated. We have recently issued an advance copy of our draft 

IT security program review to VA. While it is not our general practice 

to comment on draft reports before they are published because of the 

extensive public interest in these information security issues, I have 

described the issues that VA is addressing in my testimony. 

 In closing, I would like the committee to know that reviews of VA’s 

information security will remain a top priority in my office. We remain committed to reporting on the adequacy of IT information security controls and following up on actions taken by VA to strengthen 
8

these controls as we remain dedicated to the goal of protecting our 

Nation’s veterans.

 Mr. Chairman and members of the committee, thank you for the 

opportunity to be before you today; and I would be pleased to answer 

any questions that you might have.

  [The statement of Michael Staley appears on p. 36.]

The Chairman. Ms. Koontz, you are recognized.

STATEMENT OF LINDA KOONTZ

Ms. Koontz. Mr. Chairman and members of the committee, thank 

you for inviting us to participate in today’s hearing on information 

security and privacy at the Department of Veterans Affairs.

 The recent well-publicized security breach of the Department has 

thrown into high relief the importance of good information security 

controls in protecting personally identifiable information, not only

at VA but throughout the government. As we have reported many 

times, poor information security is a widespread problem that can 

potentially have devastating consequences.

 Today, we would like to summarize the recurring security weaknesses that we have reported at VA, discuss what agencies can do to 

prevent breaches of personal information, and comment on the issue 

of notifying individuals and the public when breaches occur.

  Since 1998, GAO and the VA IG have reported on wide-ranging deficiencies in VA’s information security, including the lack of effective

controls to prevent unauthorized access to VA systems and sensitive 

data. In addition, the Department had not consistently provided adequate physical security for its computer facilities; it had not assigned 

duties so that incompatible functions were segregated; it had not controlled changes to its operating systems; and it had not updated or 

tested its disaster recovery plans.

  These deficiencies happened at least in part because VA had not

fully implemented key components of a comprehensive, integrated 

information security program. Such a program would establish Department-wide policies and procedures to address these weaknesses.

 Further, as we reported in 2002, VA’s organization and management may also have hindered its ability to fully address security challenges. Specifically, we reported that the hundreds of information

security officers in VA did not report either directly or indirectly to

the cyber security officer, and this official did not have control over

a significant portion of the financial resources that the security program depends on to sustain its operations.

VA has taken steps to improve information security. For example, 

it reports that it recently centralized its security management. However, its efforts have not been sufficient to effectively protect its information and information systems. As a result, sensitive information, 
9

including personally identifiable information, remains vulnerable to

inadvertent or deliberate misuse, loss, or improper disclosure, as the 

recent breach demonstrates.

 In addition to a robust security program, agencies, including VA, 

can take a number of steps to help guard against the inadvertent 

compromise of personally identifiable information. Specifically, under the E-Government Act, agencies are required to conduct privacy 

impact assessments. Going forward, this gives agencies the opportunity to assess upfront how personally identifiable information is to be

collected, stored, shared, and managed so that controls can be built 

in from the beginning.

 In addition, we suggest that agencies can take a number of other 

practical steps. They can limit the collection of information to what 

they really need, they can limit the time that they keep such information, they can limit access to that information and train personnel accordingly, and they can appropriately use technological controls such 

as encryption when data needs to be stored on portable devices.

 Nonetheless, even with security and privacy protections in place, 

breaches can occur, particularly if enforcement is lax or employees 

willfully disregard policy. When such breaches occur, notifications

to those affected or the public has clear benefits, allowing people the

opportunity to protect themselves from identity theft.

 Further, although existing law does not require agencies to notify 

the public, such notification is consistent with agencies’ responsibility

to inform individuals about how their information is being accessed 

and used, and it promotes accountability for privacy protections.

  That said, we need to be careful to define appropriate criteria for

triggering notification, and notices must be sufficiently informative

to allow people to understand the threat and how they should respond to it. As the Comptroller General testified last week, these are

factors we think that Congress should consider as it deliberates on 

proposed legislation on breached notification.

 In summary, Mr. Chairman, long-standing information security 

control weaknesses at VA have placed its information systems and 

information, including personally identifiable information, at increased risk of misuse and unauthorized disclosure. Although VA

has taken steps to mitigate previously reported weaknesses, its efforts have been insufficient to address these serious issues. Only

through strong leadership and sustained management commitment 

can VA implement a comprehensive, integrated information security 

program that can effectively manage risks on an ongoing basis.

 Mr. Chairman, that concludes my statement. Mr. Wilshusen and I

would be happy to answer questions.

The Chairman. Thank you very much.

[The statement of Linda Koontz and Gregory Wilshusen appears on

p. 46.]
10

The Chairman. When I think about the lapses of security in some 

of the hearings we have had over the years we had some problems in 

pension compensation fraud. So whether it was a $12 million case 

in Atlanta, a $6 million case in Manhattan, a $6 million case at Bay 

Pines, each time we come up here we talk about what the problems 

were; and it always goes back to unauthorized access, not having sufficient controls, who had the keys, where was the authority. I hate

to keep saying it, but it is ditto, ditto, ditto. It is almost like you can 

prepare your testimony by looking back on the testimony that you 

have given over the years.

 So here is what is sort of exhaustive. You highlight these problems 

and concerns not only from GAO but IG, and you hand these off to 

the administration. Who acts on them? Who is supposed to act on

the reports?

Mr. Wilshusen. Well, at least with regard to the GAO reports, we 

usually direct our recommendations to the head of the agency, and 

then they may direct it down to lower levels of management.

The Chairman. And in this case it is the Secretary?

Mr. Wilshusen. In this case, it would be to the Secretary of VA. 

Because, under FISMA, which is the Federal Information Security 

Management Act, it is the head of the agency that is responsible for 

implementing the safeguards and information security controls necessary to protect the information and information systems under his 

control that support the operations and assets of that agency.

The Chairman. All right. Mr. Staley? I mean, you provided testimony from your fiscal year 2004 report, including 16 recommendations, all of which remain open as of today. So these reports go to 

whom?

Mr. Staley. We issue our draft reports, Mr. Chairman, to the Chief 

Information Officer; and our recommendations in this report that you

referred to included the Chief Information Officer and all of VA senior

leadership that was involved in any IT security functions so that they 

could act jointly in trying to resolve these 16 recommendations.

 In our prior reports, we have issued our reports to the Chief Information Officer; and his concern and his response has been that he

doesn’t have the enforcement authority to implement the recommendations solely by himself. So, in an attempt to remediate that issue, 

we were then broadening our recommendations to include all of VA

senior leadership.

The Chairman. All right, but -- okay, so when you are faced with 

a general counsel’s decision that the CIO could only go with compliance and not enforcement, you then would take your reports and send 

them to whom above the CIO? When you say “senior management,”

I don’t know what that means.

Mr. Staley. If we are unable to resolve a recommendation or to 

get an action plan that is acceptable, we would then elevate it to the 
11

Deputy Secretary and the Secretary, if necessary.

The Chairman. Where does the CIO obtain his authority?

Mr. Staley. The CIO obtains his authority from the FISMA act.

The Chairman. Does he not also obtain his authority from directives from the Secretary?

Mr. Staley. Certainly, he is responsible to reporting to the Secretary, and he is under his leadership.

