U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2250 Mail: Stop SSOP, Washington, DC 20402–0001

85–342PDF 2003

VA’S INFORMATION TECHNOLOGY INITIATIVES

HEARING

BEFORE THE

SUBCOMMITTEE OVERSIGHT AND INVESTIGATIONS

OF THE

COMMITTEE ON VETERANS’ AFFAIRS

HOUSE OF REPRESENTATIVES

ONE HUNDRED SEVENTH CONGRESS

SECOND SESSION

MARCH 13, 2002

Printed for the use of the Committee on Veterans’ Affairs

Serial No. 107–23

(
COMMITTEE ON VETERANS’ AFFAIRS

CHRISTOPHER H. SMITH, New Jersey, Chairman

BOB STUMP, Arizona

MICHAEL BILIRAKIS, Florida

TERRY EVERETT, Alabama

STEPHEN E. BUYER, Indiana

JACK QUINN, New York

CLIFF STEARNS, Florida

JERRY MORAN, Kansas

HOWARD P. (BUCK) MCKEON, California

JIM GIBBONS, Nevada

MICHAEL K. SIMPSON, Idaho

RICHARD H. BAKER, Louisiana

ROB SIMMONS, Connecticut

ANDER CRENSHAW, Florida

HENRY E. BROWN, JR., South Carolina

LANE EVANS, Illinois

BOB FILNER, California

LUIS V. GUTIERREZ, Illinois

CORRINE BROWN, Florida

JULIA CARSON, Indiana

SILVESTRE REYES, Texas

VIC SNYDER, Arkansas

CIRO D. RODRIGUEZ, Texas

RONNIE SHOWS, Mississippi

SHELLEY BERKLEY, Nevada

BARON P. HILL, Indiana

TOM UDALL, New Mexico

PATRICK E. RYAN, Chief Counsel and Staff Director

SUBCOMMITTEE ON OVERSIGHT AND INVESTIGATIONS

STEPHEN E. BUYER, Indiana, Chairman

BOB STUMP, Arizona

MICHAEL BILIRAKIS, Florida

TERRY EVERETT, Alabama

JULIA CARSON, Indiana

BARON P. HILL, Indiana

TOM UDALL, New Mexico

(II)
(III)

C O N T E N T S

March 13, 2002

Page

VA’s Information Technology Initiatives ............................................................... 1

OPENING STATEMENTS

Chairman Buyer ...................................................................................................... 1

Hon. Julia Carson .................................................................................................... 2

WITNESSES

Gauss, John A., Assistant Secretary for Information Technology, Department

of Veterans Affairs, accompanied by Bruce A. Brody, Associated Deputy

Assistant Secretary for Cyber Security, Department of Veterans Affairs;

Gary A. Christopherson, Chief Information Officer, Veterans Health Administration; K. Adair Martinez, Chief Information Officer, Veterans Benefits

Administration; William Campbell, Deputy Assistant Secretary for Finance,

Department of Veterans Affairs .......................................................................... 21

Prepared statement of Mr. Gauss ................................................................... 122

Griffin, Richard, Inspector General, Department of Veterans Affairs, accompanied by Stephen L. Gaskell, Director, Central Office Operations, Department of Veterans Affairs ..................................................................................... 14

Prepared statement of Mr. Griffin .................................................................. 117

Kappelman, Leon A., Director, Information Systems Research Center, University of North Texas ............................................................................................... 4

Prepared statement of Mr. Kappelman, with attachment ............................ 31

McClure, David L., Director of Information Technology Management Issues,

U.S. General Accounting Office, accompanied by Valerie Melvin, Assistant

Director for Accounting and Information Management Issues, U.S. General

Accounting Office ................................................................................................. 11

Prepared statement of Dr. McClure, with attachment .................................. 39

MATERIAL SUBMITTED FOR THE RECORD

Report prepared by U.S. General Accounting Office April 2001, entitled,

‘‘Computer-Based Patient Records—Better Planning and Oversight by VA,

DOD, and IHS Would Enhance Health Data Sharing’’ .................................... 70

Written committee questions and their responses:

Chairman Buyer to General Accounting Office ............................................. 129

Congresswoman Carson to Department of Veterans Affairs ........................ 138

(1)

VA’S INFORMATION TECHNOLOGY

INITIATIVES

WEDNESDAY, MARCH 13, 2002

U.S. HOUSE OF REPRESENTATIVES,

SUBCOMMITTEE ON OVERSIGHT AND INVESTIGATIONS,

COMMITTEE ON VETERANS’ AFFAIRS,

Washington, DC

The subcommittee met, pursuant to notice, at 10 a.m., in room

334, Cannon House Office Building, Hon. Steve Buyer (chairman of

the subcommittee), presiding.

Present: Representatives Buyer, Boozman, and Carson.

OPENING STATEMENT OF CHAIRMAN BUYER

Mr. BUYER. Today the Subcommittee on Oversight and Investigations of the Veterans’ Affairs Committee will come to order.

We will be holding our fourth hearing to receive an update on

the Department of Veterans Affairs information technology programs and the progress made in fulfilling the requirements of the

Clinger-Cohen act of 1996 to develop an enterprise architecture

plan.

Since our previous IT hearing last April, Secretary Principi has

taken several decisive steps to move towards a One-VA.

First, he chose a CIO for the Office of Information Technology.

It’s a formidable task. We thank the gentleman for accepting the

challenge, and Secretary Principi assembled the VA Enterprise Architecture innovation team to rapidly develop a plan. The team

issued a report in August of 2001, providing a strategy to ensure

that VA operates under a fully integrated system called the OneVA system.

This 90-day report stated, quote, ‘‘The mission of VA’s enterprise

architecture is to develop and implement an evolutionary high-performance One-VA information technology architecture aligned with

our program/business goals that enables enterprise-wide data integration. VA’s enterprise architecture will enable us to provide an

accessible source of consistent, reliable, accurate, useful, and secure

information and knowledge to veterans and their families, our

workforce and stakeholders, to support and effectively deliver services and benefits enabling effective decisionmaking and understanding our capabilities and accomplishments.’’ If that is not a sentence fragment, I have never seen it.

‘‘The enterprise architecture will support VA’s overall strategic

goals.’’

That was their quote.
2

These are laudable goals. However, we would like to know how

the VA’s plan on making it accessible, reliable, and secure. In particular, we hope to hear how you plan to execute this plan. Specifically, what is your business plan and what are the definitive milestone dates to accomplish the plan?

President Bush has made IT one of his top priorities, and his

budget reflects his strong commitment to overhauling or outright

replacing our current technology on a government-wide basis. The

VA will receive $1.35 billion IT for fiscal year 2003, a whopping 15

percent increase over last year’s funding level, and that is what

brings us to this point of the hearing.

We want to know if the VA is investing their IT money wisely.

VA now has a CIO in place and finally has an architecture plan

that we have been requesting for 5 years. However, a plan is only

good if it can be executed. We need to know what obstacles you

foresee and how you plan to work through the VA’s organizational

land mines, cultural bias, the turf battles, and the inherent inertia.

Furthermore, how does it address storage protection of VA’s information systems?

We would like to hear how the VA dealt with the vulnerabilities

identified in our previous hearings. Congress has pumped almost

a billion dollars per year into VA’s IT programs for the past decade,

and we want to know how VA can proceed in this One-VA concept.

Today, we hope to hear what the progress has been with the VA’s

integrated systems architecture plan, VBA’s VETSNET claims

processing program, cyber security, VHA’s Decision Support Systems, and the Government Computer-Based Patient Records

Program.

Having a plan of action is vitally important. Implementing the

plan and making it a reality will require a tremendous amount of

vigilance on the part of the Secretary, the CIO, and senior managers. We all recognize that the VA has its challenges, but they are

not insurmountable. The VA is a complex multi-faceted organization, and those in charge of its IT operation will be required to stay

focused and undeterred.

We believe the VA can meet these challenges. What we hope to

learn today is what the time-lines are in terms of achieving the

fully integrated One-VA system. Basically, we want to know, is this

going to be a couple of years or is this going to be another 16

years?

Also, I thought I would note, the background memo you sent out,

this memo you sent out to the committee—I found this ironic. You

wrote, ‘‘Currently, the VA has separate systems with multiple data

centers, technology, CIOs, and networks and vendor products,

which often result in duplication, replication, and redundancy.’’

I yield to Mrs. Carson for any comments she would like to make.

OPENING STATEMENT OF HON. JULIA CARSON

Ms. CARSON. Thank you very much, Mr. Chairman.

I, too, would like to welcome our guests and witnesses for today’s

hearing.

Congressional oversight of Department of Veterans Affairs

progress in implementing information technology integration and

security architectures under One-VA is of great importance. No sin-
3

gle management tool is as equipped to enhance the delivery and accessibility of VA services in a cost-effective manner.

Mr. Chairman, I used those same words in my letter to you last

September when I requested a reasonable delay in the IT hearing

then scheduled for October 2001. At that time, the VA’s much anticipated Enterprise Architecture had not been released, and the

Office of Cyber Security was not yet official.

Your postponement of this hearing until today allows us to now

determine if the VA is off to a fresh start, uniting and linking critical functions among the Administrations, or if they are retreating

from the many challenges of ‘‘One-VA.’’ They have now had sufficient time to select their direction and

to take their first steps. This One-VA horse has been allowed to say

in the barn far too long. We must now see if it can run.

First, let me congratulate VA leadership for publishing the Enterprise Architecture for Strategy, Governance, and Implementation. This document now provides guidance to all aspects of VA’s

IT initiative. This parent document allows us to evaluate its many

IT offspring, VA-wide.

