For Release on Delivery

Expected at

10 a.m. EDT

Monday,

October 2, 2000

GAO-01-87T

ELECTRONIC

GOVERNMENT

Opportunities and

Challenges Facing the

FirstGov Web Gateway

Statement of David L. McClure

Director, Information Technology Management Issues

Testimony

Before the Subcommittee on Government Management,

Information, and Technology,

Committee on Government Reform,

House of Representatives

United States General Accounting Office

GAO
GAO-01-87T FirstGov.gov

Mr. Chairman and Members of the Subcommittee:

I appreciate the opportunity to be here today to participate in the

Subcommittee’s hearing on the status of FirstGov.gov, the

Administration’s new web site that is intended to serve as a portal to all of

the federal government’s publicly available, on-line information and

services. As you know, FirstGov.gov became operational just 10 days ago.

My remarks today will focus primarily on describing what can be

accomplished with FirstGov.gov and identifying challenges that should be

addressed as its continued development and refinement move forward.

As this Subcommittee is well aware from other hearings, federal agencies

are beginning to provide an array of on-line or e-government services.

Although the predominant service available to date involves the collection

or dissemination of information and forms, government agencies at both

the federal and state levels have also begun enabling citizens and

businesses to perform such functions as buying and paying for postage

stamps or commemorative coins, submitting bids and proposals for

government contracts, and renewing drivers’ licenses. These changes are

being accelerated by Presidential directives, legislative mandates—such as

the Government Paperwork Elimination Act (GPEA)1 and the Electronic

Signatures in Global and National Commerce Act (E-SIGN)2—and growing

expectations from a larger number of citizens and businesses as they

embrace the use of the Internet and World Wide Web. Opportunities for

additional services abound as new global web technologies are developed

and e-government applications become more prominent and widely

accepted by citizens and businesses nationwide.

In prior testimony and reports, we have noted the opportunities for greater

citizen access and interaction with the federal government via on-line and

Internet-based services.3 In many cases, this also offers potential for

conducting government business and activities in a more cost effective

and efficient manner. However, we have also cautioned the Congress that

the likelihood of successful outcomes will depend on agencies’ top

management involvement, support, and leadership, as well as diligent

1P.L. 105-277, Div. C, Title XVII.

2P.L. 106-229.

3Electronic Government: Government Paperwork Elimination Act Presents Challenges for Agencies

(GAO/AIMD-00-282, September 15, 2000); and Electronic Government: Federal Initiatives Are Evolving

Rapidly But They Face Significant Challenges (GAO/T-AIMD/GGD-00-179, May 22, 2000).

On-Line Government

Presence Is Growing
Page 2 GAO-01-87T FirstGov.gov

oversight from OMB and the Congress. Moreover, many electronic

government initiatives challenge agencies to address a variety of

information technology management issues that have historically troubled

IT projects.

Irrespective of the challenges created by the so-called digital divide, the

use of the Internet for commercial business and public-sector service

continues to grow. Home access to personal computers and the Internet is

increasing rapidly, and at least one source projected that 60 percent of

U.S. households will have Internet access by the end of this year. Another

recent study conducted by Momentum Research Group found that 62

percent of citizens and 83 percent of business users surveyed had used the

Internet to access government services or information.

To improve the relevance of and access to on-line information and

services, governments are turning to portals—umbrella web sites that

operate as electronic front doors, linking users to a broad range of on-line

resources. The President’s December 17, 1999, memorandum on electronic

government provided the charter for the government’s efforts to develop a

single governmentwide electronic portal for federal information and

services. Specifically, the President tasked the Administrator of the

General Services Administration, in coordination with other appropriate

agencies, to “promote access to government information organized not by

agency, but by the type of service or information that people may be

seeking.”4 The response has been the rapid development of a web portal,

FirstGov.gov, which is intended to link the government’s more than 20,000

web sites and many millions of web pages and make it possible for citizens

to obtain the information and services they need without having to ponder

which federal agency controls which function.

State and some foreign governments have already implemented

governmentwide web portals that provide users with links to information

and services. For instance, by accessing Virginia’s statewide portal

(http://www.vipnet.org), residents can quickly connect to a site where they

can renew drivers’ licenses on-line. Similarly, users can access the

Washington state portal (http://access.wa.gov) to link to sites for filing

state tax returns electronically. According to an April survey by the

National Association of State Information Resource Executives, 20 states

(representing 50 percent of the nation’s population) reported having

4The White House, Memorandum for the Heads of Executive Departments and Agencies on Electronic

Government, December 17, 1999.
Page 3 GAO-01-87T FirstGov.gov

statewide government web portals. Eight more states (representing 23

percent of the population) reported plans to launch portals within a year.