Mr. Wilshusen. And, also, if I may add, Mr. Chairman, Mr. Staley 

is correct. FISMA, in addition to making -- having the Secretary assume overall responsibility for the program, he also can delegate to 

the CIO the authority to ensure compliance with the Act and the 

provisions of the Act and to develop and maintain an agency-wide information security program that contains several different elements 

including assessing risks, developing the policies and procedures that 

are necessary to reduce those risks or cost-effectively reduce those 

risks, and to provide the testing and evaluation regarding the compliance and effectiveness of those controls.

 The Chairman. I have one last question. Are you aware -- Ms. 

Koontz, are you aware of the memorandum of March 16, 2004, whereby then Secretary Tony Principi made an effort to make sure that 

cyber security, accountability,and protecting VA’s computer information systems was the responsibility of the CIO Robert McFarland?

Ms. Koontz. Yes.

The Chairman. You are familiar with that memorandum?

Ms. Koontz. I have read it. Yes.

The Chairman. Are you also familiar then with the general counsel’s opinion that said that, despite the Secretary extending authority, that he really did not have the authority of enforcement? Are you

familiar with the general counsel’s memorandum?

Ms. Koontz. The general counsel memorandum that I am familiar 

with is from February, 2004. I don’t know if this is the same one or 

not. I am not sure I have all the documentation that you have, but a 

similar issue was raised at that time.

The Chairman. I have one here dated April 7, 2004. So I will make 

sure you get a copy of this.

Ms. Koontz. Okay. Very good.

The Chairman. My question is, is when you look at the FISMA

legislation that we passed here in Congress, were there rulings from 

other general counsels of other government departments consistent 

to what the VA did with regard to authority of a CIO?

 Ms. Koontz. We haven’t done a government-wide review of that, 

but I am not aware of any other general counsel that has -- any other 

counsel decisions that would be similar.

Mr. Wilshusen. Nor am I.

The Chairman. You are not aware of up to date, but you have not 

given it a review.
12

Ms. Koontz. I haven’t done a systematic review, no, and asked 

everybody.

Mr. Chairman. Would you be outside of your lane to do that for this 

committee?

Ms. Koontz. I don’t think so.

Mr. Wilshusen. No, we could work with your staff to look at that.

The Chairman. All right. What we are most curious about is whether this legal opinion is consistent with other general counsels’ opinion 

of the interpretation of the Act, or was this an opinion that was written because it was placating toward the interests of the three Under 

Secretaries?

Ms. Koontz. I understand.

The Chairman. Mr. Filner, you are recognized.

Mr. Filner. Thank you, Mr. Chairman.

 It is a bit beyond the scope of your testimony, but I would like to 

know if either of you have thought about or would need further direction from this committee to think about a proactive response. That is, 

we have an unprecedented breach of security here. I know personally 

that dealing with identity theft is extremely difficult, it is frustrating,

it is time consuming. People who are older especially, find it hard to

fix. They need our help.

 Have you thought about a way that we can, in fact, taking into account privacy concerns, give the veterans some help from us, rather 

than leave it to them as individuals to figure out credit breaches or

monitor their credit reports or get their credit reports? Could the VA

figure out a way to work with the credit bureaus to monitor any suspicious activity, and therefore know of problems immediately? To put

some of the burden on the VA rather than on the individual veteran?

Can you comment? Have you thought about that at all?

 We have to think outside the box, as they say. We are thinking 

in very traditional terms about dealing with this issue, and yet this 

massive breach and the kind of people that we have a responsibility 

to deserve better.

Ms. Koontz. There are probably a number of options that are available to the Congress to deal with this if the Congress makes a policy 

decision that this kind of action is warranted. I have seen proposals 

all the way from offering veterans free credit reports over some period of time to working more proactively with the credit bureaus in 

terms of monitoring. But, quite honestly, we haven’t evaluated any 

of these proposals nor looked into it further.

 Mr. Filner. Are you restricted to evaluating?

Ms. Koontz. Yes.

 Mr. Filner. We have to have some people giving us some policy recommendations in response to this breech, not just an audit function.

The Chairman. Mr. Filner, that is what we have done in our coordination of hearings. We will have academics, we have private in-
13

dustries and all. We have brought in the auditors for them to give 

us the historical context of all the problems and concerns. When we 

understand the context of the problem, then we can move out toward 

a solution.

Mr. Filner. I appreciate that, Mr. Chairman.

 An independent audit that was done about a little more than 3 

years ago -- this was not done by either GAO or IG but Deloitte and 

Touche -- and I quote from that report. In the so-called C and P

system, compensation and pension, we identified numerous security weaknesses, including inappropriate access privileges and inadequate management of access privilege, excessive assignment of powerful privileges to sensitive information, and inadequate segregation 

of duties, permitting individuals to both initiate claims and authorize 

the claims for disbursement.

 It seems to me we knew that there was a disaster waiting to occur. Do you have any comment on that? Is that part of what you had

found in previous years?

Mr. Staley. Well, in commenting to the report, sir, the report continued to talk about role-based user profiles in terms of --

Mr. Filner. I am sorry. Can you define this in English, please?

Mr. Staley. Identifying the employee’s specific duties, and then

identifying what specific data that employee would need to perform

those duties, and then limiting the access and controlling the access 

to only that specific set of data. What we are finding is that there is

a broader set of data that employees are able to access.

 By going ahead and limiting that access and I think, as Ms. Koontz 

has said in her testimony, by going ahead and restricting how much 

they can get, you certainly can mitigate the risks of some employee 

going off farther into other data than they should be.

Mr. Wilshusen. I would just add that those lists of deficiencies that

you just pointed out from the Deloitte report are very similar -- in 

fact, identical -- to many of the weaknesses we identified years before

then, after from 1997 or 1998 to 2002. And I think it is just emblematic of the lack of having a comprehensive security program.

  Because you can find problems and weaknesses on one system with

one organization, and if you don’t have a centralization of your controls and standardization you will end up finding weaknesses across

the Department. Without having a strong, centralized focal point for 

implementing information security, it is likely that once an identified

weakness is known it may be corrected, and VA generally is pretty 

good at correcting identified weaknesses, but they are not that good

at proactively going forward and looking to see if similar weaknesses 

exist across the Department and taking corrective action.

Mr. Filner. Mr. Chairman, I don’t mean this in any partisan way. 

I don’t care if it is a Democratic administration or a Republican Congress or vice versa or executive-legislative being in the hands of the 
14

same party. The oversight function of Congress is critical. You have 

shown, as we look down the month’s schedule, the proper way to do 

oversight. I think all the committees have to take this more seriously, again, without any partisan thought. I think you have outlined a 

way that a committee ought to do oversight, and I hope we can serve 

as an example for other committees, too.

 My time is up. Thank you, Mr. Chairman.

The Chairman. Thank you. Mr. Moran.

Mr. Moran. Thank you, Mr. Chairman.

 We have heard for a long time, and you have outlined again today, 

a long list, a long history of weaknesses within the system. My interest is perhaps beyond your realm of ability to answer, but how do you 

explain the failure of the VA to implement the recommendations and 

for the atmosphere or culture that exists at the VA in regard to this 

issue to continue despite the significant and series of warnings that

have occurred over a long period of time? What is wrong at the VA

that inadequate response occurs, it seems to me, in each and every 

occasion to the Inspector General, to the GAO, and to congressional 

committees’ direction following review of their procedures? Why no

or insufficient response?