I think the Enterprise Architecture for VA may be one of the best

documents of its type in government. It is an outstanding effort. It

captures not only the essence of Clinger-Cohen, GPRA, and other

Federal IT guidance; it captures the spirit of that guidance and

presents it logically. It tells a story, it makes sense, even from a

layman’s perspective. Congratulations on a job well done.

For the IT architecture to serve as a tool to bring about One-VA,

it must link directly to the mission of VA. In its own words on page

14, quote, ‘‘The VA Strategic Plan must drive VA’s Enterprise Architecture and the Enterprise Architecture must define the supporting information systems required to achieve that plan,’’ end

quote. In other words, this is not a, ‘‘which-came-first-the-chickenor-the-egg,’’ scenario. Defining the mission comes first.

You cannot have an IT architecture to support the mission unless

you have first defined that mission. You cannot provide IT support

to a business plan without first knowing the business processes

that require support. You cannot break out the mission-value of IT

assets without tying their relative value to the organization’s mission. These are bedrock concepts.

You also have to implement a plan once you write it. This is the

difficult part of the process. If the desired outcome is defined as 2

percent inspiration and 98 percent perspiration, the writing of the

plan gets you up to the 4 percent range, there is a long way to go.

To implement this plan, the CIO and the Secretary will have to

overcome organizational inertia and change existing culture. These

both have classically protected the parochial interests of the three

Administrations—VBA, VHA, and NCA—over the interests and

overall mission of VA.

As Dr. Kappelman, our witness on panel one so eloquently observes, ‘‘Historically, VA has optimized the parts and sub-optimized

the whole.’’

I agree with him that shifting VA’s focus to a focus on the whole

will take patience, help, and guidance.

Writing a strategic business plan does not guarantee success. It

merely outlines the envisioned method for achieving success; it de-
4

fines goals. These goals and methods must be well articulated to

serve as the foundation for the IT architecture.

It is the job of VA to define One-VA as it devolves through the

Administrations to every field-level activity. It is the job of the CIO

to craft architecture to meet that need. It is also the job of the CIO

to guide the implementation of that plan all the way back to the

field-level activities, and Mr. Chairman, implementing IT enterprise architecture to support One-VA, the Secretary must empower

the CIO to have full control of the architecture implementation

process.

The CIO must employ a method, for example, that can compare

and contrast the relative worth of IT assets, both new and legacy

systems, and promulgate that method in a non-parochial environment to create a One-VA IT balanced scorecard. The Enterprise Architecture sets the stage for this action. The principal actors must

have the reach to bring about successful a outcome.

Thank you very much, Mr. Chairman, for allowing me to have

my say.

Mr. BUYER. Thank you.

Mr. Boozman, do you have any comment?

Mr. BOOZMAN. No.

Mr. BUYER. Thank you.

We will have the first panel, recognize Leon Kappelman, Ph.D.,

Director of Information Systems Research Center at the University

of North Texas.

We have your statement, and with no objection, it will be submitted into the record, and we will welcome your testimony.

STATEMENT OF LEON A. KAPPELMAN, DIRECTOR, INFORMATION SYSTEMS RESEARCH CENTER, UNIVERSITY OF NORTH

TEXAS

Mr. KAPPELMAN. Thank you very much, Mr. Chairman. Thank

you so much for inviting me to testify today.

Last year, I had the honor of facilitating over 20 of VA’s senior

IT and business leaders from all of the administration and department staff offices, in forming what came to be known as the Enterprise Architecture Innovation Team. For 15 days and five very long

weekends, they created and unanimously endorsed that strategic

enterprise architecture document that you just mentioned that Secretary Principi approved last September.

I also participated in analyzing VA’s project management practices. I had the privilege in October and then again just a few

weeks ago of facilitating two working conferences attended by more

than 200 of VA’s senior IT managers.

The short story is, in these past 10 months, I really have seen

a profound and significant change, positive, in how VA manages IT,

but these are just the first critical steps in what the members of

the committee have already acknowledged is a very long road.

In the cover letter to the Secretary that accompanied the enterprise architecture document, John Zachman, who I would consider

the godfather of enterprise architecture, wrote—and this is a

quote—‘‘This is not a project. It is a process. It is different from the

industrial age past. It is the information age present. Here is some

advice that may help you institutionalize VA’s enterprise architec-
5

ture: (a) Do not underestimate the difficulty and complexity. This

will take time and determination. This is a new way of life, a revolution in thinking, a discipline. Change of this magnitude takes

perseverance. Do not be discouraged. (b) Make executive education

and technical training a continuous process. It is easy to forget

long-term issues in the short-term stress of daily life, and (c) remember, there is still much to learn and discover and many opportunities to create advantage and value,’’ end quote.

VA has set a high bar for itself. They worked hard to put that

plan together, but VA is massive in size, enormously complicated,

and highly decentralized. They have significant workforce development concerns and a long, long history of independent parts that,

quite frankly, do not work very well together.

VA could use some things from Congress, too, and I humbly offer

you the following suggestions:

First, hold them accountable, but understand and honor their

long-term vision. Please do not make the mistake of demanding

short-term IT accomplishment without long-term relevance, because this will only lead to re-work, scrap, replace, and enterprise

disintegration, and we have all seen enough of that.

Secondly, provide policy guidance and assistance. They really are

entering new ground here, as they strive to achieve One-VA. Historically, as the good lady just pointed out, they have optimized the

parts and sub-optimized the whole. One-VA and Clinger-Cohen

both say shift that balance to optimizing the whole through massive integration, but this is not just a technical change. This is an

organizational change, and they need your patience, they need your

help, and they really will need some guidance in how to do some

of this.

Third, provide funding for these changes. Resources are needed,

especially for the things they have never done before. I’m not talking about IT projects. They will stand or fall on their own merits.

There is a real need, however, for additional funding for VA’s IT

central office, for the Office of the Chief Enterprise Architect, as

well as for the establishment of a VA-wide project management office, but all of this will be for naught if there is not funding and

acknowledgement of the significant effort in education, training,

and organizational culture change required to realize One-VA.

These are not IT issues. These are VA issues, and they will require the active involvement of VA’s business and IT personnel, the

assistance of change management professionals, and the continued

support and involvement of engaged and competent leadership.

Fourth, be realistic. If you want VA to perform at commercial

best practice, then you have to realize that you are asking them

to do it with about 70 percent of the funding average of commercial

IT and about half the staff.

At the two working conferences, for the first time ever, more

than 200 professionals responsible for the various pieces of the VA

IT pie worked together face to face to create a shared vision for

One-VA and IT’s role in achieving it. It was about enterprise architecture and cyber security, project management, network infrastructure, workforce development, performance measurement, and

fulfilling VA’s role in homeland security.
6

It was not about business as usual but, rather, a significant

change in mind-set from one of disintegration and fear to one of

collaboration, trust, and accountability, but the vision and hard

work of 200 managers, no matter how senior, does not suddenly

transform an enterprise with over 4,000 IT professionals, several

hundred thousand personnel, millions of customers, and a budget

greater than the GDP of 75 percent of the countries in the world.

This is not a project. There is no silver bullet. This is a new way

of life for VA, and such change can only happen incrementally, and

we are all part of it.

Thank you very much.

[The prepared statement of Mr. Kappelman, with attachment,

appears on p. 31.]

Mr. BUYER. Mr. Boozman, there is a vote on approving the journal. I am going to go ahead and stay. I’m not going to—I know it

is an important vote, extremely important. I am sure you stayed

up all night and read it.

One thing I couldn’t help—as I was reading your background, I

noticed some of the other enterprises that you had—that your work

had included, and these are some very large companies. I mean I

see Ameritech, J.C. Penney, Kraft, Coca-Cola, GTE, Texaco, Treasury Department of Canada, the United Nations, Wells Fargo,

World Bank, CIA, Cigna, Computer Associates. I mean the list goes

on and on.

What I want to ask is—obviously, they are all similar but yet different. And with the VA, with these three stovepipe operations and

the cultural biases, the differences. Sometimes they do not even

communicate, talk to each other, do not even know how to, nor

care. Have you seen some similarities out there in other companies

that have been there a long time, like a Coca-Cola, they have the

bottlers over here and distributions over there? Help me out in

some of the similarities yet differences.

Mr. KAPPELMAN. The issues are similar, as you point out. In

many ways, VA is like a university. You know, universities have

a tenured workforce. The VA has that. So, that creates its own particular set of issues, but in general, the situation is very similar.

Mr. BUYER. So, you would agree with me, a challenge but not insurmountable.

Mr. KAPPELMAN. Oh, not insurmountable at all, but needs to be,

you know, taken on with a good plan, good measures to—you know,

how are we going to know we are really making progress so we do

not end up with 16 years and we are not sure where we got, where

we know on a regular basis what kind of progress is being made.

Mr. BUYER. I will take to heart—your third recommendation—

you talked about funding. I hold you to no numbers here today, but

give me sort of an idea. When we look at this and go we want to

make a 15 percent increase in this kind of a budget—I know your

counsel to us is be patient, be responsive. You know, we just do not

have open checkbooks here on behalf of the American taxpayer, but

you are correct, we want to make sure that we transform the system. What am I looking at?

Mr. KAPPELMAN. I have not looked at their budget numbers, so

I really cannot make any——
7

Mr. BUYER. Give me an idea of this—I will not hold you to this,

but I will hold you to this testimony. These are a lot of companies

that you reshaped their architecture, their IT systems. So, given

the monies that they were spending, what it took to transform before they could get into things that made them productive and the

cost savings, how much of a boost, on average, have these systems

required?