To provide ongoing direction to the FirstGov effort, the President’s

Management Council (PMC) established a FirstGov Board of Directors,

which consists of eight members from the PMC and three members of the

Federal CIO Council. The board is responsible for coordinating FirstGov

issues across the executive, legislative, and judicial branches. Daily

operations are managed by the General Services Administration (GSA),

which has staffed a FirstGov project team to lead the effort. This team, in

turn, manages a $4-million, 2-year contract to operate and maintain the

Firstgov.gov web site. The contract does not cover services such as

redesigning the web site or changing its hosted location. It also does not

cover the electronic search function that (1) collects and indexes

information from all government web sites, (2) stores that information in a

single large database, and (3) performs searches on the database to fulfill

user requests. That search function is being provided to FirstGov.gov free

of charge for 3 years by the Federal Search Foundation (Fed-Search),

through a memorandum of understanding with GSA on behalf of the PMC

and the FirstGov Board. Dr. Eric Brewer, co-founder and chief scientist for

Inktomi Corporation, established Fed-Search this past June. Fed-Search

has a contractual relationship with Inktomi for the technology and

technical support to provide its free service to FirstGov.gov

FirstGov.gov is a federal government portal that provides a single point of

access to all federal government information posted on the World Wide

Web. Although its development is evolving, it is generally intended to

provide citizens with broad access to federal information and services in

an organized and efficient manner.

FirstGov works using three major elements: (1) a user interface (the

FirstGov.gov web site) that includes links to government information and

services (at present, a pointer system); (2) a large database that can

contain at any point in time more than 500 million pages from all publicly

accessible federal government web sites; and (3) a search engine—

provided by Fed-Search—which uses a technique known as spidering or

FirstGov: Roles and

Responsibilities

FirstGov: What It

Does
Page 4 GAO-01-87T FirstGov.gov

crawling to examine all publicly accessible government web sites and then

retrieve information for storage in the database.5

In short, FirstGov.gov serves as an intermediary among its users and

agency web sites that offer information, resources, and access to

electronic services. The process begins with the Fed-Search search engine,

which “crawls” all government web sites and stores in its database any

text that it finds at those sites. This large database is renewed at regular

intervals to keep it up to date. Upon accessing the FirstGov.gov site, some

users may decide to click on predefined topics of interest, which will link

them to commonly requested government information and sites. However,

many users seeking specific information or services will simply type a key

word or words into the site’s search box. The search criteria they enter is

then relayed to Fed-Search, which scans its database for matching

material. The database returns a list of web pages with brief text excerpts

to indicate the pages’ content. By clicking on an item on the list, the user

will then be taken directly to the original government web page that had

been indexed. Figure 1 portrays this process schematically.

5Spidering (crawling) is the automatic process of systematically traversing a group of web pages by

following their embedded electronic links in order to build an index of relevant information.
Page 5 GAO-01-87T FirstGov.gov

Figure 1: Typical FirstGov.gov Search Process

Adapted from GSA data.

This process is similar to web searches done via many commercial

Internet search sites, such as Yahoo, Google, or AltaVista. The unique

value of Firstgov.gov is that it specifically aims to canvass all publicly

accessible federal government web sites and thus can offer much more

comprehensive and definitive results for government-oriented queries than

can a commercial search engine. FirstGov officials estimate that current

commercial search engines cover only about 20 percent of federal web

pages.

As presently configured, the search engine is not particularly contextsensitive. In other words, if a given search does not produce helpful

information, it is up to the user to define and redefine the search in ways

that return more meaningful information. As a result, on any given search,

the list of results can be substantial and may include irrelevant links. The

following examples illustrate this point:

Individual

government

web sites

1

User searches

by keyword

List of site addresses

is returned to inquirer

3

User connects

directly to sites

chosen from list

Database/Index

of all

government

web sites

(Fed-Search)

2

1

Portal

2
Page 6 GAO-01-87T FirstGov.gov

• Entering a keyword search for “Superfund” resulted in approximately

45,000 web pages that covered topics ranging from project locations,

program policies, and overarching regulations. Such an overwhelming

number of links could force a user to spend a significant amount of time

looking for truly relevant information.

• A keyword search for “buy stamps” yielded a list of some 3,000 links. The

links pointed to various web sites that offer information on where to buy

stamps, how to use pre-canceled stamps, and food stamp programs. The

task of identifying the correct web site to buy postage stamps—or

re-executing the search with the word “postage” included—is left to the

user.

