U.S. GOVERNMENT PUBLISHING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Publishing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

25–501 PDF 2017

U.S. DEPARTMENT OF EDUCATION: 

INVESTIGATION OF THE CIO 

HEARING 

BEFORE THE

COMMITTEE ON OVERSIGHT 

AND GOVERNMENT REFORM 

HOUSE OF REPRESENTATIVES 

ONE HUNDRED FOURTEENTH CONGRESS 

SECOND SESSION 

FEBRUARY 2, 2016 

Serial No. 114–131 

Printed for the use of the Committee on Oversight and Government Reform 

( 

Available via the World Wide Web: http://www.fdsys.gov 

http://www.house.gov/reform 


KING-6430 with DISTILLER
(II) 

COMMITTEE ON OVERSIGHT AND GOVERNMENT REFORM 

JASON CHAFFETZ, Utah, Chairman 

JOHN L. MICA, Florida 

MICHAEL R. TURNER, Ohio 

JOHN J. DUNCAN, JR., Tennessee 

JIM JORDAN, Ohio 

TIM WALBERG, Michigan 

JUSTIN AMASH, Michigan 

PAUL A. GOSAR, Arizona 

SCOTT DESJARLAIS, Tennessee 

TREY GOWDY, South Carolina 

BLAKE FARENTHOLD, Texas 

CYNTHIA M. LUMMIS, Wyoming 

THOMAS MASSIE, Kentucky 

MARK MEADOWS, North Carolina 

RON DESANTIS, Florida 

MICK MULVANEY, South Carolina 

KEN BUCK, Colorado 

MARK WALKER, North Carolina 

ROD BLUM, Iowa 

JODY B. HICE, Georgia 

STEVE RUSSELL, Oklahoma 

EARL L. ‘‘BUDDY’’ CARTER, Georgia 

GLENN GROTHMAN, Wisconsin 

WILL HURD, Texas 

GARY J. PALMER, Alabama 

ELIJAH E. CUMMINGS, Maryland, Ranking 

Minority Member 

CAROLYN B. MALONEY, New York 

ELEANOR HOLMES NORTON, District of 

Columbia 

WM. LACY CLAY, Missouri 

STEPHEN F. LYNCH, Massachusetts 

JIM COOPER, Tennessee 

GERALD E. CONNOLLY, Virginia 

MATT CARTWRIGHT, Pennsylvania 

TAMMY DUCKWORTH, Illinois 

ROBIN L. KELLY, Illinois 

BRENDA L. LAWRENCE, Michigan 

TED LIEU, California 

BONNIE WATSON COLEMAN, New Jersey 

STACEY E. PLASKETT, Virgin Islands 

MARK DESAULNIER, California 

BRENDAN F. BOYLE, Pennsylvania 

PETER WELCH, Vermont 

MICHELLE LUJAN GRISHAM, New Mexico 

JENNIFER HEMINGWAY, Staff Director 

KATIE BAILEY, Government Operations Subcommittee Staff Director 

MICHAEL FLYNN, Counsel 

SHARON CASEY, Deputy Chief Clerk 

DAVID RAPALLO, Minority Staff Director 


KING-6430 with DISTILLER
(III) 

C O N T E N T S 

Page 

Hearing held on February 2, 2016 ......................................................................... 1 

WITNESSES 

Mr. Danny A. Harris, Chief Information Officer, U.S. Department of Education 

Oral Statement ................................................................................................. 6 

Written Statement ............................................................................................ 9 

Ms. Sandra Bruce, Deputy Inspector General, U.S. Department of Education 

Oral Statement ................................................................................................. 13 

Written Statement ............................................................................................ 15 

Ms. Susan Winchell, Assistant General Counsel for Ethics, U.S. Department 

of Education 

Oral Statement ................................................................................................. 21 

Written Statement ............................................................................................ 23 

Mr. John B. King, Jr., Acting Secretary, U.S. Department of Education 

Oral Statement ................................................................................................. 29 

Written Statement ............................................................................................ 31 

APPENDIX 

RESPONSE from Mr. King ED to Questions for the Record ............................... 90 

RESPONSE from Ms. Winchell ED to Questions for the Record ........................ 92 


KING-6430 with DISTILLER

KING-6430 with DISTILLER
(1) 

U.S. DEPARTMENT OF EDUCATION: 

INVESTIGATION OF THE CIO 

Tuesday, February 2, 2016 

HOUSE OF REPRESENTATIVES, COMMITTEE ON OVERSIGHT AND GOVERNMENT REFORM, Washington, D.C. 

The committee met, pursuant to call, at 10:02 a.m., in Room 

2154, Rayburn House Office Building, Hon. Jason Chaffetz [chairman of the committee] presiding. 

Present: Representatives Chaffetz, Mica, Walberg, Amash, 

DesJarlais, Farenthold, Lummis, Meadows, DeSantis, Mulvaney, 

Buck, Walker, Blum, Carter, Hurd, Palmer, Maloney, Norton, Clay, 

Connolly, Kelly, Lawrence, Lieu, Plaskett, and Lujan Grisham. 

Chairman CHAFFETZ. The Committee on Oversight and Government Reform will come to order. Without objection, the chair is authorized to declare a recess at any time. 

This is a follow-up to our November 17, 2015, hearing, and as 

part of my opening remarks, I would actually like to yield to the 

gentleman from Texas, Mr. Hurd. 

Mr. HURD. Thank you, Mr. Chairman. 

Last November, I said in my opening remarks that the challenges facing the Department in the area of cybersecurity were not 

only technical in nature. The tools to address these issues already 

exist, whether it be continuous monitoring, EINSTEIN, or multifactor authentication. The list goes on. The technology is here. 

Cybersecurity for the Federal Government is a matter of quality 

management and effective leadership, not just tech, and I am 

pleased to see not only Mr. Harris back before this committee today 

but also Acting Secretary King. 

Because cybersecurity and information technology are issues that 

must be addressed not only by the CIO’s office but also by the 

agency head. Implementation of FITARA and ensuring FISMA 

compliance are issues agency heads need to know about. 

Agencies can’t treat data centers, multifactor authentication, and 

legacy technologies as something just for the CIO staff. 

Cybersecurity and IT management are mission-critical infrastructure. They are as much a part of the agency’s mission as student 

aid. 

And who is ultimately accountable for IT and cybersecurity 

issues? The answer isn’t only Mr. Harris and his team in the OCIO 

shop. It is also you, Mr. King. 

My amendment was included in the Student Success Act, which 

restated the intent of Congress that students’ PII was of the utmost importance to protect. This committee will continue to hold 


KING-6430 with DISTILLER
2 

agencies responsible for the state of our agencies’ information technology and cybersecurity posture. 

The good news for the Department of Education and really the 

American people is that we aren’t here today to discuss a massive 

data breach involving millions of Americans’ PII. We are here 

today, however, to examine whether we have the management in 

place at the Department of Education to handle this crucial challenge. We need to ensure that this is the leadership team that can 

put the tools and processes in place to ensure that we aren’t back 

here again in a month or two talking about a data breach at the 

Department of Education. 

Thank you, Mr. Chairman, and I yield back. 

Chairman CHAFFETZ. I thank the gentleman. 

This is a very important hearing. In the IT sector, it is absolutely 

critical that we secure our data. We have seen the data breaches 

of huge proportions in the private sector; we have seen them at the 

White House, the Department of State, Internal Revenue Service, 

and certainly the Office of Personnel Management. 

Like these agencies, the Department of Education is a prime target. It houses the personal information of more than 139 million 

Americans. The data breach at the Office of Personnel Management was something like 22 million, but there are 139 million 

Americans that would be affected by a data breach at the Department of Education. 

We also need to remember that the Department of Education 

also oversees a student loan portfolio of more than $1.2 trillion. 

This puts it on the proportion of Citibank and other major financial 

institutions. It is critical because taxpayers deserve the best in our 

chief information officer, and they are not getting the best at the 

Department of Education. 

The inspector general testified recently the Department continues to be vulnerable to security threats and has repeatedly 

failed to implement the recommendations and failed to detect 

friendly hacks into their system. The Department scored a negative—it was one of just a handful of agencies—but a negative 14 

percent on the Office of Management and Budget’s cyber sprint. 

Cyber sprint was intended to get government-wide, get them up to 

speed, put more security in place, and yet the Department of Education was one of a handful of agencies that actually scored negative on that. And they received an F in the FITARA scorecard. This 

is a self-reported score, and they scored an F. 

Mr. Harris has served as the chief information officer since 2008, 

and by virtually every metric, he is failing to adequately secure the 

Department’s systems. 

The committee’s concerns were further amplified after learning 

Mr. Harris was investigated for possible criminal and administrative misconduct. The IG closed its investigation a few months ago, 

finding that the CIO potentially broke 12 Federal laws, regulations, 

and/or agency directives. But the Department of Justice refused to 

prosecute. That is a mystery to us. We don’t understand why they 

would not prosecute such wide use and abuse of the system. 

Mr. Harris was running two side businesses he intentionally 

failed to disclose on federally required ethics forms—a home theater installation business, a car detailing business—and inapproVerDate Nov 24 2008 14:16 Jun 22, 2017 Jkt 000000 PO 00000 Frm 00006 Fmt 6633 Sfmt 6633 H:\25501.TXT APRIL

KING-6430 with DISTILLER
3 

priately used agency resources and most likely agency time. Mr. 

Harris also admitted to the inspector general he did not report the 

income to the Internal Revenue Service. Now, most Americans 

would get in trouble for this type of situation, basically hiding information from the IRS. 

Additionally, the inspector general raised serious allegations that 

Mr. Harris influenced a government contract. As a high-ranking 

public official, Mr. Harris played a role in awarding and oversight 

in contracts to a close friend’s company. 

Equally disconcerting are the anonymous tips that the inspector 

general described Mr. Harris’s leadership as intimidating. This investigation started because people within the Department of Education expressed concern as whistleblowers, and the morale in the 

office of the CIO is an all-time low due to a dysfunctional environment that Mr. Harris has cultivated. 

Let me put up the first—the chart. There we go. 

[Slide.] 

Chairman CHAFFETZ. We rely heavily upon a disinterested third 

party to come in and evaluate. These are 14 metrics in the Office 

of the CIO at the Department of Education. Every single score is 

going down. Every single one of those is negative. And the Office 

of the Chief Information Officer at the Department of Education 

scored 285 out of 320, near the very bottom of his class. 

You can take that chart down. 

Look at the turnover rate for the IT staff within the Department 

of Education. Fiscal year it was down—it was 5 percent. Turnover 

rate in fiscal year 2014 was 6 percent. Turnover rate in 2015 was 

10 percent. It is a key metric in an understanding that maybe 

things aren’t very good in that department. Every key metric is 

down. They are scoring an F on their scorecard. 

You have got an IG who is making a recommendation for criminal prosecution with the Department of Justice, and what does the 

Department of Education do? They give him bonuses. More than 

$200,000 in bonuses Mr. Harris got over the last 10 years. And I 

want to know why. We have got good quality people working at the 

Department of Education, and we have got something wrong going 

on in that department and we are bonus-ing him up? That makes 

absolutely no sense. 

Mr. Harris came and testified before this committee in November. I asked him a basic question about IT. Are you using COBOL? 

COBOL was instituted in the 1960s. The answer was no, we are 

not using it. It ends up they have more than 1 million lines of code 

in the Central Processing System, also in the National Student 

Loan Database. So he is off with these other businesses getting 

subordinates to do the work, taking bonuses, has three other jobs, 

and we are giving him bonuses. 

Every single metric is going down, scoring an F on the scorecard, 

there is a vulnerability, and there is 139 million people who are at 

risk. We don’t have time to play these kind of games. This is exactly what the Oversight and Government Reform Committee is all 

about. 

Mr. Harris has had roles as an adjunct professor at Howard University, consulting for the Detroit public schools. He does IT conVerDate Nov 24 2008 14:16 Jun 22, 2017 Jkt 000000 PO 00000 Frm 00007 Fmt 6633 Sfmt 6633 H:\25501.TXT APRIL

KING-6430 with DISTILLER
4 

sulting services for the city of Detroit. Congratulations. You don’t 

have time to do that stuff. 

Simply put, when the CIOs fail to bring high management and 

ethical standards to their work, institutions suffer, systems are 

weakened, and the data of millions of Americans are in danger. 

For all the wrongdoing here, I am telling you there are a lot of 

good people who rely on the Department of Education. They work 

there. There are people at home in every State and every corner 

of our country who rely on this. But you know what? There are 10, 

10 senior officials at the Department of Education under investigation right now. Mr. Harris is one of them. Bob Shireman is another 

one. Who are the other ones? Because this is an agency that has 

to function. If we are going to pour the billions of dollars in it, they 

have got to deal with it ethically. But we are looking at a situation 

here that is not going well, and that is why we have the hearing 

here today. 

Chairman CHAFFETZ. With that, I will now recognize the ranking 

member. We are glad to have Ms. Plaskett filling that role today. 

And we will now recognize her. Thank you. 

Ms. PLASKETT. Thank you very much, Mr. Chairman. Thank you 

all for being here this morning. 

It is critical that all Federal employees meet the highest ethical 

standards and avoid even the appearance of impropriety. It is 

therefore essential that agencies take swift and appropriate action 

upon learning that one of their employees has engaged in either 

misconduct or exercised poor judgment in their work. 

In this instance, the Department of Education’s inspector general 

conducted a thorough investigation into allegations of wrongdoing 

involving the Department’s chief information officer, Mr. Danny 

Harris. In doing so, the IG dismissed some of those allegations as 

unsubstantiated and suggested that others ‘‘may have violated Federal laws, regulations, and departmental directives.’’ 

Now, while the IG’s report of investigations indicated that the 

CIO, Mr. Harris, may have violated Federal laws, it appears that 

law enforcement authorities who examined the alleged misconduct 

did not find any criminal wrongdoing after their investigation. That 

being said, the IG reports a series of errors in judgment by the CIO 

that raised valid questions about his ethical conduct. 

For example, though the IG did not find that the CIO influenced 

the Department’s contracting process, the IG did find that the CIO 

had ‘‘participated in awarding Department contracts to a company 

while having a personal relationship with the company’s owner.’’ 

We definitely need to ask you about that. 

The IG also found that, for a period of time, the CIO used his 

subordinate staff to help him run a home theater installation and 

car detailing business. While the IG did not identify anything prohibiting the CIO from running these businesses during non-work 

hours, the CIO’s decision to use both subordinate employees and 

failure to report the earned income from that work shows, at a bare 

minimum, poor judgment on his part. 

While the Department cannot identify any specific policies or 

procedures that the CIO had violated, it took corrective action, including mandating that he undergo at least four in-person counVerDate Nov 24 2008 14:16 Jun 22, 2017 Jkt 000000 PO 00000 Frm 00008 Fmt 6633 Sfmt 6633 H:\25501.TXT APRIL

KING-6430 with DISTILLER
5 

seling sessions, as well as receive formal written ethical guidance 

going forward. 

Since those counseling sessions, the CIO has reportedly taken 

the necessary steps to correct the deficiencies the IG found, and 

most importantly, since 2012, the CIO has not engaged in any of 

the ethically questionable behavior that the IG raised in the investigation. 

The fact that the CIO is no longer engaged in questionable conduct is nothing to celebrate. As a senior official in the Department, 

the CIO holds a critical leadership role, and as such, is expected 

to set a positive tone and example for the employees he supervises. 

If the Department employees cannot trust their CIO is guided by 

the highest ethical standards at all times, what message does that 

send in the Department of Education? It must be made clear that 

even borderline ethical conduct will not be tolerated by your department. 

I look forward to hearing directly from the Acting Secretary of 

the Department, Mr. King, John King, and the CIO himself, Mr. 

Danny Harris, who is here, on what steps they have taken to ensure that an appropriate tone is set for all employees at the department and what specific policies have been put in place, along with 

procedures to assure that these types of actions will not occur 

again. 

Given the critical role of the CIO in the Department’s IT security, valid questions may be raised today about his effectiveness in 

light of not only the IG’s report but prior audits the IG conducted 

on the adequacy of the Department’s IT security. Those audits were 

examined at length by this committee during a hearing it held this 

past November on the state of the Department’s cybersecurity. I expect that we will hear today from the CIO not only on an update 

of any improvements and progress the Department has made in 

cybersecurity since the hearing, but also his vision, your vision, Mr. 

Harris, and plan for strengthening Department’s overall information system. 

Thank you, Mr. Chairman. 

Chairman CHAFFETZ. Thank you. And we will hold the record 

open for 5 legislative days for any members who would like to submit a written statement. 

We will now recognize our witnesses. Mr. Danny Harris currently serves as the chief information officer of the United States 

Department of Education, a role he has served in since 2008. Prior 

to his current position, Mr. Harris served as deputy chief financial 

officer for 5 years. In his capacity, he was responsible for contract 

administration, grant management, accounting, risk management, 

internal controls, internal travel, and financial management systems. 

Ms. Sandra Bruce currently serves as the deputy inspector general of the United States Department of Education, and she has 

more than 30 years of experience directing, overseeing, and managing complex audit inspections and investigative-related programs. 

Ms. Susan Winchell has served as the assistant general counsel 

for ethics at the United States Department of Education since 

2007. Ms. Winchell previously served as the deputy assistant genVerDate Nov 24 2008 14:16 Jun 22, 2017 Jkt 000000 PO 00000 Frm 00009 Fmt 6633 Sfmt 6633 H:\25501.TXT APRIL

KING-6430 with DISTILLER
6 

eral counsel and is the associate general counsel at the U.S. Office 

of Government Ethics. 

Mr. John King currently serves as the Acting Secretary of Education, a position he assumed in January of 2016. Before becoming 

Acting Secretary, Mr. King had served since January of 2015 at the 

Department as the principal senior advisor. This is Mr. King’s first 

time testifying before our committee, and we welcome you here 

today. Thank you for joining us. 

Pursuant to committee rules, all witnesses are to be sworn before 

they testify. If you will please rise and raise your right hand. 

[Witnesses sworn.] 

Chairman CHAFFETZ. Thank you. Please be seated. Let the 

record reflect that the witnesses all answered in the affirmative. 

In order to allow time for discussion, we would appreciate if you 

would please limit your oral testimony to 5 minutes, and your entire written statement will be made part of the record. 

Mr. Harris, you are now recognized for 5 minutes. 

WITNESS STATEMENTS 

STATEMENT OF DANNY A. HARRIS 

Mr. HARRIS. Thank you. Chairman Chaffetz, Ranking Member 

Plaskett, and members of the committee, thank you for giving me 

the opportunity to share with you my response to the allegations 

raised and investigated by the Department’s inspector general. 

I’ve been proud to serve the public for the last 32 years at the 

Department of Education. However, in light of the IG’s investigation and the counseling I received from the Office of the Deputy 

Secretary and the Office of the General Counsel at the Department, 

I fully understand and I take full responsibility for how some of my 

actions could allow questions to arise about my judgment. I view 

my behavior as unacceptable and I have learned from this experience. 

Before I address the topic of this hearing, I’d like to provide the 

committee with an update on the progress on cybersecurity since 

the last time I sat before you in November. Since that time, the Department has enhanced its progress by standing up an Integrated 

Project Team that will be tracking all corrective action plans tied 

to FISMA or financial statement audits. The team is made up of 

the general counsel, myself, the deputy CIO, FSA chief operating 

officer, and the FSA CIO. I believe focusing this level of attention 

by senior members of the agency will help ensure we meet our targets. 

The team will meet on a weekly basis to ensure that all corrective actions are resolved based on the dates provided to and agreed 

upon by the IG. The team will be paying particular attention to 

any items associated with the Department’s high value assets, as 

well as items listed as repeat findings. 

With respect to the IG’s investigation, I have promptly and fully 

cooperated with the investigation. While I was not provided with 

a list of specific accusations against me, based on the questions 

during the investigation and the counseling I received, I understand that some concerns were expressed about my interactions 

with subordinate employees. 


KING-6430 with DISTILLER
7 

My management style is to make an—take an interest in and 

care about my colleagues and subordinates. I’ve been blessed with 

the opportunity to work with many outstanding individuals and 

even more blessed to have formed a friendship with some of the 

employees at the Department. 

Again, based on questions during the investigation and the counseling I received, I believe that concerns were raised about my conduct with respect to my hobbies. This is, in my personal time, I 

enjoy detailing cars. Additionally, prior to the investigation, I had 

also enjoyed installing audio/video equipment. My staff members at 

the Department were aware of these hobbies, and two of these individuals in particular were interested in learning more about these 

activities. I now realize that by including them in my hobbies, for 

which they were compensated, I used poor judgment. 

With regard to helping others on my team with home projects, 

I now understand that that could be misconstrued. Each request by 

staff was predicated by them approaching me and expressing an interest in benefiting from my experience. 

I think it is important to note that while I did not view these 

activities as a business, I nevertheless understand how it could be 

perceived. Therefore, I have ceased to install any audio/video equipment or engage in activities with staff where there is compensation. The last time I performed work related to installing audio/ 

video equipment for anyone and accepted compensation was in 

2012. 

The IG investigators also asked me questions related to the employment of a relative. My relative used the standard process to 

apply for a vacant position, and I had no part in the application 

process. The relative did not report to me or anyone working in my 

supervision. As I confirmed for the IG investigator, I did inquire 

with some colleagues whether they had openings in their office, 

and my relative is no longer working at the agency. 

With respect to my relationship with the owner of a vendor that 

performed work with the agency, I acknowledge that I did develop 

a personal relationship with the vendor around 2008. As CIO, I did 

not and do not have a role in determining who will be awarded contracts. At no time did I advocate for this vendor or ask staff to 

treat this vendor any differently than other vendors. I have also 

ended my personal relationship with the vendor effective February 

2013. 

After cooperating with the IG investigators, I was counseled by 

then-Deputy Secretary Tony Miller in 2013, and later counseled by 

the ethics attorney Susan Winchell and Deputy Secretary Shelton 

and King. I also received a written counseling memo. I took each 

of these sessions very seriously, and immediately following my initial counseling, consulted any records I had with respect to my 

hobby and amended my tax returns to the IRS for 2008 through 

2010. I determined I had no additional income for 2011 and reported the additional income on my 2012 tax returns and my form 

278. The updated returns reflected a nominal increase, of which 

was roughly 1 to 2 percent increase of my total household income. 

I have benefitted from the counseling of three deputy secretaries, 

as well as by the agency’s lead attorney for the ethics division, 

Susan Winchell. While, at the time, I did not view my actions to 


KING-6430 with DISTILLER
8 

be in violation of any laws, regulations, or policies, I do appreciate, 

however, that others viewed my conduct as questionable. I have 

severed my personal relationship with one vendor which I had developed a friendship. I no longer participate in activities related to 

installing audio/visual equipment, and I do not accept funds for detailing cars. 

I appreciate the opportunity to answer any questions you may 

have about the testimony. Thank you. 

[Prepared statement of Mr. Harris follows:] 


KING-6430 with DISTILLER
9 


KING-6430 with DISTILLERInsert offset folio 1 here 25501.001

Testimony of Danny Harris, Chief Information Officer 

U.S. Department of Education 

Before the 

U.S. House of Representatives Committee on Oversight and Government Reform 

"U.S. Department of Education: Investigation of the CIO" 

February 2, 2016 

Chairman Chaffetz, Ranking Member Cummings and Members of the Committee, thank you for 

giving me the opportunity to share with you my response to the allegations raised and 

investigated by the Department's Inspector General (IG). 

Background 

I have been proud to serve the public for the last 32 years at the Department of Education and 

believe I have conducted myself in an ethical ma1mer at all times. However, in light of the IG's 

investigation and the counseling I received from the Office of the Deputy Secretary (ODS) and 

the Office of the General Counsel (OGC) at the Department, I fully understand and take 

responsibility for how some of my actions could allow questions to arise about my impartiality. 

This is unacceptable. I have learned from this experience, however, and to eliminate any such 

questions, I have assured my supervisors at the Department, and I want to also state 

unequivocally today, that I have not engaged in any of the actions that raised questions since 

prior to the IG's investigation. The actions I took showed that I used poor judgment and I deeply 

regret those actions. 

Update on Progress Made Regarding Cyber Security 

Before I address the topic ofthis hearing, I'd like to provide the Committee with an update on a 

process we have put in place as part of the progress on cyber security we have made since the 

last time I sat before you in November. As I stated during my testimony last fall, I am 

committed to ensuring that the Department reaches our goals to continually improve our 

cybersecurity and we continue to make progress on those plans. I appreciate the work of the 

Inspector General in this area as the office has benefitted from her assessment and 

recommendations on how to improve. Since November, the Department has made progress in a 

number of areas, which I would be pleased to discuss further, but in particular: 

The Department has stood up an Integrated Project Team that will be tracking all Corrective 

Action Plans tied to FISMA or Financial System Audits. The team is made up of the General 

Counsel (delegated the duties of the Deputy Secretary), myself, Deputy CIO, FSA Chief 

1 
10 


KING-6430 with DISTILLERInsert offset folio 2 here 25501.002

Operating Officer and the FSA CIO. The team will meet on a weekly basis to ensure that all 

corrective actions are resolved based on the dates provided to and agreed upon with the OIG. 

The team will be paying particular attention to any items associated with the Department High 

Value Assets as well as items listed as repeat findings. This team has been charged by Acting 

Secretary King with ensuring that all corrective actions are resolved, but also that root causes and 

systemic weaknesses are identified and addressed, and I intend to ensure that happens. 

The IG's Investigation 

At every stage of the IG's investigation, I have promptly and fully cooperated with the 

investigation. I was interviewed in February of2013, and then again in April of2013, and 

during those interviews I answered their questions truthfully and without hesitation. At no time 

did I attempt to hinder or impede the IG's work. 

While I was not provided with a list of specific accusations against me, based on the questions 

during the investigation and the counseling I received, I understand that some concerns were 

expressed about my interactions with subordinate employees. My management style is to take 

an interest in and care about my colleagues and subordinates. I have been blessed with the 

opportunity to work with many outstanding individuals and even more blessed to have formed a 

friendship with some of the employees at the Department. I have tried my best to mentor staff 

when they have asked for my guidance and to help employees grow professionally whether that 

means developing skills for the job they are in or should they have an interest in areas outside of 

the office. I understand now that those actions could be viewed as showing favoritism. While I 

continue to mentor staff, I have modified my behavior so as not to create an appearance of 

favoritism. At no time, however, did my personal relationships cloud my professional judgment. 

The Department of Education has very strict rules and safeguards to ensure that an unbiased 

review is done of all candidates prior to consideration for promotion or hire and I can tell you 

emphatically that those guidelines were followed at all times. 

Again, based on the questions during the investigation and the counseling I received, I believe 

that concerns were raised by the investigation about my conduct with respect to that in my 

personal time I enjoy detailing cars, and that prior to the investigation, I had also enjoyed 

installing audio/visual equipment. Many staff members at the Department were aware of these 

hobbies and two individuals in particular were interested in learning more about these activities. 