Mr. KAPPELMAN. Okay. For none of those organizations did I do

organization-wide enterprise architecture. They were more specifically focused issues that I was helping them deal with.

Mr. BUYER. Did any of them do it system-wide?

Mr. KAPPELMAN. However, in—commercial IT—we have different

rules of thumb that we can apply, and each rule of thumb, you

know, is based on averages. So, you have to be cautious in applying

averages to any specific situation. You have to understand the

issues of that particular enterprise, but in general, we tend to replace about one-third of IT a year.

So, you know, if we had a good estimate of what VA’s total asset

base of technology was and what it had cost to put it there, then

we could estimate that they are going to spend about a third of

that a year maintaining it and keeping it going forward.

Mr. BUYER. When you say they replace one-third a year, is that

during the implementation of the plan?

Mr. KAPPELMAN. Of significant change, but what we find is that

number tends to hold up pretty well over the long run, too.

So, for example, Delta Airlines recently went through a similar

process. They looked at it and they said, okay, well, we have about

$3 billion worth of technology that we manage, and the person they

had asked to do that went to the board and said, look, if you really

want this to happen, it is going to take a billion dollars a year to

make it work, and with the commitment of the board, which you

people really represent in this case, then it could be done.

I do not know what that number is for VA, but there are intelligent ways to come up with those estimates.

Mr. BUYER. If a major part of the budget is for the maintenance

and support of existing systems, what have you seen? I am looking

at all the different players of a team to actually make transformation a reality. Whether it is education of the executives or the

workforce, but you know, you have got a support staff out there— i.e., contractors, contracts in place, and some may agree with what

is going on and some do not and it is all about the dollar and they

have in fighting and companies do not like each other. Give me

some idea of what we are walking into with some existing companies out there.

Mr. KAPPELMAN. It is probably no different—I have no idea, but

it is probably no different than what we’re walking into in—look,

VA has close to 200 entities that basically are separately budgeted.

You know, they are independently—they have separate control, it

is local control of those funds, and there is all kinds of little pieces

of, you know, local controlled—little clumps of technology. Any kind

of organizational change of this kind of magnitude that is trying to

even just centralize standardization, put controls on decisionmaking—you are messing with people’s security and power, and

you have to be sensitive to that.
8

You just have to be sensitive to, you know, what I am sure a lot

of you already know, just the good issues of organizational change

management, the psychology of that. I am sure it is not that much

different with the vendor community.

When we first started the enterprise architecture thing, all these

vendors started approaching us about—you know, they wanted to

make presentations as if what we were doing was figuring out

some technical thing, and it was not about technology, you know.

It had a lot to do with it, but it was not technical decisions we were

making, we were making strategic decisions, but they felt very

threatened and they wanted to, you know, have their voices heard.

I am sure it is not going to be much different now, but, you

know, if the plans change, then I am sure that the vendors can be

worked with, just like if the plans change, I am sure the internal

personnel can be worked with, but it needs to be done intelligently,

thoughtfully, and you know, people’s needs have to be met.

Mr. BUYER. Let me switch gears, the last question before I yield.

If you are working with a company in the private sector, you can

hook in their commitment to the plan because they are going to be

there for a little while. So, my question is about the continuity that

you can have and the commitment toward a plan when you are in

government and people are moving in and out of the system.

So, if you worked with some of the other government systems, in

particular the Canadian Treasury and others, I mean I look at this

one and say we have been fiddling and doing maintenance with

these kinds of systems for over 16 years here in the United States,

and we’re spending a lot of money, and I do not want the ebb and

flow of different administrations changing what we are trying to

do. Can you give me some counsel?

Mr. KAPPELMAN. Big issue.

Mr. BUYER. Continuity is what I am focused on.

Mr. KAPPELMAN. It is not unlike when democracy comes to a

country that has never had it before. You know, we can change

some structures at first, and that is kind of the stage VA is at now,

but there is—but that is just the institutions, the structural things.

There is also a lot of education of the people that has to happen,

and there are a lot of things that do not happen until they experience it and they realize the benefits of this new way.

So, that is kind of what is happening at VA. There is a lot of

need for education. Yes, the structural stuff is happening, but there

is a big need for education. There is a big need for learning this

new language of enterprise architecture and learning how to communicate learning this new language, and some of it is about inventing some of the language. We do not have good tools, good

graphical ways of representing some of these things, that they need

to have the dialogue between IT people and business people.

One of the things we did at this last conference was people made

presentations, and in their presentations, they would have a graphic of some aspect of VA or some aspects of its technology, and one

of the things we did was we tried to see how those things fit into

this framework that they have chosen to help them organize this

language. This framework is really like a grammar, and so, now

they are starting to invent the words in the vocabulary. So, what
9

we know is people are already doing some of this, but they do not

realize how it fits into this grammar.

So what we did is we looked at some of these graphics, and we

said, well, we think this one goes here, and this one is, you know,

useful for architecture, and this one is more useful for implementation.

So learning that language and experiencing it—one of the other

things we realized at this last conference was the IT people might

make a first draft of what they think the business process is or

something, but then they have to go to the business person and

verify it.

Mr. BUYER. All right. Wait a second. You have jumped into the

weeds.

Mr. KAPPELMAN. All right.

Mr. BUYER. I do not want to get lost in your high weeds. My

question is more—it is a much larger level here. We here in Congress, and particularly this committee, on a bipartisan basis, has

no interest in the micro-management of the systems, but we do

have our oversight responsibilities on government efficiencies. We

want to make sure that certain acts passed by Congress are implemented and we are being watchful.

So when you testify to us that you want to make sure that we

implement this plan and we properly fund it and education is in

place, continuity, to make sure that, even though you have ebbs

and flows of leadership that come in and out, I am trying to figure

out and be helpful here to the VA on what modeling or what do

they need to do to make sure that it does not matter who moves

in and out of that system, that when they come into it, that part

of that executive educative function that you are talking about,

that they move into these things, that you just do not come in from

the outside and you bring with you that experience they had at

Westinghouse or, you know, at GTE or—it does not matter. They

come in. They are educated. I just did not know what kind of

thoughts you had on it.

Mr. KAPPELMAN. How do you institutionalize a change of this

magnitude? It needs to become how business is done. It needs to

become the language. Part of it is that institutional piece, that

they, you know, create some structures and new decisionmaking

bodies, but part of it is what they learn to experience. Partially it’s

training and they learn new things, but it is also the fact that people work together and actually start using these tools to make decisions, and they find out that they are getting better. In other

words, they find out that doing it this way led to a better result.

You know, people go back to the old ways if they do not see the

new ways as beneficial. So, this will happen through experience

and training and helping them deal with all of these changes.

Mr. BUYER. All right. Ten seconds or less——

Mr. KAPPELMAN. All right.

Mr. BUYER. What is the time-line to actually get something like

this implemented, do you think? One year, 2 years, 3 years, 4

years, 5 years, 6 years? When commitment is made.

Mr. KAPPELMAN. At some level, this never ends. However—because this becomes a new way of life.

Mr. BUYER. I understand.
10

Mr. KAPPELMAN. All right. Three to 5 years, they can accomplish

an enormous amount.

Mr. BUYER. All right. Thank you.

I would now yield to Mrs. Carson for any questions she may

have.

I ask unanimous consent that Ms. Carson’s counsel may ask

questions of the witness. Hearing no objection, I now yield.

Mr. SISTEK. Thank you very much, Mr. Chairman.

Dr. Kappelman, I am going to follow up on a line of questioning

that the chairman broached concerning change management and

the role of change in the organization. The enterprise architecture

is a major change for any organization that it comes through. This

marriage of strategy and business plan, to the supporting IT architecture is a large pill for some folks to swallow.

So let me start off with a hypothetical dealing with organizational culture and organizational behavior. In a hypothetical organization, your task is to design an HR management system, an organizational chart, so to speak, for the organization. This organization has very powerful component parts in the sub-strata, which

have a history of tremendous independence. You go out and you

hire a CIO, a well-qualified CIO, to manage this plan.

Can you give me an idea of what he is going to find in the typical

organization trying to push a major change through like this?

Mr. KAPPELMAN. Resistance.

Mr. SISTEK. How will that manifest itself?

Mr. KAPPELMAN. Well, you know, people do it in different ways.

They will—sometimes it is overt, sometimes it is covert. The question becomes how do you deal with it, and realizing that there are

early adopters to a change and there some late adopters to a

change, those that are more skeptical and they want to see how

things play out.

Mr. SISTEK. But let us say time is important. We do not want

to take two decades to implement this change. What kind of tools—

and I think you partially addressed this in your testimony—what

kind of tools would you give this CIO? What type of authorities?

What type of responsibilities? How far would his reach be, to quote

Mrs. Carson’s last statement?

Mr. KAPPELMAN. You have got to tie it to the money, and you

have to tie it to the fact that their business people support the

change, because the IT people go back to their little pieces of the

enterprise, and if the business person is not on board for this, then

it is no longer important. Nobody really does what is not important

to their boss. So, unless the business people are also engaged, it is

difficult to bring about these changes.

In other words, the business person is going to want one thing

to happen, and if the CIO is saying, well, do something else, you

know, you have these two conflicting authorities. So, management

needs to be synchronized, on the one hand.

Secondly, it needs to be tied to budgeting, how projects get approved, how things get funded. If they do not comply with architecture, if they do not comply with security, if they do not comply with

these other things, then they should not get funding.

Mr. SISTEK. Okay.
11

So, back to the organizational chart. Where do the lines from the

CIO lead?

Mr. KAPPELMAN. Right now—— Mr. SISTEK. Hypothetical organization.