The board has proposed a partnership program intended to broaden

exposure and participation in the FirstGov project. To promote and

increase traffic to the FirstGov portal, organizations are being encouraged

to connect to and utilize the Fed-Search search engine’s capabilities. The

board’s plan is that organizations be linked to the search engine in several

different ways, ranging from simply including the FirstGov brand as a

clickable reference on the partner’s web site to establishing a direct

connection to the search engine, with the results displayed on the

partner’s web site. Table 1 shows a brief description of the three partner

levels that have been established by the FirstGov project. All FirstGov

partners will be required to comply with a list of seven basic conditions of

use designed to guarantee such things as the integrity of the information,

protection of users’ privacy, free and open access to all users, clear

attribution of the U.S. government source, and dissociation from

advertising or any appearance of commercial endorsement.6

6Commerce Business Daily, July 6, 2000.

FirstGov Partners Are

Intended to Broaden

Its Use
Page 7 GAO-01-87T FirstGov.gov

Table 1: Comparison of the three endorsed methods of connecting to the Fed-Search search

engine.

Level 1 (Bronze) Level 2 (Silver) Level 3 (Gold)

Description of Connection

to Search Engine

Simple link with

FirstGov logo

Search-box link with

FirstGov logo

Search-box with FirstGov

logo directly connected to

search engine

Search Engine Results FirstGov web site FirstGov web site Partner web site

Cost to Private

Organizations

None None Annual and marginal cost

Implementation Rapid More difficult Most difficult

Source: GSA.

On June 24, 2000, President Clinton challenged GSA and its partners to

develop the FirstGov portal within 90 days. A functioning web site was

successfully brought on line September 22, 2000. While all parties involved

met the deadline, and indeed FirstGov is less than a month old, not all

issues associated with enhancing and running FirstGov have yet been

settled. These issues include:

• Maintaining the security of the FirstGov.gov site. Known computer and

network vulnerabilities—as well as the automated attack tools needed to

exploit them—are increasingly being publicly posted on the Internet. This

offers potential attackers with little technical skill and knowledge the

opportunity to cause a great deal of damage, and accentuates the need for

careful and coordinated security planning. In recent years we have

consistently found security weaknesses at many federal agencies.7

However, FirstGov currently has no comprehensive security plan and,

from a security standpoint, has not been accredited for operational use.8

FirstGov operations rely on components supplied by several different

contractors and subcontractors, and these entities have not coordinated

the security measures they have adopted, leaving the potential for security

vulnerabilities. Further, independent tests of the site’s access controls

have not been conducted, nor has the FirstGov Board established a

program for conducting periodic security assessments. It is critical that

7Federal Information Security: Actions Needed to Address Widespread Weaknesses (GAO/T-AIMD-00-

135, March 29, 2000) and Information Security: Serious and Widespread Weaknesses Persist at Federal

Agencies (GAO/AIMD-00-295, September 6, 2000).

8Accreditation is the formal declaration by a designated approving authority that an information

system is approved to operate in a particular security mode using a prescribed set of safeguards at an

acceptable level of risk.

Challenges in Making

FirstGov Fully

Operational
Page 8 GAO-01-87T FirstGov.gov

these and other elements of a complete security program be put into place

to meet governmentwide requirements and to ensure that security is

consistently maintained throughout the life of this important and highly

visible project.

• Protecting the government’s resources from malicious electronic search

through FirstGov. FirstGov is designed as a complete index of all

information on the federal government’s web sites. It provides a unique

and invaluable tool for ordinary citizens to use in gaining access to

government information, since commercial search engines index only a

fraction of the government’s sites. Unfortunately, the tool also provides

assistance to wrongdoers who, as a result, no longer need to conduct

tedious electronic reconnaissance at individual federal web sites to

determine the location of sensitive information that might facilitate

hacking or other malicious activity. Of course, the first line of defense is

the individual federal agencies, who need to ensure that their web sites do

not post inappropriate information. However, because FirstGov.gov

enhances the ability of individuals to locate information at federal sites,

the FirstGov Board may need to consider options for systematically

checking or identifying questionable or sensitive materials. For example,

the Fed-Search engine could check for certain specific kinds of

information and leave them out of its database, even if that information

remains available on an unindexed, publicly accessible web site.

Currently, the FirstGov Board does not have formal policies or procedures

in place for such routine checking.

• Allaying concerns about FirstGov’s relationship with the private sector.

The heart of FirstGov is a search engine and data index developed and

maintained for three years as a gift to the government. The Federal Search

Foundation has a memorandum of understanding with GSA but has stated

that it is not bound by any contract. This raises questions about whether

the government is in full control of how data from its web sites are

collected and used. Questions have also been raised about the mechanics

of how the government will interact with FirstGov’s official partners.