Mr. Staley. One of the reasons I think, sir, is that the recommendations -- the Department has seemed to focus on a resolution of recommendations at the sites that we visit. We go out to the information 

technology centers, and then we go out to a select number of medical 

centers or regional offices, and then we conduct these program reviews where we go out to offices. And the responses we get back to

those recommendations are, is we have taken actions at site A.

 Then next year we come along and we go to site B and we see that 

the same conditions exist. We have been continuing to report that 

these are systemic issues and that you need a comprehensive and 

central approach to ensuring that all of the recommendations are issued at all the sites concurrently. So we wind up going ahead and 

making the recommendation the following year, and so then it just 

seems to perpetuate itself.

 Really, the Department needs to take an aggressive stance in ensuring that all of the regional offices and all of the facilities are correcting the vulnerabilities that we have identified and also correcting

the vulnerabilities that they have recognized through their own certification and accreditation process in order to mitigate the risks that

we are talking about here today.

Mr. Wilshusen. If I may add, because I wholeheartedly endorse 

what Mr. Staley said, is also there needs to be appropriate accountability mechanisms in place to help assure compliance; and, if not, 

that there are consequences for not implementing security controls.

Mr. Moran. Mr. Wilshusen, your testimony was that, legally, the 

responsibility for these issues, the security of information contained 
15

at the VA, rests with the Secretary of the Department. Is that true?

Mr. Wilshusen. Yes, under the Federal Information Security Management Act.

Mr. Moran. So no question as to who is responsible legally.

Mr. Wilshusen. He has overall responsibility.

Mr. Moran. What is your reaction to what is very troublesome to 

me as about the time frame in which it -- the time passage. Say that 

differently. A long period of time -- at least in my mind, a long period 

of time transpired before this breach reached the desk of the Secretary, and yet you tell me that the Secretary is legally responsible for 

this system and the consequences of that breach. What does it tell us 

about the VA in the failure for this information to quickly reach the 

Secretary?

Mr. Wilshusen. One of the elements that is required under law 

by FISMA is that agencies develop the policies and procedures for 

adequately detecting, reporting, and responding to security incidents 

and events.

 It seems clear -- and, again, we haven’t done any work, so I don’t 

know the specifics of this other than what I have read -- but it seems

like there might have been a breakdown in those policies and procedures.

Mr. Moran. Are there policies for response and for notification in

place at the VA today? 

Mr. Wilshusen. That is something we haven’t looked at recently.

Mr. Staley. There is an incident response criteria in VA’s handbook. We currently have an administrative investigation ongoing to 

look at the specific instructions of the incident response handbook

and what occurred from the point of time where the employee notified

the VA. We hope to issue that report to the Department for comment 

at the end of this month; and as soon as the Department responds to 

our issues and recommendations, we will be issuing the report, hopefully in mid-July.

Mr. Moran. Well, as I indicated, this aspect of it is clearly troublesome to me, the idea that it would take so long for the Secretary to 

learn of this breach. The concern it raises with me is we either have 

a desire at a level of the VA in which to camouflage or hide, cover up

the errors and mistakes, or a suggestion that the Secretary or the upper management is disengaged in these issues. And either one is a 

terrible conclusion to reach.

 But I would like to know -- I am anxious for your report, Mr. Staley 

-- to learn why it would take such an extraordinary amount of time. 

I just know in the management of any business, small or large, the 

first place you go with something of this magnitude is to the leader;

and it clearly happened in a very slow fashion at the Department of 

Veterans Affairs.

 Thank you, Mr. Chairman.
16

The Chairman. Thank you very much. Mr. Michaud.

Mr. Michaud. Thank you very much, Mr. Chairman.

Question: During the coordinated draft, VA directive 6500 information security program, VHA questioned the requirement that all 

companies acting as contractors or subcontractors with access to VA’s 

information system, including transcription services and medical devices, shall be American owned.

  Today, the VA Office of Inspector General will release a report indicating that, in February of 2005, an offshore subcontractor contacted 

the Office of Inspector General hot line division threatening to expose

about 30,000 VHA patient records from five VHA facilities over the

Internet if the contractor did not pay over $28,000 owed. Draft directive 6500 would have prevented this. But the culture within VHA, 

as explained at previous hearings, that “don’t tell me what to do” 

attitude, questioned the American-owned transcription service requirement. They went out, but, as a result, confidentiality of medical

records of over 30,000 veterans was jeopardized.

 I would like you to comment.

Mr. Staley. Yes, sir. We have been conducting this audit for some 

time in conjunction with our Office of Investigations, because there

have also been certain investigations that have been ongoing as well, 

some of which would been under seal, so we have been a bit delayed 

in issuing this report. In fact, we worked with the Justice Department a few months ago to try to sort out what language we could or 

could not put in the report before we issued it, and we just recently 

received comments back from the Justice Department.

 The break in the control is that the contracts do not specify to the 

contractors a number of criteria in terms of how to protect personal 

identifying information. Such as you can send it to a U.S. contractor, but you cannot use an offshore foreign subcontractor. It is silent 

on the issue. So, consequently, you have an issue such as you have 

described this morning arise.

 And, of course, our report hopes to be out on the Internet today, 

latest tomorrow; and it talks about four issues: using speech recognition technology in-house to try to keep more of this in-house and 

not outsource it because the information is so sensitive; acquiring 

transcription services uniformly; and verifying the invoices and then, 

most importantly, the management controls over patient privacy and 

personal patient identifiers.

The Chairman. Mr. Michaud, if the gentleman would yield to me. 

I recognized you out of order, and if you hold your thoughts, let me 

recognize Dr. Snyder, because he is going to have to get to the Armed 

Services Committee.

Mr. Michaud. No problem.

The Chairman. Mr. Snyder.

Mr. Snyder. Thank you, Mr. Chairman. I appreciate your holding 
17

this hearing, also.

 I don’t know if it happened to you, Mr. Chairman, but, as I mentioned in another hearing, my wife and I have a 3-week-old baby, so 

we got about 3 weeks behind in our mail. Two days ago we were going through literally a laundry basket full of mail because we are on 

so many lists, and there was my letter from Secretary Nicholson, and 

I thought I was not going to be -- did you think the same thing?

The Chairman. It was personalized, too.

Mr. Snyder. It was very personalized.

The Chairman. “Dear Veteran.”

 Mr. Snyder. It gives you this empty feeling when you realize that 

somebody is sitting out there with your stuff.

 But at one of the hearings that was held, I think it was in the May 

25th hearing -- I will direct this to you, Mr. Staley -- some privatesector privacy experts suggested that the VA doesn’t need to be using 

Social Security numbers at all; and, in fact, that we were all -- everybody in the military memorizes for all time their service number. We 

could either use our service number, which is just distinctly for the 

military, or be assigned another number. Why do we have to use a 

Social Security number at all since this is all an in-house thing?