As I shared above, I do my best to work with my staff to help them gain new skills. I came to 

realize that by including them in these activities, for which they were compensated, I used poor 

judgment. 

With regard to helping others on my team with home projects, I also carne to understand how 

that could have been misconstrued. Each interaction with staff was predicated by them 

2 
11 


KING-6430 with DISTILLERInsert offset folio 3 here 25501.003

approaching me and expressing an interest in benefiting from my experience. I think it is 

important to note that while I did not view these activities as a business, I nevertheless 

understand how it could be perceived; therefore I have ceased to install any audio/visual 

equipment for staff or engage in activities with staff in which there is any exchange of funds. 

The last time I performed work related to installing audio/visual equipment for anyone was in 

2012, and I do not accept any funds for detailing cars. 

The IG investigators also asked me questions related to the employment of a relative in another 

office within the Department. As I confirmed for the IG investigator, I did inquire with some 

colleagues about whether they had any openings in their office. I was pleased when I learned my 

relative was successful in the application for the position as I have enjoyed working for the 

federal government and believed my relative would find the experience rewarding. I'd also like 

to share that the position was a term-limited position and the relative is no longer working at the 

agency. 

After cooperating with the IG investigators, I was counseled by then-Deputy Secretary Tony 

Miller in 2013. After this counseling, I consulted any records I had with respect to my hobby and 

amended my tax returns to the IRS for 2008-2010, determined I had no additional income for 

2011 and reported the additional income on my 2012 tax returns. The updated returns reflected 

an increase of roughly 1-2 %of my total household income. 

With respect to my relationship with the owner of a vendor that performed work with the agency, 

I acknowledged that relationship but want to be very clear about when that relationship 

developed and also about the nature of my role in the agency's procurement process. The 

process, which is used to determine successful bidders, is done through another office within the 

agency over which I do not have control. As CIO, I did not and do not have a role in 

determining who will be awarded contracts. There was a period of time during which I worked 

in the office that does have responsibility for awarding contracts and I was on a review panel 

which ultimately determined to award a contract to this vendor but that was several years prior to 

my developing a personal relationship with the owner of the vendor and I was one of three 

individuals who made recommendations but did not have the final determination on which 

vendor was awarded the contract. My personal relationship with the individual developed 

several years after that date and occurred around when I moved in 2008 to a new neighborhood 

and discovered the individual lived nearby. After running into one another in the neighborhood 

several times we discovered we had many common interests outside of the workplace and the 

friendship developed. 

At no time did I advocate for this vendor or ask staff to treat this vendor any differently than 

other vendors. I also ended my personal relationship with the vendor in February 2013. 

3 
12 


KING-6430 with DISTILLERInsert offset folio 4 here 25501.004

Moving Forward 

I have benefitted from the counseling of two Deputy Secretaries- Tony Miller, and Jim Shelton, 

and John King, who at the time was delegated the functions and duties of the Deputy Secretaryas well as by the agency's lead attorney for the Ethics Division Susan Winchell. Ms. Winchell 

provided counseling at an in-person meeting and in writing. While at the time I took them, I did 

not view my actions to be inappropriate, the investigation and counseling led me to appreciate 

how others might have viewed my conduct as questionable, and how in retrospect, I should have 

exercised better judgment. As noted, I have severed my personal relationship with the owner of 

the vendor in question. I no longer install audio/visual equipment, do not accept funds for 

detailing cars, amended the applicable tax returns, and where it was appropriate, included the 

relevant income on my financial disclosure form. 

I appreciate the IG's looking into these issues and raising them to my superiors and myself to 

allow me to perform to the best of my ability and in the best interest of the agency. I have 

learned from this experience and vow to do everything I can to show myself to be of the highest 

integrity and honor. I am proud of the service I have been able to provide to the agency and 

want to continue to serve the American people. I know that as the CIO, others look to me to 

demonstrate the best behavior possible and I am sorry ifi have given any of my co-workers or 

supervisors or anyone else a reason to doubt my integrity. 

I'd appreciate the opportunity to answer any questions you may have about my testimony. 

4 
13 

Chairman CHAFFETZ. Thank you. 

Ms. Bruce, you are now recognized for 5 minutes. 

STATEMENT OF SANDRA BRUCE 

Ms. BRUCE. Chairman Chaffetz, Ranking Member Plaskett, and 

the members of the committee, thank you for inviting me here 

today to discuss the Department of Education Office of Inspector 

General investigation of Dr. Danny Harris, the Department’s chief 

information officer. 

As detailed in my written testimony, in 2011 and 2012, the OIG 

received two anonymous complaints concerning allegations of criminal and administrative misconduct by Dr. Harris. The complaints 

included allegations that Dr. Harris improperly awarded contracts 

to a company owned by his personal friend, operated a home theater installation business with a subordinate employee, and solicited other Department employees to perform work for this business. 

During our investigation, we learned of additional complaints alleging that Dr. Harris operated a business detailing cars where he 

employed subordinate employees to assist with the detailing work 

and also accepted payments from subordinate employees for detailing their cars; instructed a subordinate employee to purchase products from eBay for his home theater business and sold items on 

eBay using the subordinate’s account, splitting the proceeds with 

the subordinate, and further used his Department email account to 

conduct these transactions; appeared to have advocated for a relative’s employment within the Department; and appeared to have 

made a $4,000 personal loan to one of his subordinate staff. 

By April 2013, our investigation had substantiated most of these 

allegations. Our investigation determined that Dr. Harris operated 

outside business ventures involving home theater installation and 

car detailing with members of his subordinate staff; had business 

cards and received payments from subordinate employees for services provided by those ventures. 

Dr. Harris informed us that the home theater installation venture generated at least $10,000 in income, which exceeded the $200 

annual threshold that required reporting on the Public Financial 

Disclosure Report, Office of Government Ethics form 278. Dr. Harris admitted that he did not report the income on the required 

forms during the relevant time periods. 

The Department’s designated ethics official informed the OIG 

that Dr. Harris not reporting the income on his ethics forms was 

a problem that needed to be referred to the U.S. Attorney’s Office. 

Dr. Harris also advised that he did not report this income on his 

taxes and acknowledged that he probably should have done so. 

Our investigation also determined that Dr. Harris used his Department email account to conduct his outside business ventures. 

Participated on a panel that awarded a contract to a company 

owned by someone he had a personal relationship with. His participation, however, did not result in that contract being improperly 

awarded 

Took actions to help a relative secure employment within the Department. The relative was employed at the GS–4 level from 2010 

to 2013. 

Made a loan—a $4,000 loan to one of his subordinate staff. 


KING-6430 with DISTILLER
14 

We received conflicting information regarding the allegation that 

Dr. Harris instructed a subordinate employee to purchase products 

from eBay for his home theater business. Dr. Harris stated that the 

purchase was for his personal use. The employee stated the purchase related to the home theater installation business. 

As our criminal investigation into the allegations against Dr. 

Harris continued, we provided a report of our initial findings to the 

Department so that it could take appropriate administrative action 

against Dr. Harris. The OIG also made a referral to the Internal 

Revenue Service regarding Dr. Harris’s failure to report all of his 

income on his income tax returns. 

In February 2015, the U.S. District Attorney’s Office for the District of Columbia declined prosecution of all issues based on the 

availability of administrative remedies. In March, we submitted 

another report to the Department noting the U.S. attorney’s decision. 

In June 2015, the acting deputy secretary responded to our report stating that, overall, the Department found no violation of law 

or regulation. Instead, the acting deputy secretary said that he believed Dr. Harris displayed certain lapses in judgment, which were 

addressed through counseling provided by the two prior deputy secretaries and the acting deputy secretary, and also guidance provided by the Department’s ethics official. 

We closed our investigation administratively in September 2015. 

This concludes my remarks, and I am happy to answer your 

questions. 

[Prepared statement of Ms. Bruce follows:] 


KING-6430 with DISTILLER
15 


KING-6430 with DISTILLERInsert offset folio 5 here 25501.005

Statement of Deputy Inspector General Sandra D. Bruce 

U.S. Department of Education 

Before the Committee on Oversight and Government Reform and the 

United States House of Representatives 

February 2, 2016 

Chairman Chaffetz, Ranking Member Cummings, and the members of the Committee on 

Oversight and Government Reform: 

Thank you for inviting me here today to discuss the U.S. Department of Education (ED) 

Office oflnspector General (OTG) investigation of Dr. Danny A. Harris, ED's Chieflnformation 

Officer. Before I discuss this investigation, I would like to provide you with background 

information on our investigative operations. 

The ED OIG was established in 1980, charged with promoting integrity, efficiency, and 

effectiveness in Federal programs and operations. We are also responsible for detecting and 

preventing waste, fraud, abuse, and criminal activity involving ED funds, programs, and 

operations. As such, we conduct criminal investigations of suspected fraudulent activities by 

ED employees, contractors, grant recipients, schools, teachers, students -in essence, by any entity 

or individual that receives ED funds or participates in ED programs. Our investigations cover a 

wide range of wrongdoing, including Federal student aid fraud rings, diploma mill schemes, fraud 

and corruption in after-school tutoring programs, and fraudulent billing of contracts. Our 

investigations have unraveled multi-million dollar fraud schemes by high ranking school officials, 

school owners, and other people placed in positions of trust to educate our children. 
16 


KING-6430 with DISTILLERInsert offset folio 6 here 25501.006

At present, the OIG currently operates with an investigative staffof77, including 70 criminal 

investigators. Our criminal investigators carry an annual caseload of about 250-300 cases. 

Cases come to the OIG in a number of ways, including our hotline, self-initiated investigations 

based on our audit-related or previous investigative work, reports from schools, universities, 

colleges, grantees, contractors, other State or Federal law enforcement agencies, ED employees, 

and Congressional representatives and their staff. 

Because of the nature of our investigative work, Congress granted the OIG full statutory law 

enforcement authority in 2002, which includes making arrests and conducting search warrants. 

Our office conducts approximately 60 arrest warrants and between 20-25 search warrants each 

year. Some of the cases we work involve subjects with significant criminal histories, including 

violence against law enforcement officers, which are considered high-risk activities. We carry out 

all of our law enforcement activities in accordance with Federal laws, rules, and policies and 

procedures established by the U.S. Attorney General. This includes expeditiously reporting to the 

Attorney General whenever the OIG has reasonable grounds to believe that there has been a 

violation of Federal criminal law. In conducting our investigations, the OIG works closely with 

the U.S. Department of Justice (DOJ): the OIG is the investigative arm, the fact finders; DOJ is 

the prosecutive arm and determines whether a case will be prosecuted at the Federal level. 

The DOJ may decline criminal or civil prosecution in favor of an agency's pursuit of 

administrative remedies. As the OIG is an independent unit within the agency and cannot be 

involved in management decisions, we are not involved in the agency's determination whether to 

take administrative action or the type of action to take. We do believe that it is important for an 

agency to make full and effective use of administrative remedies to address employee misconduct, 

2 
17 


KING-6430 with DISTILLERInsert offset folio 7 here 25501.007

which also serves as a deterrent against misconduct by other employees and helps the agency 

maintain a culture of accountability and ethical behavior in the workplace. 

As mentioned previously, the OIG carries an annual caseload of about 250-300 investigations. 

Less than 2 percent of these investigations involve ED employees. Although employee 

investigations account for a very small percentage of our work, we take these investigations very 

seriously, particularly those involving employees in senior leadership positions, as they have been 

trusted not only to help lead the agency, but also to serve as stewards of billions of taxpayer 

dollars. Since 2010, we have conducted 10 investigations involving senior ED officials (which we 

define as employees at the GS-15 level or higher.) Our investigation involving 

Dr. Danny Harris that you have asked me to discuss today is one of those cases. 

The OIG Investigation of Dr. Danny Harris, Chieflnformation Officer 

In 2011 and 2012, the OIG-received two anonymous complaints concerning allegations of 

criminal and administrative misconduct by Dr. Danny Harris, ED's Chieflnformation Officer in 

the Office of the Chief Information Officer (OCIO), who is a member of the Senior Executive 

Service. The complaints included allegations that Dr. Harris: 

( 1) Improperly awarded contracts to a company owned by his personal friend. 

(2) Operated a home theatre installation business with a subordinate employee and solicited 

other ED employees to perform work for this business. 

3 
18 


KING-6430 with DISTILLERInsert offset folio 8 here 25501.008

During our investigation, we learned of additional complaints, alleging that Dr. Harris: 

(3) Operated a business detailing cars, where he employed subordinate OCIO employees to 

assist with the detailing work, and also accepted payments from subordinate OCIO 

employees for detailing their cars. 

( 4) Instructed a subordinate OCIO employee to purchase products from eBay for his home 

theatre business and sold items on eBay using the subordinate's account, splitting the 

proceeds with the subordinate, and further used his ED email account to conduct these 

transactions. 

(5) Appeared to have advocated for a relative's employment within ED, and 

(6) Appeared to have made a $4,000 personal loan to one ofhis subordinate staff. 

By Apri12013, our investigation had substantiated most of these allegations. Specifically, our 

investigation determined that Dr. Harris: 

• Operated outside business ventures involving home theatre installation and car detailing 

with members of his subordinate OCIO staff and received payment from subordinate 

OCIO employees for services provided by the ventures. We found a business card for 

"Harris-Audio/Visual Innovation" which included a company logo and listed "Danny A. 

Harris" as "Owner/Operator." Dr. Harris stated that he paid hourly two OCIO employees 

for the work they completed related to these ventures. Dr. Harris informed us that the home 

theatre installation venture generated at least $10,000 in income. This amount exceeded the 

4 
19 


KING-6430 with DISTILLERInsert offset folio 9 here 25501.009

$200 annual threshold that required reporting on the Public Financial Disclosure Report, 

Office of Government Ethics Form 278 (OGE-278). Dr. Harris did not report the income 

on his OGE-278s during the relevant time periods. Dr. Harris admitted that he did not 

report them on his OGE-278s. ED's Designated Agency Ethics Official (DAEO) said to 

the OIG that Dr. Harris' not reporting the income on his OGE-278s was a problem and 

would need a referral to the U.S. Attorney's Office. Dr. Harris also advised that he did not 

report this income on his taxes and acknowledged that he probably should have done so. 

• Used his ED email account to conduct his outside business ventures. 

• While employed in ED's Office of the Chief Financial Officer, participated on a panel that 

awarded a contract to a company owned by someone he had a personal relationship with. 

His participation, however, did not result in that contract being improperly awarded. 

• Took actions to help a relative secure employment in ED. The relative was employed at the 

GS-41evel from 2010-2013. 

• Made a $4,000 loan to one of his subordinate staff. 

We received conflicting information regarding the allegation that Dr. Harris instructed a 

subordinate OCIO employee to purchase products from el3ay for his home theatre business. 

Dr. Harris stated that the purchase was for his personal use; the employee stated that it was related 

to their home theatre installation business. 

On April2, 2013, as our criminal investigation into the allegations against Dr. Harris continued, 

we provided a report on our initial investigative findings to ED so that it could take appropriate 

administrative action against Dr. Harris. The OIG also made a referral to the Internal Revenue 

5 
20 


KING-6430 with DISTILLERInsert offset folio 10 here 25501.010

Service-Criminal Investigations Division regarding Dr. Harris' failure to report all of his income 

on his income tax returns. 

On February 13, 2015, the U.S. District Attorney's Office for the District of Columbia declined 

prosecution of all issues based on the availability of administrative remedies. On March 23, 2015, 

the OIG issued an addendum to our April2, 2013, report to ED senior officials that reiterated the 

OIG's findings and noted the U.S. Attorney's Office declination based on the availability for 

administrative remedies. On June 23,2015, the Acting Deputy Secretary responded to the 

addendum and stated that overall, he and the previous Deputy Secretaries working in consultation 

with ED's Office of General Counsel, found no violation oflaw or regulation. Instead, the Acting 

Deputy Secretary said that he believed Dr. Harris displayed certain lapses in judgment, which 

were addressed through counseling provided to the employee by the two prior Deputy Secretaries 

and the DAEO, and that the DAEO would provide written guidance to the employee and .the 

Acting Deputy Secretary would provide additional counseling. 

On July 9, 2015, the DAEO issued a written memorandum to the employee following up on oral 

guidance previously provided regarding the ethics issues raised by the OIG investigation, 

including Dr. Harris's personal friendship with a contractor, personal friendships and business 

relationships with subordinate employees, and personal use of government equipment and 

information resources. We closed our investigation administratively in September 2015. 

This concludes my discussion of the OIG investigation. I am happy to answer your questions. 

6 
21 

Chairman CHAFFETZ. Thank you. 

Ms. Winchell, you are now recognized for 5 minutes. 

STATEMENT OF SUSAN WINCHELL 

Ms. WINCHELL. Chairman Chaffetz, Representative Plaskett, 

members of the committee, thank you for the opportunity to appear 

before you today and discuss the matter regarding the Department’s chief information officer, Danny Harris. 

As the designated agency ethics official at the Department, I am 

responsible for running the Department’s ethics program. I believe 

a successful and effective ethics program must ensure that all employees have enough information about the rules to either know 

how to comply with them or to know when to ask questions and 

who to ask. I take this responsibility very seriously. 

I first became aware of the IG’s investigation in February of 

2013. At that time, in developing recommendations for deputy secretary, I took into consideration that no ethics rules had been violated, that the activities had already ceased, and that the matter 

had been referred to the U.S. attorney. 

I subsequently participated in conversations regarding a question 

from the deputy secretary about whether it would be appropriate 

to reassign Dr. Harris from the OCIO position to another position. 

Based on the information provided in the report, we concluded that 

that would be a drastic action under the circumstances and was 

neither reasonable nor required. 

According to information provided in the IG’s report, the kinds 

of financial relationships Dr. Harris engaged in with subordinates 

are not covered by the criminal conflict of interest statute, but they 

do raise potential concerns under the standards of ethical conduct. 

I believe that paying a subordinate to provide services outside of 

work and providing personal services to—for a fee to a subordinate 

does create a ‘‘covered relationship’’ with those subordinates. However, under the rules, the determination about whether a recusal 

is required rests with the employee first. 

While the ethics official may make a binding and independent 

determination about the necessity of a recusal, that determination 

may not be applied retroactively under the rules. Dr. Harris has 

now been counseled that he may not have outside financial relationships with any subordinate because the—as the ethics official, 

I have determined that such relationships could give rise to the appearance of a lack of impartiality. 

With respect to his friendship with the owner of a vendor, information in the IG’s report suggests that Dr. Harris formed a close 

personal friendship with the vendor in approximately 2010. However, in my reading of the IG’s report, I concluded that the information presented did not support a conclusion that a close personal 

friendship existed at the time Dr. Harris participated in the selection of the vendor or the implementation of the resulting contract. 

According to the IG’s report, Dr. Harris failed to report income 

he received from his outside activities on his public financial disclosure report. Dr. Harris has reported—did subsequently report income on his report covering calendar year 2012. He has not reported any such income in subsequent years. The IG’s report does 


KING-6430 with DISTILLER
22 

not contain information to support a conclusion that the omissions 

were willful. 

The IG’s report states that Dr. Harris advocated for a relative to 

be hired at the Department. From an ethics perspective, I reviewed 

the information provided in the report to determine whether Dr. 

Harris misused his government position in attempting to obtain 

employment for a relative. I concluded that he did not, as there is 

no information showing that he participated in or attempted to influence the hiring process. In my view, a simple inquiry about job 

openings that might be suitable for a relative is not, without more, 

a misuse of position under the rules. 

Finally, I reviewed the allegation that Dr. Harris misused Department equipment and resources by using Department email and 

other electronic resources in connection with his outside activities. 

However, the IG’s report did not clearly establish whether the outside activities were a business or a hobby. If the activities were a 

business, personal use of government equipment is prohibited 

under the Department’s policy. However, if they are a hobby, the 

Department policy does permit a certain amount of personal use of 

such equipment. 

I met with Dr. Harris in his office on March 21, 2014. I reviewed 

the ethics laws and rules regarding conflict of interest and appearance of lack of impartiality. This discussion focused, to a large extent, on how to handle friends in the workplace and appearance 

issues that arise when supervisors and subordinates have financial 

relationships outside of work. I also discussed gifts between employees and misuse of government equipment. 

Chairman Chaffetz, Representative Plaskett, and the members of 

the committee, this concludes my statement, and I am happy to answer any questions you may have. 

[Prepared statement of Ms. Winchell follows:] 


KING-6430 with DISTILLER
23 


KING-6430 with DISTILLERInsert offset folio 11 here 25501.011

Statement of Susan Winchell 

Assistant General Counsel for Ethics 

Office of the General Counsel 

United States Department of Education 

Before the United States House of Representatives 

Committee on Oversight and Government Reform 

Hearing on 

"U.S. Department of Education; Investigation of the CIO" 

February 2, 2015 

Chairman Chaffetz, Ranking Member Cummings, and members of the Committee, thank 

you for the opportunity to appear before you today and discuss the matter regarding 

the Department of Education's Chief Information Officer, Danny Harris. 

My name is Susan Winchell, and as the Designated Agency Ethics Official (DAEO) and 

Assistant General Counsel for Ethics, at the United States Department of Education (ED), 

I am responsible for running the Department's ethics program. Before I discuss the 

present matter, I would like to provide a brief overview of my background and ED's 

ethics program. 

The ED ethics program is structured pursuant to U.S. Office of Government Ethics (OGE) 

regulations and guidance. The program has three basic components: financial 

disclosure, training, and advice and counseling. Each year we thoroughly and timely 

review and certify approximately 285 public financial disclosure reports and 900 

confidential financial disclosure reports; provide new entrant and annual ethics training 

for approximately 1,300 employees; and respond to approximately 1,600 discrete 

requests for ethics advice. In a recent program review, the OGE highlighted a number of 

model practices we have instituted in the past few years to improve the ethics program, 

such as ensuring that all financial disclosure reports are reviewed within 5 business 

days; developing a detailed reviewer form to ensure a comprehensive and effective 

review of all financial disclosure forms; and providing tailored in-person discretionary 

training for offices throughout the Department upon request. Other recent 

improvements include establishing an Ethics Officer of the Week rotation so that all 

employees seeking ethics guidance receive a timely and complete response, and 

regularly publishing information bulletins about ethics topics for all employees. The 

Ethics Division has a robust intra net site with comprehensive guidance about a wide 

1 
24 


KING-6430 with DISTILLERInsert offset folio 12 here 25501.012

variety of ethics topics. The Ethics Division has been recognized in the past by OGE for 

outstanding training. 

I have worked at ED as a career attorney in the Office of the General Counsel (OGC) 

since 1988. I began working in the Ethics Division when it was formed in 1991. From 

2003 to 2006 I served as an Associate General Counsel at OGE. When I returned to ED in 

2006, I served as the Alternate Designated Agency Ethics Official and Deputy Assistant 

General Counsel for Ethics until 2008, when I was selected to serve in my current 

position. 

I believe a successful and effective agency ethics program must ensure that all 

employees have enough information about the rules to either know how to comply with 

them or understand when they should be asking questions about how the rules apply to 

particular situations. I take this responsibility very seriously, especially with respect to 

ensuring that employees know when to seek counseling and who they can call if they 

have questions. 

Involvement with OIG Investigation 

I first became aware of the Office of Inspector General (OIG) investigation around 

February 27, 2013, when two OIG investigators came to meet with me and Phil 

Rosenfelt, who was serving as the acting General Counsel at that time. I was formally 

interviewed by the OIG investigators the next day, on February 28, 2013. 

Involvement with Department Actions 

In developing recommendations for the Office of the Deputy Secretary, OGC reviewed 

the OIG's April 2013 Report of Investigation (ROI) and concluded that the information it 

contained did not support a finding that any ethics rules had been violated. We also 

took into consideration our understanding that the activities had already ceased and 

that the matter had been referred to the U.S. Attorney's office for investigation. 

I subsequently participated in conversations in 2013 regarding a question from the 

Office of the Deputy Secretary about whether it would be appropriate to reassign Dr. 

Harris from the OCIO position to another position. Based on the information provided 

in the ROI we concluded that this would be a drastic action under the circumstances, 

and was neither reasonable nor required. 

Analysis of Issues Raised in OIG Investigation 

Based on the information provided in the ROI, I concluded that although it appeared 

that Dr. Harris exercised poor judgment with respect to some of the conduct outlined in 

the ROI, he did not violate the ethics rules. 

Relationships with Subordinates 

According to information provided in the ROI with respect to several individuals who 

were Dr. Harris's subordinates at ED, outside of work Dr. Harris paid a few of these 

2 
25 


KING-6430 with DISTILLERInsert offset folio 13 here 25501.013

individuals to help him with A/V installation and car detailing, and with respect to 

others, he agreed to provide A/V installation and car detailing in exchange for a fee. 

These kinds of financial relationships with individuals are not covered by the criminal 

conflict of interest statute, but do raise potential issues under the Standards of Ethical 

Conduct section on impartiality. 5 C.F.R. § 2635.502. Under this section, an employee is 

required to consider whether a reasonable person with knowledge of the relevant facts 

would question his impartiality if he works on an official assignment affecting an 

individual or entity with whom he has a "covered relationship" outside of work. 

A relationship with an individual with whom an employee has a financial relationship, 

other than a routine consumer transaction, is a "covered relationship." I believe that 

paying subordinates outside of work and providing personal services for a fee to 

subordinates does create a "covered relationship" with those subordinates. However, 

for a recusal to be required, Dr. Harris would have to determine that a reasonable 

person would question his impartiality with respect to official matters that affect the 

subordinates involved. 

Under the rules, the determination about whether a recusal is required rests with the 

employee first. While the ethics offic;ial can make a binding and independent 

determination about the necessity of a recusal, that determination may not be applied 

retroactively. If Dr. Harris had asked me this question ahead of time, I would have 

advised him that having this kind of outside relationship with a subordinate is 

problematic, and that, in my judgment, would cause a reasonable person with 

knowledge of the facts to question his impartiality in matters concerning those 

employees, including making assignments, recommending promotions, awarding 

bonuses, and conducting performance reviews. Dr. Harris has now been counseled that 

he may not have outside financial relationships with any subordinate because such 

relationships create the appearance of lack of impartiality. As a result, should Dr. Harris 

now repeat this conduct in the future, he would violate the Standards of Ethical 

Conduct, and, taking all circumstances into account, appropriate disciplinary action 

would be recommended. Having counseled Dr. Harris on this issue, I feel confident he 

understands and will not take any future actions in violation of the rule. 

Personal Friendship with Owner of Department Contractor 

With respect to his relationship with the owner of a department contractor, the ROI 

reflected that Dr. Harris had known the owner for 15 years, which means they first met 

in the late 1990's or early 2000's, and that he formed a close personal friendship with 

the owner five years prior to his OIG interview in 2013, which means, from Dr. Harris's 

point of view the close friendship formed in approximately 2008 or 2009. According to 

the ROI, Dr. Harris and his wife vacationed with the owner between 2010 and 2012. I 

am not aware of any information showing that personal funds were mingled while on 

vacation or that the owner gave Dr. Harris gifts while vacationing or otherwise. 