Mr. KAPPELMAN. Hypothetical? If you are going to have One-VA,

you need to have central authority.

Mr. SISTEK. Thank you.

Second question deals with performance measurement systems:

How do we know when we reach One-VA? How do we know when

we get there? How do we know that the information technology

overlay is working? Do we use some form of Six Sigma quality architecture overlay to this? How do we define success?

Mr. KAPPELMAN. Those metrics need to be determined, but some

of them we knew about. We knew we wanted—you know, when

they wrote that plan, the idea that a veteran could go to one interface and have contact with all VA services, that they could move

from one hospital to another and not have to fill out forms again,

you know, we knew some of the things that they wanted to achieve,

but some of those metrics are yet to be defined.

Mr. SISTEK. Thank you very much, Mr. Chairman. I yield back.

Mr. BUYER. Mr. Boozman?

Mr. BOOZMAN. No questions.

Mr. BUYER. Thank you. Appreciate your testimony.

Mr. KAPPELMAN. It is an honor; I appreciate it.

Mr. BUYER. For our next panel, what we are going to do is we

are going to combine panels two and three. So if Dr. McClure, Director of Information Technology Management Issues at the U.S.

General Accounting Office, and the Honorable Richard Griffin, Inspector General, Department of Veterans Affairs, and those whom

may be accompanying you—I have the written statements of the

GAO and the IG of the Department of Veterans Affairs, your statements will be submitted for the record, and ask for you to present

your testimony, introduce your guests.

STATEMENTS OF DAVID L. McCLURE, DIRECTOR OF INFORMATION TECHNOLOGY MANAGEMENT ISSUES, U.S. GENERAL

ACCOUNTING OFFICE, ACCOMPANIED BY VALERIE MELVIN,

ASSISTANT DIRECTOR FOR ACCOUNTING AND INFORMATION MANAGEMENT ISSUES, U.S. GENERAL ACCOUNTING

OFFICE; AND RICHARD GRIFFIN, INSPECTOR GENERAL, DEPARTMENT OF VETERANS AFFAIRS, ACCOMPANIED BY STEPHEN L. GASKELL, DIRECTOR, CENTRAL OFFICE OPERATIONS, DEPARTMENT OF VETERANS AFFAIRS

STATEMENT OF DAVID L. McCLURE

Mr. MCCLURE. Good morning, Mr. Chairman, I am Dave

McClure, the Director for IT Management Issues at GAO, and with

me today is the Assistant Director in charge of IT Audits, Ms. Valerie Melvin. We are happy to be here this morning and share with

you our assessment of where VA is with several of the issues that

we have been talking about.

In the testimony that we gave last April, we did begin to point

out some signs of progress. We remain concerned about particular

areas within VA’s information management technology. I would
12

like to share those with you today and be as straightforward as

possible.

Let me start with the topic that Dr. Kappelman was discussing

with you, and that is enterprise architecture.

The department is laying a very good foundation for an integrated enterprise architecture, something that we have been recommending to VA since 1998. As we have said in the past, this is

a very important blueprint for evolving its information systems and

optimizing them for the mission—the areas of the department. It

is a formidable exercise. It is not anything that can be done without attention, time, and resources.

Executive management attention to VA’s enterprise architecture

I think is to be applauded. Some of the steps that have been taken

over the last 11 months of getting executive commitment, involvement, buy-in, participation in the development of this enterprise

architecture are really beyond what we see in many other agencies.

The appointment of a CIO, the recruiting of a chief architect are

critical in continuing the progress in this area.

We have a table in my written statement that provides you with

an assessment of where VA is in its implementation of its enterprise architecture. This analysis is based upon guidance that has

been issued by GAO, OMB, and the Federal CIO Council. I think

it paints for you a real marker of where VA actually is in its implementation of its management of this process.

It is clear that there have been many things that have occurred

in the last 11 months that are extremely positive. There has been

a chief architect that has been focused on this, not permanent but

acting. There has been a governance structure that has been put

in place, and there have been many of the beginning steps of defining the as-is architecture, both from a logical and technical

perspective.

There are many other things, though, that remain to be done.

That should be abundantly clear from looking at that table. We are

many—we have many steps to go down this road before we actually

can claim success, and as Dr. Kappelman indicated, this is an evolutionary, ever-changing, iterative, dynamic process that VA will be

managing continually from now on.

So, we are pleased to see the executive involvement, participation

in this enterprise architecture effort, but we do want to remind the

committee and VA that continued management attention is essential to make sure that this continues in a very positive way.

The second area is information security. Our work and that of

the IG has continued to show fundamental weaknesses in VA that

place its financial, health care, benefits payment information at

risk of misuse, fraud, improper disclosure, and destruction.

VA is continuing to make progress in this area, as well. At the

direction of the department’s cyber security officer, VA has embraced best practices guidance in this area, as well. In Table 2 of

the written statement, we outline critical areas for the management of information security and show you where VA has taken actions and areas that remain to be addressed.

There are very positive developments that have occurred, again,

over the last 11 months. There has been an emphasis on performance, the standards for SES, involving information security issues.
13

Risk assessment methodology guidelines have been established.

There has been additional penetration testing of its web-sites, and

there have been centralized functions put in place that VA has long

needed, but there is many, many more things that need to be done

and need to be addressed to ensure that fundamental security

weaknesses are addressed and put in place. We would like to see

specific milestones and specific actions in these areas.

You asked us, also, to comment on three systems modernizations

occurring at VA—VETSNET, GCPR, and DSS, the decision support

system used by VHA.

VETSNET, to start with, is a critical replacement exercise for the

VA. Its existing applications on its existing infrastructure are at

risk of failure. It does need to replace these as soon as possible.

They are frail, they are old, and they are not actually performing

as VA needs them to today.

Secondly, this is the core mission area of DBA. Therefore, the

VETSNET project is critical for it to improve in the claims processing area.

VETSNET, in some form or fashion, has been going on for years,

as you noted. There have been millions of dollars spent on infrastructure needs and applications associated with VETSNET. We

recommend that three specific things in my written testimony be

done immediately, completed on VETSNET:

A comprehensive testing of the system’s functional business capability be performed. The Secretary has indicated that an audit

has been conducted, but in our opinion, that audit did not cover

some critical test areas to make sure that the applications are

going to actually meet business needs.

Secondly, because of the elapsed time-frames that have occurred

on the development of VETSNET, we think it’s very important that

user needs be validated once again. The applications that are associated with VETSNET are, for the most part, modernizing the asis claims processing environment. If VA changes that claims processing environment through business process re-engineering, I

think it is important to know how these applications will perform

in that new environment. So, it is very important that this issue

be addressed openly.

Thirdly, we think an integrated project plan needs to be put in

place, something that has been missing, and we know that VA has

committed itself to do in the past and in the conversations we have

had in the last few days.

Real briefly, on GCPR and DSS, I think GCPR, as you know, is

proceeding, but not in a way that was originally planned. The virtual patient record focus of GCPR is not what currently is being

put in place. It is more of a data sharing exercise in which a oneway data transfer in the first phase will occur and is being tested

between DOD and VA, has to be expanded to the Indian Health

Service, as well. This is not the creation of the virtual patient

record. It is a data-sharing capability. It is to be looked at as a

positive development but one that is very different from the original goals of GCPR, and we would like to point that out to you.

We also believe there are still some fundamental project management weaknesses that need to be addressed with GCPR to ensure

its success, and we believe, more importantly, accountability, au-
14

thority, and responsibility—lead accountability, responsibility— need to be established for this tri-agency effort. That has been a

problem in the past, as well.

In the use of the decision support system, this is extremely positive. We have seen continued acceptance of that executive support

system to get a really good handle on the information in the hospitals on the cost of care and being able to compare cost of care

across the different facilities.

It is now in use in all the VISNs, something that was not the

case when we testified before you last time or the years prior to

that, and we see that a continue positive acceptance of DSS, continued training and engagement by the managers in its use, is turning around the acceptance of it across the VISNs, and I believe it

provides information to VHA that it did not have before, cost comparison data across the different kinds of health services. So, that

is extremely positive.

In summary, I think what we would like to tell you is that VA

has, indeed, made tangible progress since we last testified before

you, and this level of executive commitment is extremely important, something that is missing in many other agencies. It has

taken necessary steps but not sufficient steps in these areas that

I have just gone over to ensure success. Continued management attention and resources need to be focused on each one of them.

We are recommending that VA focus its management activities

on discipline processes, put them in place and follow them, and

that is the key to seeing long-term success in any best practicestype organization, and lastly, we think the dialogue in this area

across all these IT functional areas needs to begin to move to results. Once the plans, once the processes are put in place, VA needs

to be held accountable for performance metrics and progress and

showing that the mission areas that these systems are supporting

are, indeed, improving results.

Thank you. I would be happy to answer any questions.

[The prepared statement of Dr. McClure, with attachment, appears on p. 39.]

Mr. BUYER. Thank you, Dr. McClure. Mr. Griffin.

STATEMENT OF RICHARD GRIFFIN

Mr. GRIFFIN. Good morning, Mr. Chairman. I am accompanied

this morning by Steve Gaskell, the Division Director of our audit

group that does the IT security audits for our organization.

Mr. Chairman and members of the subcommittee, I am here

today to report on our findings concerning the Department of Veterans Affairs automated information security program. I am

pleased to report that, since the committee’s hearing last April, the

department has named a CIO, defined an enterprise architecture,

developed a VA firewall policy to protect the system from external

attack, and the Secretary has recently approved a certification and

accreditation policy to assure that IT systems have security reviews

prior to being authorized to process sensitive information.