Mr. Staley. Well, it is certainly a policy decision by the Department. But my views on that, as I had a service number and not a 

Social Security number, but I also joined the VA around 1971, so I

recognized that the Department of Defense was moving from service 

numbers to Social Security numbers depending on the branch of service you were in. So VA eventually moved Social Security numbers 

as your general identifier. And many of your affiliations and your

other business associates that work with the VA also use Social Security numbers. Department of Defense uses Social Security numbers. 

So I think that is pretty much how Social Security numbers became 

the -- 

Mr. Snyder. I understand why it was done 35 years ago. But why 

do we perpetuate it? We have a distinctive number that is not a Social Security number. Would that not add a different level of protection if we got away from Social Security numbers?

Mr. Staley. Certainly your point is well taken.

Mr. Snyder. They go throughout their military career with using 

a number that is not their Social Security number. Is that not correct? 

 Mr. Staley. I am sorry, your question again?

Mr. Snyder. People in the military go throughout their military 

career, whether it is 2 years or 20 years, with a number that is not 

their Social Security number as their identifying number. Is that not 

correct?

Mr. Staley. I believe -- I am not sure whether all military branches 

use a unique service number. I couldn’t comment on that.
18

Mr. Snyder. I want to get back to Mr. Buyer’s statement about this 

memorandum on the CIO authority. And I haven’t read this, I just 

quickly looked through it.

 When you start seeing -- when someone has to ask for this kind of 

guidance and somebody is quoting court cases on statutory authority, 

you know, the principles of interpreting statute, we are in doo-doo 

city. I mean, because somebody out there has to sit -- is looking for 

how do I have to do my dang job? And do I have authority or not?

And when I call up you to tell you I have the authority, I don’t need to 

be sending along: Well, you need to refer to page 7, footnote 3, about 

my authority to tell you how to improve your stuff. I mean, does this 

not point that we need to do some clarifying legislative kind of language so that the lines of authority on this are clear?

Mr. Staley. Obviously, I can’t speak for the general counsel in 

that their legal opinion has been the focal point of the reasons why 

the CIO has continued to inform us, as we push forward in trying to 

move our recommendations forward, that he had been hampered by 

enforcing many of the initiatives that he had tried to execute in terms 

of having the authority to make them happen.

Mr. Snyder. And you folks from the GAO, there is a statement in 

there. You talk about the weaknesses, that things have been identified in 2001 that had not been resolved, what Mr. Buyer referred to as

the ditto document, that we are rehashing some of the stuff had been 

talked about in the past. In one line there in the report, it talks about 

the Department has maximized limited resources to make significant

improvements. The phrase “limited resources” catches my attention. 

Do we have now and have we had funding issues in terms of getting 

this done?

Mr. Wilshusen. I think that was the Department’s response.

Mr. Snyder. It was the Department’s response. Do you agree with 

that response? Is it partly a money issue?

Mr. Wilshusen. We believe -- and in our reports we talk about 

what resources are available that they have and how they are being 

used. I wouldn’t say that is a resource issue or that they need more 

money. We generally don’t make such recommendations along those 

lines. We look at how they use the resources that they have. 

Mr. Snyder. Dr. Staley, one of the problems that you mentioned 

is controlling access to physical space. Now we can talk about encryption and all these kind of things as being a new problem. We all 

understand new problems. But access, protection of medical records, 

physical space is not a new challenge. Why is that not an easy problem to correct?

 I assume what we are talking about is the ability of someone just 

to walk in and say I am going to grab that file. Why are we still having to deal, after this many decades of concern about medical privacy, 

before even the advent of computers, why are we still dealing with 
19

controlling access to physical space, just somebody walking in and 

grabbing files?

Mr. Staley. Well, it is an issue of vigilance, sir, and continually 

ensuring that your physical space is secure. Obviously, the Department has made improvements by adding key cards and things of that 

nature to control physical space better. We see more and more of that 

as we go out on these site visits.

But it doesn’t preclude someone from sticking a pop bottle in that 

door, and then we arrive and, my goodness, there is a pop bottle and 

the door is open. It doesn’t preclude cleaning crews from going in 

there unescorted, or because of a lack of time, someone lets a contractor in there to deliver materials and they are not there next to them. 

 So these physical security issues continue to persist, and it is really 

an issue of vigilance and ensuring that our guard is not let down and 

that those areas are always secured.

Mr. Snyder. If you see in your work, if you see Mr. Buyer’s or my 

file laying around, would you let us know?

 Thank you. Thank you, Mr. Chairman.

The Chairman. Dr. Snyder, your question with regard to Social 

Security numbers. At the last hearing, Gartner Consulting gave a 

recommendation to the committee that the VA should no longer use 

Social Security numbers and should use a user personal identifier.

So, distinctive.

 Your other question on enforcement, where we are going, is the 

reason we have turned now to the other subcommittees to hold their 

own hearings. Because if the CIO can’t do the enforcement, then the 

enforcement is the responsibility of the three Under Secretaries. So 

we have got to bring them in.

Mr. Snyder. Thank you.

The Chairman. Mr. Michaud.

Mr. Michaud. Thank you very much, Mr. Chairman.

 I just want to follow up on my last question. St our last hearing 

we were assured that there is a culture within VHA based upon the 

medical profession code to do no harm by Dr. Perlin. But my concern when I find out that just last year that you received a call from

a subcontractor threatening to expose 30,000 veterans’ information, 

medical records, over the Internet unless VA pay the $28,000 owed is 

a real concern that I have. And I am just wondering, in your many 

reviews of the VA IT system, have you identified a stronger IT security culture in VHA versus the Veterans Benefits Administration or

the National Cemetery Administration?

Mr. Staley. Our principal focus is in the Veterans’ Health Administration and the Veterans’ Benefits Administration. They have far

more platforms and systems than the National Cemetery Administration. There is only a few systems that are being used there. And 

we are finding similar problems in both administrations. Referring
20

to encryption solutions, you will find the same problems, that the veterans’ benefits network does transmit clear text, unencrypted among

its network. You go to VHA, you look at their Vista system, which is 

predominant, and the transmission and storage is in clear text. And 

when you look at some of the other areas that I have testified on in

my written testimony, similar conditions exist in both administrations.

Mr. Michaud. Has the GAO found that with other agencies dealing 

with subcontractors, that this is a problem? Have you looked at this

issue as a potential problem?

Mr. Wilshusen. We looked at the issue last year in terms of the use 

of contractors to provide services, information technology and security-related services; and one of the things we found is that Federal 

agencies, by and large, did not do an adequate job of providing oversight over the services that those contractors provide.

 One of the things -- again, I keep referring to FISMA. But one of 

the things that FISMA does, is it also extends the requirement that 

the agency’s information security program extends to the information 

and the systems that are being operated on its behalf by contractors 

and other third parties; and we found that there is still room for improvement on agencies’ oversight of the work being done by contractors with regard to information security.

Mr. Michaud. Thank you, Mr. Chairman.

The Chairman. Thank you.

 Mr. Bilirakis.

Mr. Bilirakis. Thank you, Mr. Chairman.

 Mr. Staley, as you may know, tomorrow the Subcommittee on Oversight Investigations will hold a hearing on patient safety, where we 

will hear testimony from GAO on credentialing physicians, which includes background checks, of course. Your written testimony states 

that you have identified instances where background investigations

and reinvestigations were not initiated in a timely manner on employees and contractors or were not initiated at all. Now, are you 

telling this committee that the Department is lacking background 

checks for personnel that handle secure data as well?