These concerns revolve around whether the partners will have special

access to government information or receive other benefits simply from

being partners—benefits that should not be exclusively theirs. By

establishing more complete definitions and descriptions of these

relationships, the FirstGov Board could help alleviate these concerns. This

is particularly important given the expectation to contract the

development and maintenance of FirstGov.gov in 2 to 3 years.

• Extending, tailoring, and coordinating access to government information.

In his December 17, 1999, memorandum on electronic government, the
Page 9 GAO-01-87T FirstGov.gov

President broadly tasked GSA to “promote access to government

information organized not by agency, but by the type of service or

information that people may be seeking.” This is a very large task. The

government maintains many databases of information, not all of which can

be indexed by a web-based search system such as FirstGov’s. In addition,

other electronic directories of government information have already been

developed, including the Government Information Locator Service (GILS)

and GPO Access. Further, a variety of ways exist to tailor the display of

information to better meet user needs, and more ways will undoubtedly be

devised in the future. For example, commercial web portals allow users to

select the kinds of information they are most interested in and craft

customized web pages to fit their personal needs.

As currently configured, FirstGov leaves these issues unaddressed.

However, it may be possible to enhance FirstGov to index more of the

government’s information, provide users with more tailored views of that

information, and work more closely with other existing government

electronic directories. For example, software agents could be used to

periodically search on-line information and directories based on a user’s

specified interests and automatically e-mail that user when new or

updated information becomes available. A September 2000 Brown

University study concluded that government web sites are not making full

use of available technology. The FirstGov Board is aware of these issues

and, indeed, is promoting FirstGov as a mechanism that can adapt to

changing technology and user needs as time goes on. Working groups

comprising representatives from federal agencies have been set up to

address issues associated with site content, technological advances, and

user feedback. Through these groups, the board will need to grapple with

the issue of how FirstGov.gov fits in with other on-line government

resources and directories and whether more sophisticated and powerful

connections can be made among them. Current federal policy may limit

the ability of a government site to tailor web pages to specific users

because it restricts the use of special data files known as persistent

cookies, which are used by commercial providers to carry out this

function.9 This policy restriction is a result of valid concerns about

privacy.

9OMB Memorandum M-00-13, June 22, 2000, and letter from OMB’s Administrator, Office of

Information and Regulatory Affairs, to the Chief Information Officer, Department of Commerce,

September 5, 2000.
Page 10 GAO-01-87T FirstGov.gov

In summary, FirstGov represents a significant achievement in that an

important and previously unavailable capability—searching the entire

government’s web pages—was rapidly and successfully put into place.

Now come the larger issues of how to sustain the site as a permanent

feature of the federal government and how to expand it to take on greater

significance.

We see four important issues for the FirstGov Board of Directors as this

effort moves forward. Managing site security for FirstGov.gov needs to be

improved; assessing and acting upon information in the Fed-Search

database that might facilitate malicious activity; issues about privatesector sponsorship need to be addressed; and plans for the future need to

be developed and communicated.

An overall management plan for FirstGov.gov would be a useful vehicle

for setting expectations regarding what general functions are likely to be

achievable for FirstGov in the near term, how the site will be managed on

an ongoing basis, and how progress toward the larger goals set forth in the

President’s December 1999 memorandum will be measured. The plan

would also likely go a long way in allaying concerns about coordinating

the security of FirstGov and its information and verifying that site security

is maintained on an ongoing basis. Such a plan would be subject to

continual revision and need not be an impediment to the adoption of

creative, unanticipated new approaches.

To assess the FirstGov effort, we interviewed officials at GSA and

obtained official documentation on the FirstGov project. We conducted

our audit work in September 2000 in accordance with generally accepted

government auditing standards.

Mr. Chairman, this concludes my statement. I would be happy to answer

any questions that you or other members of the Subcommittee may have at

this time.

For information about this testimony, please contact David L. McClure at

(202) 512-6240 or by e-mail at mcclured.aimd@gao.gov. Individuals making

key contributions to this testimony included Felipe Colon, John de Ferrari,

Steven Law, Patricia Slocum, and William Wadsworth.

(512031)

Contact and

Acknowledgments
Orders by Internet

For information on how to access GAO reports on the Internet, send

an e-mail message with “info” in the body to:

Info@www.gao.gov

or visit GAO’s World Wide Web home page at:

http://www.gao.gov

Contact one:

Web site: http://www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

1-800-424-5454 (automated answering system)

Ordering Information

To Report Fraud,

Waste, and Abuse in

Federal Programs