3 
26 


KING-6430 with DISTILLERInsert offset folio 14 here 25501.014

The ROI concludes that Dr. Harris participated in awarding contracts to the department 

contractor at a time when he was close personal friends with the owner. However, in 

my reading of the ROI, I concluded that the information presented does not support this 

conclusion because it is not clear that a close personal friendship had formed at the 

time Dr. Harris was involved in activities relating to the owner's company. 

Under the rules governing appearance of lack of impartiality, the analysis of personal 

friendships is similar to the analysis for financial relationships discussed above. First, 

friends are not among the relationships covered by the criminal conflict of interest laws 

at 18 U.S.C. § 208. Friends are also not a "covered relationship" under the Standards of 

Ethical Conduct, at 5 C.F.R. § 2635.502(a). Therefore, under this rule an employee may 

consider, but is not required to consider, whether a reasonable person with knowledge 

of the relevant facts would question his impartiality if he worked on a Department 

matter affecting his friend. 

It is important to note that "friend" is a broad term and can describe anything from a 

friendly acquaintance to a more significant and enduring personal relationship. 

Therefore, the pattern, nature, and longevity of a friendship must be considered in 

determining whether a disqualification is prudent. For example, in evaluating whether 

an employee must disqualify himself from matters involving a friend, it is a much 

different case when the friendship involves a lunch or coffee a few times a year than 

one that involves an old family friend of long duration. 

When friendships develop at or through work, there may come a time when a 

disqualification is advisable. However, it is not practical or necessary for employees to 

be disqualified from matters involving every individual they are friendly with. While the 

ROI establishes that Dr. Harris and the owner knew each other as far back as 1998 or 

1999, it does not provide information that illustrates a close friendship, the nature of 

which would make a disqualification advisable, until 2010 when the Harris's and the 

owner vacationed together. The ROI indicates that Dr. Harris was involved in activities 

relating to the department contractor through 2006, when he served as a program 

manager for a contract awarded that year. Dr. Harris did determine at some point that 

the nature of the friendship had become close enough for him to notify his staff that he 

was disqualified from matters involving the department contractor. 

It is important to note that even if an employee participates in a matter involving a 

personal friend where the nature of the relationship makes it prudent to disqualify, as 

noted above, while the ethics official may make an independent and binding 

determination about whether an appearance of impartiality exists in a specific set of 

circumstances, the rule is specifically designed to place this judgment in the first 

instance with the employee. This means that if an employee works on a matter 

involving a friend, he has not violated the rule until and unless his supervisor or the 

ethics official makes a different determination and he proceeds to work on the 

problematic matters anyway. As OGE has stated, "2635.502 reflects OGE's concern that 

4 
27 


KING-6430 with DISTILLERInsert offset folio 15 here 25501.015

an employee not be placed in the position of being disciplined under the ethics rules for 

having failed to identify every imaginable appearance issue or for having improperly 

surmised the expectations of the "reasonable person." OGE Informal Advisory Opinion 

97X8 (4/22/97) (emphasis added). 

Income Disclosure 

According to the ROI, Dr. Harris failed to report income that he received from his 

outside car detailing and A/V installation activities on his public financial disclosure 

report. He did report income in connection with A/V installation activities on his report 

covering 2012, and he has not reported such income in subsequent years, nor is there 

information showing that such income existed for those subsequent years. We 

generally do not require employees to amend prior reports. In our experience, 

employees occasionally and inadvertently omit required information. We have 

heightened concern only when there is reason to believe that the omission was willful 

or the omitted entry gives rise to conflict of interest concerns. The ROI does not contain 

information supporting a conclusion that Dr. Harris's omissions were willful or give rise 

to a conflict of interest. 

Inquiry about Work Opportunities for a Relative 

The ROI states that Dr. Harris advocated for a relative to be hired at ED. From an ethics 

perspective I reviewed the information provided in the ROI to determine whether Dr. 

Harris misused his government position in attempting to obtain employment for a 

relative. I concluded that he did not. Based on the information in the ROll concluded 

that Dr. Harris inquired about possible employment that would be appropriate for his 

relative. There is no information showing that he participated in, or attempted to 

influence, the hiring process. In my view a simple inquiry about job openings that might 

be suitable for a relative is not, without more, misuse of position under the Standards of 

Ethical Conduct. 

Misuse of Department Equipment 

Finally, I reviewed the allegation that Dr. Harris misused Department equipment and 

resources by using ED email and other computer equipment and software in connection 

with his outside activities. However, the ROI did not clearly establish whether the 

outside activities were a business or a hobby for this purpose. If the activities were a 

business, personal use of government equipment is prohibited. However, if they were a 

hobby, the Department's personal use policy permits de minimis personal use of such 

equipment. 

Ethics Counseling of Dr. Harris 

On February 20, 2014, I contacted Dr. Harris by email about setting up a time to meet 

and discuss ethics rules. This meeting would fulfill his annual ethics training 

requirement and also provide an opportunity to conduct in-person counseling on the 

issues raised in the OIG's report. This meeting took place on March 21, 2014. 

5 
28 


KING-6430 with DISTILLERInsert offset folio 16 here 25501.016

Prior to that meeting, Dr. Harris requested guidance on how to handle friendships in the 

workplace. Given the timing of this request, I believe it reflected the fact that Dr. Harris 

was sensitized to issues relating to friendships in the workplace by the OIG investigation 

and his subsequent counseling. · 

Thereafter, I met with Dr. Harris in his office on March 21, 2014. I reviewed the ethics 

laws and rules regarding conflict of interest and appearance of lack of impartiality. This 

discussion focused, to a large extent, on how to handle friends in the workplace and 

appearance issues that arise when supervisors and subordinates have financial 

relationships outside of work. I also discussed gifts between employees and misuse of 

government equipment. 

During our conversation, Dr. Harris appeared to understand the issues, and how, with 

the benefit of hindsight, the conduct under review was likely to raise the appearance 

that his official actions affecting friends and subordinates with whom he has personal 

and financial relationships outside of work are not impartial. He also appreciated the 

fact that the personal use of government equipment is prohibited in connection with 

personal business activities. I also learned in this discussion that his friendship with the 

owner ended at the time the OIG initiated interviews in connection with their 

investigation, and Dr. Harris no longer performed any A/V installation activities involving 

his ED subordinates. This was consistent with OGC's understanding that Dr. Harris no 

longer conducted home theater installations. Dr. Harris indicated to me that he fully 

understood what he needed to do in the future to avoid similar questions and issues 

about his conduct. I felt that his representations in this regard were sincere and 

credible. 

Ultimately, had Dr. Harris consulted me on the above activities prior to engaging in 

them, I would likely have advised that he not engage in the activities because they may 

give the appearance of lack of impartiality. My understanding is that the U.S. Attorney's 

office has declined to prosecute Dr. Harris and closed their investigation. Having 

counseled Dr. Harris on this matter, both in person and in writing, I believe that the 

activities cited were temporary lapses in judgment in the long career of a public servant. 

I also believe the Department handled the matter responsibly given the circumstances. 

Chairman Chaffetz, Ranking Member Cummings, and members of the Committee, this 

concludes my statement. I am happy to answer any questions you may have. 

6 
29 

Chairman CHAFFETZ. Thank you. 

Mr. King, you are now recognized for 5 minutes. 

STATEMENT OF JOHN B. KING, JR. 

Mr. KING. Thank you. Chairman Chaffetz, Representative 

Plaskett, and members —— 

Chairman CHAFFETZ. Your microphone doesn’t appear to be on 

there. 

Mr. KING. Chairman Chaffetz, Representative Plaskett, and 

members of the committee, thank you for the opportunity to appear 

before you today. 

In January of 2015, I joined the Department as senior advisor 

delegated the duties of deputy secretary, and I became Acting Secretary on January 1 of this year when Secretary Arne Duncan 

stepped down. 

I firmly believe that providing our children with a great education is not just about subject matter knowledge, but also about 

instilling the values that will help them become faithful contributors to our communities and democracy. I expect all Department 

employees to adhere to the highest standards of ethical conduct. 

Before I address the actions taken by the Department with respect to the report by the inspector general in this matter, I’d like 

to provide you with a brief update of what the Department has 

achieved to enhance our cybersecurity since the agency last testified before this committee, as I believe we have made meaningful 

progress. 

Specifically, we have moved from a rate of 11 percent compliance 

for two-factor authentication of all privileged users at the conclusion of the cybersecurity sprint to an overall compliance rate of 95 

percent as of January 31, 2016. We continue to work aggressively 

with a single external vendor to accelerate implementation of twofactor authentication for the remaining privileged users at that 

vendor and project to achieve 100 percent compliance during March 

2016. 

I view cybersecurity as a responsibility of the entire agency, not 

just that of any one individual. And although we have made and 

are continuing to make progress, I am not satisfied with where we 

are as an agency. I’ve notified my team that we must do better, 

and I’ve directed my team to immediately undertake additional actions to strengthen our cybersecurity. 

These steps include using a focused and disciplined approach to 

systematically resolving and addressing the root causes behind any 

cybersecurity-related findings from both our 2015 FISMA audit and 

the 2015 financial statement audit. 

I have also directed the team to take additional steps to increase 

end-user cybersecurity awareness, to strengthen our incident response capabilities, and to continue to build the capacity of our internal team through hiring of additional professionals with expertise on these issues who can assist us in implementing best practices and improving the Department’s cybersecurity program. 

Returning to the IG’s investigation and report issued to me in 

March 2015, I considered very seriously the allegations. Ultimately, 

my response to those allegations closed a several-years-long investigation and confirmed and supplemented the work of two prior 


KING-6430 with DISTILLER
30 

deputy secretaries at the Department there and my staff and our 

Office of the General Counsel. 

I considered this matter in the overall context of Dr. Harris’s 

more than 30-year career with the Department. Dr. Harris has 

been steadily promoted under administrations of both parties to 

roles of increasing responsibility. He was promoted to the Senior 

Executive Service in 1998 and was appointed to his current role as 

CIO during the prior administration under Secretary Spellings in 

2008. He has been widely recognized for his work in the CIO role. 

Given that history of service and my commitment to ethics, I was 

therefore troubled to learn of the IG’s investigation. However, I was 

also informed that Dr. Harris had been counseled by former Deputy Secretary Tony Miller on this matter, as well as my immediate 

predecessor, former Deputy Secretary Jim Shelton and the agency’s 

lead career ethics attorney Susan Winchell. 

Upon receiving the IG’s addendum in 2015, I again consulted 

with the general counsel’s office. The synopsis of the addendum 

stated that the U.S. Attorney’s Office in the District of Columbia 

had declined prosecution. After reviewing the addendum, the Office 

of General Counsel and Ms. Winchell advised that the additional 

information included in the addendum served to confirm the conclusions reached by the Office of General Counsel and two prior 

deputy secretaries following receipt of the initial report, namely, 

that the OIG investigative materials did not include information 

that could support a finding that Dr. Harris had violated any law, 

rule, or regulation. 

I considered all of these factors, along with the fact that the actions in question had occurred several years earlier, had since 

ceased, and that Dr. Harris took immediate responsibility for his 

actions and, where appropriate, included the relevant income on 

his financial disclosure forms and took other corrective actions. 

Based on these facts, I determined the appropriate course of action was to supplement the actions already taken with counseling 

of my own for Dr. Harris on these serious matters. I also asked Ms. 

Winchell to confirm her prior oral counseling to Dr. Harris in writing. 

As I stated at the outset, ensuring that the public’s business and 

our work of expanding educational opportunity for all students are 

carried out according to the highest standards of ethical conduct is 

vitally and personally important to me. I believe the Department 

took appropriate actions to address the issues raised by the investigation and ensure that they are not repeated as we continue to 

work to rapidly strengthen our cybersecurity posture, an area of 

critical need and a top management priority for me over the coming 

year. 

Thank you for the opportunity to testify, and I look forward to 

answering any questions you may have. 

[Prepared statement of Mr. King follows:] 


KING-6430 with DISTILLER
31 


KING-6430 with DISTILLERInsert offset folio 17 here 25501.017

Statement of John B. King, Jr. 

Acting Secretary 

U.S. Department of Education 

Before the U.S. House Oversight and Government Reform Committee 

Hearing on "U.S. Department of Education: Investigation of the CIO" 

February 2, 2016 

Chairman Chaffetz, Ranking Member Cummings, and members of the Committee, good 

morning and thank you for the opportunity to appear before you today. As you know, I joined 

the Department in January of2015 as senior advisor delegated the functions and duties of the 

Deputy Secretary of Education, and I became Acting Secretary on January first of this year when 

Secretary Arne Duncan stepped down. Prior to joining the Department, I had most recently 

served in New York State as Commissioner of Education (and before that, as Senior Deputy 

Commissioner), but I started my career in education as a public school teacher and then worked 

as a charter school founder and principal and later as leader of a charter management 

organization. In all ofthese roles my singular focus has been on expanding educational 

opportunity for all students. 

I firmly believe that providing our children with a great education is not just about 

subject matter knowledge, but also about instilling the values that will help them become faithful 

contributors to our communities and democracy. That is why throughout my career in public 

service I have always expected myself, then my students, and later, my colleagues and 

employees, to adhere to the highest standards of ethical conduct, and I will continue to expect the 

same of the Department under my leadership in the year to come. For the same reason, after 

joining the Department last year and learning about the ongoing investigation by the Office of 

1 
32 


KING-6430 with DISTILLERInsert offset folio 18 here 25501.018

the Inspector General (OIG) of alleged actions that ended in 2013 or before by the Department's 

Chieflnformation Officer (CIO), Dr. Danny Harris, I was concerned and considered very 

seriously the allegations, the prior responses to the allegations by the Department, and Dr. 

Harris's previously completed steps to address the questions raised by the investigation. 

Ultimately, my response to those allegations confirmed and supplemented the work of two prior 

Deputy Secretaries at the Department, their and my staff, and our Office of the General Counsel, 

and closed a several-years long investigation. I appreciate the opportunity to discuss those 

matters with you today. 

As you may be aware, Dr. Harris, the Department's CIO, first joined the Department as 

an intern in 1985, and then was hired as a career civil service employee in that same year. Since 

then, Dr. Harris has served the Department for more than thirty years and he has been steadily 

promoted under Administrations of both parties to roles within the agency of increasing 

responsibility. Dr. Harris was promoted to the Senior Executive Service (SES) in 1998 and then 

appointed to his current role as CIO during the prior Administration under Secretary Spellings in 

2008. He has been recognized for his work in the CIO role both within the Department as well 

as by a number of external organizations. Dr. Harris has received industry recognition in the 

form of the Information Technology Senior Management Forum Leadership Award in 2012 and 

was selected as one of the 50 Most Important African Americans in Technology in 2011. During 

this time, Dr. Harris has served an important role as the agency has taken urgent steps to 

strengthen its cybersecurity posture- an area that I have identified as a critical priority for the 

Department over the next year. 

After joining the Department in 2015, I came to learn of Dr. Harris's longtime service to 

the Department and his reputation for consistent performance over those many years in a variety 

2 
33 


KING-6430 with DISTILLERInsert offset folio 19 here 25501.019

of roles with increasing amounts of responsibility. I therefore was surprised and troubled to 

learn that prior to my tenure the OIG had opened an investigation into certain allegations 

concerning actions by Dr. Harris that ended in 2013 or before. I also learned, however, that my 

two most recent predecessors had both reviewed the findings of the IG's investigation, consulted 

with the career attorney leading the Office of the General Counsel at the time and his 

experienced staff, including the career Designated Agency Ethics Official-(DAEO), Susan 

Winchell, and had each taken steps to address the results of the investigation. 

Specifically, I learned that then-Deputy Secretary Tony Miller received the OIG's initial 

Report oflnvestigation (Report) on this matter in April2013, consulted with the Office of the 

General Counsel, and provided counseling to Dr. Harris in 2013. I also learned from staff and 

my immediate predecessor, Jim Shelton, that then-Deputy Secretary Shelton also consulted with 

the General Counsel's Office and provided further counseling on these issues to Dr. Harris. I 

also learned that the Designated Agency Ethics Official, Susan Winchell, who has responsibility 

for managing the Department's ethics program, had also provided counseling to Dr. Harris in 

response to the OIG Report. I was further advised that the OIG had referred the matter to the 

U.S. Attorney's Office for the District of Columbia and that the reason the OIG investigation still 

remained open when I joined the Department in January 2015- even after the actions of the two 

prior Deputy Secretaries and the General Counsel's Office and after the questioned activities by 

Dr. Harris had ceased years earlier- was because the OIG was awaiting the results of that Jaw 

enforcement referral. 

A few months later, on March 23, 2015, the OIG submitted an Addendum to the Report 

oflnvestigation (Addendum) to me. The OIG's Synopsis of the Addendum (Addendum 

Synopsis) referred to the prior Report provided roughly two years earlier to then-Deputy 

3 
34 


KING-6430 with DISTILLERInsert offset folio 20 here 25501.020

Secretary Miller. The Addendum Synopsis also stated that the U.S. Attorney's Office declined 

prosecution, described the limited additional information gathered by OIG since the original 

Report, and made clear that Dr. Harris had taken corrective action. After reviewing the 

Addendum, the Office of the General Counsel and Ms. Winchell advised that the additional 

information included in the Addendum served to confirm the conclusions reached by the Office 

of the General Counsel following receipt of the initial Report. Specifically, that the information 

did not support a conclusion that Dr. Harris violated any law, regulation, or standard of ethical 

conduct. 

I weighed this counsel significantly, along with the fact that my two previous 

predecessors had carefully and thoroughly reviewed and had already taken steps to address the 

issues raised by the initial OIG Report that was submitted in 2013. As I stated earlier, I was 

advised when I joined the Department that the reason the OIG file remained open was due to the 

law enforcement referral. In considering the appropriate response to the Addendum, therefore, I 

carefully considered whether any new information included in the Addendum should now lead 

me to undertake any new or different actions with respect to this matter than the ones my 

predecessors had undertaken. The new information confirmed not only OGC's conclusion that 

the information did not support a conclusion that Dr. Harris violated any law, regulation, or 

standard of ethical conduct, but also that the counseling undertaken by my predecessors and Ms. 

Winchell appeared to have been effective and appropriate. And, as I noted, the OIG's 

Addendum made clear that since the first counseling by then-Deputy Secretary Miller, Dr. Harris 

had taken corrective action. Moreover, as reflected in the contents ofthe Addendum Synopsis 

(which did not describe any new activities by Dr. Harris beyond his corrective action), there 

appeared to have been no new activities or incidents since the OIG investigation and counseling 

4 
35 


KING-6430 with DISTILLERInsert offset folio 21 here 25501.021

took place in 2013. I considered all of these factors also in light of the information in the 

Addendum that the U.S. Attorney's Office in the District of Columbia declined prosecution in 

this matter. 

While no information in the Addendum led me to conclude that different administrative 

actions were appropriate for the activities that had been documented and addressed years earlier, 

I nonetheless viewed some of the actions by Dr. Harris that were detailed through the 

investigation to reflect a serious lack of judgment. That is why although the actions in question 

had occurred several years earlier (and since ceased), and had been previously addressed in 

counseling by my two predecessors and the career Designated Agency Ethics Official, I chose to 

supplement those actions with counseling of my own for Dr. Harris on these serious matters. In 

counseling Dr. Harris, I stated my expectation that Dr. Harris ensure that absolutely no questions 

or issues of appearance arise again in the future. Dr. Harris expressed profound remorse for his 

actions and stated that he had already taken actions to address any questions since the OIG 

investigation and receiving counseling from then-Deputy Secretaries Miller and Shelton. I also 

asked Ms. Winchell to confirm her prior oral counseling to Dr. Harris in writing. 

As I stated at the outset, ensuring that the public's business, and our work of expanding 

educational opportunity for all students, are carried out according to the highest standards of 

ethical conduct is vitally and personally important to me. Here, I have carefully considered the 

assessment by our General Counsel's Office and career Designated Agency Ethics Official that 

the information did not support a conclusion that Dr. Harris violated any law, regulation, or 

standard of ethical conduct, and the decision to decline prosecution by the U.S. Attorney's 

Office, Dr. Harris's longtime service to the Department and his consistent level of fine 

performance over many years, along with Dr. Harris's remorse, receptiveness to counselling, and 

5 
36 


KING-6430 with DISTILLERInsert offset folio 22 here 25501.022

prompt actions following the investigation and counseling to ensure that any questions about his 

conduct and impartiality were eliminated and to resolve these issues in a forthright and positive 

manner. I believe the Department took appropriate actions to address the issues raised by the 

investigation and ensure that they are not repeated as we continue to take urgent steps to rapidly 

strengthen our cybersecurity posture - an area of critical need and a top management priority for 

me over the coming year. 

Given that focus over the coming year, I would like to close by sharing an update on our 

most recent progress in this area where we also face continuing challenges and must continue to 

do better: 

• I was not satisfied with the Department's results on the cybersecurity sprint this summer, 

but we have made significant progress since then in implementation of two factor 

authentication for privileged users- one of the most important steps we can take to 

strengthen our cybersecurity. We have moved from a rate of 11% compliance for twofactor authentication of all privileged users at the conclusion of the cybersecurity sprint to 

an overall compliance rate of95% as of January 31, 2016. While we have achieved 100% 

compliance with two-factor authentication for privileged users in both the EDUCATE 

and VDC environments, we continue to work aggressively with a single external vendor 

to accelerate implementation of two-factor authentication for the remaining privileged 

users at that vendor, and project to achieve 100% overall compliance during March 2016. 

• I have directed the team to undertake a focused and disciplined approach to systemically 

resolving- and addressing the root causes behind- any cybersecurity related findings 

from both our 2015 FISMA Audit and the 20 15 Financial Statement Audit. Our goal is 

to reduce our overall number of findings for the FY 2016 audit cycle and have a 

significant impact on repeat findings. 

• I have directed our team to work closely with third party partners of Federal Student Aid 

(FSA) such as guaranty agencies (GAs) and institutions of higher education (IHEs) to 

strengthen their cyber security postures. For GAs, FSA has required GAs to complete a 

self-assessment regarding compliance with applicable National Institute of Standards and 

Technology (NIST) standards, required corrective action and management plans as 

appropriate to address identified deficiencies, and is now tracking progress on those plans 

to completion. For IHEs, the Department has issued further guidance around the need to 

comply with applicable standards and developed a robust technical assistance program to 

help institutions accelerate progress. 

6 
37 


KING-6430 with DISTILLERInsert offset folio 23 here 25501.023

• I have also directed the team to take additional steps to increase end user cybersecurity 

awareness, to strengthen our incident response capabilities, and continue to build the 

capacity of our internal team through hiring of additional highly qualified professionals 

with cybersecurity expertise who can assist us in continuing to implement best practices 

and improving the Department's cybersecurity program. 

While significant challenges remain and we have much work to do in this area, I have set the 

expectation for my team that through these activities and ongoing engagement from me and my 

leadership team, the agency must see continued progress in this area during 2016. 

Thank you for the opportunity to testify and I look forward to answering any questions 

you may have. 

7 
38 

Chairman CHAFFETZ. Thank you. 

I will now recognize the gentleman from Florida, Mr. Mica, for 

5 minutes. 

Mr. MICA. I think Congress and the American people have to 

think that a CIO position, chief information officer position, stands 

for chaos, ineptness, and outrage after what we have learned this 

morning. The CIO is an important position to protect the integrity 

of information data. I think you have what, Mr. King, 139 million 

records that you possess, personal information, $1.2 trillion of information on people who have student loans, and anyone who has 

applied, I guess, has all that background information. 

At the very least, Ms. Bruce, Mr. Harris was acting improperly 

according to your investigation. I think there has been some hairsplitting here on whether it was a business or a hobby. You found 

information that it was a business, I think, in your investigation, 

did you not, Ms. Bruce? 

Ms. BRUCE. That’s correct. 

Mr. MICA. Yes. And I guess also if you don’t report the income 

on your disclosure—that is financial disclosure—that is also a violation, Ms. Bruce? 

Ms. BRUCE. Yes, according to 5 U.S.C. at 104. 

Mr. MICA. Yes. 

Ms. BRUCE. Although the Department has decided that, because 

it was not done knowingly and willfully, it doesn’t pursue a civil 

action. Knowingly only has to be established to do administrative 

—— Mr. MICA. And it was corrected after the fact, is that not correct? 

That is —— 

Ms. BRUCE. That’s correct. 

Mr. MICA. Yes. Well, Mr. Harris, you are a senior executive service position, is that correct? 

Mr. HARRIS. That is correct, sir. 

Mr. MICA. Yes. And you have been the CIO since 2008, is that 

correct? 

Mr. HARRIS. That is correct, sir. 

Mr. MICA. And every year since 2008—we will take you to 

2011—the FISMA audit contains findings of failure of the protection of the records and all of the information you are charged with, 

according to what we have. That is correct. And in that time, you 

received bonuses of $116,000, according to our report. That is just 

part of the record, right, Mr. Harris? 

Mr. HARRIS. That’s correct, sir. 

Mr. MICA. This whole investigation started in December 2011. In 

the meantime, he received bonuses in 2012 of $17,000; 2013, 

$17,000; 2014. During all that time period, the information I have 

is your performance, the job you were hired for as the chief information officer, you had failing evaluations. Is that correct? 

Mr. HARRIS. That is not correct, sir. 

Mr. MICA. It is correct to the information that we have. The only 

information we had just now is Mr. King mentioned that since January they have done better. But it appears you have actually failed 

in your mission. 

First, your ethics—Ms. Winchell gave you as much cover as she 

possibly could, but your ethics were questionable. Ms. Bruce also 


KING-6430 with DISTILLER
39 

said that your activities were not proper. There is no reason, Mr. 

King, why Mr. Harris shouldn’t be fired. He is a senior executive 

service officer. He has failed continually since he took the position. 

I don’t think you could find more ineptness or misconduct with any 

senior employee that has come before us and then rewarded for it. 

It is so offensive. 

And Ms. Winchell says, well, maybe we should discuss moving 

him to another position. Well, that is what is wrong with this 

whole system is he can fail every time, getting huge salaries, plus 

he has got his little businesses or hobbies or whatever you want 

to call it on the side, all the ethical questions that have been 

raised, and you leave him in that position. The worst thing would 

be to put him in another position and continue to get the high salaries and bonuses. 

Mr. King? 

Mr. KING. Congressman, respectfully, what I can attest to is the 

dramatic progress since I arrived at the Department —— 

Mr. MICA. Dramatic progress? 

Mr. KING.—in January 2015. 

Mr. MICA. Who approved the bonuses for him when he was failing? Were you involved? You were a deputy, weren’t you? 

Mr. KING. I was not present at the Department. I joined —— 

Mr. MICA. You were not—who —— 

Mr. KING. I joined —— 

Mr. MICA. Then it would be the Secretary that approves the bonuses? Who approved the bonuses? Even while he is under investigation, there should be at least a suspension of the bonuses. 

Mr. KING. He was previously supervised by deputy —— 

Mr. MICA. But he failed every time, every single time since 2008. 