Mr. Staley. Yes, Mr. Bilirakis.

Mr. Bilirakis. You are saying that.

Mr. Staley. Yes. VBA has recently reported to our office that they

need to conduct about 3,000 new background checks in order to resolve this issue. So that is one of the reasons our recommendation 

remains open and why we continue to monitor it.

Mr. Bilirakis. My God. We identified IT and security deficiencies

at 37; 67 percent of 55 Veterans’ Benefits Administration facilities

reviewed. And this is something that has been in the offing, as you

know, for a long, long time. We have held hearing after hearing after 

hearing. We have had roundtables. We can just go on and on and 
21

on.

 I guess we can continue to talk about the details here and about 

Social Security numbers, but I don’t know why in the world we got 

away from the old military service numbers, quite frankly, and went 

into Social Security numbers. All we did was just compounded the 

problem.

 Mr. Moran went into the atmosphere of the culture. I would add 

an additional word to that, and that is turf, T-U-R-F. Frankly, one of 

my biggest disappointments -- and I am not a spring chicken. I have 

served in the military. You just name it. Basically, I think I have 

done it all. Yet it is still one of my biggest disappointments since 

coming to the Congress 24 years ago is the turf concerns that we have 

up here. I think we probably would function one hell of a lot better 

if we weren’t as concerned with it as we are. And maybe it is human 

nature and maybe it is something we can’t ever change because it is 

within us. I don’t know. But that is a terrible disappointment on my 

part.

  I might add, too, my first experience with the IG was when I was in

the military, and I saw a lot of power there. I mean, people straightened up and paid attention when the IG got involved in a particular 

situation. Now we have GAO which -- thank God for you. I think, 

frankly, you do great work. And we have the IG. And yet we haven’t 

been able to straighten things out at the VA.

 Granted, we have secretaries who are political appointments, many 

of whom don’t even serve the full 4 years that they are appointed. I

think that there is a lot of resentment probably towards them by the 

bureaucrats.

  Why can’t we get these things straightened out? I mean, don’t you

have any recommendations to us? Is the only way to get this culture

and this atmosphere that exists there and these turf problems -- and 

I know you haven’t acknowledged that yet, but I think you probably 

would acknowledge that turf is part of the problem. Isn’t there any 

way to get this straightened out without necessarily someone coming 

in and saying just we are going to clean out everybody? And I don’t

want the papers to report that I have suggested that, but -- clean 

out everyone and start from scratch? Why should we continue to -- I

mean, it creates work for us and whatnot. And maybe that is good, 

because we are needed. But, at the same time, why can’t we get past 

that? 

  Comments? GAO, Ms. Koontz, say you are queen of the day. I

mean, tell me, what would you do?

Ms. Koontz. Well, I think one of the things that I didn’t want to 

leave this hearing without saying is that one of the very serious problems at VA has been the lack of a strong CIO organization, and VA

was very slow to put into place a full-time CIO. That didn’t happen 

until 2001. And, since then, there has been two CIOs who have come 
22

and gone. Each of them recognized that there was a need to realign 

the CIO function and to strengthen it.

 We supported the notion that you needed to have centralized security management, and we supported the idea that the CIO really had 

to have a seat at the table and needed to have veto authority, power 

over things that just didn’t make sense, that weren’t standard within 

the organization, that shouldn’t be connected to the network, that 

didn’t meet security standards. And what you have seen is that two 

CIOs have come and gone and the realignment has yet to happen.

 Obviously, VA is very, very resistant to change, quite slow to move. 

And I have to say I think it is up to the Secretary to make sure that 

the CIO has the support to make the realignment happen in such a 

way that we can get a positive result.

Mr. Bilirakis. Should that CIO be someone coming through the 

ranks, so to speak, a bureaucrat, or should it be somebody from the 

outside?

Ms. Koontz. I think that the CIO has to have particular qualifications, and the CIO at VA is a political appointment. I think that the 

talent and the qualifications of the person is probably most important, but, also, the support from the Secretary is very vital.

Mr. Bilirakis. But if that CIO is and has to be -- I mean, I don’t 

know whether that person has to be a political appointment. But if 

he or she has to be a political appointment, won’t that person maybe 

suffer the same problems that the Secretary -- any Secretary might 

because of resentment and the culture that exists there and this is an 

outsider coming in?

Ms. Koontz. I think that will be a challenge for anyone coming 

up, either within the ranks or from outside. And, again, I think that 

the Secretary has the authority and the power to make sure that 

the CIO can be effective in the organization, even though I recognize 

there are big challenges in terms of all the reasons that you have just 

mentioned -- that it is a very large organization, it is very difficult to

change, and there appears to be some resistance to changing things 

in this area.

Mr. Bilirakis. In the process -- and I don’t see the red light on yet, 

Mr. Chairman, so I guess I will continue. But in the process of your 

investigations and also the investigations of the IG, you go into the 

details and you see things wrong and you make recommendations, 

but do you take into consideration this culture, invisible type of thing, 

culture, turf, atmosphere type thing in the process? Or do you just

concentrate on, I will say, the tangible, if you will, the mistakes that 

are made, the inefficiencies, and things of that nature?

Ms. Koontz. Well, I think -- from a GAO perspective, I think we 

always try to identify what the root cause is of any particular deficiencies that we found. And I think we have reported over and over 

that -- management being a very critical problem at VA in terms of 
23

IT and one that needs to be resolved. So I think we have taken that 

into consideration.

Mr. Bilirakis. Mr. Staley, anything to add on that? Again, I said

my experience with you all is that you are awfully powerful, but are 

you not powerful as far as the VA is concerned.

Mr. Staley. We continue to make recommendations, Mr. Bilirakis. 

In my written testimony, the first recommendation speaks to a centralized approach which we recognized because each administration 

needs to work together to resolve the vulnerabilities that are talked 

about in the testimony from 2 to 17, in that all of the administrations 

need to work together to achieve success. And I know there are some 

very hardworking individuals in each of the administrations that 

have specific missions for their specific administration. But there is

a bigger picture here, in that what everything points to is a standardized approach, and the only way that can be accomplished is if it is 

all done as one voice.

Mr. Bilirakis. Do you see continuity? Secretary Principi left, Secretary Nicholson came aboard. I guess there was probably a little bit 

of a gap period of time there. Is there continuity? How much time is

spent by those two secretaries, along with their chief personnel, to sit 

down and to kind of go over, hey, this is what has been a problem, this 

is what we have accomplished, this is what we have kind of turned 

over to you and recommend? Is that taking place?

Mr. Staley. In the case of Secretary Principi he was very adamant 

that the administrations complete their certifications and accreditation process by August 21, 2005. And he made that happen. And it 

also allowed the Department to realize and to catalog the number 

of vulnerabilities that it really had to deal with just by the fact that 

they were able to certify and accreditate all of their systems. It also 

gave them a better handle on how many systems they really had. So 

Secretary Principi did make progress in that area, of course; then he 

had moved on. And now we have secretary Nicholson trying to get a 

handle on this issue.

Mr. Bilirakis. Thank you.

The Chairman. We will have a second round. Ms. Herseth.