While we acknowledge that progress is being made, we continue

to identify serious department-wide weaknesses in information security. As a result, we concluded in our recent audit of VA’s consolidated financial statements for fiscal year 2001 that the depart-
15

ment must continue to designate information security as a material

weakness area under the Federal Managers Financial Integrity

Act.

Our ongoing national audit of VA’s information security shows

that significant information security vulnerabilities continue to

place the department at risk of denial of service attacks, disruption

of mission-critical systems, and unauthorized access to and disclosure of sensitive financial data and data subject to privacy act

protection.

Our current review revealed that many of the information system security weaknesses reported in our 2001 national audit remained unresolved and additional security weaknesses have been

identified. Further action is needed to prioritize completion of key

security initiatives, establish time-lines for completion, and secure

necessary budget resources.

Based on our national information security audit results and discussion with officials in the Office of Cyber Security, we identified

the key areas that should be considered for priority completion in

the next year. Some of these areas require enforcement of existing

department policy and governmental regulations while others require new hardware, software, or possibly contractor support.

Examples include intrusion detection systems, infrastructure protection, data center contingency planning, and operating system

change controls.

In response to our findings, the department has identified these

areas in its Government Information Security Reform Act remediation action plan for priority corrective action in the next 12

months.

Once these security initiatives are prioritized for completion, necessary budget resources will need to be secured. We recognize that

the department faces a significant challenge to implement necessary security remediation actions that are estimated to require

$804 million for fiscal years 2002 through 2006. This represents

substantial expenditures above the levels funded in past years.

In fiscal year 2001, about $17 million was expended for cyber security program initiatives. For fiscal year 2002, about 21.4 million

is budgeted for the Office of Cyber Security program initiatives.

This level of funding support is significantly below the 93.2 million

identified in the department’s cyber security capital investment

proposal.

In fiscal year 2003, the level of projected security funding requirements increases to over $132 million.

In addition to these Office of Cyber Security program expenditures, each of the department’s administration budget also include

program expenditures that address various security initiatives. For

fiscal year 2002, these planned expenditures are significant and

total approximately $34 million.

During our current national security audit, we will be reviewing

individual administration security expenditures to assess the value

of those expenditures in light of VA’s national security priorities.

This concludes my testimony. I would be pleased to answer any

questions that you and the members of the subcommittee may

have.

[The prepared statement of Mr. Griffin appears on p. 117.]
16

Mr. BUYER. Thank you, Mr. Griffin.

Dr. McClure, I would like you to do me a favor. I do not very

often do this, but I acknowledge in the back of the testimony that

you submitted to this committee, you have a team that put this together. I apologize. I got through most of it last night and finished

it this morning, but your team did a remarkable job. This is a very

difficult subject area, and I have requested a lot of—whether it is

here or when I was on the Armed Services Committee—a lot of

things from GAO, but you have got a great team here that put together a wonderful product, and will you please extend my compliments to them?

Mr. MCCLURE. I will certainly do it. Many of them are sitting

with us today, and I know they are happy to hear that from you.

Mr. BUYER. This is excellent, excellent work, and you know, what

I did like—because I am—believe me, I am outside my expertise,

you know, and I really—I enjoyed this. This chart—whoever came

up with this and designed this—it was very helpful to me to help

put it together, sort of that checklist that is being done. I just want

to let you know I found that to be very helpful to me, okay? Someone else may think it is very elementary, but I have a simple mind,

I suppose.

One thing that I did notice—you stated that VHA has begun

steps to further improve the accuracy and timeliness of its DSS

data. Can you tell us what specific steps VHA has taken? How,

quote, ‘‘on board’’ is VHA’s top management in utilizing the DSS?

Mr. MCCLURE. Well, as I said, I think, if you go back over the

last few testimonies that we have done, we have seen increasing

use of the DSS. Three years ago, there was a question of whether

all the VISNs were using it or not. There was also questions about

the use of the data itself.

Our latest visits and conversations indicate that there is growing

acceptance of the value of the DSS data and that some of the issues

associated with the use of the system itself are now being worked

out with user groups themselves, and I think that is a very positive

development.

It is really a very valuable system to VHA in that, as I said, it

is the only system that gives them a cost-per-episode type of ability

to compare these things within facilities and across facilities. That

kind of information is, I think, critical to focus on results and improvements in performance, and I think, as the system has been

continuously worked upon and is being continuously used, the

value—its value is being seen more and more by managers and executives within VHA.

Whether it is universally accepted or not—I do not know of any

system that continuously gets universal acceptance, because there

is always needs that might have to be addressed as it evolves.

Mr. BUYER. Would you be able to tell us which VISNs are using

this as a critical management resource tool and which ones are

not?

Mr. MCCLURE. Every VISN is using it in VA at the moment.

That is a marked difference from, again, what we testified last year

and the year before. Every VISN is using DSS, and again, I think

part of that is the commitment and the understanding of the resource base needed to train users, to show the value of that system
17

in doing the kinds of cost comparisons and performance comparisons that are needed across those facilities, very valuable tool in

that sense.

Mr. BUYER. How would you characterize the success of the

VETSNET project, and should VETSNET be terminated?

Mr. MCCLURE. I think, as I indicated, VETSNET is at a critical

juncture. That is where I would put it. There are five—you know,

with the five different applications—software applications that VA

is working on to modernize its C&P systems with VETSNET—each

one of them needs to make sure that it is looked at end to end in

its ability to provide functionality for business needs.

The tests that have been conducted have not been conducted

across all five of those applications. In fact, the two ones that are

critical, really, for the aging BDN, the awards, and the FAS, the

financial system, are still in the end stages of development. Those

are critical to the replacement of some of the outdated applications

on the existing network.

So, I think what we are recommending is that there be a full

testing of the functional business capability of VETSNET, not just

looking at its capacity issues and not just looking at stress tests

but security and full business requirements being met, the user requirements being examined, because again of the passage of time

and the very fact that this system is a field-based exercise. It

means users in the field have to be knowledgeable, trained in the

use of it, and that, I think, is very critical for its long-term success.

Mr. BUYER. Should it be terminated?

Mr. MCCLURE. I think it is too early to make a termination decision on the spot today, until these functional tests are performed

and until some of these issues in which you are given specific information on them and then there can be, I think, a more informed

decision about whether this should proceed or not.

Mr. BUYER. Thank you. Mr. Boozman.

Mr. BOOZMAN. I also would like to compliment you on—this is

very readable and yet really provides an awful lot of useful

information.

On the GCPR initiative, you state, ‘‘Nonetheless, progress on

GCPR initiative continues to be disappointing,’’ and then you outline why and kind of the things that are going on. I guess a lot of

money is being spent in this area, and again, you know, you outlined some concerns. I guess the question I would have—are we

asking them to do something that is just that difficult to do or is

the road block that they do not want to do it? I guess my question

to you is where are the road blocks? You know, what do you see

as the failure in the area of this not being—in that it is disappointing, the progress that is being made.

Mr. MCCLURE. The exercise itself of being able to integrate data

across three entities can be very problematic. The systems within

each one of these entities—DOD, VA, and the Indian Health Service—were not originally designed to share information between

them.

So you do have issues with how data is defined, how it can be

used in a common fashion and still be accurate and reliable. Those

are steps that really have to be done very carefully.
18

In addition, I think the technical solution has to be very well defined. Is this an interface? Is it something that would allow data

to be manipulated by physicians and clinicians, no matter where

they are housed to use it? Is it a repository, a replication of information, or is it actual data that is being used both from the service

as well as veterans?

So those are issues that I think have been looked at, worked on

for the last few years. The problem has been some of them have

not been adequately resolved. There have been questions about

leadership of the project, when you are involving three entities like

this, and a very good value case being presented on what are we

going to be able to do better and when can we begin doing some

pilots and testing of this to show that the results are there, and

those are issues that I think, to overcome these obstacles, have to

be addressed with a lot of discipline.

Mr. BOOZMAN. You mentioned that the mission, you know, had

been changed somewhat, you know, in what they are doing. I guess

that, to me, is a fundamental problem, you know, in the sense that

I guess I would say that, if the mission has been changed, how does

that—I mean where is that authority coming from? You know, how

do we rectify that situation?

Mr. MCCLURE. I think that is a good line of questioning to pursue. It could be that the strategy for GCPR is, indeed, changed

from the virtual patient record type of approach to a data-sharing

approach. I think that that needs to be articulated very clearly by

the three entities involved. If not and what we are seeing is an evolution and a testing and a demonstration of the ability to share

data that will then be built upon to try to achieve the original goals

of GCPR, that needs to be articulated.

So some of that, I think, is where there are some uncertainties

as to where we are headed long-term that would be good to get

more information on.

Mr. BOOZMAN. Okay. Thank you very much.

Mr. BUYER. Thank you.

I will recognize counsel for Ms. Carson, Mr. Sistek.

Mr. SISTEK. Thank you again, Mr. Chairman.

Dr. McClure, you mentioned the fragility of the BDN system at

Hines. Could you speak to where can we expect a break-down

there, or can we keep patching for a longer period of time, if necessary? Clearly, it is performing an essential business function.

There is some point in time where, if we lose the capability to perform that business function, we are going to be in a world of hurt.

Give us a perspective of how long we can keep patching.

Mr. MCCLURE. You can keep patching it until the end of time.

You can keep putting patches on it. You can keep spending money.

The time-frames for the extension of BDN continue to go out. As

you know, it is a reliable payment system. It is not that it is broken down and crashing at the moment. The issue is risk. How

much longer can the applications survive because of their proprietary, outdated coding, and keeping the resources focused just to

maintain that? I think that is an issue.