The only time we have had any success reported is what you reported from January, and that is only because the chairman conducted a hearing and we hammered you last year. 

I yield back the balance of my time. 

Chairman CHAFFETZ. I thank the gentleman. 

I now recognize Ms. Plaskett for 5 minutes. 

Ms. PLASKETT. Thank you, Mr. Chairman. Good morning. Good 

morning, Mr. Harris. 

As a CIO, you are the senior official at the Department and that 

your division is looking for for leadership and guidance. The IG reported in her investigation into the alleged misconduct that you 

used subordinate staff to run an outside business and failed to 

properly report this business on a mandatory financial disclosure 

form. Do you dispute that report at this time? 

Mr. HARRIS. I do dispute that as articulated. 

Ms. PLASKETT. Okay. But do you dispute that you failed to report 

the income? 

Mr. HARRIS. I do not dispute that. 

Ms. PLASKETT. Okay. And although neither the Department or 

any law enforcement authorities, the law enforcement did not elect 

to prosecute, even the Acting Secretary stated in a 2015 memorandum to the IG that you ‘‘displayed certain lapses in judgment.’’ 

Knowing that and not disputing that you failed to report that income and you agree with some portions of the report, what specific 


KING-6430 with DISTILLER
40 

steps have you taken to earn back the trust of not only the Department but in particular the employees that you supervise? 

Mr. HARRIS. Well, thank you for the question. I want to say categorically that these were hobbies that I’ve enjoyed for the greater 

part of my life, and the employees that wanted to engage me, two 

of them actually wanted to learn from me. And I am a teacher. 

That’s one of the things I love to do. 

Since 2012, I have severed my relationship with the vendor in 

question, and I’d like to also say that in 2004 when I sat on a 

panel, not selecting the vendor but providing a review for the 

panel, I was not a personal friend of that vendor. That friendship 

did not occur until 2008, and at that point I am completely removed from the acquisition process. 

Ms. PLASKETT. So what have you done to earn back the trust of 

the people that you supervise? 

Mr. HARRIS. I have communicated with them, explained to them, 

providing transparency, and that’s pretty much what I’ve done. 

Ms. PLASKETT. And do you believe that that alone is sufficient to 

allow you to effectively serve as the CIO of the Department of Education? 

Mr. HARRIS. I’m sorry. Would you ask that question again? 

Ms. PLASKETT. So you said that what you have done to earn back 

their trust is communicate with them about severing your ties with 

the contractor. Do you think that is sufficient to make you an effective CIO at the Department of Education? 

Mr. HARRIS. I think working hard and actually demonstrating 

that I’m passionate about the job and I’m providing not only the 

direction but the time to do the job right. 

I’d also like to put my job as CIO in context if I may. 

Cybersecurity is absolutely critical to the Federal Government. 

However, it is only one of the mission-critical responsibilities under 

my leadership. For example, I run the entire financial management 

platform. We have received 13 clean audit opinions. We have an incredible IT investment management program. We have the best 

grants management system in the Federal Government. One, I 

think, should look at the totality of my leadership, not just cyber, 

even though I agree that the Department had a poor record in improving cybersecurity. But again, it is only one aspect of my job, 

though it is a critical aspect. 

Ms. PLASKETT. Thank you. Acting Secretary King, both the IG’s 

report of the investigation in 2013 and the addendum to that report in 2015 raise not just concerns about this specific issue here 

with your CIO but the general culture at the Department of Education. Are you at all concerned that the IG’s concerns indicate a 

broader cultural problem in your department when it comes to employees meeting ethical standards? 

Mr. KING. Certainly, I have sent a clear message to the entire 

Department that we are committed to ethical conduct, as did my 

predecessor, Secretary Duncan. And with respect to this specific 

issue, it was taken seriously. Counseling was provided. They conduct that was of concern in the IG report ended by 2013. And 

cybersecurity is a top management priority for the Department. 

We’ve made substantial progress since last January when I joined 


KING-6430 with DISTILLER
41 

the Department, but there is clearly much more work to do to ensure that we’re —— 

Ms. PLASKETT. So how are you instilling to your employees that 

this is not something that will be tolerated in the Department if 

all you have done is given him counseling sessions? Where is the 

stick as opposed to just, you know, the pat to him telling him don’t 

do it again and it hasn’t occurred again? How do people know that 

they cannot be involved in this kind of behavior? Is there anything 

procedurally that you have done with Mr. Harris or moving forward put in place that will demonstrate that to people? 

Mr. KING. We provide ethics training to all new employees and 

annual ethics training to all employees. Ms. Winchell runs a strong 

department-wide ethics program. In the specific case of Dr. Harris, 

as I indicated previously, after the IG report, Deputy Secretary 

Miller and then Deputy Secretary Shelton reviewed the IG report 

with the general counsel, who advised that there were no violations 

of law or regulations or policy, but nonetheless, both took the step 

of providing counseling, which I think was humbling for Dr. Harris, 

made clear that the conduct needed to end. All of the activities 

cited ended by 2013. 

When I joined the Department in 2015, the outstanding issue 

was the addendum resolving the referral to the Department of Justice. The Department of Justice also found there was no justification for further action in terms of a violation of law. 

I again consulted with the general counsel. Again, she advised 

that there was no violation of law or regulations. However, because 

I was concerned about sending a clear message about the importance of ethical conduct, I counseled Dr. Harris again and asked 

the general counsel to provide written guidance to Dr. Harris on 

all these matters. 

Ms. PLASKETT. Has anything been sent out to the employees or 

anything letting people know how this conduct was not being tolerated? I mean, personally, I don’t think that counseling is humbling 

for an individual that then allows them—that is just a way to keep 

your job. But I am just trying to see if you believe that what has 

been done will keep your department on track in the areas that the 

CIO is responsible for, and that you believe—do you believe that 

Mr. Harris can effectively continue in the position that he has now? 

Mr. KING. I believe that the evidence is clear that the activities 

have stopped. It is clear that Dr. Harris understands the gravity 

of the impression that was created by his activities. His remorse 

is evident. We have made significant progress on cybersecurity over 

the last year that I’ve been at the Department, and Dr. Harris has 

been a key participant in that. He also is performing ably in other 

areas of his work as CIO in terms of infrastructure, planning for 

the continued upgrades to technology at the Department. 

The message around ethical conduct is clear from me and certainly from the training that is provided to all employees. We make 

clear that not only do we need ethical conduct, but we can’t even 

have the appearance of any impropriety. 

Ms. PLASKETT. Thank you. 

Chairman CHAFFETZ. Thank you. I am now going to recognize 

myself for 5 minutes. 

Mr. Harris, when did you first get to know William Hall? 


KING-6430 with DISTILLER
42 

Mr. HARRIS. I —— 

Chairman CHAFFETZ. Your microphone, please. 

Mr. HARRIS. Thank you, sir. I met him about 15 or so years ago. 

Chairman CHAFFETZ. Which year did you meet him? 2000? 

Mr. HARRIS. I would say 2002 is what I recall. 

Chairman CHAFFETZ. In your testimony you said, ‘‘My personal 

relationship with the individual developed several years after the 

date and occurred when I moved in 2008 to a new neighborhood 

and discovered the individual lived nearby.’’ 

Mr. HARRIS. That is correct, sir. I met him, but we did not form 

a friendship. He actually worked at the Department and I knew of 

him, but we never spent time together. I wasn’t a friend. It wasn’t 

until I —— 

Chairman CHAFFETZ. You didn’t spend time with him in 2005? 

E Source was awarded a sole-source contract, and you were designated the program manager for that contract, correct? 

Mr. HARRIS. But I did not lead that project. I was just —— 

Chairman CHAFFETZ. You were the program manager, correct? 

Mr. HARRIS. But I did not select that vendor. 

Chairman CHAFFETZ. But did you interact with them? You were 

the program manager. 

Mr. HARRIS. I did interact with him, but I was not a friend. It’s 

no different than the vendors—the other vendors that I interact 

with that hold contracts with the Department. 

Chairman CHAFFETZ. 2006 E Source was awarded another contract, and you are again made program manager for that, correct? 

Mr. HARRIS. I don’t recall, sir. I don’t have that in front of me. 

Chairman CHAFFETZ. Okay. The point is, based on your testimony, your written testimony, you said you really got to know him 

in 2008, but it is clear that you had known him since 2001. There 

was somebody that had—they had recommended—Mr. Hall had 

recommended to come work for you, who then you hired and then 

she oversaw those contracts, correct? 

Mr. HARRIS. That is not true. 

Chairman CHAFFETZ. Okay. We are going to explore that a little 

bit more, and be careful about how you answer that one. 

Mr. King, you said that you saw no violation of law, regulation, 

or policy, correct? 

Mr. KING. That was what was advised by our general counsel. 

Chairman CHAFFETZ. Okay. So let’s go through this. Mr. Harris, 

we know that you were friends with this William Hall. We know 

that you interacted with him. During 2008 to 2011, you had had 

some 700 phone calls with Mr. Hall, correct? 

Mr. HARRIS. They were not phone calls. I’m not a phone talker. 

They were probably text messages. But he was a friend. I make no 

excuses for that. He was a friend. 

Chairman CHAFFETZ. Yes, we have the phone records. These are 

the 700 calls, 700 during that time frame. There are two contracts 

that get awarded during that time, correct? One was a renewal, 

one was a new one? 

Mr. HARRIS. I am not involved in the acquisitions process in any 

shape, form, or fashion. 

Chairman CHAFFETZ. You are in charge. You are obviously very 

good friends with this person. According to the inspector general, 


KING-6430 with DISTILLER
43 

you actually, either you or your company—you call it a hobby; I 

don’t buy it. When you have revenue, you set up a company, you 

don’t disclose it on your ethics form, you don’t disclose it to the 

IRS. This is something you have already admitted. 

So, Mr. King, how is that not a violation of regulation, policy, or the law? He admitted that he had outside income above the $200 

threshold and he did not report it neither to the IRS, nor on the 

ethics form. How is that not a violation of law, regulation, or policy? 

Mr. KING. Well, as you know, the general counsel’s role is to review—our chief career ethics officer, her job is to review the findings from the inspector general and to determine whether or not 

there has been a violation of law or regulation or policy. The general counsel advised —— 

Chairman CHAFFETZ. But you are asked to review that. You are 

the one that is supposed to look at that. You are not just supposed 

to read it and say, hey, that is what they say. You still to this day 

believe that Mr. Harris has done nothing wrong? 

Mr. KING. As I indicated previously, the general counsel made 

—— 

Chairman CHAFFETZ. No, I want to know what you believe. All 

this evidence we have thrown out there, you still believe that there 

is nothing he has done wrong? 

Mr. KING. My responsibility is to rely on the guidance of general 

counsel to review —— 

Chairman CHAFFETZ. No, your responsibility is to make a judgment —— 

Mr. KING. To review the evidence based —— 

Chairman CHAFFETZ. You are hired for your judgment. You are 

the Acting Secretary. 

Mr. KING. And based on the recommendation of the general counsel, based on the review that was conducted by Deputy Secretary 

Miller when these incidents first occurred, Deputy Secretary 

Shelton, after further review of the inspector general’s report, after 

review of the addendum, which indicated that the Department of 

Justice declined further action, based on all of those recommendations and the recommendations of our staff, yes, I believe the Department’s actions in this case have been appropriate. 

Chairman CHAFFETZ. I asked you if you believed that he had 

done anything wrong. To this day do you believe he has done anything wrong? 

Mr. KING. I believe there were significant lapses of judgment, 

counseled him to that fact —— 

Chairman CHAFFETZ. In your mind, is that doing something 

wrong? 

Mr. KING. Those significant lapses of judgment, I counseled him 

on those, and they ended by 2013. 

Chairman CHAFFETZ. Is it a violation of policy or regulation or 

law to have outside income and not disclose it? 

Mr. KING. The specific determination of whether or not the evidence —— 

Chairman CHAFFETZ. No, no, no, no, no, Mr. King, with all due 

respect, you are smart guy. You are in this position for a reason. 

I am asking you, is it appropriate? Because everybody at the DeVerDate Nov 24 2008 14:16 Jun 22, 2017 Jkt 000000 PO 00000 Frm 00047 Fmt 6633 Sfmt 6633 H:\25501.TXT APRIL

KING-6430 with DISTILLER
44 

partment of Education is watching you and what you are doing, 

and there is a reason why you are scoring near the bottom of the 

heap, bottom 10 percent of everybody in government. Every single 

key metric we look at is going down, and it is your leadership that 

is on the line. I am asking you, is it appropriate, is it a violation 

of law, regulation, or policy to have outside income and purposely 

not disclose it? 

Mr. KING. Based on the recommendation of our general counsel, 

I do not believe that there was a violation of law, regulation, or policy. 

Chairman CHAFFETZ. He admitted that he didn’t do it. 

Mr. KING. But I will say—I will say —— 

Chairman CHAFFETZ. He admitted he didn’t do it. You don’t 

think that is —— 

Mr. KING. Respectfully, Congressman, on the point of whether or 

not every indicator is going down, the Department has made dramatic progress —— 

Chairman CHAFFETZ. No, no, no —— 

Mr. KING.—with respect to cybersecurity since January of 2015. 

Chairman CHAFFETZ. You got an F. You are one of only a couple 

agencies that during the cyber sprint you went down, and you are 

here to tell us things are getting better? I don’t buy it. The question before you, again, last time—I don’t want to badger you. This 

is the last time I am going to ask this. It is a simple question. Is 

it appropriate, is it a—or let me put it another way. Is it a violation of law, regulation, or policy to have outside income above $200 

or more and not report it? Because he has admitted that he hadn’t 

reported it. 

Mr. KING. It was a lapse in judgment. As a result of that lapse 

in judgment, Dr. Harris was counseled on the point of the progress 

made —— 

Chairman CHAFFETZ. I’m asking you if it was a violation, not did 

he go through counseling, which didn’t do crap. Did he or did he 

not violate policy? 

Mr. KING. Respectfully, Congressman, after the counseling, the 

activities ended. I’ve been very clear that the activities constituted 

a lapse in judgment. 

I do want to make the point with respect to the cybersecurity 

and the topic of the hearing in November, the Department has 

made substantial progress. One of the clearest indicators of that is 

the issue of two-factor authentication, which is a significant 

cybersecurity challenge for all public and private institutions. We 

were at 11 percent of the time of the cybersecurity sprint. We are 

at 95 percent today with one vendor that needs to resolve their 

two-factor authentication compliance and will do so by March. That 

is very significant progress. We are also making progress on resolving the findings in the FISMA audit. 

I joined the Department in January 2015. Like you, I did not feel 

that the Department had done adequate work to protect our 

cybersecurity. We have, since then, made tremendous progress. 

Chairman CHAFFETZ. Mr. Harris, what kind of bonus to you get 

last year, 2015? 

Mr. HARRIS. Approximately $15,000. 


KING-6430 with DISTILLER
45 

Chairman CHAFFETZ. All right. So $230,000 in bonuses, really? 

You can justify that? 

Mr. KING. I can’t speak to the reviews of performance prior to my 

joining the Department. I can say that since I joined the Department in January 2015, we have made very significant progress on 

cybersecurity. 

Chairman CHAFFETZ. There is no metric, with all due respect— 

and I appreciate the time here—there is not a single metric, not 

one that is positive. Every single metric has gone down. 

With that, my time is more than expired. I will now recognize 

the gentlewoman from New York, Mrs. Maloney, for 5 minutes. 

Mrs. MALONEY. Thank you. 

Dr. Harris, cybersecurity, it is a problem. It has been rated with 

an F. It is one of the biggest challenges we have before our government. It is a huge responsibility to address it. And as the chairman 

pointed out, you had $230,000 in bonuses. I understand you are 

paid $183,000 a year for being a CIO, is that correct? 

Mr. HARRIS. That is correct. 

Mrs. MALONEY. And also you are a consultant to the Department 

of Education for the city of Detroit. Is that correct? 

Mr. HARRIS. No longer, but at one time. 

Mrs. MALONEY. How much were you paid those years when you 

were there? 

Mr. HARRIS. Approximately $5,000. 

Mrs. MALONEY. Approximately $5,000. And then also you teach 

at Howard University? 

Mr. HARRIS. That is correct. 

Mrs. MALONEY. And how much are you paid for that? 

Mr. HARRIS. Fifteen thousand dollars. 

Mrs. MALONEY. Fifteen thousand. And then on top of that, you 

have, I think, three other jobs I have heard today. You have got 

your car business with 40 employees, is that correct? 

Mr. HARRIS. That is not correct. 

Mrs. MALONEY. Do you have a car business? 

Mr. HARRIS. I do not. It is a hobby, and one other individual 

who’s an enthusiast helps me. 

Mrs. MALONEY. Do you make money off of it? 

Mr. HARRIS. No, I do not. I get $50 and I pay for supplies. I make 

no money off of that. 

Mrs. MALONEY. And then —— 

Mr. HARRIS. And I’ve only —— 

Mrs. MALONEY. Then you have another hobby where you are putting equipment in people’s homes and are compensated for that, too 

—— 

Mr. HARRIS. I —— 

Mrs. MALONEY.—right? 

Mr. HARRIS. I did prior to 2012. 

Mrs. MALONEY. Well, you are a very, very busy man. I can understand why there are problems at the cybersecurity and Education Department when you have so many other outside jobs. 

Anyway, on this situation with your friend, what was the contract for, the E Source contract, and how much was it for? You are 

the contract manager. Do you know what the contract was? Was 

it $10 or $1 million? 


KING-6430 with DISTILLER
46 

Mr. HARRIS. Which contract would you be referring to, the one 

in 2004? 

Mrs. MALONEY. All of them, the one in 2004 and the other two. 

Mr. HARRIS. The one in 2004 I believe was for project support. 

The other contracts —— 

Mrs. MALONEY. Okay. How much was that one for? 

Mr. HARRIS. I have no idea. 

Mrs. MALONEY. Can you find out and get back to the committee? 

Mr. HARRIS. I most certainly could. 

Mrs. MALONEY. Okay. What were the other two for? 

Mr. HARRIS. I believe both were for project management support, 

and I can get you —— 

Mrs. MALONEY. Project support? 

Mr. HARRIS.—the information on that. 

Mrs. MALONEY. Now, why did this have to be a sole-source contract? That seems like a business that a lot of people could be in. 

I could even go in and get some project support. Why was that a 

sole-source contract? 

Mr. HARRIS. Well, if—allow me to put in context how they Department works in terms of acquisitions. I as the CIO make general—provide general direction on technologies and implementations —— 

Mrs. MALONEY. Okay. Can you get back to me in writing —— 

Mr. HARRIS. I —— 

Mrs. MALONEY.—why that was a sole-source contract? Because I 

think everybody on this panel could go in and do project support. 

That should be a competitively bid contract to the lowest-qualified 

bidder. 

Mr. HARRIS. I will get back to you. Our contracts division, which 

is not in CIO, determines the contract approach. I have nothing to 

do with that. But we can certainly get that information for you. 

Mrs. MALONEY. I think the contract approach for an agency that 

is rated the most mismanaged, that probably has the most important goal and responsibility of any agency in our government is 

education and building our workforce and helping our young people 

become good citizens. It is an incredibly important agency. And I 

think maybe you are spending too much time in meetings. 

I think all these contracts should not be sole source. They should 

go to the lowest-qualified bidder. It would be cheaper to administrate and it would cut out any threat or all these ethics meetings 

on whether or not there is a conflict of interest. Do you agree that 

a sole-source contract would work, Dr. Harris? 

Mr. HARRIS. I’m not a subject matter expert on contracts, and 

that’s not in my division so —— 

Mrs. MALONEY. Okay. Ms. Bruce, do you think a sole-source contract to a qualified bidder—you have to have a panel, make sure 

they are qualified, that they can do the work, that they have a 

work history, that they are paying their taxes as good citizens, lowest-qualified bidder. Something like the support service, do you 

think that could have been a sole-source contract or should it be 

a sole-source contract or competitively bid? 

Ms. BRUCE. Ms. Maloney, I would have to defer to the Department as far as the acquisition process. I do know that the Federal 

acquisition regulations and other processes do look for those things, 


KING-6430 with DISTILLER
47 

but I would defer to the Department as to why they made the decision to use the sole-source contract. 

Mrs. MALONEY. Yes. I don’t understand that. And I think we 

should change the law, that you go to the lowest-qualified bidder. 

And if you go to a sole source, have to write out in detail why you 

need a sole source. 

I would just like to respond to Mr. King. I think the point that 

the chairman was trying to make is that when you head an agency, 

everyone looks at you. You are the leader. And you are sending 

messages to employees of how to act. And when someone violates 

a regulation or a law, then it tells everybody else they can violate 

the same one and go to counseling and it is okay. 

So I think that is the point he was trying to make, that if we 

have rules and laws, they are supposed to be followed. That is why 

they are there. And if you are going to change it—most people 

think you have a rule or law, you follow it. Basically, what is happening under your leadership is you have a rule or law, you can 

violate it, just go to counseling and it is okay. Is that an appropriate description of what is happening? 

Mr. KING. No. So to be clear, the Office of General Counsel, my 

predecessor’s predecessor, and my predecessor all reviewed the report of the IG and concluded there was no violation of law or regulation and —— 

Mrs. MALONEY. But there is a law —— 

Mr. KING.—his conduct —— 

Mrs. MALONEY. There is a law that if you have outside income, 

you report it, and they didn’t report the outside income. That, in 

my opinion, is a violation of law. 

Mr. KING. The general counsel, in reviewing that specific issue, 

made a distinction between a hobby and a business and what 

knowledge of the application of the disclosure Dr. Harris had at the 

time. But I—but to be clear, of the conduct —— 

Mrs. MALONEY. But I think we should change that, too, and we 

should say that a law is a law, and that a hobby is also covered. 

Maybe we need to clarify it for your counsel. 

Mr. KING. The conduct at the time—just to be clear, the conduct 

that was described in the IG report ended by 2013. I had joined the 

Department in 2015. 

Chairman CHAFFETZ. I thank the gentlewoman. 

And I would—as we recognize Mr. Farenthold here, Mr. Harris, 

you previously served as the deputy chief financial officer. We introduced you as being responsible for contract administration, 

grant management, accounting. Your ignorance about contracting 

is, I think, without merit. 

I will now recognize the gentleman from Texas, Mr. Farenthold, 

for 5 minutes. 

Mr. FARENTHOLD. Thank you very much. 

Mr. Harris, I am over here behind the person doing the transcriptions. I will lean over so you can see me. 

So after the breaches at the OPM, the OMB launched the cyber 

sprint for 30 days. And you guys actually scored negative 14, which 

puts you in the worst of the worst. And I have kind of heard some 

testimony here that you are trying to improve. But the Department’s performance in that cyber sprint reinforces the key IG findVerDate Nov 24 2008 14:16 Jun 22, 2017 Jkt 000000 PO 00000 Frm 00051 Fmt 6633 Sfmt 6633 H:\25501.TXT APRIL

KING-6430 with DISTILLER
48 

ing that the Department had no mechanisms to restrict the use of 

unauthorized devices on its network. This was a finding from the 

2011 fiscal year. 

The IG is continually warning that failure to restrict unauthorized devices on internal network segments could allow perpetrators 

to bypass the two-factor authorization, obtain information about 

the network, and gain access to the Department’s internal resources. 

Obviously, the private sector is moving faster than the government by banning workers from using portable devices such as USB 

drives and wanting employees to be careful what they post on social media and even discouraging workers from posting out-of-office 

replies on their emails. 

The IG found you used Department emails to support your side 

business—we have talked a lot about that—but also that you connected various electronic devices like USB thumb drives and CD– 

ROMs from home in conflict with your own internal policy that I 

guess you wrote. Don’t you see a little problem here with the guys 

on the top aren’t following the rules? 

Mr. HARRIS. We certainly have tools in place now to restrict all 

employees from connecting anything. I think it’s standard practice 

when you travel all the time with your devices so that you can 

work to inadvertently put a non-supported USB or a CD in a drive. 

Mr. FARENTHOLD. Yes. My concern is you guys have pretty much 

every student Social Security number on file, probably including 

both of my daughters. I am old enough that you probably don’t 

have mine. So this is something that really is concerning. 

Mr. King was testifying that you guys have made some progress. 

Do you agree, the progress? 

Mr. HARRIS. Yes, we have. 

Mr. FARENTHOLD. All right, but —— 

Mr. HARRIS. Ninety-five percent is a really good number. 

Mr. FARENTHOLD. There is still work to be done, though? 

Mr. HARRIS. There is indeed. 

Mr. FARENTHOLD. What is stopping you from getting it done? 

Mr. HARRIS. The—we have two small challenges on privileged 

and non-privileged. On the privileged, we are 95, and we have one 

vendor who is completely re-architecting their data centers to segment out the Department of Education so that we can overlay twofactor authentication. That is to happen in March, and we will be 

at 100 percent. 

In terms of unprivileged users, we’re at 86 percent plus, and 

we’re looking at our assistive technology and disabled community 

to provide technology that allows them to use two-factor, and then 

we would be 100 percent on unprivileged as well. And we’re looking 

to achieve that by summer. 

Mr. FARENTHOLD. All right. And so can you talk a little bit about 

your—I mean, you are CIO. Could you talk a little bit about your 

IT background and training? Because it looks like you came up 

through the financial and contracting segments. 

Mr. HARRIS. Actually, I came up through the IT segment. I started at the Department as a GS–5 programmer. I did development 

work probably for the first 7 years of my career. I did big database 

administration work —— 


KING-6430 with DISTILLER
49 

Mr. FARENTHOLD. So you should have—why didn’t you see some 

of this coming beforehand? I mean, obviously hindsight is 20/20. So 

having, you know, worked up in the trenches of the organization 

and—you know, you saw the headlines from Snowden to—I mean, 

why didn’t we see some of this coming and do something about it 

before it hit the fan? 

Mr. HARRIS. So as an IT professional, I am not a cybersecurity 

subject matter expert. And so it is true that the Department has 

been slow in making progress, and we’re happy about the progress 

we’re making now, but we need to make more. 

Mr. FARENTHOLD. But, I mean, if you are a former programmer 

and have been messing with computers for years, in light of—I 

mean, when Snowden came out, didn’t something go off in your 

head, maybe we ought to, you know, make sure that this doesn’t 

happen to us? 

Mr. HARRIS. Well, it’s a good question. I would like to say that 

approximately 6 years ago I met with then-Secretary Arne Duncan 

and indicated to him that I was very concerned about our IT security posture, and I asked him for funding to do the first-ever Department IT security discovery process. And that was really, in my 

opinion, the foundation of the Department really starting to get 

really serious about cybersecurity. 

Mr. FARENTHOLD. But then how do we come to, you know, just 

a few months ago you are an F? I don’t understand it. I guess if— 

well, I am not going to take a shot. We just have got to get it fixed. 

I yield back. 

Chairman CHAFFETZ. I thank the gentleman. 

I will now recognize the delegate from the District of Columbia, 

Ms. Norton, for 5 minutes. 