Ms. Herseth. Thank you, Mr. Chairman. If I could make just a 

request to add on to yours, in working with the committee and with 

the GAO to undertake a systematic analysis of the general counsel’s 

rulings. I would alsoinquire, Mr. Chairman, as to your willingness 

to extend that to look at, in light of Ms. Koontz’s acknowledgment or 

her explanation of what she thinks is a problem here and a lack of a 

strong CIO organization, we have got since 1996 under the KlingerCohen Act, a CIO is supposed to be created in each Federal agency. It 

would be interesting to see if we have the same problem in the other 

Federal agencies with the lack of a strong organization with the CIO, 

if there are other determinations, and maybe we can extend it.
24

 I only bring it up because we need some continuity across agencies. 

And if they are having the same problem in another agency with the 

lack of a strong CIO that has led to some of the same problems that 

the VA has been experiencing based on a currently decentralized system but the need for some sort of centralization, we have other CIOs 

that have been created in other Federal agencies. And I do not know 

if they all communicate effectively about the different problems they 

are having, but we do need to facilitate the exchange of information 

among these different entities we create after statutory authority to 

do so.

The Chairman. Your point is well taken. The reason we focus on 

this memo, and we will bring the general counsel up, is that Tony 

Principi, the former Secretary, went out and found one of the Nation’s 

best and brightest in Bob McFarland to be the CIO to take on these 

challenges that GAO and IG have laid out. But what happened is we 

had a strong intelligent person who is undercut in his authority to 

be able to implement it, and that is what we are going to get to the 

bottom of.

 I yield back. 

Ms. Herseth. I appreciate that, Mr. Chairman, and I hope that we 

can pursue this in other ways because I think -- and this leads to sort 

of my next question here -- if we can identify where things are working better in a different agency with a new position that we create, 

that way it helps us to identify how we improve, kind of find sort of

the best practices for other agencies.

 So that leads me, Mr. Stalely, to my question for you. And that is 

on page 3 of your written testimony, and I know that Mr. Bilirakis 

identified this as well. We have a number, significant percentages

here of our VHA and VBA facilities that have an ongoing problem 

with implementing recommendations and have these vulnerabilities. 

But has there ever been an analysis as to what is going right or what 

steps were taken at the 40 VHA facilities and the 18 VBA facilities 

in which these comprehensive reviews have shown that the recommendations were acted on or they have been able to avoid or take 

corrective action to address the vulnerabilities so that as we seek to 

centralize and standardize the procedures, is it differences in leadership at the regional offices? Is it differences in attitude? We have

all posed questions about culture. Is it differences how resources are 

being allocated?

 I would rather us move -- while we can talk for hours about the 

problems, maybe we could shift our focus to those sites, those facilities, that have done a good job, and figure out how we integrate their

practices into our desire to have a more centralized and effective system to address the vulnerabilities. Has a similar analysis and trying 

to figure out and put together a best practices has been completed?

Mr. Staley. Certainly we haven’t reported as a cumulative on best 
25

practices, as you have suggested. It is a good point. What we have 

done is discuss a best practice or a control in an individual report. 

But no, we have not taken those facilities that are complying and 

are vigilant about access controls and those kind of issues and talked 

about them as; here is a body of work and here is what you need to do 

for example. We haven’t done that.

 We have reached out to these PCIE communities. My IG has 

reached out to the PCIE to talk about whether we need to get together as a group and look at this issue governmentwide. I do know 

that we are scheduled to meet with the PCIE in the future and talk 

about this very issue.

Ms. Herseth. And the acronym stands for what again? Did you

say PCAI?

Mr. Staley. PCIE, the President’s Council on Integrity and Efficiency.

Ms. Herseth. That was going to be another question. That is the 

entity that brings all the offices of the inspector general together.

Mr. Staley. Yes.

Ms. Herseth. To identify patterns and trends. And how often does 

that Council get together?

Mr. Staley. It is routine. I cannot give you an exact time but usually monthly.

mMs. Herseth. Just as a follow-up, Ms. Koontz, are you aware at the 

GAO, do the CIOs created among the different agencies, do they have 

a mechanism in which they get together on a regular basis to share 

information?

Ms. Koontz. The CIOs also have the CIO Council which was established -- or reestablished under the E-Government Act.

Ms. Herseth. So they all meet together. They are meeting in sort 

of subsets of one another, based on whether they are in the IG office

or CIO?

Ms. Koontz. Right.

Ms. Herseth. I will yield back. I hate to end on this note but I

think it is important to put this on the record again because it is an 

observation that has some pretty powerful implications. In the first

hearing that we had on the data theft, we secured a written statement from Dr. Leon Kappelman who is an expert in information technology in our organization, culture, and operations. Here is what he 

observed. He has personally seen VA personnel subvert and sabotage 

hundreds of millions of dollars’ worth of IT projects and read about 

billions more wasted on other failures. I have seen a total disregard 

for one cyber security effort after another. These are only the tip of 

the iceberg.

  Why do such things happen at VA? Largely because these systems

and efforts would make the utilization of budget and personnel more 

transparent and thereby make accountability possible. Have either 
26

of you in your work ever seen evidence at different facilities of personnel intentionally subverting and sabotaging projects designed to 

implement recommendations, particularly in the cyber security and 

information technology arena?

Mr. Wilshusen. No, I cannot say that I have seen any personnel 

sabotaging such projects.

Mr. Staley. The same for me. I can not recall any specific instances. Of course we are an audit organization. We do have an Office

of Investigations, but I cannot speak for any specific instance where

that may have occurred.

Ms. Herseth. I appreciate your responses.

Mr. Bilirakis. Will the gentlewoman yield.

Ms. Herseth. Yes, Mr. Bilirakis. 

Mr. Bilirakis. As a follow up on that, how does the VA in your 

opinions, particularly GAO because you have experience throughout 

all of the other departments and agencies, how does the VA compare 

in these areas with the other departments and agencies?

Mr. Wilshusen. At least with regard to information security, every 

year we look at the FISMA reports that are required that each agency 

is supposed to send to the Congress and also to OMB. Our analysis 

of those FISMA reports tends to show that VA and its implementation of the FISMA requirements tends to be at the bottom end of the 

scale, if you will, along with some of the other larger, more diverse 

organizations compared to other smaller organizations that tend to 

do higher on that particular score. But certainly with VA reporting 

material weaknesses since 1998, 1997, it is an indication that there

is a lot of work that needs to be done.

Mr. Bilirakis. Thank you.

The Chairman. Thank you very much. I would like to go to your issue number one and it deals with the implementation of a centralized 

agencywide IT security program. We got to go to this one because a 

lot of people will -- and it is easy to say this is the responsibility of 

the CIO. Really? I suppose that is what it should be in corporate

America and it is. It is what it should be at the VA but it is not. 

  So Tony Principi goes out there and he finds one of the best, makes

him the CIO, and then we learn that operational controls are decentralized among each of the administrations; so VHA, VBA, the 

National Cemetery Administration and other programs, they have 

the operational control. The CIO can only provide guidance and the 

tools to support these activities but has no ability to enforce. Is that 

statement correct?

Mr. Staley. That is correct. Correct, sir. That is correct, sir.

The Chairman. I wanted to make sure I was hearing correctly. 