It also means that those resources being spent to maintain that

environment are resources that are being taken away from the new

environment that VBA needs to move toward, and that tension is
19

going to be there until, again, VETSNET or the C&P replacement

is put in place and begins—sequenced into place, I should say.

Mr. SISTEK. Dr. McClure, on page 3 of your testimony, you state,

concerning the cyber security office—you state, ‘‘Moreover, VA’s

current organizational structure does not ensure that the cyber security officer can effectively oversee and enforce compliance with

security policies and procedures.’’ You elaborate on this at page 20.

How would you draw the dotted lines here if you are putting together an organizational structure? I think I know the answer.

Mr. MCCLURE. Well, it is a situation that we really wanted to

make sure you understood, the committee understood. Creating the

Office of Cyber Security is a gigantic step forward. Having a cyber

security officer is a gigantic step forward. We have numerous security positions across VA that remain unfilled. That needs to be addressed. We have others that report on a full-time, permanent

basis on security issues and others that are part-time.

What is challenging in an environment such as VA’s is the fact

that it is so decentralized, and one of the tools that a cyber security

officer needs it not only to write policies and procedures for how

security would be done but be able to follow up on enforcement and

compliance, and what we are recommending is that at least the relationship between the security officers throughout VA and the

cyber security office be more definite, and in that sense, there can

be more accountability as to the security officers’ actions.

I do not want to imply, however, two things—one, that it should

be command and control totally on security issues from that office.

Security has to work in a decentralized environment, and you must

have real good security, people, process, and technology throughout

the enterprise. The second thing I do not want to leave the impression is that only the security folks should do security functions. The

business lines have to be involved and be held accountable for the

security of their systems, and I think, again, that is a separate

issue from simply the security officers reporting to the Office of

Cyber Security.

Mr. SISTEK. In that last comment, you refer not only to technical

implementation but a cultural change that makes people more security aware, and that has been brought out in previous hearings

by the chairman.

One quick question for Mr. Griffin.

In your October 24 report of last year, you reported and recommended centralized budgetary control, but the Principal Deputy

Assistant Secretary for Management at the VA disagreed with that

centralized budgetary control. There was discussion in the report

about other measures—other control measures being put in place

and that you thought that those control measures were acceptable

and you considered the issue resolved and you would follow up

later with the department.

That report was in October. Do you have a sense of how things

are going now? Are those control measures working to assure the

proper budgetary line?

Mr. GRIFFIN. We are monitoring the progress there, but our point

was you cannot have, in this decentralized VA, people in the field

buying whatever they want without having a focus on whether it

is part of your system-wide integration. Our recommendation was,
20

that the CFO, who sits on top of the budget process, be responsible

for reviewing proposed purchases and ruling on them, so we would

have somebody at a national level doing that type of review.

The decision that was made was to have the CIO be the person

to review and approve from a budgetary perspective. If something

comes across the CIO’s desk that is totally out of sync with the system that they are trying to put in place, whether it is economical

or not, if it does not fit with the system, the CIO then is in a position to disapprove the purchase.

So that is the path that was chosen, and we will continue to

monitor to make sure that there is oversight on a national systemwide basis.

Mr. SISTEK. Thank you very much.

Thank you, Mr. Chairman.

Mr. BUYER. Mr. Griffin, has your office thought about establishing an office solely devoted to investigating cyber crime, such as

NASA’s IG office has recently established? Do you think that is a

good idea or not?

Mr. GRIFFIN. We have a unit like that, sir.

Mr. BUYER. Okay.

Mr. GRIFFIN. We started a cyber unit about 18 months ago.

Mr. BUYER. Great. Working out well?

Mr. GRIFFIN. Very well.

Mr. BUYER. You need more people and resources?

Mr. GRIFFIN. Well, we trained a cadre of people. We hired some

experts when we started the unit, and we have trained some of our

existing criminal investigators to bring them up to speed. So far,

we do not believe there is more work in that area than we can deal

with, but certainly, if it appears that that is going to be the case,

I will make the adjustments.

Mr. BUYER. I would like to also—Mr. Gaskell, let me thank you

and your auditors for crunching the numbers and doing all the

things. It does not get a lot of publicity and people do not focus on

it, but you have always been very responsive to the committee’s requests, and I appreciate that.

Mr. GASKELL. Thank you very much.

Mr. BUYER. Mr. Boozman, do you have anything else?

Mr. BOOZMAN. No.

Mr. BUYER. This panel is now excused. Thank you very much for

your quality work.

Our last panel is the Honorable John A. Gauss, the Assistant

Secretary for Information Technology, Department of Veterans

Affairs.

I would like for you to introduce the guests you brought with you

and their functions, and then your written testimony will be submitted for the record, and you may begin as soon as you are prepared.
21

STATEMENT OF JOHN A. GAUSS, ASSISTANT SECRETARY FOR

INFORMATION TECHNOLOGY, DEPARTMENT OF VETERANS

AFFAIRS, ACCOMPANIED BY BRUCE A. BRODY, ASSOCIATED

DEPUTY ASSISTANT SECRETARY FOR CYBER SECURITY,

DEPARTMENT OF VETERANS AFFAIRS; GARY A.

CHRISTOPHERSON, CHIEF INFORMATION OFFICER, VETERANS HEALTH ADMINISTRATION; K. ADAIR MARTINEZ, CHIEF

INFORMATION OFFICER, VETERANS BENEFITS ADMINISTRATION; WILLIAM CAMPBELL, DEPUTY ASSISTANT SECRETARY

FOR FINANCE, DEPARTMENT OF VETERANS AFFAIRS

Mr. GAUSS. Yes, sir. Thank you very much, and good morning,

Mr. Chairman. I have with me the Chief Information Officer from

the Veterans Health Administration, Mr. Gary Christopherson. I

have the Deputy Assistant Secretary for Finance from the central

office, Mr. Bill Campbell. I have the Chief Information Officer from

the Veterans Benefits Administration, Ms. Adair Martinez, and I

have my chief cyber security officer, Mr. Bruce Brody here at the

table with me.

It is a pleasure to be here this morning and discuss some of these

very important issues. Due to the length of the written statement

that I submitted, I would like to briefly summarize some of the key

points.

On behalf of the Secretary of Veterans Affairs, I am pleased to

be here today and update you on the progress the department has

made in strengthening our information technology program and

specifically address issues related to enterprise architecture, cyber

security, VETSNET, decision support, and the government computer-based patient records program.

Last April, the Secretary appeared before this committee and

gave you his personal commitment to reform the way VA uses information technology. Those specific commitments are included in

my written statement. I am pleased to report to you today that it

is no longer business as usual in VA’s information technology

program.

With respect to enterprise architecture, the department has selected a methodology known as the Zachman framework to develop

and maintain its One-VA enterprise architecture. This methodology

is a systems engineering approach that requires us to define all aspects of the VA enterprise, from a business process, data, location,

schedule, personnel, and requirements perspective before we begin

modernizing our legacy IT systems. This work is well underway.

From a technical perspective, we have developed a technical implementation model for the future VA information technology enterprise. Companies in the private sector that have successfully

modernized their IT enterprises have taken a two-prong approach

to their modernization.

First, they modernize their IT infrastructure to provide a network and computing environment capable of implementing re-engineered business processes. In parallel, they re-engineer their business processes, modernize the IT used to implement those processes, and finally, implement the IT on that modern, high-performance, cost-effective infrastructure. These best commercial practices

are part of our overall strategy.
22

Cyber security of our networks and systems is another issue that

has the Secretary’s highest priority and has my number one priority. In order to effectively secure our networked information, we

must completely understand the topology of our data network.

Our current network is overly complex, too expensive for the performance it provides, and does not have an enterprise-wide network management capability. This complexity and lack of network

management capability impedes our ability to properly secure and

assure network services. Further, our current network infrastructure does not support modernization of our enterprise, as previously discussed.

To correct these deficiencies, we have embarked on a project to

re-architect our data network and change the network from a circuit-based network to a performance-based network. We have established department-wide priorities for security VA’s computing

enterprise. Our first priority is securing VA’s boundaries against

external attack.

As we transition to a performance-based network, we will collapse the total number of gateways to external networks to a manageable number while providing significantly increased security

protection at these gateways. This and our data network efforts are

key components of our approach to implementing a secure enterprise architecture and correcting cyber security deficiencies noted

by our Inspector General and the General Accounting Office.

Major improvements in our cyber security posture include deployment of anti-virus software across the entire department, implementation of a VA-wide firewall policy, and development of a

comprehensive certification and accreditation policy.

The specifics related to VETSNET, the decision support system,

and government computer-based patient record program are contained in my written statement.

Mr. Chairman, I am very concerned about two other areas in addition to what I have talked about this morning.

First, we need to reverse the trend in IT spending. Our overall

IT budget continues to grow. Even more troubling is the

sustainment cost to operate and maintain in-service IT systems as

a percentage of the overall budget. As we formulate the budget for

fiscal year 2004, we will develop a 5-year strategy to reverse these

trends in IT spending.

Second, just like other agencies, our IT workforce is aging, with

a large percentage nearing retirement. To address this issue, I

have launched an aggressive IT workforce initiative to develop and

implement a plan for evolving the workforce, recruiting new people,

and training current employees.

I hope I have provided some insight as to why it is no longer

business as usual at VA. I believe these efforts demonstrate our

very strong commitment at all levels to build an effective information technology program for the long term.

Thank you for this opportunity to discuss these very important

issues. I will be happy to answer any of your questions.

[The prepared statement of Mr. Gauss appears on p. 122.]