Ms. NORTON. Thank you, Mr. Chairman. 

What is concerning here, Secretary King, if you see how this 

began, it was uncovered not from the top down but apparently 

there were anonymous complaints. That suggests something that is 

very troubling. If you are an employee—and who knows where 

these anonymous complaints—perhaps they were peers—but there 

is a good chance, given that we are talking about an SES member 

here, that it was subordinates and that there may have been 

resentments. So, you see, that reflects on the Department itself, 

and it is very concerning to me since obviously you look to whoever 

is in charge to provide the example so they can reprimand those 

who do not live up to what is expected. 

Now, I have to tell you, I am unimpressed that the U.S. attorney 

did not proceed. I know how U.S. attorneys work. They have to 

have a slam dunk. It has to be worth it to them. It has to be a 

big enough case because they have so many complaints or possible 

cases, so it absolutely means nothing. 

I don’t even know what the standard is. I don’t know if the 

standard was intent, which may have made it difficult, was know 

or should have known. So, you know, I discard that. But I do note 

that Ms. Bruce said that—and I am looking here at your testimony 

on page 5—‘‘so that it could take appropriate administrative action.’’ So I want to move to the Secretary. 

Would you outline the kinds of administrative action that was 

possible to be taken? We know that what happened was counseling. 


KING-6430 with DISTILLER
50 

What kinds of administrative action could have been taken against 

this employee to indicate that there had been issues with what he 

had been doing? 

Mr. KING. Well, I will ask Ms. Winchell to expand on this, but 

I think for us the key question is, was there a violation of law or 

regulation? There are a set of penalties or table of penalties that 

are associated with violations of law or regulation —— 

Ms. NORTON. So I am asking for the administrative actions that 

could have been taken in light of the findings that have been made. 

So you don’t have to reiterate the findings because I am going to 

ask you about no violations next. 

Mr. KING. Yes. 

Ms. NORTON. I am simply trying to find out, as someone who is 

literally ignorant, when I hear that what happened was counseling, 

okay, but what were the possible administrative actions that could 

have been taken? 

Mr. KING. Well, the key thing is the finding here was a set of 

lapses in judgment that could lead to —— 

Ms. NORTON. Okay. What were —— 

Mr. KING.—here it’s —— 

Ms. NORTON.—the possible administrative actions —— 

Mr. KING. Right. 

Ms. NORTON.—that can be taken when there is a lapse of judgment but apparently no violation of regulations or, as far as you 

know, laws? 

Mr. KING. As an SES employee, an SES can be reassigned. That 

was apparently considered by Deputy Secretary Miller several 

years ago when —— 

Ms. NORTON. So what else could be —— 

Mr. KING.—this first was raised. This could have been factored 

into the employee’s ratings at the time. Those were decisions that 

were made by Deputy Secretary Miller at the time that these 

issues —— 

Ms. NORTON. Pardon me —— 

Mr. KING.—emerged. 

Ms. NORTON.—were they factored into the employee’s ratings? 

Mr. KING. I’m—I don’t know. That was—that was 2 years before—it was more than 2 years before I came to the Department. 

Ms. NORTON. You don’t have access to what the ratings were? 

Mr. KING. I do not have personal knowledge of the ratings and 

how they were constructed by the—his supervisor at the time. 

Ms. NORTON. Mr. Harris, were your ratings affected? 

Mr. HARRIS. Outstanding. 

Ms. NORTON. Your ratings throughout —— 

Mr. HARRIS. My ratings were outstanding. 

Ms. NORTON.—all of this was outstanding? 

Mr. HARRIS. Yes, as a result of the entire body of my work, not 

just cybersecurity. 

Ms. NORTON. And that is even though these questions had arisen? You were given outstanding ratings even though these questions were known to those who were the raters? 

Mr. HARRIS. Many of them were just allegations, and I’ve owned 

up to those that represent really poor judgment on my part. 


KING-6430 with DISTILLER
51 

Ms. NORTON. So has your ratings suffered at all as a result of 

what has now been found to be the facts? 

Mr. HARRIS. No. 

Ms. NORTON. So you continued to be rated outstanding? 

Mr. HARRIS. Yes. 

Ms. NORTON. Mr. King —— 

Mr. KING. Yes, so —— 

Ms. NORTON.—you see the problem that that may raise. Put 

yourself in the position of a Federal employee, and you look at how 

the rating apparently has not even been affected, no violations of 

regulations, no violations of any kind found. 

Could I ask you, in light of the fact that no violations were found, 

that apparently there is a finding that it was unclear whether Dr. 

Harris’s outside work constituted a business or a hobby, has it not 

occurred to the Department to clarify this so employees know what 

is the difference and so it will not be unclear for those who may 

have seen or known about this particular matter so that—don’t you 

think that is rank confusion in the Department when they see a 

high level official was engaged in outside activity for which there 

was remuneration but it was unclear whether it was a business or 

a hobby? Doesn’t the Department have an obligation now to issue 

guidance so that these things are cleared up? 

Mr. KING. Yes. We do make clear in our ethics training what employees’ responsibilities are —— 

Ms. NORTON. So what is the answer? In other words, if an employee wants to know, look, I want to know, I don’t want to be 

caught in this thing, too, I want to know if I do this, would it be 

considered a business by the Department of Education or would it 

be considered a hobby? Is there concrete guidance on that matter, 

given what has happened here with an SES employee? 

Mr. KING. The guidance to employees is to, when there is a potential issue of appearance of impropriety, to seek guidance from 

the ethics officer, and the ethics officer provides that guidance. In 

this case—I mean, it’s a question of whether or not Dr. Harris understood at the time that he needed to seek that guidance. He did 

not, and this was raised through the IG report, and then the ethics 

officer was reviewing the IG findings. 

Chairman CHAFFETZ. I thank the gentlewoman. 

I now recognize the gentleman from Michigan, Mr. Walberg, for 

5 minutes. 

Mr. WALBERG. Thank you, Mr. Chairman. It is good to have the 

testimony in front of us today. I guess I would offer a point of personal advertising. My SES bill seems to have more pertinence all 

the time of trying to deal with concerns that go on. 

Dr. King, I just want to ask you a direct question, and other 

questioners kind of waltzed all around it, but the direct question 

I want to ask you is do you have faith that Dr. Harris can effectively lead the OCIO? 

Mr. KING. I do, based on the progress that we’ve made since January 2015 and based on his overall performance in the other areas 

of responsibilities, yes. 

Mr. WALBERG. You have clear faith, certain faith that he can 

lead? 


KING-6430 with DISTILLER
52 

Mr. KING. I have confidence in his leadership. I have confidence 

in the progress that we’ve made over the last —— 

Mr. WALBERG. Well, it is important for me to know because the 

Department of Education, in its oversight capacity over national 

education issues—and brought up the fact that Dr. Harris has been 

involved with Detroit school system in trying to turn a failing 

school system around, a system that needs to be turned around for 

the benefit of its students, the families, and the city at large. 

It is a requirement for any type of growth economically or otherwise in a community as important as Detroit to have a school system that we have confidence in. And so when we have leadership 

coming from the Department of Education and we have people from 

the Department that are working in a consulting, advisory, leadership, whatever aspect of trying to turn schools around like that, it 

is important that integrity reigns and that confidence is there. And 

so that is why I wanted to hear your answer. You said you have 

complete confidence, faith that Mr. Harris can carry on his duties. 

Let me ask you then, since you began directly receiving reports 

of findings from the IG as early as March 23, 2015, have you personally talked to OCIO staff to better understand the culture there 

to try and improve things for the staff but also the effectiveness of 

the organization? 

Mr. KING. I’ve certainly worked with staff from OCIO as we have 

focused on addressing that—the significant need for improvement 

around cybersecurity, and I’ve worked closely with our staff to 

make those improvements since I arrived in January 2015. 

Mr. WALBERG. What specific steps are you taking to improve the 

morale at the very least? 

Mr. KING. Well, I think the —— 

Mr. WALBERG. Specific steps. 

Mr. KING. The morale is bound up with the responsibility to execute on their work for the Department, which is to ensure that the 

Department’s technology works smoothly for their fellow employees 

and to ensure that the personal information that we have is secure. 

And we have made substantial progress. 

I do think that substantial progress has required folks to work 

additional time, to adjust their work processes, but we are seeing 

progress. We’re seeing progress in terms of our two-factor authentication. We’re seeing progress in terms of the resolution of FISMA 

audit findings. I met with the CIO and members of his team, as 

well as our Federal Student Aid Technology Team on a weekly 

basis for much of last year to ensure that we made progress, and 

we’re going to continue to do that going forward. 

Mr. WALBERG. And I wish you well. During the committee’s November hearing, Dr. Harris, under my questioning, could not answer my questions during the testimony specifically in the area of 

risk rating and the facts/figures that were there and the contracting issues. Regarding information that he certifies on the Federal IT dashboard, do you have confidence in Dr. Harris to provide 

accurate information to the dashboard? 

Mr. KING. I do have confidence going forward. Obviously, I can’t 

comment on information that was provided prior to my joining the 

Department. 


KING-6430 with DISTILLER
53 

I will say I share the committee’s concern that we need to rapidly 

improve our cybersecurity posture. We are making progress. I 

think it’s clear to everyone that all public and private institutions 

are subject to significant cybersecurity threat, and that threat is 

ever-evolving, and we’ve got to continue to work to ensure that we 

are positioned to protect the information that we have. 

Mr. WALBERG. Well, I again wish you well on that. We expect to 

see that in action. It is very concerning that we set in a place of 

great responsibility with records, with backgrounds, Social Security 

numbers, information on families as well as students, and there is 

an expressed concern that we have all sorts of reason because of 

the lack of integrity, of credibility, and now, more importantly, ultimately no consequences except counseling. 

I think I have said probably enough. I yield back the balance of 

my time. 

Chairman CHAFFETZ. I thank the gentleman. 

I now recognize the gentlewoman from Illinois, Ms. Kelly, for 5 

minutes. 

Ms. KELLY. Thank you, Mr. Chair. Good morning. 

We all are aware of the constantly evolving cyber threats to information systems, as seen by the many breaches that have recently occurred in both the private and public sectors. The Federal 

Information Security Management Act is another important piece 

of legislation that requires the agency and inspector general to assess the state of their information security management. 

Dr. Harris, my committee, the IT Subcommittee, held a hearing 

in November on the Department’s compliance with FISMA based 

on the IG audit report. We learned the Department heavily relies 

on contractors for its IT systems. We also heard that, although 

progress has been made on IT security, continued improvement is 

needed. You acknowledged this need for improvement in your opening statement. Can you tell me what your top priority is in this 

space? 

Mr. HARRIS. Well, specifically in the FISMA area, we have put 

an integrated project team together to meet weekly to look at the 

51 caps that we have under the 18 findings for FISMA. We have 

already completed a number of those, approximately four of those, 

and we’re looking to complete the vast majority of them by midsummer. 

Our number one priority is to protect—to correct those things 

that impact our HVAs, our high-value assets. A second priority is 

to ensure that repeat findings simply don’t occur, not just not occur 

in individual systems, but occur across our ecosystems. So those 

are our two top priorities. 

Ms. KELLY. You might have answered this and I wasn’t in the 

room, but do you feel like you have the staff and the resources that 

you need to complete your goals? 

Mr. HARRIS. We don’t have the necessary resources that we need 

to complete our goals. Everything is based on risk, and so what we 

do is look at risk and then we complete those items at the highest 

level of risk. There are times—in fact, some of our repeat findings 

have to do with the fact that we don’t have the resources to do everything. 


KING-6430 with DISTILLER
54 

Ms. KELLY. And the reason I ask oftentimes people say they can’t 

find the people to carry out the tasks because everyone is, public 

and private sector, looking for experts on cybersecurity, and of 

course government doesn’t pay what the private sector pays. So are 

you finding that also? 

Mr. HARRIS. We are. It’s one of our biggest challenges. As Dr. 

King mentioned earlier, we are bringing on a couple of 

cybersecurity experts to support not just the Department of Education but specifically Federal Student Aid, and we’re looking for 

more talent also to bring on board to get at some of these challenging issues we have in cybersecurity. 

Ms. KELLY. Okay. Thank you. And I just ask that you keep this 

committee updated as you continue to address the weaknesses in 

the Department’s security systems identified by the IG. Thank you. 

Mr. HARRIS. I will. 

Mr. CONNOLLY. Would my friend yield? 

Ms. KELLY. Yes, I will. 

Mr. CONNOLLY. I thank my friend from Illinois. 

Just if I could build on that, Mr. King, how well do you think 

the Department is implementing FITARA, which is of great concern to this committee? 

Mr. KING. We are making progress. We have our FITARA implementation plan now approved by OMB. We have made good 

progress on implementation, continued work to happen through 

this spring into the summer. Historically, the work of the Federal 

Student Aid CIO and the Department CIO have proceeded on parallel paths but not always coordinated paths with Department CIO 

having full transparency into the activities of the FSA CIO. That 

will now change with FITARA implementation, and we are working 

through the internal operations to ensure that that happens. 

Mr. CONNOLLY. And how are you doing on data center consolidation, perhaps one of the most immediate big cost-savers if done correctly? 

Mr. KING. We are in the initial stages of implementation. I would 

have to ask Dr. Harris to comment —— 

Mr. CONNOLLY. Dr. Harris —— 

Mr. KING.—on the technical side of that. 

Mr. CONNOLLY. Mr. Harris? 

Mr. HARRIS. We have approximately 134 systems in our information systems inventory. More than half of them fall within our primary data centers, and we are working on those that fall outside, 

much of which don’t have PII, but we’re working with those vendors to amend contracts and to ensure that they follow NIST guidance and FISMA guidance. 

Mr. CONNOLLY. Well, remember, one of the explicit goals is consolidation of those data centers. We don’t want a huge, you know, 

plethora of data centers if we can help it. How are you coming on 

that? 

Mr. HARRIS. Well, what we’re doing is we’re looking at those 

things that we can actually consolidate, but we’re also looking at 

a massive retirement of systems that we simply don’t need to be 

carrying on our list of systems inventory. 

Mr. CONNOLLY. We look forward to seeing that progress. Thank 

you. And I thank my colleague from Illinois. 


KING-6430 with DISTILLER
55 

Mr. CARTER. [Presiding.] The gentleman yields. 

The chair recognizes the gentleman from Alabama, Mr. Palmer, 

for 5 minutes. 

Mr. PALMER. Thank you, Mr. Chairman. 

Dr. Harris, you once said in an interview with FedScoop that 

what keeps you up at night are things you don’t know, yet at our 

last hearing—it is November 17 last year—you couldn’t answer 

some basic questions asked about the lack of personal identification, identity verification/authentication and the vulnerabilities in 

the Federal Student Aid central processing system. I would like to 

direct your attention to some slides if the staff can put up the first 

slide. 

[Slide.] 

Mr. PALMER. This is, if you will notice, a conference. It is a presentation from a conference on Federal Student Aid that you did. 

Okay. If you would go to slide number 8. 

[Slide.] 

Mr. PALMER. If you look at slide number 8, you are laying out 

all these things that you are doing. Now, this was in 2011. And 

what concerns me is when I was asking you just a basic question 

about the security measures that are in place to protect the CPS 

system, I mean, CPS system processes 22 million student aid applications a year. There is integration between the Veterans Administration, Selective Service, Department of Justice, Department of 

Homeland Security, Social Security Administration. I mean, there 

are 139 million unique Social Security numbers in this system. And 

your answer to that question was to apologize. You said I don’t 

have operational oversight of that system. I have limited knowledge, but I can certainly get you more information on that. 

Dr. Harris, you know, what you don’t know may keep you up at 

night, but I can assure you when we get responses like that from 

people responsible for keeping our information systems protected, 

when you can’t answer that, that keeps us up at night. 

What I would like to do is to go back to this question and ask 

you, have you had time to learn about this since I asked you that 

question? 

Mr. HARRIS. I have, sir. And as a result of implementing 

FITARA, there are two significant things that have occurred that 

will allow me to engage Federal Student Aid more. I made no apology if you will about my lack of—my lack and limitation in the 

Federal Student area—arena. They have, up unto this point, independence. But FITARA will allow me 1) to have veto authority over 

Federal Student Aid IT activities and spending. It will also put me 

on their Investment Review Board, which I was not on before, to 

actually have an impact on how they strategize and plan their IT 

activities. Now, I can truly get answers about how their ecosystem 

actually works. 

Mr. PALMER. Well, what is the status of implementing the personal identification verification? 

Mr. HARRIS. The PIV? 

Mr. PALMER. The PIV. 

Mr. HARRIS. We are at 95 percent, and the one vendor that we 

talked about is in the Federal Student Aid ecosystem, and we’re 

hoping to be—our plan is to be 100 percent by March —— 


KING-6430 with DISTILLER
56 

Mr. PALMER. You —— 

Mr. HARRIS.—once that vendor segments their architecture. 

Mr. PALMER. You also made a point that you weren’t able to give 

me an answer on that because you didn’t have operational oversight, and I think you may have mentioned that it was performance-based organization. Can you describe the Department’s oversight of the PVO’s information security activities under FISMA 

now? 

Mr. HARRIS. Yes. Under FISMA they followed the same guidelines that the rest of the Department follows, and that actually 

does flow up to me. And that is exactly why we set up the team, 

the senior team to actually ensure that all of the lines are on time 

and are met. 

Mr. PALMER. How many of these—you made all of these points 

that things that you said needed to be done. How many of those 

have actually been done? 

Mr. HARRIS. I would have to see that again on the screen, sir, 

and I can react to that. 

Mr. PALMER. Well, you can go back to that. We’re down to the 

last few seconds here. 

Mr. HARRIS. Okay. But I can respond—I can provide that information to you, sir. 

Mr. PALMER. Okay. That’s all the questions I have, Mr. Chairman. I yield back. 

Chairman CHAFFETZ. I thank the gentleman. 

I will now recognize the gentleman from California, Mr. Lieu, for 

5 minutes. 

Mr. LIEU. Thank you, Mr. Chair. I have a question for Mr. King. 

A number of times this morning you have said that you believe 

Mr. Harris engaged in a hobby rather than a business venture. 

When I think of a hobby, I think of someone collecting stamps or 

building model airplanes or maybe gardening. I am not aware of 

any hobby known as installing home theaters in other people’s 

homes for a profit. Are you aware that in this case that there was 

a business card that said Harris Audio/Visual Innovation, which included a company logo and listed Danny A. Harris as owner and 

operator? Are you aware of that? Yes or no? 

Mr. KING. Only for purposes of preparation for this hearing. That 

was a detail that was in the file that was reviewed by the Office 

of General Counsel —— 

Mr. LIEU. And you had read it? Were you aware of that fact? 

Mr. KING. No. I did not review the entirety of the investigative 

—— 

Mr. LIEU. All right. So you weren’t aware —— 

Mr. KING.—findings. 

Mr. LIEU. So you were not aware until now that he had a business card that listed him as owner/operator? 

Mr. KING. No. I became aware of that in the process of preparing 

for this hearing. That was in the investigative file. The structure 

in the Department —— 

Mr. LIEU. Okay. All right. Second question —— 

Mr. KING.—is the general counsel reviews the investigative findings —— 


KING-6430 with DISTILLER
57 

Mr. LIEU. Are you aware that he paid two employees to do these 

installations in other people’s homes? 

Mr. KING. My understanding is that there were two employees 

who were involved in this activity —— 

Mr. LIEU. Okay. All right. Have —— 

Mr. KING.—and that received compensation —— 

Mr. LIEU. All right. 

Mr. KING.—as part of that. 

Mr. LIEU. Now having known this, do you still believe he engaged in a hobby rather than a business venture? 

Mr. KING. The —— 

Mr. LIEU. Just a yes or no. 

Mr. KING.—determination of whether or not it was a hobby or a 

business venture was based on the recommendation from our Office 

of General Counsel that reviewed —— 

Mr. LIEU. Let me just stop you there. 

Mr. KING.—the entirety of the file. 

Mr. LIEU. Let me stop you there. Let me tell you how it works. 

And I know something about this because I was an active duty 

JAG in the military. I am still in the reserves. I am a military attorney. The way it works in government, attorneys give advice. You 

make the decision. Attorneys don’t make the decision; you do. And 

in this case, I want to know your view, now knowing these facts, 

did he engage in a hobby or a business venture? 

Mr. KING. I credit the judgment of our general counsel —— 

Mr. LIEU. Okay. All right. You were —— 

Mr. KING.—and two deputy secretaries that preceded me —— 

Mr. LIEU. Let me tell you how it works. You are not a rubber 

stamp for you attorney. That is not how it works. And if you think 

that is how it works, then you need to reevaluate. 

So let me shift to another line of questioning based on what 

Chair Chaffetz had mentioned about violating a law, a rule, or regulation. Outside this bubble of Washington, D.C., the rest of America would view what Mr. Harris did as violating a law, rule, or regulation. For you to not find that was simply an error. It was a mistake because your job is not to protect Mr. Harris. It is to send a 

proper tone, standards of conduct, and leadership for your agency. 

And you have now sent the message that you can operate a business venture, not report that on your ethics forms, not report the 

income on your tax filings, and that does not violate a law, rule, 

or regulation. That is simply ridiculous. And you cannot use a 

shield of relying on some recommendation of an attorney. It is your 

decision. It is your job to make the correct decision. You made the 

wrong one. 

I now have questions of Mr. Harris. And, Mr. Harris, I am going 

to ask you something related to cybersecurity now. You had mentioned in your testimony this morning that you said cybersecurity 

is a critical component of what you do but it is not the only one. 

I want to know, do you believe cybersecurity is the most important 

aspect of your job, yes or no? 

Mr. HARRIS. I do. 

Mr. LIEU. Okay. 

Mr. HARRIS. I think it overlays everything else. 

Mr. LIEU. All right. And do you have a chief security officer —— 


KING-6430 with DISTILLER
58 

Mr. HARRIS. I —— 

Mr. LIEU.—for —— 

Mr. HARRIS. I do, sir. 

Mr. LIEU. All right. Does that person report to you or to the Secretary? 

Mr. HARRIS. He reports to me. 

Mr. LIEU. Okay. So some private sector companies have either 

reversed the order of having the chief information officer report to 

the security officer or had the chief security officer report directly 

to the Secretary. What do you think of those models? 

Mr. HARRIS. I don’t feel that there is a conflict of interest. I have 

seen the organizational arrangement in both ways in the CIO organization, as well as outside of it. I personally don’t see a conflict 

of interest between the CSO being inside of the CIO organization, 

but I have seen it, as you’ve indicated, arranged differently. 

Mr. LIEU. All right. So given the not-so-good ratings of the Department, you might want to look at those other models in terms 

of cybersecurity. 

And then I have a sort of general question about the executive 

branch’s approach on cybersecurity. It does seem to me that there 

is no centralized place. You have got different agencies doing their 

own thing. You have got the Department of Homeland Security 

that has some role in cybersecurity. You then have the Office of 

Management and Budget that has some role in cybersecurity. 

Then, you have got this White House cybersecurity czar. Don’t you 

think it would be much better if we had one agency, one person responsible for cybersecurity across all the .gov network that can either take responsibility when things go right or wrong but also 

have the power to go make changes when things are not performing as they should be? 

Mr. HARRIS. Though we interact with all of those bodies that you 

mentioned, we rely heaviest on DHS and their CDM program in 

terms of operationalizing the progress we need to get made. It’s 

DHS that we work most closely with. 

Mr. LIEU. Okay. Thank you. I yield back. 

Chairman CHAFFETZ. Before the gentleman yields back, I ask 

unanimous consent to enter two documents into the record. One is 

a memorandum from Mr. John King, who is sitting before us today, 

to Aaron Jordan, Assistant Inspector General for Investigations, of 

June 23 of 2015. This is where he says, ‘‘Overall, we found no violations of law or regulation.’’ Further, in finding 1, he said, ‘‘It does 

not appear to support the conclusion Mr. Harris violated any law 

or regulation or any standard of ethical conduct.’’ Any standard of 

ethical conduct. You want to get to the heart of why we are here 

today, it is that. 

I also ask unanimous consent to enter into the record July 9, 

2015. This is to Danny Harris from Susan Winchell, follow-up ethics guidance. And without objection, we will enter these into the 

record. 

Chairman CHAFFETZ. This document gives us huge concern given 

that Ms. Winchell’s conclusion was that it is the employee’s responsibility to ask and really what you should do is just ask next time. 

And quite frankly, I don’t know, Ms. Winchell, why we should even 


KING-6430 with DISTILLER
59 

hire you if that is just your advice because there is no enforcement. 

This is the concern. 

I will now recognize the gentleman from North Carolina, Mr. 

Walker, for 5 minutes. 

Mr. WALKER. Thank you, Mr. Chairman. 

Last November, Mr. Harris, I believe we had a conversation and 

I asked you regarding remote access management and the two-factor authentication at the Department. And this is an important 

point for me, I guess for all of us, because this is the first time this 

has happened. Remember, it was a failure in access management 

that contributed to the data breach over at OPM. 

It is especially troubling, given the Department’s failure over the 

summer during the cyber sprint. And I am going to come back to 

the cyber sprint in just a few minutes, but I want to stay on this 

two-factor authentication. Mr. Harris, you told me during my previous question back in November that the Department has 100 percent implemented two-factor authentication, and that the financial 

system audits would be also at 100 percent by December. 

However, according to the inspector general—and this is from 

the FISMA audit of 2014, end of year, it says, ‘‘In some instances, 

although the Department said it completed a recommendation, we 

continue to find that the corrective actions were not implemented.’’ 

Do you or disagree with that finding? 

Mr. HARRIS. Based on my discovery, yes, I have found that the 

discipline that should have been in place in terms of some of the 

recommendations and—findings and recommendations and caps 

were not made, and that’s something that the senior team now is 

ensuring will never happen again. 

Mr. WALKER. So what you testified to me in November you are 

basically saying today was not accurate or was not true? 

Mr. HARRIS. It was based on my understanding. 

Mr. WALKER. Well, what was your understanding based on? 

Mr. HARRIS. Based on the facts that my staff had provided me. 

Mr. WALKER. So this is the staff’s fault? It wasn’t yours? You 

were just going off what the staff told you? So what you said in November is not true but what you are testifying today is? 

Mr. HARRIS. I always base my decisions on the data pulled by 

staff, but at the end of the day, it’s my responsibility. 

Mr. WALKER. Okay. Well, I am glad to hear that part. What 

about the contractors that we are dealing with? Are you sitting 

here testifying under oath today—as I look through these contractors—that every one of these contractors are also operating under 

a two-factor authentication? Are you saying that is the case as 

well? 

Mr. HARRIS. We are saying that is the case. 

Mr. WALKER. So when —— 

Mr. HARRIS. The 95 percent is based on what we are doing internally, as well as the contractors are doing. 

Mr. WALKER. You also said the Department’s two-factor authentication is at level 4 in terms of the level of assurance according 

to the NIST authentication guidelines. Is that correct? 

Mr. HARRIS. That is the—correct with the exception of those that 

use PIV–I. 