That is an important predicate. It is an important predicate because 

we need to figure out what are the lines of authority. If you figure out

what are the lines of authority, then we can get to the implementa-
27

tion to cure the problem.

 In Congress when we looked at this last year on a bipartisan basis, we moved overwhelmingly, not only in this committee but in the 

entire House. Not a single vote against centralizing the IT system. 

Whoa, did we get pushed back. The Senate wanted to give deference 

to the VA and the bureaucracy became the centurians. Wow. Then 

we continued to receive your reports about all of these issues that are 

still noncompliant. I suppose, then, if we have a system that is so 

decentralized -- but let’s go back. 

 We have the Secretary who has the authority. He then extends 

part of his authority to CIO and part of that goes to cyber security, 

both of which can only do compliance but not enforcement; therefore, 

I must assume that enforcement then rests with the three Under 

Secretaries. Would that be a correct assumption?

Mr. Staley. That is correct.

The Chairman. So it is now the responsibility of the three Under 

Secretaries to implement these recommendations from GAO and IG; 

would that be correct? I am looking for responsibility, Mr. Stalely.

Mr. Staley. The CIO in conjunction with VA leadership, they have 

a joint responsibility to implement these recommendations. That is 

correct Mr. Chairman.

The Chairman. Okay. Both of you have an incredibly challenging 

job. When you see something in error and you keep highlighting the 

error and you are trying to work with someone else who says, I know 

all about it but I have no authority, and this has been happening for 

years.

 Let me ask this. On GAO you have got to have a higher authority. 

If the GAO turns to the VA and for years you give these recommendations to cure, yet you have a department of government that is not 

implementing GAO recommendations, who is your higher authority?

Mr. Wilshusen. I would just say, you know, it is the management’s 

responsibility for implementing those recommendations. We continue to make them.

The Chairman. Who is the manager of the management?

Mr. Wilshusen. That would be at the agency. It would be the Secretary and the senior managers of CIO, as others.

The Chairman. Wait a minute, wait a minute. I do not understand 

the answer. At the GAO you are overlooking departments of government, and you have a department of government that is noncompliant and perhaps even recalcitrant from a bureaucracy that will not 

implement the changes, who do you appeal to. Do you turn to OMB?

Do you report this to the White House? Is there a higher appellate

authority? Or do you just say, you know what, the Secretary reports

to the Cabinet and all we can do is we’re auditors. We can tell them 

what we see and if they act on the information that is great; if they do 

not act, well, I guess that is what happens.
28

Mr. Wilshusen. Well, we do report to the Department; that is correct. I do not know if we would appeal to OMB on a specific instance

where a department is noncompliant with implementing our recommendations.

The Chairman. So your audits would only go to a Secretariat of a 

department, and they do not go anywhere else.

Mr. Wilshusen. No, we also send, usually, copies of the recommendations; and our reports go to different congressional committees of 

jurisdiction.

The Chairman. So outside of our oversight and the Senate’s oversight, what oversight is there in the executive branch if you have a 

department of government that does not implement changes to prevent a train wreck? I don’t know. If there is not, just tell me. I am

not asking you a question I know the answer to. I do not know.

Mr. Wilshusen. I guess the only other higher authority might be 

the American public, because many of our reports are also publicized 

and put on the Web site.

The Chairman. I will stay within the executive branch. Within 

GAO is there ever a function whereby you take your report and you 

send it to anyone else? The anyone else would be what? The White

House. Because the Secretariats work for the President.

Mr. Wilshusen. Generally, when we would do a governmentwide 

review, our recommendations and report would then usually be addressed to the director of OMB if it has OMB issues in it. But that 

would not necessarily be the result of our work that we have been 

doing over at VA.

The Chairman. If it has OMB issues on it. All right. Let’s go with 

theft, fraud, 6 million, right, 6 million, 12 million, these Bay Pines 

debacles, hundreds of millions of dollars. That is kind of OMB implication, right? So if you have got the VA nonimplementation, was

there ever a thought within GAO that, gee, we probably need to kick 

this over to OMB? I am just curious. I do not know.

Ms. Koontz. I think one of the mechanisms that we use is that 

we have publicized information security as being a governmentwide 

high-risk area since 1997, I believe. And we have put a lot of emphasis on it and there have been a lot of conversations with OMB and 

with the individual agencies about trying to address this particular 

weakness.

Mr. Wilshusen. Right. And one other comment, too, is that agencies are to report how they have implemented the GAO recommendations. So I guess it is to the GAO oversight committees, which would 

be the House Government Reform and Senate Homeland Security, 

Government Affairs.

The Chairman. All right. Let’s go to Government Reform, because 

they ended up coming with the FISMA act. So we put teeth in Privacy Act violations. Are there sufficient -- is there sufficient teeth for
29

compliance in this act? Do you think Congress needs to come back in

to the FISMA and make them equate with the Privacy Act violation?

Mr. Wilshusen. I do not think there are any particular, I will say, 

penalties.

The Chairman. Enforcement mechanisms? Tools?

Mr. Wilshusen. Right. Other than agencies are required to report 

to Congress and to OMB on the progress of implementing FISMA.

The Chairman. And there are no consequences for not?

Mr. Wilshusen. For not reporting? I do not know if that has happened. I think each agency has reported.

The Chairman. Ms. Koontz, I can remember the first time in your

testimony before one of the subcommittees that I chaired, the VA was 

the last to go out and get a CIO that I recall. It was driving me crazy 

with the Klinger Act. And that is when I first -- I had deep respect

for you because you went right at it. And our difficulty right now is

that we have so many of these security vulnerabilities, key controls, 

information that should have never been taken down, information 

that does not even -- if you have an individual that gains access to 

particular information, it is not even time sensitive.

 This is going to take a tremendous amount of work to put this one 

together. Does anybody else have further questions? Mr. Moran.

Mr. Moran. No, sir.

The Chairman. Mr. Bilirakis.

Mr. Bilirakis. I guess you have to go over there.

Mr. Michaud. Yes. Thank you, Mr. Chairman. FISMA applies to 

national and nonnational security systems. The data that was stolen, 

does that fall in that category as national or nonnational security? 

Mr. Staley. Sir, I am really not able to comment at this time, in 

that we currently have an ongoing administrative investigation and 

we are also doing a set of comprehensive policy reviews as well and 

working with the Justice Department. And I believe our intention is 

to get that report out at the end of the month to the Department for 

comment, and then to issue it to the public and to the Hill by midJuly.

Mr. Michaud. So you cannot comment whether it was national or 

nonnational?

Mr. Staley. I would not be able to comment -- sir.

Mr. Michaud. Assuming that it was or is a national or nonnational 

-- assuming that it was or it is -- my question is that on August 1 of 

2003, the general counsel issued an advisory opinion to address the 

extent of the authority and responsibility to the VA chief information 

officer contemplated by the Federal Information Security Management Act of 2003 as a national security information and information 

system. It held that FISMA charges the CIO with certain security 

responsibilities, a major one being the development and maintenance 

of information security policy, procedures and controlled techniques 
30

to ensure security requirements issued by the President and OMB requiring national and nonnational security systems are met. FISMA

requires the CIO to develop and implement an agencywide security 

program to achieve these purposes. Has this happened? Why or why

not?