Mr. BUYER. I could not help but think that all the years that you

gave to the country in service to the U.S. Navy, you sit before us

as an admiral, retired admiral, in a position where you have no dis-
23

tinct line authority. So I look and say, you know, if I were an admiral and I am now brought onto a staff, how do I define what my

authority is, and I sure do not want my services to be purely

pastoral.

Mr. GAUSS. Yes, sir. When I was asked to submit a resume for

this position, I came down, was interviewed, and talked with the

Secretary, and the Secretary made it perfectly clear that he wanted

this area of information technology attacked and attacked with a

fervor. Further, he indicated and later published a memorandum

empowering the CIO to fix these problems within VA. He further

published a memo that provided the dotted-line connection for matters of IT between me and the people who are sitting here at the

table, except for Mr. Brody, who is a direct report.

Clinger-Cohen gives the CIO authorities to approve the expenditure of funding, approve the planning, approve the programs, and

using that authority, I believe that I can exercise a positive control

over the enterprise.

During my military career, I spent 22 years in the acquisition

side of the house. The acquisition side of the house is very much

like how VA is organized in terms of lines of authority and the ability to influence outcome. So, this is not an environment that I am

unfamiliar with.

Mr. BUYER. I hate to keep going back to your military career, but

I’m trying to figure out how you actually do this when you have

a position with no line authority, and even though you have—you

know, you are sort of a representative here—what do you when a

bureaucrat, in particular on of the—I do not know—within the benefits—you have got a bureaucrat there that tries to do an end run

on you?

Mr. GAUSS. We have made some fundamental process changes at

VA, Mr. Chairman, to try and prevent that.

Now, have we become foolproof? No, sir, we have not. We have

put in place a tracking system to track all expenditures. Any IT expenditure and execution has to come to my staff for review and approval in execution prior to it going out the door.

I am working with the Assistant Secretary for Management to

put similar controls down the contracting path and down the financial authorization path so that if someone were to say I am going

to bypass this process, it is too hard, we will have checks and balances on the contracting and financial authorization end.

Mr. BUYER. I guess, Admiral, when I look at this, they have got

to believe that, when the dust settles at the end of the fight, that

you are standing.

Mr. GAUSS. Yes, sir.

Mr. BUYER. Right?

Mr. GAUSS. Yes, sir.

Mr. BUYER. Well, let me ask it this way. You are comfortable

that the Secretary has empowered you to do what you need to do

to get the job done.

Mr. GAUSS. Yes, sir, I am, and in fact——

Mr. BUYER. Okay.

Mr. GAUSS (continuing). I would not have considered applying for

this without——
24

Mr. BUYER. We, this subcommittee, needs to know, then, who we

then hold accountable, okay? Responsibility will rest with the Secretary, okay, but we need to know who we are going to talk to.

So, we are not going to go into these three stovepipes and beat

them up. We are going to come to you. We are going to give you

the compliments, and we will rest it all to you. If we do not like

something, we are going to come to you. Is that correct with regard

to this implementation of the One-VA? It is you.

Mr. GAUSS. Yes, sir. My military experience is that the Secretary

is accountable for everything. He has delegated responsibility to me

and accountability for that responsibility for matters of information

technology, and I stand ready to assume that accountability that

is commensurate with that responsibility.

Mr. BUYER. All right.

The tragedy of September 11 heightened the awareness and concerns regarding the preparedness of all Federal agencies for continuity of operations and information assurance in the event of another manmade or natural disaster. Due to the sensitive nature, I

am not asking you to discuss specific vulnerabilities that you feel—

are uncomfortable discussing in an open forum. However, given the

importance of these two areas, in your view, are improvements

needed in these areas? More directly, what specific steps are being

taken to ensure that VA operations can continue in the event of a

catastrophic event?

Mr. GAUSS. When I came to VA last August, I looked at the continuity of operations that was in place, the processes and procedures, and it was my view then and it is my view now that VA has

not taken advantage of what technology brings to bear for continuity of operation, for quicker restoral of service.

In my opening remarks, I talked about the need to modernize our

data network. With a modern, high-performance data network, we

can use technology to electronically vault data to other geographic

locations from our data centers and bring up restoration of service

far better than the process that is in place today, which is to back

it up on tapes, fly it to coop sites, send people there with it, and

stand it up in 72 hours.

So, there is much to be done in that area.

Mr. BUYER. Last year, with much fanfare, VBA announced it was

paying 10 veterans payments using VETSNET’s C&P as the demonstration test. Have anymore claims been processed and paid

using the automated VETSNET project?

Mr. GAUSS. No, sir. The intent of that demonstration was to demonstrate that the processing of claims was not tied to existing ways

of doing business. There were 10 very simple claims using very rudimentary processing. Much more complex claims require additional development in those two modules left to complete that the

General Accounting Office discussed in their testimony.

Mr. BUYER. When over 3 million VA beneficiaries received legislative cost-of-living increases this past January, did the 10

VETSNET beneficiaries get their increase?

Mr. GAUSS. Yes, sir, they did.

Mr. BUYER. Okay. Will you explain—was it through the system

or was it by—was there a problem with it, though?
25

Ms. MARTINEZ. There was not any problem with it. We changed

the system. We now only have nine vets being paid, because one

just moved to West Virginia, and they are being paid through

BDN. There was no problem with the COLA.

Mr. BUYER. Okay. But it was not sent out in January. It was reprocessed and done in February?

Ms. MARTINEZ. I was there in January, and they were doing all

of the work to do it. I am not aware that it was reprocessed for

February.

Mr. BUYER. All right.

I yield to Ms. Carson.

Ms. CARSON. Thank you very much, Mr. Chairman.

Dr. Gauss, in your written statement, you address the two-prong

approach that private sector companies have successfully used in

modernizing their IT enterprise. You state, quote, ‘‘First they modernize their IT infrastructure to provide a network and computing

environment capable of implementing re-engineered business processes. In parallel, they re-engineered their business processes, modernized the IT used to implement those processes, and finally implemented the IT on the modern, high-performance, cost-effective

infrastructure.’’ Then you go on to say, ‘‘These commercial best

practices are part of our overall strategy.’’

My question, then, Dr. Gauss, is how does the proposed

VETSNET system, devised in 1985, embarked upon in 1993, and

still mostly unrealized, fit into the commercial best practices schema you endorse for the VA?

Mr. GAUSS. The technology that is being used in VETSNET today

that was under test, as mentioned earlier, is technology from the

mid-1990s. It does client-server operations. It is not state of the art

as of 2001 and 2002.

Much has been invested in that technology that I believe can be

reusable in meeting the objective of shutting down that old mainframe system and get to a more modern technology framework.

Sometime in the future, we will need to put some performance improvements into VETSNET, but we first have to get it operational

and shut down that legacy mainframe system.

Ms. CARSON. If I may, Mr. Chairman, ask him another question—I apologize for being in and out. Sorry about that. I did have

the advantage of your testimony. You had indicated that veterans

are best served—are veterans best served or is the department best

served by the status quo?

Now, you have some great minds here that is assembled here,

but don’t they all report to different under secretaries?

Mr. GAUSS. For normal reporting processes, each of the people at

this table, except Mr. Brody, report to other people. However, last

summer, the Secretary published a memo giving me indirect reporting with these people on matters of IT. So, I have the ability

to go direct to everyone at this table to reconcile issues related to

our information technology programs and architecture.

Ms. CARSON. Uniformly, then, you have one-line authority across

the board and they can all feed into you so that there is some uniformity in terms of what you do?

Mr. GAUSS. We have developed that process to do that, yes.
26

Mr. BUYER. She asked a specific question. I mean, do you have

the specific line authority? The answer is no.

Mr. GAUSS. No, sir. No. In my answer, I said that I do not have

direct line authority. I have indirect authority for matters of IT,

and so, I have a sub-organization within the structure where I deal

directly with these people on matters of enterprise architecture, IT,

and cyber security, and that is an efficiency gained over the past

year, because I do not have to go to an under secretary to get it

approved to go to the deputy under secretary in order to go to one

of the CIOs. I pick up the phone, call direct, we work the issues,

we get them solved.

Ms. CARSON. I am still having some problem with indirect, but

I will leave that up to the chairman to sort all that out. Thank you

very much, Dr. Gauss.

Mr. BUYER. Well, Ms. Carson, that was my concern, too. What

we have here is testimony from an individual that the Secretary

has chosen to lead this, and he is here before us saying I am the

man that is responsible, and so, I have got some concerns, too, if

I have got someone who does not have specific line authority, but

if his testimony to us is that he can figure this out, he is going to

make it happen, this is the person that we are going to have to

work with to make sure all this gets implemented. I share your

concerns, Ms. Carson.

Mr. GAUSS. Mr. Chairman, may I add, in my last job, I was the

commander of a material acquisition command. I reported directly

to the vice chief of naval operations. He did not provide me my

money. That came from four or five different resource sponsors. My

customers were four-star admiral fleet commanders. I had lots of

indirect lines, and when the four-star called, I did what I needed

to do.

So we are taking some of the military structural organizational

constructs and applying them to our IT here. Not all of them had

to go to the vice chief of naval operations to get me to do what I

needed to do if I needed to help them.

Ms. CARSON. Do all the under secretaries report to you, then?

Mr. GAUSS. The under secretaries report to the Secretary. The

chief information officers here at the table report directly within

their administrations, but on matters of information technology,

they report to me.

Ms. CARSON. So, you have the sole jurisdiction of IT.

Mr. GAUSS. Yes, ma’am.

Ms. CARSON. You are it.

Mr. GAUSS. Yes, ma’am.