Mr. WALKER. Okay. 


KING-6430 with DISTILLER
60 

Mr. HARRIS. I. 

Mr. WALKER. So if that is the case then, then you are not employing two-factor authentication but the Department is also employing the highest level of assurance for 100 percent of all its 

users? That is the goal right here —— 

Mr. HARRIS. That is the goal, sir. 

Mr. WALKER.—is 100 percent? Okay. All right. Well, here is the 

issue. In coming back to this cyber sprint, okay, this summer, 14 

percent minus. And then within a few months you have secured 

100 percent. How in the world does that happen over that short period of time? 

Mr. HARRIS. More times than not it’s about configuring the system, issuing PIV cards, and turning that on. 

Mr. WALKER. But why didn’t you do that earlier then? 

Mr. HARRIS. I think the technical challenge for the vendors that 

implemented this and maintained these systems was larger than 

we anticipated. In —— 

Mr. WALKER. Well, it appears to us that it is only when the light 

is shone on the deficiencies or you start bringing these grades of 

concurrent F’s that you are willing to do something. Mr. King, you 

are fidgeting over there like you are wanting to jump in. What do 

you have to say on this? 

Mr. KING. Yes, sir. So the Department had previously used a 

level 3 goal. That goal was changed to level 4. And in—I joined the 

Department in January 2015, began meeting regularly with the 

team on how we might improve our cybersecurity. After the sprint, 

we began meeting weekly to ensure that we would get to level 4 

across the agency. 

In the Federal Student Aid area, we have a number of external 

contractors. They use PIV–I. In order to get to 95 percent, we needed to amend nearly 60 contracts, which we did with external vendors, provided technical assistance to those external vendors. 

That’s why we’re at 95 percent. So I just want to convey again the 

urgency that we brought to this matter throughout my time at the 

Department. 

Mr. WALKER. Yes, you have been conveying and almost to me 

like you are trying to cover here. I think the Congresswoman from 

D.C., Ms. Norton, really brought it to a point here saying there is 

no consequences for the actions. The people get scored. Your grade 

didn’t change at all. You are still getting high marks. And the irony 

of this is this is education, so what in the world are we teaching 

our children? There are no consequences for their actions? Mr. 

King, today, you are still defending the actions like this is no big 

deal. I don’t understand that. 

I want to ask you right now—I want to come back to this. Under 

oath, are you still saying to me and to this panel and to the American people that you do not believe that any standard of ethical 

conduct was breached? Is that your testimony? 

Mr. KING. My testimony was that I saw significant lapses in 

judgment, that I counseled Dr. Harris —— 

Mr. WALKER. That is what you said. Do you believe that today 

or not? 

Mr. KING. Yes, I believe there were significant —— 


KING-6430 with DISTILLER
61 

Mr. WALKER. Do you believe that any ethical standard of conduct 

was breached or broken? 

Mr. KING. I do not believe there was a violation of law or regulation or policy of the Department. However, I do believe there were 

significant lapses in judgment. I counseled Dr. Harris on those. 

That was the fourth counseling that he received —— 

Mr. WALKER. So let me —— 

Mr. KING.—on that matter —— 

Mr. WALKER.—see, lapses of judgment, ethical conduct. Do those 

two merge at all or are those two separate things? 

Mr. KING. That —— 

Mr. WALKER. You sit here today and you blame it on your general counsel and lawyers for not taking a position of leadership and 

holding the people accountable. 

Mr. KING. No, sir. I —— 

Mr. WALKER. Do you understand why the American people are 

frustrated with this? 

Mr. KING. I disagree with that characterization. I took it very seriously. It’s why I engaged in additional counseling of Dr. Harris. 

It’s why I asked that the counseling that he’d received from the 

ethics officer to be put in writing. 

Mr. WALKER. You took it very serious. What actions did you take —— Mr. KING. I —— 

Mr. WALKER.—toward Mr. Harris? 

Mr. KING. I engaged in counseling —— 

Mr. WALKER. My time is expired. I am sorry. 

Mr. KING. Once again —— 

Mr. WALKER. I have to yield back. Thank you, Mr. Chairman. 

Chairman CHAFFETZ. Don’t worry. We are going to keep going. 

We are going to be here for a while. 

Mr. Clay, you are now recognized for 5 minutes. 

Mr. CLAY. Thank you, Mr. Chairman. 

And let me take a little different tack here and say that, look, 

I appreciate Federal employees’ service to this country, and I am 

sure that Secretary King and Mr. Harris also take their service to 

the people of this nation seriously. 

Having said that, let me ask Secretary King and Dr. Harris, the 

standards of ethical conduct for Federal employees states, ‘‘Public 

service is a public trust.’’ Would you both agree that Federal employees must be held to the highest ethical standards, Mr. King? 

Mr. KING. Yes, absolutely. 

Mr. HARRIS. Yes. 

Mr. CLAY. Mr. Harris? Okay. Mr. King, in your June 23, 2015, 

response to the IG’s reports of investigation into the CIO’s alleged 

misconduct you stated, ‘‘We found no violations of law or regulations.’’ Is that correct? 

Mr. KING. That is. 

Mr. CLAY. The U.S. Attorney’s Office has also declined to prosecute Dr. Harris and has closed its investigation. Is that correct? 

Mr. KING. That is correct. 

Mr. CLAY. However, there may have been violations of the standards of ethical conduct, so let’s take a closer look at the IG’s findings. Ms. Winchell, the IG found that Dr. Harris used Department 


KING-6430 with DISTILLER
62 

email to conduct his outside business. Wasn’t Dr. Harris’s misuse 

of emails a violation of the ethics code prohibiting employees from 

using government property for nonofficial business? 

Ms. WINCHELL. Yes. The standards of conduct provide that employees may not use government resources for other than an authorized purpose. Authorized purpose is not defined by the rules. 

In this context, the authorized purpose would be defined in a department policy that permits a certain amount of personal use of 

government equipment and resources. 

I reviewed the record, and my review of the record was I didn’t 

think it was clear whether this activity was a hobby or a business. 

It is true that there was a business card, it is true that there were 

written proposals for A/V installations, but it’s also true that this 

was never formed as a business entity, it never had a business license, it never had a separate bank account. Several of the people 

that were familiar with it referred to it as a hobby, and several 

people referred to it as a business. 

If it’s a hobby or a personal activity, under the policy, then, a 

certain amount, a de minimis amount of personal use of government resources is permitted. My review of the record is that there 

were 11 emails related to these businesses over a 3-year period, 

and it seems to me that that comes well within the boundary of de 

minimis. 

If, on the other hand, this was considered a business, it would 

be strictly prohibited under that policy to use government resources. At the time that I gave Dr. Harris the counseling, I advised him that it was prudent to consider any activity that would 

generate income such that it needed to be reported on a financial 

disclosure report as a business, regardless of any other factors. 

Mr. CLAY. It sounds to me like a hobby. 

Let me also say that you also found that Dr. Harris did not report on his tax return the income he received from his car detailing 

and home theater installation businesses. Ms. Winchell, wasn’t Dr. 

Harris’s failure to report income a violation of the ethics code requiring Federal employees to satisfy their tax obligations? 

Ms. WINCHELL. Well, of course it concerns me greatly when information is omitted from financial disclosure reports, but occasionally, employees omit information inadvertently. 

In this particular case, looking at the totality of the circumstances, I did not—it is a violation to willfully fail to provide 

information. But in this case, the record reflects that his wife actually queried a tax lawyer about whether the income was reportable 

on his income taxes, and they received advice that it was not, 

which I take to mean he also thought it didn’t need to be reported 

on his financial disclosure report. The advice was wrong, although 

they relied on it, and it was remedied after they realized it was a 

mistake. 

Mr. CLAY. Okay. Fair enough. And they corrected the record. 

Secretary King, the ethics code also requires Federal employees 

to avoid the appearance of impropriety. Wouldn’t you agree that 

any appearance of impropriety involving the Department’s officials 

and employees cannot be tolerated? 

Mr. KING. Absolutely. And that was the focus of my counseling 

with Dr. Harris. 


KING-6430 with DISTILLER
63 

Mr. CLAY. Thank you for your response. 

And, Mr. Chairman, do I get any extra time? 

Chairman CHAFFETZ. You get two gold stars for concluding on 

time. 

Mr. CLAY. Well, thank you very much. I yield back. 

Chairman CHAFFETZ. Your first two gold stars, I would note, but 

two nonetheless. 

Mr. CLAY. All right. 

Chairman CHAFFETZ. We will recognize the gentleman from 

South Carolina, Mr. Mulvaney, now for 5 minutes. 

Mr. MULVANEY. I thank the chairman. I thank the panel. 

I have been struggling a little bit, folks, with how I wanted to 

address this hearing today because the purpose in my mind—and 

I only speak for myself, not for any other member and not the 

chairman or the ranking member. The purpose in my mind, Mr. 

Harris—and, please, several of us have referred to you today as 

Mr. Harris. We mean no disrespect. It is on your name tag, so 

when we can’t remember your name, we look up, it is sitting there 

so —— 

Mr. HARRIS. That’s quite all right. 

Mr. MULVANEY.—I know you have been called—we mean no disrespect. 

I don’t think—at least for me personally, the purpose here is certainly not to try and get you fired. I think that is important for you 

to know that. In fact, for me, it is not even to drill down into the 

details of your car detailing business/hobby, the audio/video, as objectionable as I may find that at a personal level. I think it was 

a bad decision by you and some bad judgment. 

At some point I think I have to recognize that Congress cannot 

be in the job of micromanaging the CIO position vis-a-vis ethics at 

the Department of Education. We might not like it, it doesn’t make 

us happy, but really, not our business. 

You start screwing around, Mr. King, it is a different story, but 

the folks who work for you, I think we have to rely on the process. 

The OIG gets involved, the ethics gets involved, and we may disagree, disagree with the decision, but that is not the purpose here 

is to second-guess, at least in my mind, whether or not what you 

did was right or wrong or whether or not the process of examining 

was right or wrong. 

The purpose of being here is what you are responsible for doing 

for the folks that we represent and the taxpayers and the 139 million people’s whose records you hold. And as we discussed last 

time, Dr. Harris, when you were here in November, it is not just 

the ordinary stuff that I give to Target. You have my bank accounts. That is a whole different level of serious than when I swipe 

my card at the gas station or I buy something at Target. 

So I don’t want us to get distracted on whether or not it was a 

business or a hobby or you reported it on your taxes and lose in 

that minutia the fact that this is really dangerous stuff when it 

goes into the wrong hands. 

So I want to pick up with where you and I were, Dr. Harris, in 

November when you said something that caught my attention and 

we talked about it briefly when you said it wasn’t so much a money 

issue that you had dealing with cyber at the DoE as it was getting 


KING-6430 with DISTILLER
64 

the talent. And you said, look, we are a little tiny agency. It is not 

very sexy. We can’t get the people. And I asked you, I said, look, 

we have other good people in other areas of the Federal Government. In other silos it is sexy. The Air Force, for example, does a 

tremendous job on this. DOD regularly does a really good job on 

this. There are other agencies. What have you been able to do since 

November, Dr. Harris, to try and draw on the resources available 

to us as a Federal Government in order to help protect the data 

of these taxpayers? 

Mr. HARRIS. I’m very pleased to announce that, in addition to becoming a little more aggressive in bringing in our own talent, we 

have taken advantage of what digital services has to offer. They 

have been in a number of times to talk to us about best practices 

and help us strategize. We are moving forward with the DHS for 

the CDM phase 2 project that will allow us to put more sensors 

and collect more data across our ecosystem then we’ve ever been 

able to do before. So I think from that perspective —— 

Mr. MULVANEY. Collecting data, again, this is not my area of expertise. I am more worried about you securing the data than collecting it. So tell me why that is relevant. 

Mr. HARRIS. Collecting it will allow us to secure it. 

Mr. MULVANEY. Okay. 

Mr. HARRIS. It’s in real time that we’re able to use our network 

access control and our data loss prevention that will actually, for 

example, stop you from sending unencrypted and specifically PII 

information outside of our ecosystem, as well as stopping folks from 

coming inside. 

Mr. MULVANEY. Mr. King, what have you done since we were 

here last? I don’t think you were here in November. I may be 

wrong. But what have we done in the last couple of months to 

make sure—did we get access to the talent that you need to do this 

job properly? 

Mr. KING. We have added a new chief security officer on the 

Education Department side who, to your point about military experience, is a retired military officer who comes to us from the Department of Defense and brings expertise on cybersecurity. We are 

in the process of adding additional talent on the Federal Student 

Aid side. 

But we have the technology. This is a challenge across the Federal Government of recruiting adequate talent. And where we need 

to continue to invest as a country is in STEM education so that we 

have a prepared cybersecurity workforce, not only that the government needs, but that the private sector needs as well. 

Mr. MULVANEY. Dr. Harris, I will close by saying this. While we 

are not here to deal with the details of your personal situation 

within the agency, to the extent your activity impacts on what people feel about working at the DoE, it certainly is relevant, and that 

is why I think you are getting all the attention today, and rightfully so. 

But let me close by saying this. While we are not here today to 

have anybody fired, at least in my mind, lose the data and it is a 

different story. Start losing people’s bank records, and as unpleasant as this hearing may have been, it is going to be a whole different level of unpleasant. Lose the data and the next explanation 


KING-6430 with DISTILLER
65 

you’re going to have to give to this committee is why you shouldn’t 

be fired. That is as plain as I can put it. So as reasonable as I am 

trying to be today in laying out for you what we are not here to 

try to accomplish, you can expect me and others to be fairly unreasonable with our patience next time if you lose the stuff. So please, 

don’t lose it. Thanks. 

Chairman CHAFFETZ. I thank the gentleman. 

I now recognize the gentleman from Texas, the subcommittee 

chairman on Information Technology, Mr. Hurd, for 5 minutes. 

Mr. HURD. Well, thank you, Mr. Chairman. And thank you, Secretary King, for being with us today. 

And I would like to echo some of my colleagues’ good work on the 

two-factor authentication. I know the difficulty of that. And, you 

know, I am confident that you all are going to get the 5 percent. 

And I would also say that using the new authorities in FITARA 

to get the FSA CIO under control of your own CIO is important, 

and if you think there are additional authorities that you need in 

order to have the right management structure in place, we are here 

to help. 

The one thing I would caution is saying that we are doing great 

work. Let’s raise our gaze, as Speaker Ryan likes to say, and we 

should not be saying just implementing one part of a larger strategy is good enough. I think we should be talking about when 95 

percent of the recommendations by the IG are approved, that is 

going to be great work. When there are not repeat findings, as you 

mentioned earlier today, Mr. Harris, that would be good work. 

Secretary King, has Mr. Harris been given a performance plan 

since you have been in your new role? 

Mr. KING. When Dr. Harris was directly reporting to me, we had 

a performance agreement around goals that would be accomplished, and those goals were accomplished over the 2015 year. 

That is related to the progress that we’ve seen in many areas of 

cybersecurity. 

Mr. HURD. Has he been given a progress review? 

Mr. KING. We met throughout the year for review of his progress 

and an end-of-year conversation about the overall performance. In 

each—on each of those occasions, although I did express appreciation for the progress we were making, I also conveyed the urgency 

of continued progress —— 

Mr. HURD. Great. 

Mr. KING.—on cybersecurity —— 

Mr. HURD. And we already said—he mentioned he got an outstanding performance. So my question is—this is going to you, Mr. 

Harris—what is EDL? 

Mr. HARRIS. EDL, which happens to have PII, is an investment 

that is an education locator. It allows the public—it’s public-facing. 

It allows the public to reach out to anyone in the Department of 

Education that they need to reach. 

Mr. HURD. And they are putting PII information in that? 

Mr. HARRIS. It’s PII but —— 

Mr. HURD. And this is not FISMA-compliant, is that correct? 

Mr. HARRIS. That is correct, sir. It is PII but we consider it low 

level. In other words, with the name and phone number, we consider it PII, but it certainly doesn’t include Social Security numVerDate Nov 24 2008 14:16 Jun 22, 2017 Jkt 000000 PO 00000 Frm 00069 Fmt 6633 Sfmt 6633 H:\25501.TXT APRIL

KING-6430 with DISTILLER
66 

bers, bank information. So on the one hand it does not have an 

ATO, and we are pushing it to get an ATO. 

Mr. HURD. And when will you get it done? 

Mr. HARRIS. We’re looking for the end of next quarter. 

Mr. HURD. Great. Fifty-four software programs that you all are 

using are no longer supported by the vendor. Why is that? 

Mr. HARRIS. To a large degree, many of these systems owners of 

these tools, sometimes it’s an OS, sometimes it’s an application or 

middleware, simply didn’t have the funding to upgrade them or, 

from a mission perspective, decided that it wasn’t —— 

Mr. HURD. So what do you need to do in order to fix that problem? 

Mr. HARRIS. We are looking to do three things. We’re looking to 

either upgrade or retire 90 percent of those by June. The remaining 

will have to have documentation that says the Department of Education accepts the risk. We will absolutely not allow anyone to sit 

out there and just say, well, we’ll do it at some point. 

Mr. HURD. Secretary King, if that is accomplished by June, I 

would say that is a pretty significant achievement. Secretary 

King—and I am not trying to be coy here—do you know what 

COBOL is? 

Mr. KING. Yes. 

Mr. HURD. Okay. 

Mr. KING. I’m not familiar with the technical details of the coding language but I —— 

Mr. HURD. It is coding language. 

Mr. KING.—but I am aware of what COBOL is. 

Mr. HURD. It was old even when I was going through university 

in programming. 

Mr. MEADOWS. I take exception to that, Mr. Hurd. 

Mr. HURD. And you all have over one million lines of code on 

that. However, we were told at the last hearing on November 17 

that the Department of Education does not use COBOL. Is that 

correct, Mr. Harris? 

Mr. HARRIS. And I was referring to outside of the FSA ecosystem, 

and that is why I said we don’t use it. I wasn’t talking about FSA, 

to clarify. 

Mr. HURD. So now that FITARA is giving you more authorities 

in which to oversee FSA, what is your plan with getting rid of 

COBOL? 

Mr. HARRIS. It’s a good question, and based on the information 

I’m provided, COBOL is old; however, the latest version is considered secure. It has all the patches. From a business perspective, 

FSA is indicating—the FSA CIO is indicating that their business 

decision is to stay on the current version of COBOL and continue 

to keep it updated. 

I do want to engage the CIO at FSA about moving away from 

COBOL not because the software version is insecure but because 

the talent necessary to manage that platform is, as you can imagine, dwindling. 

Mr. HURD. And I want to echo my colleague from South Carolina’s comments, in months from now if these 54 programs—we 

don’t have a plan on getting rid of them, if we don’t have 100 percent achievement on two-factor authentication, you know, we 


KING-6430 with DISTILLER
67 

should be asking larger questions here. And with great responsibility comes great accountability, and we are going to make sure 

you have all the tools you need to get the job done and we are 

going to hold you accountable. 

I yield back. 

Chairman CHAFFETZ. I thank the gentleman. 

I now recognize the gentleman from North Carolina, Mr. Meadows, for 5 minutes. 

Mr. MEADOWS. Thank you, Mr. Chairman. 

Dr. Harris, let me come to your opening statement. In your opening statement, and I quote, ‘‘Others viewed my conduct as questionable.’’ So I guess the fundamental question here today is if others 

viewed it, did you view your conduct as questionable? 

Mr. HARRIS. Congressman Meadows, I would not waste any more 

of your time suggesting that my behavior represented poor judgment. After talking with the IG —— 

Mr. MEADOWS. So your action is questionable. 

Mr. HARRIS. Talking with the IG, after all the interventions with 

leadership, in hindsight, absolutely, I—poor judgment. 

Mr. MEADOWS. All right. 

Mr. HARRIS. I make no excuses. 

Mr. MEADOWS. All right. So, Ms. Winchell, I would believe that 

you take ethics pretty seriously given your job, is that correct? 

Ms. WINCHELL. That’s correct. 

Mr. MEADOWS. So when you hear a complaint, you get on it right 

away, is that correct? 

Ms. WINCHELL. Yes. 

Mr. MEADOWS. And so no time lapses between when you hear 

about it and you work towards remedy? 

Ms. WINCHELL. Well, we would evaluate the allegation and try 

to obtain as much relevant information before we took action, but 

yes —— 

Mr. MEADOWS. Okay. 

Ms. WINCHELL.—we would try to do that as swiftly as possible. 

Mr. MEADOWS. Sure. Mr. King, is that your testimony as well, 

you take it real serious? 

Mr. KING. Absolutely. 

Mr. MEADOWS. Okay. Can either of you, Ms. Winchell or Mr. 

King, explain to me why the inspector general gave you a report 

on April of 2013 and they had to do a follow-up 2 years later and 

said that they had never heard from anybody? Why would that be? 

Mr. King, you may want to answer since it was directed to you 

on March 23 of 2015. In response it says, ‘‘To date, we have not 

received a response from the Office of the Deputy Secretary concerning the findings that they gave on April 2 of 2013.’’ Why would 

they have not had response in 2 years —— 

Mr. KING. When I —— 

Mr. MEADOWS.—if you take it serious? 

Mr. KING. When I joined the Department in January of 2015, the 

IG explained that there was an addendum to the report that was 

forthcoming —— 

Mr. MEADOWS. But that is not what this is saying. I am going 

back to the original report when they put in the report on April 2 


KING-6430 with DISTILLER
68 

of 2013. You know what they heard from you guys? Crickets, not 

a single dadgum response. 

Ms. Winchell, you want to respond to that? 

Ms. WINCHELL. Well, I can’t speak for why the Office of the Deputy Secretary didn’t respond to the IG, but I can tell you that we 

met in the Office of the General Counsel to consider the report I 

think in—I think we were—in April, in the March/April time frame 

in 2013. And at that time we understood from the IG that the offending conduct had ceased. But we also understood —— 

Mr. MEADOWS. How did you figure that out? 

Ms. WINCHELL. I don’t —— 

Mr. MEADOWS. Who talked to Dr. Harris? 

Ms. WINCHELL. I —— 

Mr. MEADOWS. Because you didn’t talk to him, according to your 

note —— 

Ms. WINCHELL. Right. 

Mr. MEADOWS.—until a year later, and you take everything real 

serious, and yet, according to your memo, you didn’t talk to Dr. 

Harris until March 12 of 2014, almost a year after the IG submitted a request. Why would it take a year? 

Ms. WINCHELL. Well, we were—we were waiting for the feedback 

from the U.S. Attorney’s Office to see what—if any action that they 

were going to take on these. We understood that the conduct had 

ceased actually in —— 

Mr. MEADOWS. How did you —— 

Ms. WINCHELL.—fall of —— 

Mr. MEADOWS. How did you understand that? 

Ms. WINCHELL. Pardon me? 

Mr. MEADOWS. Did you go and talk to Dr. Harris? 

Ms. WINCHELL. I understood it from the IG. 

Mr. MEADOWS. Well, now —— 

Ms. WINCHELL. I—it was in my notes —— 

Mr. MEADOWS.—hold on, hold on, hold on just a second. You understood from the IG’s report and —— 

Ms. WINCHELL. No, I didn’t—I don’t—I —— 

Mr. MEADOWS. And they were waiting for a response —— 

Ms. WINCHELL. It’s in my notes —— 

Mr. MEADOWS.—from you. 

Ms. WINCHELL. It’s in my notes that, at the time that we had 

these conversations that the conduct had ceased. 

Mr. MEADOWS. So —— 

Ms. WINCHELL. I did not talk to Mr. Harris personally. 

Mr. MEADOWS. So you are in charge of ethics —— 

Ms. WINCHELL. Yes. 

Mr. MEADOWS.—and you are taking somebody else’s word that 

the conduct has ceased a year later? 

Mr. KING. My understanding is that Deputy Secretary Miller, 

after receiving the initial IG report, consulted with the Office of 

General Counsel and spoke directly with Dr. Harris giving Dr. Harris counseling. 

Mr. MEADOWS. And said it was okay? 

Mr. KING. No. Giving him counseling that there was a —— 

Mr. MEADOWS. Now, how is that your understanding? Did you 

talk to Tony Miller about that? 


KING-6430 with DISTILLER
69 

Mr. KING. That’s my understanding from the staff, the Deputy 

Secretary’s Office —— 

Mr. MEADOWS. Okay. Well —— 

Mr. KING.—overlapped between Deputy Secretary Miller and 

—— 

Mr. MEADOWS. Mr. King, let me tell you what is troubling here. 

I don’t know if Dr. Harris’s actions are the most troubling or your 

cover-up of it is the most troubling, Mr. King, because let me tell 

you the concern I have. Everybody can make a mistake, but the 

minute that it was put forth by the IG, everybody, Ms. Winchell 

and Mr. King, you should have been all over this and saying that 

this is a problem. 

And let me tell you the reason why I am so concerned. I have 

been visiting Federal employees, and you know what I constantly 

hear is that there is a double standard for the people at the top 

and the rank-and-file Federal workers. And today, listening to this 

testimony, I tell you, I hope they are not watching because they 

would use a different word for a bovine waste than what is used 

here. 

Mr. KING. Congressman, I just want to be clear that I took this 

incident very seriously. I started with the Department —— 

Mr. MEADOWS. No, you haven’t because your responses —— 

Mr. KING.—in January of 2015 —— 

Mr. MEADOWS.—I would disagree, Mr. King, because your responses indicate that nothing has happened in terms of retribution. 

No one has been fired. In fact, you approved a big bonus for Dr. 

Harris. There has been no consequences so that —— 

Mr. KING. I disagree. There’s—there have been four counseling 

—— 

Mr. MEADOWS. What are the consequences? 

Mr. KING. There have been four counseling sessions —— 

Mr. MEADOWS. Okay. So his —— 

Mr. KING.—two with the prior deputy —— 

Mr. MEADOWS.—consequence is that —— 

Mr. KING.—secretaries —— 

Mr. MEADOWS.—he has had counseling sessions? 

Mr. KING. Had counseling sessions, corrected the behavior. The 

behavior ended in 2013, fully 2 years before I joined the Department —— 

Mr. MEADOWS. And how do you know that? 

Mr. KING. Based on the findings of the IG addendum —— 

Mr. MEADOWS. But how do you know that? 

Mr. KING. The IG—the IG completed the investigation and provided an addendum —— 

Mr. MEADOWS. But the IG said —— 

Mr. KING.—in March of 2013. 

Mr. MEADOWS.—it was a business. The IG said it was a business, 

and Ms. Winchell disagrees. And with the indulgence of the chair, 

I will finish with this. President Obama sent an Executive order 

just a few weeks ago on Second Amendment. The guidance with 

that said that if you have a business card, you are in the business 

of selling firearms. So in light of that, Ms. Winchell, is the President wrong or are you wrong? 


KING-6430 with DISTILLER
70 

Ms. WINCHELL. I still think that, according to the information in 

the report, it is not clear whether this was a business or a hobby 

at the time that I reviewed the report. 

Mr. MEADOWS. Everybody else is very clear. 

I yield back. 

Chairman CHAFFETZ. Thank you. 