Mr. Staley. Certainly. Our reports have repeatedly shown that 

security vulnerabilities continue to exist in many facets of the Department, and that the VA even itself reported itself as receiving an 

F grade in terms of IT security. I think, as GAO had pointed out, they 

have a long way to go to mitigate these vulnerabilities and to have a 

sound comprehensive IT security program.

Mr. Michaud. When will you know whether or not this is a national 

or nonnational security issue?

Mr. Staley. Well, our report will be issued mid-July and it is conducting a comprehensive review of policy procedures and these other 

issues.

 Mr. Michaud. Thank you, Mr. Chairman.

The Chairman. Mr. Filner.

Mr. Filner. I thank the panel for being here. I want to make two 

quick comments, Mr. Chairman. We can go through all of this analysis (we used to call it “analysis paralysis”) and recommendations. 

Between the lines of the bureaucratese and the big words everybody 

is using, there is a failure of management at the very top. The Secretary has not taken control, and we should hold him accountable. It is 

as simple as that, as far as I can tell.

 Secondly, it has been 6 weeks since this theft of data. The Department of Veterans Affairs finally got out a letter to people who were

impacted by this theft, although they said they didn’t get a letter out 

earlier because they did not have enough envelopes. The letter gives 

the veteran little support or help. The Web site that everybody has 

been referred to gives little or no help. The 800 number gives little or 

no help. Basically, the VA leaves it to the individual veteran to solve 

this massive issue.

 It is about time that the VA had an answer for these veterans. 

We are going to make sure nothing happens again -- that we have 

centralized IT -- but we still have this problem. Veterans are not getting the help, and they better! I do not know how many people are 

sitting out there from the VA Department. They have a lot of people 

monitoring stuff rather than doing stuff. You better come back with a 

proactive stance soon. It has been 6 weeks. We should not go another 

week without having some help and hope for these veterans.

The Chairman. Thank you, Mr. Bilirakis.

Mr. Bilirakis. Thank you, Mr. Chairman. To get clear here -- and 

maybe we already are, I do not know -- the General Accountability 

Office used to be the General Accounting Office. So your responsibility is accountability. Is that accountability limited to just making 
31

recommendations?

Mr. Wilshusen. Well, we do follow up to see if they are taking corrective actions on our recommendations.

Mr. Bilirakis. And if they haven’t, that is it?

Mr. Wilshusen. Well, we report on that.

Mr. Bilirakis. You report on that.

Mr. Wilshusen. Yes. We do not have the authority to actually 

implement the actions at the organizations.

Mr. Bilirakis. So I guess it really gets back to, again, what we have 

been talking about here, not really knowing where the buck stops. 

And it really, I guess, stops with the head of the VA I, suppose, the 

head of the particular agency or department.

Mr. Wilshusen. Well, under FISMA he is responsible for implementing appropriate safeguards.

Mr. Bilirakis. Now, the IG sir, I keep coming back to you because I

keep thinking that you have, or should have maybe, more authority. 

Again, in your case, what is it? You uncover things that go wrong and

you make, what, you make recommendations, then?

Mr. Staley. Yes, sir. At the conclusion of our audits we make a 

series of recommendations to the Department. The leadership in the 

Department is responsible for implementing those recommendations. 

We have a follow-up system to determine whether their implementation plans are adequate and, again, if the recommendations are not 

implemented, we report them as such.

Mr. Bilirakis. You report them to, again, going back.

Mr. Staley. They are in our semiannual report to Congress and to 

the Secretary. And we leave them open and we continue to ask the 

Department for corrective action.

Mr. Bilirakis. Mr. Chairman, again, we can talk about details here, 

but I am not sure even -- we come up with legislation and we come up 

with laws and we mandate certain things and whatnot, but we are 

awfully busy people, despite the fact that we have oversight subcommittees. We are awfully busy people and we go off to maybe fight

another fire or whatever the case might be. So it still comes down,

I think, to culture and the mental state of the people who should be 

doing this job.

 I do not really have any hope, I do not care how many hearings 

we hold, that any of that is going to change until the culture basically changes in the VA and the other organizations, here in this committee where our concern is the VA. It has always been my biggest 

concern ever since I have been in the Congress. It is disappointing. 

Thank you, Mr. Chairman.

The Chairman. Thank you, Mr. Bilirakis.

 Ms. Koontz, I have to go back to the issue on GAO and what actions 

are taken when there is a Department that may not act. Have you 

ever seen any other Department or agency of government not act on 
32

your recommendations with regard to IT?

Mr. Wilshusen. Well, I would also just like to say with regard to 

VA, that on many of our recommendations that they have taken corrective actions, usually on the specific, detailed, technical control

findings that we would identify. I do not want to leave the impression that they have not done anything. But with regard to the larger 

recommendations related to implementing an entitywide security 

program, their efforts have fallen short in that area.

  Other agencies where we have conducted repeatable work, we find

similar situations where we can make a number of detailed technical 

findings and recommendations. And often they will act on those, but

it is more in terms of acting proactively and taking what they learned 

in terms of the identified findings and seeing if they exist elsewhere

where they fall short. And again it often comes down to not having implemented an information security program agencywide. And, 

yes, those incidents do occur where we have made recommendations, 

and they have not yet fully implemented them.

The Chairman. Tomorrow in the Commerce Committee under part 

of Mr. Bilirakis’ leadership, along with Nathan Deal and Sherrod 

Brown, on a bipartisan basis, we are going to deal with the health 

record and the security of the health record and these kind of issues. 

We are going to create a position for a national coordinator within 

HHS so that we move toward more of a standardization with regard 

to plans and policies programmatics with the health record.

 And so it is interesting. We are going to try to create that czar over 

the health record to make sure that everybody -- and we moved to 

centralized -- so here we are, Mr. Bilirakis and I, on the Commerce 

Committee, yet we are not going to defend a stovepipe. The stovepipe 

in this case would be our jurisdiction of the VA.

 So when Mr. Bilirakis talks about the turf and everybody defending the turf, we are going to have to move toward the empowerment 

of this national coordinator to make sure it all gets implemented so 

we are not decentralized. So as we talk about centralized, what I see 

is that is the trend line, that is where everybody is going.

 I asked staff, Ms. Koontz, to give up the August 1, 2003, memorandum from the general counsel that was read by Mr. Michaud. I

give it to you because as you look at this question for us with regard 

to general counsel and the interpretation of the FISH bill, this is on 

August 1, 2003, they make a holding that is completely different than 

the April 2004. So it is almost like what happened over the year? So

it will be interesting, the way to get into this. And we will be having 

Admiral Goss and Bob McFarland will both come in and give their 

testimony about what happened.

 These were two individuals who were attempted to have been empowered, and then their authorities were taken away and we have 
33

ended up with this mess. I think it is clear to the American people 

that this loss of data was not caused by just the negligent act of just 

one person. We have a systemwide meltdown of information management systems, and what we are going to do here in Congress is move 

a package that attempts to not only take actions to assist the veterans 

but also what can we do with regard to implementation down at VA?

 I want to thank you for your leadership. We look forward to looking to your report. And, Ms. Koontz I have a feeling that you will be 

back before us soon. This hearing is now concluded.

  [Whereupon, at 12:15 p.m., the committee was adjourned.]
(34)

APPENDIX

34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82