Ms. CARSON. Anything that is sort of——

Mr. GAUSS. Well, the Secretary is it. On his behalf, I am it.

Ms. CARSON. Yes, I understand. The Secretary had said that, if

at any point, the best interest of the veteran, are not being served,

that the Secretary was prepared to change the reporting mechanism. As I understand you, your response to the chairperson, that

you are ready to take full responsibility, all the hits, like in the

military, if it does not work.

Mr. GAUSS. Yes, ma’am.

Ms. CARSON. Okay. It is probably engaging in another war you

probably do not want to be in.
27

Mr. GAUSS. There might be some wars that you do not get to see

in these chambers here in the process.

Ms. CARSON. Yes, we have the President of the United States on

Capitol Hill. If I see him, I will tell you him you are the hit man.

Thank you very much.

Mr. BUYER. Mr. Boozman, if you will be patient with me just a

second, Ms. Carson and I both are trying to figure this out, and obviously, Admiral, if you are comfortable with it, I suppose I am

supposed to be, and so is Ms. Carson and this committee, but you

know, when you look at what the IG has submitted to us, when you

look at what GAO has submitted to us, they are complimentary,

and then they put in the semicolon, however.

Mr. GAUSS. Yes, sir.

Mr. BUYER. They are complimentary, but they are also—and I

will even accept the testimony of our experts over the framework

for us to be patient. It is so very, very important at the beginning

to make sure that the individuals who are selected are empowered

and have the authority to do what they have to do. I guess I

learned long ago, direct line authority is pretty important in order

to get someone to be extremely responsive.

I mean if you are paying them and they know that you are rating

them—let me ask that question. What input do you have with regard to rating people?

Mr. GAUSS. I have direct input to the reporting seniors of these

folks for what goes into their performance evaluation.

Mr. BUYER. Okay. Then, with regard to promotions, with regard

to merit bonuses, do you have input in that, also?

Mr. GAUSS. The process at VA—— Mr. BUYER. If you are working with someone in one of those administrations who is messing with you and making life difficult to

get this implementation going, do you have the ability to say no,

they are not entitled to a merit bonus?

Mr. GAUSS. I do not have that. The bonuses are provided at VA

on an as-occurring basis. It is not like an end-of-the-year, total performance type of an award, but I certainly have input into their

performance evaluations that document their performance, and

should Mr. Christopherson decide that he does not want to proceed

the way I wanted to, I will make this an issue with his boss, and

if necessary, I will make it an issue with the Secretary.

Mr. Chairman, we have made some changes in how we operate

within VA. May I recommend that we have a post-hearing question

to lay out what those are specifically and then document how we

believe this will work?

Mr. BUYER. All right. Thank you. Mr. Boozman.

Mr. BOOZMAN. I just want to compliment you on taking on a big

job. You know, this is a big job, and I certainly think you are up

to the task.

We had a report from the GAO earlier. Is there anything that

you see—are there any discrepancies that you find with that, or do

you feel like that they are on track with their report as to kind of

what is going on with the system and where we are heading?

Mr. GAUSS. I, too, agree that the report that the GAO submitted

to this hearing is an excellent piece of work, and I plan to keep

that by my side as we move into the future. There are minor things
28

that I will address separately, but they are of such insignificant

magnitude, I would not want to bring them up here to this

committee.

Mr. BOOZMAN. So overall, you felt like that was accurate.

Mr. GAUSS. Overall, I thought it was an excellent report and very

fair and objective on where we are.

Mr. BOOZMAN. Thank you.

Mr. BUYER. Dr. Gauss, Ms. Carson and I have spent a lot of time

on the whole question about your line authority, and you might

say, you know, of all the things that are out there, trying to implement this One-VA system, why are we spending so much time on

that?

I am not going to speak for Ms. Carson, but I do believe that the

two of us—we want to make sure that you are empowered and people understand within the VA administration that everybody is

looking to you to implement this, and if we receive this testimony

about the—and these are my words—about the cultural bias and

the inertia that is out there by some tenured individuals, using the

doctor’s word, we think it is pretty important, and you know, we

are looking right now to the Secretary. The Secretary creates this

position, brings you in. We are looking at it from the position of— we are going to evaluate.

So we would like for you to submit that to us. Please make it

timely, and I think this committee, in a bipartisan basis, will

evaluate whether or not we need to actually legislate a position,

and I can assure you, if we actually legislate the position, we are

going to give you all types of line authorities.

Now, just because I just mentioned that here this morning, you

are going to hear all types of people coming in saying why that is

such a bad idea. I would welcome your attentive listening to those

individuals who are anxious to tell you why it is a bad idea, you

know?

Mr. GAUSS. Sure.

Mr. BUYER. Because I do not know if it is a bad idea or a good

idea, and earlier on I said I do not want us to be micro-managing,

and we are going to do our oversight function, but I do know that

it is extremely important that we have someone at the top that has

direct line authority and chain of command. Admiral, if it requires

us to make a legislative position to do that—the taxpayers are putting a lot of money into this, and we want to make sure of its success, and we are going to make you the captain of the One-VA ship,

all right?

Mr. GAUSS. Yes, sir.

Mr. BUYER. If it requires us to actually legislate that position, I

think this committee is prepared to do something like that, but we

will also be a good listener. We want to evaluate what you submit

to us, and we will sit down with you, we will talk with the Secretary, and we will see whether or not we should actually make

this a specific position and empower you to do what is required.

Billions of dollars are at stake. A lot of contracts out there are at

stake.

With that, I do have one question I wanted to ask you and forgot

to. On standardized software, as you go down the integrated enterprise architecture path, do you require standardized software
29

throughout the three administrations? Is that what you are sort of

looking toward?

Mr. GAUSS. In the software arena, there are some software products that are commodities, where commercial standards have

emerged, where it does not matter what the brand name is on the

product, it will work and be inter-operable. There are certain technologies where the power of the technology is vendor-unique and

the commercial standards are very weak. It is in those cases that,

in order for us to exchange information and be inter-operable, we

will, unfortunately, have to standardize, and anyone who needs to

use that function would have to use the standard product.

Mr. BUYER. Are there any existing problems with Microsoft at

the moment, between your office and that company, existing

contracts?

Mr. GAUSS. I’m sorry, sir?

Mr. BUYER. About an existing contract?

Mr. GAUSS. We had an enterprise license with Microsoft for

180,000 seats and some number of servers in the back office, and

it was due for renewal, and we chose not to renew that enterprise

contract. The dollar value associated for the benefit gain this fiscal

year traded against patient health care did not seem like a reasonable balance, and so, we own licenses for the computers that we

have. We have Windows 2000 products. We have Office 2000 products. Our licenses with Office 2000 are portable from one machine

to another.

So, as we buy new computers, we will pay the GSA schedule rate

of $130 per machine for a new license vice $8, and what we lose

by not renewing the license is the rights to upgrade to the next

generation of product should and when it be released.

Mr. BUYER. Whose decision was that?

Mr. GAUSS. It was a collaborative decision between myself, the

acting under secretary for health, and we advised the Secretary of

what we planned to do, and he and the deputy secretary concurred.

Mr. BUYER. A collaborative decision. I do not get that. If we empowered and created a position for you, would you be calling it a

collaborative decision?

Mr. GAUSS. Yes, sir, I would, and I would because I need to have

cooperation from folks. Having line authority and a hammer is an

important thing to do, I will not argue that, but I still need to have

cooperation from the administrations in these types of decisions

that have potentially broad-reaching impacts.

Mr. BUYER. All right. Ms. Carson.

Ms. CARSON. I agree with the chairman wholeheartedly on line

authority. Let me take another spin to it, just at a different perspective—not a different perspective. Do you feel comfortable—

could you be very open and candid about whether or not you feel

comfortable in recommending something that is probably broke and

needs to be fixed? I know, oftentimes, government people have apprehension about writing down their observations. The only federal

people I have seen that have no observation was the Immigration

and Naturalization Service people. Do you have some reservations

about doing this?

Mr. GAUSS. No, ma’am, not at all.
30

Ms. CARSON. Okay. You do not anticipate any repercussions

about describing what is broke that needs to be fixed.

Mr. GAUSS. No, ma’am, I do not.

Ms. CARSON. Okay. Fine. Because you were going to get an opportunity to opt out of this at this time. Now you do not get that

opportunity anymore. Thank you very much.

Mr. BUYER. Thank you, Ms. Carson.

Mr. Boozman, do you have any follow-up?

Mr. BOOZMAN. No.

Mr. BUYER. Dr. Gauss and the team, thank you for coming over.

We are going to have some follow-up written questions that we are

going to submit to you, and I would like to have the follow-up discussion with this committee and find out—and we need to make a

decision.

Mr. GAUSS. Yes, sir.

Mr. BUYER. Okay? We will make a, quote, ‘‘collaborative’’ decision——

Mr. GAUSS. Yes, sir.

Mr. BUYER (continuing). Amongst the members of the committee

on whether or not we actually create a position for you, all right?

Mr. GAUSS. Yes, sir.

Mr. BUYER. Thank you.

Mr. GAUSS. Thank you.

Mr. BUYER. The meeting stands adjourned.

[Whereupon, at 11:52 a.m., the subcommittee was adjourned.]
31

A P P E N D I X
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129

WRITTEN COMMITTEE QUESTIONS AND THEIR RESPONSES

CHAIRMAN BUYER TO GENERAL ACCOUNTING OFFICE
130
131
132
133
134
135
136
137
138

CONGRESSWOMAN CARSON TO DEPARTMENT OF VETERANS AFFAIRS
139
140

Æ