I will now recognize myself. 

Ms. Bruce, how long have you been in the Inspector General’s Office? 

Ms. BRUCE. I’ve been working—doing this kind of work for over 

30 years. I’ve been in specific Office of Inspector General for the 

last 20. 

Chairman CHAFFETZ. And to the best of your recollection just in 

general, how many criminal referrals have you been involved in 

and engaged with during that time? 

Ms. BRUCE. Well, I was an auditor, so I wasn’t specifically in investigations, so I wouldn’t have been involved with those types of 

things. 

Chairman CHAFFETZ. But since you have become —— 

Ms. BRUCE. The deputy inspector general? 

Chairman CHAFFETZ.—more senior—yes, how many have you 

seen? How many have been coming out of the Office of Inspector 

General? 

Ms. BRUCE. I would definitely have to get back with you on that. 

I —— 

Chairman CHAFFETZ. But it is a handful, right? This is not something that happens week in and week out. 

Ms. BRUCE. So when you said criminal investigations, you mean —— Chairman CHAFFETZ. Oh, criminal referrals to the Department of 

Justice. 

Ms. BRUCE. Oh, criminal referrals? Well, we have many criminal 

referrals to the Department of Justice because we don’t know 

whether it’s going to be tried criminally, civilly, or administratively. So we have plenty of those. 

Chairman CHAFFETZ. And so when you do that, you have come 

to a finding that you believe is fairly serious. If we could put up 

the slide of the potential violations here. 

[Slide.] 

Chairman CHAFFETZ. So this is the slide of the potential violations coming out of the IG to the Department of Justice. Now, the 

Department of Justice didn’t come to a conclusion and say you are 

absolutely wrong. They just decided not to prosecute, correct? 

Ms. BRUCE. That’s correct. The Department of Justice declined 

prosecution in favor of administrative remedies. 

Chairman CHAFFETZ. So we can take that slide down. 

Mr. King, this is one of the problems. Because the Department 

of Justice believes that you as the Acting Secretary have the ability 

within your realm to enact the remedies, they decide not to prosecute. Don’t come before this committee, as I believe you did, to try 

to infer that because there was no prosecution, there was nothing 

wrong there. 

Are you telling me, Mr. King, that Ms. Bruce and the inspector 

general is wrong on all 12 of those, not even the standard of breakVerDate Nov 24 2008 14:16 Jun 22, 2017 Jkt 000000 PO 00000 Frm 00074 Fmt 6633 Sfmt 6633 H:\25501.TXT APRIL

KING-6430 with DISTILLER
71 

ing the law, but as you said, you have listed out, ‘‘no violation of 

law, regulation, policy, or ethics’’? 

Mr. KING. The IG doesn’t make a conclusion. They provide findings. The general counsel then reviews those findings. They were 

—— Chairman CHAFFETZ. And they make —— 

Mr. KING. And they made a recommendation —— 

Chairman CHAFFETZ.—a recommendation to? 

Mr. KING. They make a recommendation to me. 

Chairman CHAFFETZ. Yes. 

Mr. KING. To—in this case, it’d be my —— 

Chairman CHAFFETZ. And you are the final —— 

Mr. KING.—predecessor and to my predecessor’s predecessor. In 

each case we took it seriously. We provided counseling. The conduct 

that was in question stopped in 2013. 

Chairman CHAFFETZ. What is it that Mr. Harris did—and I want 

to explain the reason why I think this is so vital. We have thousands—how many people at the Department of Education? How 

many people work at the Department of Education? 

Mr. KING. More than 4,000 employees. 

Chairman CHAFFETZ. Okay. Mr. Harris gets a $15,000 bonus. 

You probably didn’t hand out a whole lot of those, but a lot of people didn’t get bonuses, and probably most didn’t get those high of 

bonuses. They work hard, they care, they are doing things right. 

They don’t need counseling sessions. They don’t need inspectors 

general to come in and interview them. They don’t need to have a 

Department of Justice review their file. And put up the scorecard 

again. 

[Slide.] 

Chairman CHAFFETZ. This is an objective. This isn’t Congress. 

This is not some Republican or Democratic thing. ‘‘Best places to 

work’’ category is the change between 2014 and 2015, every single 

key metric is down, every single one. And it is listed as one of the 

worst places to work, and your turnover rate is near 10 percent. 

So, Mr. King, what—you can take that slide down—what is it 

that Mr. Harris did that justifies pulling money out of the taxpayers’ pocket and giving him a $15,000 bonus? 

Mr. KING. In the evaluation for 2015 is based on the totality of 

performance. Yes, employee morale is very important to us, but it 

is also very important that we made progress on cybersecurity. As 

I indicated, we went from 11 percent at level 4 two-factor —— 

Chairman CHAFFETZ. Can I stop you right there, please? You 

scored an F in what you self-reported. The Office of Management 

and Budget put out a cyber sprint. You were one of, I think, three 

or four agencies that scored a negative. Everybody else bolted 

ahead. So —— 

Mr. KING. Over the course of the 2015 year we went from 11 percent to 95 percent, making dramatic improvements. We are also 

—— Chairman CHAFFETZ. And every single metric was negative, 

every single one. The problem is Mr. Harris has been in charge— 

you can say, well, it was so bad at 11 percent that we had such 

great improvement. The problem is he has been in charge since 

2008. It is not like he just inherited this and he hasn’t had a few 


KING-6430 with DISTILLER
72 

months to fix it. What specifically did Mr. Harris do to justify the 

Congress appropriating people’s money, $15,000? 

Mr. KING. Again, cybersecurity is one aspect of his performance, 

but on cybersecurity he co-led an effort with our FSA CIO that involved amending nearly 60 contracts in order to ensure that all of 

our external vendors are at level 4 two-factor authentication. We 

made dramatic progress there. We are resolving FISMA audit findings, and we’re making progress on cybersecurity. We also have a 

variety of other technology efforts: replacing outdated technology 

systems, improving services to employees. The overall performance 

of the CIO in 2015 was strong. 

I can’t speak to prior evaluations of Dr. Harris’s performance. 

What I can speak to is the progress that we’ve made since I joined 

the Department in January 2015. 

Chairman CHAFFETZ. Again, you are looking at an inspector general report that comes out midyear, criminal referrals, every single 

metric is down, 10 systems still to this date with expired authorities to operate, one has PII information, 54 unsupported software 

systems. You have an inspector general who can go in there undetected into the system. You have the 139 million Social Security 

numbers and this guy gets a bonus. This is why we have zero confidence in you personally, zero. 

Now, I want to ask a few more things because I am telling you, 

this bothers me to no end. Mr. Harris, you gave a loan to one of 

your employees, correct? 

Mr. HARRIS. Correct. 

Chairman CHAFFETZ. Has that been repaid? 

Mr. HARRIS. Yes, it has. 

Chairman CHAFFETZ. When? 

Mr. HARRIS. It was years ago. I don’t have the exact date but I 

can get you that. 

Chairman CHAFFETZ. You listed two other jobs that you currently 

also have, right? You teach, correct? 

Mr. HARRIS. That is correct. 

Chairman CHAFFETZ. How much time does that take? 

Mr. HARRIS. I teach at night and I do it on my own time. And 

if I may, in context —— 

Chairman CHAFFETZ. Yes. 

Mr. HARRIS.—talk about my role as CIO. My average day is 12 

hours, and my superiors and colleagues and customers call me all 

times of the night and weekends. If you look at my leave balances, 

I am rarely away from the Department. So, yes, I do work a lot, 

but I am very passionate and very serious about my job. 

Chairman CHAFFETZ. What is the other job that you have that 

generates income? There is another one. 

Mr. HARRIS. I just teach. That’s it. 

Chairman CHAFFETZ. But you had before. You were working for 

the city of Detroit, correct? 

Mr. HARRIS. I did a short consulting stint with Detroit, both the 

city and the school system, in a different year. 

Chairman CHAFFETZ. And how much time did that take? 

Mr. HARRIS. Very little. I would be in Detroit maybe once every 

other month and then I would work remotely. I was simply consulting them on their IT strategy, so very little. 


KING-6430 with DISTILLER
73 

Chairman CHAFFETZ. Ms. Bruce, let’s go back to this. Does the 

inspector general’s office believe that this was a business or a 

hobby? 

Ms. BRUCE. The Office of Inspector General found business cards, 

a logo, paid employees. We do believe that it’s a business. 

Chairman CHAFFETZ. And were those paid employees subordinates of Mr. Harris? 

Ms. BRUCE. Yes, they were. 

Chairman CHAFFETZ. Is that a violation of policy? I am asking 

for your professional opinion here. 

Ms. BRUCE. So when you say violation of policy, I will answer it 

this way. When you speak of 5 C.F.R. 2635, 5012 701, 702, and 

704, you have to make sure that you’re not giving the appearance 

of impartiality or misuse of position. 

Chairman CHAFFETZ. Mr. Harris, who is Christopher Claiborne? 

Mr. HARRIS. He works in the CIO organization. 

Chairman CHAFFETZ. So he works for you? 

Mr. HARRIS. He is several layers under me, but he works in the 

organization. I do not supervise him. 

Chairman CHAFFETZ. He is in your organization. You are the 

boss, right? If you came into his office and said do this, would he 

do it? 

Mr. HARRIS. I do not supervise him. 

Chairman CHAFFETZ. Come on. Seriously? He works where? His 

title, as best I can tell, Christopher Claiborne—and I don’t mean 

to bring him into this. I am sure he is a nice guy, but I am sorry 

to have to invoke his name here, but you are just not being candid 

with us. He is an operations manager, Office of the Chief Information Officer, correct? 

Mr. HARRIS. That is correct. I just wanted to be clear that I don’t 

supervise him directly. 

Chairman CHAFFETZ. Have you asked him to do work for you? 

Mr. HARRIS. I have not. He has always asked me to be involved. 

Chairman CHAFFETZ. In what? 

Mr. HARRIS. If I had a project that I was doing and he wanted 

to learn, he would ask me. 

Chairman CHAFFETZ. In your outside business was he involved? 

Mr. HARRIS. I didn’t have an outside business. It was a hobby. 

Chairman CHAFFETZ. So when he sends this email dated November 6, 2009, saying ‘‘If you have time, I’d like to talk to you about 

one. This is a million-dollar home in Beech Tree I’d like us to complete’’—talking about leather chair recliners for a theater, complete 

theater, complete bar area. I can go on. ‘‘I sent you pictures.’’ He 

is doing all that. You’re just telling me—how does that come about? 

He is just involved with you in a hobby. 

Mr. HARRIS. Absolutely. 

Chairman CHAFFETZ. Really? 

Mr. HARRIS. It’s something we enjoy doing. 

Chairman CHAFFETZ. And you are his boss? You are ultimately 

in his office? 

Mr. HARRIS. Yes. 

Chairman CHAFFETZ. Mr. King, do you think this is acceptable? 

Mr. KING. Again, after reviewing all of the information —— 

Chairman CHAFFETZ. Well, I am asking you about —— 


KING-6430 with DISTILLER
74 

Mr. KING. Again, after reviewing all of the information that was 

provided, there was not a violation of regulation or law or policy. 

I was, however —— 

Chairman CHAFFETZ. Or concerned? 

Mr. KING. I was, however, concerned about the appearance of— 

potential appearance of impropriety and counseled Dr. Harris to 

that effect, as did my predecessor and my predecessor’s predecessor, as did our ethics officer. And as we’ve discussed previously, 

the activities ended in 2013. 

Chairman CHAFFETZ. Was it unethical when it was happening at 

the time if nobody said it and it was continuing today? Is that unethical? 

Mr. KING. Again, it was a lapse in judgment, and I counseled Dr. 

Harris —— 

Chairman CHAFFETZ. But what —— 

Mr. KING.—to that effect. 

Chairman CHAFFETZ. So good judgment would have said he 

wouldn’t have done that. Unethical judgment would have said— 

where is the line here? Come on. You have got 4,000 employees. 

They are all watching this hearing. Explain to somebody who is 

there and says, you know, my boss has a business and a hobby 

and, you know what, I bet if I helped them make money, that 

might help me. Is that a reasonable conclusion? 

Mr. KING. Where there’s an appearance of impropriety, it is bad 

judgment. I counseled Dr. Harris —— 

Chairman CHAFFETZ. What if there is —— 

Mr. KING.—to that effect. 

Chairman CHAFFETZ. What if there is actual impropriety? 

Mr. KING. In this case, based on the findings of the IG report 

that were provided to our Office of General Counsel and our review 

of those findings, the review that was conducted by Deputy Secretary Miller and then by Deputy Secretary Shelton, by Ms. 

Winchell, and then my review of their findings, there was not a violation here of law or regulation or policy. There were lapses in 

judgment. Dr. Harris was counseled on those lapses of judgment 

four separate times, and the behavior, the activities ended. 

Chairman CHAFFETZ. You really think that Ms. Bruce and the 

Office of Inspector General need a criminal referral because they 

believed there was no violation of law, regulation, policy, or ethics? 

Mr. KING. They provided information to the Department of Justice, and the Department of Justice chose not to proceed based on 

the information they received. That’s what was summarized in the 

addendum that I received in March of 2015. 

Chairman CHAFFETZ. I will now recognize Ms. Plaskett for as 

much time as she would like. 

Ms. PLASKETT. That is very generous of you, Mr. Chairman. I 

won’t forget that. Thank you. 

I just wanted to go back and ask some more questions. And this 

is really about the past conduct, the allegations concerning the past 

conduct. Ms. Winchell, in your testimony on today’s hearing you 

stated that in the time you reviewed the inspector general’s 2013 

report, your understanding was that the activities had already 

ceased and that the matter had been referred to the U.S. AttorVerDate Nov 24 2008 14:16 Jun 22, 2017 Jkt 000000 PO 00000 Frm 00078 Fmt 6633 Sfmt 6633 H:\25501.TXT APRIL

KING-6430 with DISTILLER
75 

ney’s Office for investigation. Is that correct of your understanding 

at the time —— 

Ms. WINCHELL. That’s —— 

Ms. PLASKETT.—you reviewed the inspector general’s April 2013 

report? 

Ms. WINCHELL. That’s correct. 

Ms. PLASKETT. Okay. And, Dr. Harris, had you stopped the activities at issue before the IG issued the April 2013 report? 

Mr. HARRIS. Yes. My last—the last activity I had was 2012. 

Ms. PLASKETT. Last activity? What would that activity have 

been? 

Mr. HARRIS. My hobbies. 

Ms. PLASKETT. Okay. And that would have been the detailing 

and the home technology—the theater —— 

Mr. HARRIS. That is correct. I still detail but I do not accept compensation. It’s still a hobby of mine. 

Ms. PLASKETT. Okay. And I understand that you had—and then 

going back to a contract with E Source Technologies, it is our understanding that you have a personal relationship with the president of that company, a contractor for the Department. And the 

IG’s report references a contract awarded in 2004. What was your 

position in 2004 with the Department of Education? 

Mr. HARRIS. In 2004 I was the deputy CFO, and I was not a personal friend of that vendor then. I knew him. I knew of him, as I 

do other vendors, but I was not a personal friend. 

Ms. PLASKETT. And were you involved in the procurement or the 

contracting as the deputy CFO in 2004? 

Mr. HARRIS. I may have sat on the panel, but I did not select the 

vendor. 

Ms. PLASKETT. What does ‘‘sitting on the panel’’ mean? 

Mr. HARRIS. You simply review what the vendors provide. 

Ms. PLASKETT. You are reviewing and then discussing with the 

others on the panel your recommendation or —— 

Mr. HARRIS. That is correct. 

Ms. PLASKETT. Okay. So you were part of the group that made 

recommendations to the ultimate contracting, but you say you were 

not a personal friend —— 

Mr. HARRIS. That is correct. 

Ms. PLASKETT.—in 2004? 

Mr. HARRIS. That is correct. 

Ms. PLASKETT. When did you consider yourself a personal friend? 

Mr. HARRIS. Approximately 2008 when I moved into the same 

area where the vendor lives. 

Ms. PLASKETT. And did you have any contact with the vendor between 2004 and 2008? 

Mr. HARRIS. I’m sure I saw him as a result of him having business at the Department, but I didn’t—our families weren’t friends. 

We didn’t travel together. We didn’t —— 

Ms. PLASKETT. So you did that after 2008 when you say you traveled —— 

Mr. HARRIS. After 2008, yes, we became friends. 

Ms. PLASKETT. You traveled together —— 

Mr. HARRIS. Absolutely. 

Ms. PLASKETT.—your families? 


KING-6430 with DISTILLER
76 

Mr. HARRIS. Absolutely. We were friends. 

Ms. PLASKETT. And that friendship was started because you 

moved into the area or he moved into the same area? 

Mr. HARRIS. I moved into the same area and we realized that we 

lived in the same area because we ran into each other in the area. 

Ms. PLASKETT. Okay. And then, Ms. Winchell, in your testimony 

you stated that ‘‘It’s not clear that a close personal friendship had 

formed at the time Dr. Harris was involved in activities relating to 

the owner’s company.’’ 

Ms. WINCHELL. That’s correct. 

Ms. PLASKETT. Can you elaborate on that? What did you mean 

by that? 

Ms. WINCHELL. Well, you know, we all create friendly relationships at work, and the way the rule works—actually, the rule 

doesn’t include friendship as the kind of relationship that necessarily gives rise to a conflict. And OG—the Office of Government 

Ethics did that fairly deliberately. They provide a process that you 

can go through to evaluate whether the friendship would give rise 

to an appearance of a conflict of interest, basically evaluating 

whether a reasonable person would question your impartiality if 

you were to work on a matter involving that individual. 

So when I’m looking at these questions—and employees do call 

me from time to time about whether or not they should work on 

something that involves a friend. I’ll ask them a series of questions 

like have you gone on vacation with this friend? How long have you 

known them? You know, sometimes you have people that meet 

their significant others, and technically this rule doesn’t apply to 

them until they’re actually sharing a household. But obviously, 

that’s an important thing to know. 

The report of investigation, the only evidence there is in the report of a close personal friendship is when the vacations occurred, 

which was, I believe, in —— 

Ms. PLASKETT. So —— 

Ms. WINCHELL.—and—in or around 2010. 

Ms. PLASKETT.—before people go on vacations together, they’re 

usually eating and socializing —— 

Ms. WINCHELL. Right. 

Ms. PLASKETT.—and everything else before you to rise to the occasion that I think —— 

Ms. WINCHELL. Absolutely. 

Ms. PLASKETT.—I can go on a personal vacation. 

Ms. WINCHELL. That’s true. But there’s no —— 

Ms. PLASKETT. So you don’t think that there was a personal relationship before they went on a vacation? 

Ms. WINCHELL. Well, I think there probably was, but there’s no 

evidence of that except in —— 

Ms. PLASKETT. Did you ask the questions? 

Ms. WINCHELL. Well, Dr. Harris has said on several occasions 

that the close personal friendship started in 2008. 

Ms. PLASKETT. Did you ask the questions? 

Ms. WINCHELL. I did not ask that question at that time because 

I didn’t know —— 

Ms. PLASKETT. So the series of questions that you ask employees 

when they call and ask —— 


KING-6430 with DISTILLER
77 

Ms. WINCHELL. Correct. 

Ms. PLASKETT.—do I have a personal friendship, when you were 

looking into this, did you ask him those personal questions —— 

Ms. WINCHELL. I —— 

Ms. PLASKETT.—those series of questions? 

Ms. WINCHELL. I did not ask those questions at the time. 

Ms. PLASKETT. So you just took his word for when that personal 

friendship began? 

Ms. WINCHELL. Yes, I did. 

Ms. PLASKETT. Did you think in hindsight—does that make sense 

now? I mean, I have been an ethics —— 

Ms. WINCHELL. Well —— 

Ms. PLASKETT.—counsel. 

Ms. WINCHELL. Right. 

Ms. PLASKETT. I was counsel on the House Ethics Committee 

—— 

Ms. WINCHELL. Okay. 

Ms. PLASKETT.—and I think I would have gone back and looked 

because I don’t want the employee to get into trouble. 

Ms. WINCHELL. Right. 

Ms. PLASKETT. Not that I am just trying to cover myself, but that 

I don’t want him to get into trouble. 

Ms. WINCHELL. I certainly appreciate your point, and I think at 

the time my thought process was that the friendship had ended, so 

I wasn’t concerned about the ongoing implications of that friendship. But I think you are making a valid point. 

Ms. PLASKETT. And so if you were to ask those questions now, 

do you think there may have been some overlap in time period 

when there was a personal friendship and he had involvement with 

this so that the 2013 date may not be the hard date that we should 

be looking at? 

Ms. WINCHELL. Well, I don’t—the hard date that I was looking 

at for when the friendship became a close personal friendship was 

2008 to 2010, and the activity involved in his participation in the 

contract was prior to that time. 

Ms. PLASKETT. Okay. And why did you say his activity was prior 

to that time? Does he not still —— 

Ms. WINCHELL. Because —— 

Ms. PLASKETT.—have an ongoing contract with the Department 

of Education? 

Ms. WINCHELL. He may have—there may be an ongoing contract, 

but there’s no ongoing friendship at this point. In order for the appearance problem to exist, there has to be both, you know—the 

rules are about—this particular rule is about whether or not you 

have a personal interest or friendship on one hand and an official 

duty on the other hand. And at this point in time the friendship 

doesn’t exist. And as I understand it, he also doesn’t participate in 

these contracts. 

Ms. PLASKETT. The president of the company no longer participates in the contracts? 

Ms. WINCHELL. No, Danny—Dr. Harris no longer participates in 

the—does not participate—doesn’t have a role in the implementation of the contracts. 


KING-6430 with DISTILLER
78 

Ms. PLASKETT. Ms. Bruce, do you—and you know that—Ms. 

Winchell, how do you know that? 

Ms. WINCHELL. Well, the only participation that’s detailed in the 

report is from 2004, 2005, 2006. 

Chairman CHAFFETZ. If I can —— 

Ms. PLASKETT. Yes. 

Chairman CHAFFETZ. If the gentlewoman would yield, there are 

still contracts that this company has that you have a responsibility 

for, right? I mean, you are the CIO. They are contracts with the 

Department of Education regarding CIO issues. 

Mr. HARRIS. But I do not have responsibility for the acquisition 

process —— 

Chairman CHAFFETZ. How can you claim you don’t have a responsibility when you are the chief information officer? Those contracts are still outstanding, Ms. Winchell. They are still there. 

They are still in place. They still get money from the American taxpayer via the Department of Education —— 

Mr. HARRIS. Sir, if I —— 

Chairman CHAFFETZ.—correct? 

Mr. HARRIS. If I may, the way the Department is organized, and 

most agencies are organized this way, when it comes to acquisition, 

not just the selecting of vendors but the payment of those vendors, 

that is completely removed from the CIO’s organization. It is purposeful. There is a firewall between me and any contract activities. 

And so I can’t influence in any shape, form, or fashion. 

Now, as CIO, I do set IT strategy but I do not select vendors, 

products, or services. 

Chairman CHAFFETZ. But you did, according to the inspector general, previously engage in the selection. According to the inspector 

general, there was one contract where another company’s proposal 

was ‘‘significantly greater than the proposed by other offerers.’’ And 

that the IG writes that the decision was changed to go to your 

friend William Hall’s company ‘‘based at least in part on input from 

Mr. Harris.’’ 

Mr. HARRIS. That had to have been 2004, and I had no friendship 

with that individual. 

Chairman CHAFFETZ. You have gotten promoted since, then, and 

the contracts continue. So to say that you have no interaction, no 

responsibility, you are the chief information officer. This is the ethical problem that it then presents because you did help him get 

this contract. 

Mr. HARRIS. I’m sorry. I disagree, sir. I’m sorry. 

Chairman CHAFFETZ. You are the CIO, and they are a vendor. 

How do you not have responsibility for that? 

Mr. HARRIS. The firewall that is created on purpose with the contracting organization and the rest of the Department, including 

CIO, and especially CIO when it comes to IT contracts, I am completely removed from and had no authority or influence on that 

process. That is the way we are organized, and most agencies are 

organized that way. 

Ms. PLASKETT. So you have no input on whether or not they are 

effectively carrying out the contract that involves information services? 

Mr. HARRIS. That is correct. 


KING-6430 with DISTILLER
79 

Ms. PLASKETT. You don’t send reports or anything to say this relationship—this contractor is performing the duties that I need for 

my job correctly or incorrectly? 

Mr. HARRIS. That is the contracting officer representative’s job. 

Ms. PLASKETT. And when does —— 

Mr. HARRIS. That is not my job. 

Ms. PLASKETT. Where does the contracting officer get that information from? 

Mr. HARRIS. They get it from the project manager and the people 

working with the vendor, but they would not get it from me. 

Ms. PLASKETT. And the project manager and the people working 

with the vendor would be your employees? 

Mr. HARRIS. That is correct. 

Ms. PLASKETT. And would any of those employees be the people 

who worked for you on your hobby? 

Mr. HARRIS. No. 

Ms. PLASKETT. Were they people who report directly to you and 

give you information about whether the contract was being performed properly or not? 

Mr. HARRIS. They would provide me briefings on the status of 

our various —— 

Ms. PLASKETT. And you have no input or say into whether or not 

that is yea, nay, okay, sounds good —— 

Mr. HARRIS. That is correct. 

Ms. PLASKETT.—let’s continue? 

Mr. HARRIS. From a contractual perspective, that is correct. 

Ms. PLASKETT. Wait a minute. So you are saying that when your 

employees give you reports, you don’t have anything to say about 

it? 

Mr. HARRIS. I would provide my input, but I don’t make contractual statements. 

Ms. PLASKETT. But you provide the input that then goes back to 

the contractual people who are determining whether or not this has 

been performed properly or not? 

Mr. HARRIS. I think that’s an accurate statement. 

Ms. PLASKETT. So you are in some measure involved in this, 

whether it be from you stating that the contractor has performed 

or not performed the work of the contracts properly? Yes —— 

Mr. HARRIS. I would still say that I am removed from the —— 

Ms. PLASKETT. Wait, but that is yes or no. That is yes or no. 

Mr. HARRIS. I would still say I am removed from the acquisition 

process. 

Ms. PLASKETT. I didn’t ask you about the acquisition. I am asking you if, as the CIO and the reports for the contract come to you, 

if you have any input in whether or not those are being performed 

properly or not. 

Mr. HARRIS. Yes. 

Ms. PLASKETT. Thank you. So in stating that, are there additional steps that you believe Ms. Winchell, Secretary King, that 

should be taken to ensure that possibly we need to look at this a 

little further because it appears that when the IG made the report, 

you took it at face value what the IG said and didn’t do your own 

digging in this, Ms. Winchell. 


KING-6430 with DISTILLER
80 

Ms. WINCHELL. Well, I do rely on the IG report. That’s true. I 

assume that they do a full and thorough investigation. So I did rely 

on the report. I don’t do a separate investigation. I don’t have authority to do investigation and have actually been instructed not to 

investigate wrongdoing because it can interfere with the IG’s ability to do their job. 

Ms. PLASKETT. But when you are counseling, these counseling 

sessions —— 

Ms. WINCHELL. I do ask questions. 

Ms. PLASKETT.—you didn’t think it was appropriate to speak 

with Danny on a more deeper level about what he was and was not 

doing? 

Ms. WINCHELL. I did speak to him on a fairly deep level about 

how the rules apply to personal friendships, how they apply to relationships with subordinates, and also misuse of position and misuse of government equipment. We had quite—we’ve actually had 

two lengthy conversations about that over the course of the last few 

years focused specifically on the concerns raised in the report. 

Mr. KING. Congresswoman, if I might, I think —— 

Ms. PLASKETT. Yes. 

Mr. KING.—what you are raising is exactly the issue of appearance of impropriety on which Dr. Harris was counseled by Deputy 

Secretary Miller, then Deputy Secretary Shelton, and by me to the 

reason, my understanding, that he ended the relationship entirely 

in 2013 so that there would not be an appearance of impropriety. 

What is clear, though, on the sequencing of the contracting is 

that the only findings that the IG had was that the personal 

friendship began in 2008. These contract matters occurred in 2004. 

But again, in order to ensure that there is no appearance of impropriety, he was counseled on these matters and ended the relationship in 2013. 

Ms. PLASKETT. But, Secretary King, you have an enormously important job. Your job is to educate the American children, our future. And you don’t have time to be dealing with stuff like this. But 

what I am finding in this hearing that is really disturbing is that 

it has taken all of these other Members of Congress questioning 

Dr. Harris and going through this with a fine-tooth comb to find 

out that a lot of the statements that he has made in an IG report 

really don’t cover up the entire truth of what was going on. To say 

that he was not involved in the requisition of the contract is correct 

after 2004, but to say he had no say and involvement in the contract is not a true statement. 

And I think—that is not incumbent on you, sir. That is incumbent on Ms. Winchell, Dr. Harris to be telling us the complete truth 

of it and not just concerned about making himself look like he had 

a hobby and was not so involved in the contracting with the personal relationship. That is what is disturbing to me because this 

is not your job to do. This is Ms. Winchell’s, this is the IG, this is 

those counsel that you relied on to ask these more substantive 

questions, and obviously, unfortunately, almost cross examination 

of Dr. Harris to get to the truth of the matter. 

Chairman CHAFFETZ. I now recognize the gentleman from North 

Carolina, Mr. Meadows. 


KING-6430 with DISTILLER
81 

Mr. MEADOWS. Mr. King, so let me make sure I am clear. Your 

testimony here today is that there has been no ethical breach by 

Dr. Harris? That is your testimony? 

Mr. KING. That there has been no violation of law or regulation 

or policy of the Department —— 

Mr. MEADOWS. Yes, you keep going back to that. Is that what the 

general counsel told you to respond every time you were asked a 

direct question is to respond with that? Is that what your counsel 

—— Mr. KING. That’s my response to the question I was asked. 

Mr. MEADOWS. So there is no ethical challenge? 

Mr. KING. Again, there is no violation of the law or regulation 

—— 

Mr. MEADOWS. Okay. 

Mr. KING.—or policy of the Department. 

Mr. MEADOWS. If that is the case, I have got good news for you, 

Mr. Harris. You can go back to doing whatever you darn well 

please because what he is saying is there is no violation. 

Mr. KING. Congressman, respectfully —— 

Mr. MEADOWS. No, that is what you are saying. 

Mr. KING. No, respectfully, what I am saying —— 

Mr. MEADOWS. That is a circular reasoning. 

Mr. KING.—is that—no. It’s —— 

Mr. MEADOWS. You are saying it is not. Why did you stop, Dr. 

Harris? If there was no violation of ethical standards, why did you 

stop? 

Mr. HARRIS. In hindsight and after getting counseling, I realized 

the appearance is not good. 

Mr. MEADOWS. All right. So let me ask you this, Mr. King. Why 

did three different Secretaries counsel Dr. Harris? If the first one 

took, why was there a need for a counseling of the second one? Why 

is there a need for the third one? 

Mr. KING. The evidence of those activities —— 

Mr. MEADOWS. If it was done on 2013 according to your testimony, everything was over, why did everybody keep following up 

with Dr. Harris? If there is no violation of ethics or anything else, 

why would you have embarked to counsel him again? 

Mr. KING. The evidence is that the initial counseling was effective and that the initial counseling was effective and that the activities ended in 2013. 

Mr. MEADOWS. So why did you waste your time? 

Mr. KING. But both my predecessor and I believe that high ethical standards are of the upmost importance and —— 

Mr. MEADOWS. So he did violate ethical standards? 

Mr. KING.—also the importance—and wanted—no, and wanted to 

convey, wanted to convey —— 

Mr. MEADOWS. You can’t have it both ways, Mr. King. You can’t 

have it both ways. 

Mr. KING. Again, we wanted to convey to Dr. Harris that there 

could not even be the appearance —— 

Mr. MEADOWS. Let me tell you what you are conveying —— 

Mr. KING.—of impropriety. 

Mr. MEADOWS.—to the American people. Let me tell you what 

you are conveying to the American people, and more importantly, 


KING-6430 with DISTILLER
82 

to the 4,000 workers at the Department of Education, is that you 

can bend the rules; it just is a matter of who you are if you are 

bending the rules. And that is a sad commentary here today because, Ms. Winchell, you said that you go by what the IG has, is 

that—that was your testimony, right? 

Ms. WINCHELL. That’s correct. 

Mr. MEADOWS. Okay. If the IG said it was a business, which she 

did, why did you not go by that? You questioned it there. 

Ms. WINCHELL. Well, in all honesty, I’d have to go back and see 

exactly what the report said but —— 

Mr. MEADOWS. I have read it. 

Ms. WINCHELL. I —— 

Mr. MEADOWS. And I am telling you she said it—your testimony, 

Ms. Bruce, was it a business? 

Ms. BRUCE. Correct. We said because income was being generated, has a business logo and employees were paid —— 

Mr. MEADOWS. It was a business. So why did you not take her 

advice—you did on everything else. Ms. Plaskett said that you 

should have done your investigation. You said you relied on it, but 

yet, on the business part, you didn’t rely on it. 

Ms. WINCHELL. Well, I relied on the facts that they provided and 

on the breadth of their investigation, but I did not rely on the conclusions that they reached because I thought their conclusions were 

wrong. 

Mr. MEADOWS. But that is not what you said, Ms. Winchell, in 

answering Ms. Plaskett. And again, you are using circular reasoning. You said that it was the IG’s assumption that he was either 

innocent or guilty, and so what you did was took their words and 

then you came to your own conclusion? Is that what you are saying, without an investigation? 

Ms. WINCHELL. I came to my own conclusion based on the facts 

that were provided in the investigation. 

Mr. MEADOWS. All right. So, Ms. Bruce, Mr. Harris paid 11 employees? That was your testimony? I may have missed that. 

Ms. BRUCE. No, two employees. 

Mr. MEADOWS. Two employees. 

Ms. BRUCE. Yes. 

Mr. MEADOWS. So he paid two different employees? 

Ms. BRUCE. Yes. 

Mr. MEADOWS. Mr. Harris, was a 1099 filled out or a W–2 filled 

out for those two employees? 

Mr. HARRIS. No, sir. 

Mr. MEADOWS. So did they make over $600? 

Mr. HARRIS. I don’t believe so. 

Mr. MEADOWS. You are under oath. Neither of them made over 

$600? 

Mr. HARRIS. I’ll—I’ll —— 

Mr. MEADOWS. Were never paid over $600? 

Mr. HARRIS. One may have made over $600. I don’t believe the 

other did but I would have to look at the record. 

Mr. MEADOWS. So aren’t you required to do a 1099? 

Mr. HARRIS. As I —— 

Mr. MEADOWS. I mean, if they are working for you. 

Mr. HARRIS. As I indicated, it was just a hobby. 


KING-6430 with DISTILLER
83 

Mr. MEADOWS. Okay. 

Mr. HARRIS. In hindsight —— 

Mr. MEADOWS. So you told me it was just a hobby and so now 

you are detailing operation is just a hobby, is that correct? 

Mr. HARRIS. Absolutely, and I make —— 

Mr. MEADOWS. Okay. Well, I have two cars. When can I sign up? 

If it is a hobby, I mean I would love to bring my cars and let you 

detail my cars. Dr. Harris, I think you and I both know it is not 

just a hobby. 

Mr. HARRIS. It was a hobby, sir. 

Mr. MEADOWS. Okay. Have you done any personal work for anybody, Ms. Winchell, Mr. King? 

Mr. HARRIS. I have not, sir. 

Mr. MEADOWS. Ever? 

Mr. HARRIS. Ever. 

Mr. MEADOWS. Okay. How do we go from here, Mr. King, because 

it is not over with this hearing. I know a lot of people like to get 

prepared for a hearing and say it is all over and it is not over, I 

can tell you, because we have a responsibility to the American people and responsibility to the Federal workers who were whistleblowers, who are probably disappointed with your response today. 

So where do we go from here? 

Mr. KING. Again, corrective action was taken. The behavior 

ended in 2013. Our focus at the Department is on ensuring that 

we move forward on cybersecurity and the other urgent priorities 

of the Department. We are making significant progress on 

cybersecurity, but we have much more to do and to ensure that we 

are responding as best we can to the cybersecurity threats —— 

Mr. MEADOWS. So let me —— 

Mr. KING.—that exist. 

Mr. MEADOWS. Let me close with this last question then. What 

message does it send to all the Federal workers if we have someone 

who has been referred for criminal action by the OIG, who has 

been counseled three times for questionable behavior, and continues to get outstanding performance reviews and bonuses that 

would make most of us blush? What message does it send, Mr. 

King? 

Mr. KING. The message is clear. Where there was the appearance 

of impropriety —— 

Mr. MEADOWS. I agree the message is clear, but I am —— 

Mr. KING. Where there was the appearance of impropriety, the 

employee was counseled by three deputy secretaries, by our ethics 

officer —— 

Mr. MEADOWS. And the checks kept —— 

Mr. KING.—and the activities —— 

Mr. MEADOWS.—coming. And the checks —— 

Mr. KING. The activities —— 

Mr. MEADOWS.—kept coming. 

Mr. KING. The activities ended, and the employee understands 

the importance of not even allowing the appearance of impropriety. 

Mr. MEADOWS. I will yield back. Thank you, Mr. Chairman. 

Chairman CHAFFETZ. Thank you. I have a few things to clean up. 

Mr. Harris, William Hall was the person in question here. He 

may be the finest man, offering good services. I hope so. We are 


KING-6430 with DISTILLER
84 

sending him I don’t know how many dollars, so I am guessing millions of dollars. According to the inspector general, you actually 

went to his house and installed home theater equipment, correct? 

Mr. HARRIS. I did. 

Chairman CHAFFETZ. Was that you personally? 

Mr. HARRIS. That was me personally. 

Chairman CHAFFETZ. Who else was involved in that? 

Mr. HARRIS. Just me. 

Chairman CHAFFETZ. And what were you paid by him to do that. 

Mr. HARRIS. I was not compensated. 

Chairman CHAFFETZ. So this is a person with how many contracts, six or eight contracts with the Department of Education, 

and you go to his house, you have a business—I disagree. I don’t 

think this is a little hobby. I think this is—I agree with the inspector general here. And you go to this person’s house and you install 

a home theater system, and he paid you how much? Nothing? 

Mr. HARRIS. He was a friend. 

Chairman CHAFFETZ. Mr. King, you don’t see any ethical problem 

doing that? 

Mr. KING. Again, Dr. Harris was not involved after 2008 when 

this relationship began —— 

Chairman CHAFFETZ. No, I am just asking about when it happened —— 

Mr. KING.—and the contract —— 

Chairman CHAFFETZ.—at the time. 

Mr. KING. But what I counseled him on was —— 

Chairman CHAFFETZ. No, he was —— 

Mr. KING.—that we can’t have—we —— 

Chairman CHAFFETZ. That is—but wait, wait, wait. Mr. King, 

you are making an assumption that the inspector general says is 

not true. 

Mr. KING. No, they —— 

Chairman CHAFFETZ. They laid out a case where Mr. Harris was 

involved—a contract was going to a different vendor. He got personally involved and at least had some input. I am not saying the 

final decision, some input, and that contract was changed and 

given to William Hall’s company. 

Mr. KING. There was a contract in 2004 before this relationship 

began according to the evidence. 

Chairman CHAFFETZ. But he was the program manager —— 

Mr. KING. There then was —— 

Chairman CHAFFETZ.—for other contracts. 

Mr. KING. But again, the personal relationship —— 

Chairman CHAFFETZ. No, wait a second, Mr. King. The initial 

contact, the interaction Mr. Harris had with William Hall started 

in like 2000, 2001. 

Mr. KING. As acquaintances —— 

Chairman CHAFFETZ. So it is an acquaintance —— 

Mr. KING. Based on the evidence —— 

Chairman CHAFFETZ. There is a standard between an acquaintance and a friend? 

Mr. KING. Based on the evidence that was presented by the IG 

to our general counsel, there was a —— 


KING-6430 with DISTILLER
85 

Chairman CHAFFETZ. I am tired of hearing about you and your 

general counsel, okay? They can give you all the advice you want. 

You make the decisions. You are the decision-maker. So let’s just 

cut that part out and get right to the —— 

Mr. KING. Again—again —— 

Chairman CHAFFETZ.—chase here. 

Mr. KING. Again —— 

Chairman CHAFFETZ. Hold on one sec. Hold on one second. You 

see no ethical problem with somebody who oversees and supervises 

the personnel who have to implement these contracts with them 

personally going and installing home theater equipment to a company that I am guessing makes millions of dollars from those contracts? 

Mr. KING. As I indicated, I made clear in my counseling to Dr. 

Harris —— 

Chairman CHAFFETZ. Yes, if you are just going to read —— 

Mr. KING.—that there cannot be —— 

Chairman CHAFFETZ.—the same thing 

Mr. KING.—there cannot be an appearance of impropriety to the 

extent that having this personal relationship —— 

Chairman CHAFFETZ. Well, I want to know if there was any impropriety, and in your mind, you are saying no —— 

Mr. KING. What I’m saying is that —— 

Chairman CHAFFETZ.—there is no —— 

Mr. KING.—the appearance, as a result of the personal relationship, was a problem. Dr. Harris understood that. The relationship 

ended in 2013. 

Chairman CHAFFETZ. I think Mr. Meadows is exactly right. You 

can’t have it both ways. Either Mr. Harris violated no regulation, 

law, policy, or any ethical concern and you should continue on, sir. 

According to Mr. King, continue on, play on. You have had nothing 

docked in your pay, you have progressed at every level, you got 

bonused up. I mean, you have had, what, almost $250,000 in bonuses over the last 11 years. Congratulations. And you have side 

businesses, three other jobs, you had people that had contracts 

with you that were going to their home and installing theaters, 

over a 2-year period you exchanged 700 phone calls that were text 

messages you say, but you say, hey, there is no relationship. You 

still oversee those. I don’t know how you get away with it. I really 

don’t. I am concerned about the other 3,900 and however many employees are out there. I think you are sending the wrong mix. 

And, Mr. King, I hope at some point you do reevaluate and go 

through this. 

I have got one other thing here. Mr. Harris, what was the—you 

had to go back with this unreported income. How much money are 

we talking about was the unreported income? 

Mr. HARRIS. It was 1 percent of my household income. 

Chairman CHAFFETZ. Over what period of time? 

Mr. HARRIS. Over a 10-year period. 

Chairman CHAFFETZ. So over a 10-year period you are making in 

excess close to $2 million during that time. 

Mr. HARRIS. No, sir. No, sir. It was an average of $4,000 a year, 

and that was before expenses. After expenses it was hundreds of 


KING-6430 with DISTILLER
86 

dollars. And that is why—poor judgment, but that is why I didn’t— 

it wasn’t a business. It was just a hobby. But it was —— 

Chairman CHAFFETZ. So there is $40,000 in revenue? That is 

what we are talking about, that wasn’t —— 

Mr. HARRIS. Over 10 years, and again, that’s before expenses. 

With—after expenses, it would have been hundreds of dollars. 

There literally was no major profit to be made. It was insignificant 

amounts of money. 

Chairman CHAFFETZ. But you had employees, you were installing 

home theater equipment, you had people —— 

Mr. HARRIS. I did not have employees. 

Chairman CHAFFETZ. Okay. You had independent contractors 

that worked at the Department of Education that also worked for 

you, and they had dual income as well. I am just trying to—so if 

it is 1 percent of your income, you said 1 to 2 percent of your income over 10 years. 

Mr. HARRIS. Annually, 1 percent annually. 

Chairman CHAFFETZ. I know but I am taking your salary, 

183,000. You haven’t always made that much. You multiply that 

times 10. That equals how much? One point eight million dollars. 

Take what is 1 or 2 percent of that, yes, and you start —— 

Mr. HARRIS. No, sir. 

Chairman CHAFFETZ.—to come up with tens of thousands of dollars that I just want to understand the gravity. We will work on 

the math with you and the Department of Education soon. 

I could continue on, but we have exhausted this. Mr. King, with 

all due respect, Ms. Winchell—let me do this before we do this. 

Ms. Bruce, we have talked about several things here over the 

last few minutes. You looked like you wanted to make some sort 

of comment there. 

Ms. BRUCE. Only that I know we spent quite a bit of time talking 

about business. The OIG at no time never was approached to get 

some additional information. We’ve always been available for that 

additional information. Our concern has not been business. It’s 

been about earned income. So I wanted to make sure that point 

was made clear. When you asked me about a business, it was about 

earned income in our report and not necessarily about a business. 

Chairman CHAFFETZ. And, Ms. Winchell, the policy is any income above $200, correct? 

Ms. WINCHELL. Yes, actually, it’s the law that governs the financial disclosure reporting. 

Chairman CHAFFETZ. Right. 

Ms. WINCHELL. It’s $200 from any source. Because Dr. Harris 

didn’t form a business, that would be over $200 from each person 

who paid him to provide a service in a given year. So, for example, 

if he installed a home AV system for—and earned $700, he would 

need to report that. But if he detailed a car for $74 or $100 —— 

Chairman CHAFFETZ. Right. 

Ms. WINCHELL.—that would not need to be reported. 

Chairman CHAFFETZ. Yes, and I —— 

Ms. WINCHELL. In other words, they don’t have to —— 

Chairman CHAFFETZ. In my mind, it is actually more understandable. And why do we do that? Why do we get disclosures of 

$200 or more? 


KING-6430 with DISTILLER
87 

Ms. WINCHELL. Well, I can’t speak for why the Legislature set the $200, but the whole point of the system is to help the government identify and remediate potential—actual and potential conflicts of interest. 

Chairman CHAFFETZ. Yes, it is an ethical issue. 

Ms. WINCHELL. Exactly. 

Chairman CHAFFETZ. Did he fill out a form for 10 years or did 

he fill a form out for just one year? 

Ms. WINCHELL. Mr. Harris actually has filled out his public financial disclosure form completely and in a timely manner every 

year. And when we have had questions that we needed to address 

on technical aspects of the form, he’s been very responsive. 

Chairman CHAFFETZ. I don’t know how you come to the—it’s kind 

of laughable almost that after this hearing you still think he filled 

it out completely. 

Ms. Bruce, what did you find there? 

Ms. BRUCE. Our evidence showed that for the years in question, 

2008, ’09, and ’10, there were no disclosures as far as the $200— 

in excess of $200. 

Chairman CHAFFETZ. And Mr. Harris admitted that he is making 

money every year for 10 years, and there are 3 years that they 

didn’t complete them. And you just said—this is what scares us— 

this is why we got a hearing that is going into hour 4 is because 

you still—as the ethics officer, you spend supposedly 8 hours a day 

working on ethics, hard to believe that that happens, you still don’t 

understand it. You still don’t know that there is a problem. 

And, Mr. King, you are enabling this. You are the decisionmaker. You have been given this mantle of trust from the President of the United States and you are failing. And it has got to 

quit. 

You still don’t know. He admitted right here just now that for 

10 years he has been having this income and the inspector general—why are you shaking your head back in the audience just 

laughing at us? You are laughing at the American taxpayer. I don’t 

know who that guy works for. I am telling you, don’t just sit there 

and laugh at us. I will follow this through. You didn’t think we 

were taking this seriously. You are making a fundamental and 

total mistake. You are misusing American taxpayer dollars. We 

have vulnerabilities that are just unbelievable. And we will continue to pursue this. 

You better hope that none of that data gets out there. But when 

the inspector general went to penetrate the system, they got in 

there unimpeded, never detected, walked back out and reported it 

to Congress, as they should. 

Ms. Bruce, to the people that work in the inspector general’s office, thank you. Thank you for your good work. We wouldn’t know 

about this without those good people doing tough, difficult work. 

Nobody wants to hear from the inspector general, but they do some 

of the most valuable work that we have before us today. I thank 

you all for your service, and I thank you for your testimony today. 

I thank the men and women who work in the Department of Education. We are trying to fix it, but the problem is sitting here with 

Ms. Winchell and Mr. King and Mr. Harris. 

This meeting is now adjourned. 


KING-6430 with DISTILLER
88 

[Whereupon, at 12:59 p.m., the committee was adjourned.] 


KING-6430 with DISTILLER
(89) 

APPENDIX 

MATERIAL SUBMITTED FOR THE HEARING RECORD


KING-6430 with DISTILLER
90 


KING-6430 with DISTILLERInsert offset folio 24 here 25501.024

Questions for Dr. John B. King, Jr. 

Acting Secretary 

U.S. Department of Education 

Questions from Chairman Will Hurd 

Subcommittee on Information Technology 

Committee on Oversight and Government Reform 

February 2, 2016, Full Committee Hearing titled: 

"U.S. Department of Education; Investigation of the Chief Information Officer" 

1. Do you know where the Department's sensitive or regulated data resides 

across its IT infrastructure? How does the Department and OCIO keep 

track of this? 

The Department closely monitors all of its IT systems and applications to identifY the types 

of data being processed and stored, and to ensure the appropriate level5 of protections are 

in place. Under the Federal Infurmation Security Management Act (FISMA) and as part of 

the Department's enterpri<;e cybersecurity program, an Authority to Operate (ATO) i<; 

i<;sued fur all IT systems which documents the IT environment and systems boundaries, 

including the data that resides in or i<; utilized by the application. Based on that 

infurrnation, the security assessment teams verifY the appropriate safuguards have been 

fully imp'lemented. The ATO accounts for the implementation and sustainment of required 

IT control5. The Department al5o tracks all sensitive data in its IT environment by 

developing and managing the various Privacy Impact Assessments (PIA) and System of 

Record Notices (SORN). In addition, the Department's IT system inventory i<; tracked in 

the FISMA tracking and reporting tool More specifically, in the tooL the Department 

categorizes all IT systems as high, moderate, or low using Federal Information Processing 

Standards (FIPS) and National Institute of Standards and Technology (NIS1) guidelines. 

Based on thi<; determination, the corresponding IT security control5 are implemented 

commensurate with the data categorization. 

2. Do you know of all Department nsers who have access to the most 

sensitive data? What controls are currently in place, other than twofactor authentication, to address security risks associated with privileged 

~? 

The Department monitors all users who have access to the most sensitive data. In addition 

to two-fuctor authentication, the Department has a series of control5 in place to address the 

security ri<;ks associated with access to sensitive data by privileged users. First and 

furemost, the Department's privileged users with access to the most sensitive data are 

required to comply with Federal personnel security requirements. Background 
91 


KING-6430 with DISTILLERInsert offset folio 25 here 25501.025

investigations and reinvestigations are a mandatory component fur .all employees and 

contractors with access to IT systems. The Department also requires mandatory IT security 

training (general and specialized) prior to issuance of credentials. This ensures that Federal 

employees and contractors are knowledgeable of the security regulations and user 

responsibilities with respect to the security of federal networks, systems, and data. 

The capabilities ofthe Department's two-fuctor authentication tool also assists with 

protection of sensitive data by implementing automated access controls and monitoring 

capabilities, limiting the users ability to only access data they have permissions to view, 

and implementing the least privilege the requirement. 

Federal Student Aid (FSA) also utilizes access controls through two other systems, 

Personal Authentication Service (PAS) and the Access and Identity Management System 

(AIMS). PAS provides access and identity management for FSA's non-privileged users 

(students, parents, and borrowers) to access FSA applications. All users outside ofFSA 

needing access to other people's personally identif~able information (PII) are only able to 

access FSA sensitive data after obtaining an account in AIMS. AIMS provides access and 

identity management for FSA's line-of-business applications fur users who can access 

other people's Pli, including ED employees, contractors, school users and third-party 

servicers. AIMS utilizes an architecture that includes access management tools, identity 

management tools, enterprise policy repositories, enterprise user repositories, two-fuctor 

authentication and other related security components to enfurce and assist user access 

management, controls, and security related services for FSA systems and Department of 

Education systems. AIMS security controls includes: Authentication, Authorization and 

Accountability; Single Sign-On; Identity management; and Two-Factor Authentication. 

Additionally, the Student Aid Internet Gateway (SAIG) Enrollment Agreement, which is 

required prior to being given an AIMS ID, is entered into by each Title N participating 

institution. The SAIG agreement includes a provision that the institution "[m]ust ensure 

that all Federal Student Aid applicant infOrmation is protected fi'om access by or disclosure 

to unauthorized personneL" 

3. Does the Department have insight about the potential and magnitude of data 

exposure across its IT infrastructure? 

Under the Department's enterprise cybersecurity program, through the implementation of 

NIST compliant security processes and procedures, the Department has insight about the 

potential and magnitude of data exposure across the IT infi'astructure. The Department has 

the necessary visibility into the category of systems and types of data being processed and 

stored across the IT environment. 
92 

Æ 


KING-6430 with DISTILLERInsert offset folio 26 here 25501.026

Questions for Ms. Snsan Winchell 

Assistant General Counsel of Ethics 

U.S. Department of Education 

Questions from Chairman Jason 

Committee on Oversight and Government 

Reform 

Febmary 2, 2016, Full Committee Hearing titled: 

"U.S. Department of Education; Investigation of the Chief Information Officer" 

1. During the hearing, Dr. Harris testified to earning income over a ten-year period,. The 

OIG fuund that Mr. Harris did not disclose income on required furrn OGE-278 during 

the 2008-2012 timeframe. Did Mr. Harris disclose income from side business on the 

OGE-278 limns, or as he refurs to them as ''hobbies," over the 2002-2007 timeframe? 

Pursuant to the Ethics in Government Act, an agency maintaining public financial 

disclosure reports must destroy such reports after six years, unless needed in connection 

with an ongoing investigation --5 U.S.C. app. § lOS( d). The Department complies with 

this policy to destroy records after 6 years. Therefore, at the current time, Dr. Harris's file 

contains reports filed after 2009. As a result, it is not possible to report whether Dr. Harris 

included income from his outside activities that were the subject ofthe above-mentioned 

hearing on his reports filed during the time period 2002-2007.