SPECIAL INSPECTOR GENERAL FOR IRAQ RECONSTRUCTION

400 Army Navy Drive • Arlington, Virginia 22202

January 28, 2011 

LETTER FOR DIRECTOR, ARMY BUDGET, OFFICE OF THE ASSISTANT SECRETARY 

OF THE ARMY (FINANCIAL MANAGEMENT and COMPTROLLER).

SUBJECT: Interim Report: Action Needed To Address Missing Iraq Transaction Data 

(SIGIR 11-008) 

This interim report addresses the Special Inspector General for Iraq Reconstruction’s (SIGIR) 

concerns over missing Iraq transaction data and it seeks your assistance in recovering the data. 

The missing data has been reported to the Army Financial Management Command and Defense 

Finance and Accounting Service (DFAS) by the Department of Defense Inspector General 

(DoDIG). While the Army Financial Management Command took some steps to reconstruct the 

missing data, these efforts have not been fully successful. 

SIGIR is primarily concerned about the missing data because Section 3001, (o)(2), of Public Law 

108-106, as amended requires us to prepare a final forensic audit report on all amounts 

appropriated or otherwise made available for the reconstruction of Iraq, and this data is necessary 

for us to fulfill our Congressional mandate. Additionally, a substantial amount of the data could 

be cash transactions made through the Commander’s Emergency Response Program (CERP), 

which prior SIGIR audits and investigations have shown to be vulnerable to fraud and theft. 

Further, reconstructing the missing data should be important to the Department of the Army 

because (1) the missing data likely includes Personally Identifiable Information (PII) from pay 

agents and other U.S. military personnel that could be used to defraud these individuals; and (2) 

the missing data may include classified information.

Background 

In December 2008, SIGIR announced an audit of Department of Defense (DoD) appropriation, 

obligation, and expenditure data related to Iraq relief and reconstruction projects (Project 9005). 

We are performing this analysis to meet our mandate to forensically audit all Iraq reconstruction 

funds. In collecting the records, we found that about $2.5 billion in transactions, primarily 

CERP transactions, were recorded in the Deployable Disbursing System (DDS). 

DFAS developed DDS in 2005 to serve as an on-site, tactical disbursing system for deployed 

military units. The system runs on individual computers that operate independently of a central 

network or server and enables DoD personnel to maintain accountability of appropriated funds in 

the field. When units return from the field, the data is to be transferred into DFAS’ primary 

financial system. SIGIR’s objective for this report is to determine the extent to which DoD has 

attempted to retrieve transaction data missing from DDS and evaluate the sensitivity of missing 

data and follow-up steps it must take to address missing data.
2 

Transaction Data Is Missing

During the course of our data collection process, we reconciled the DDS data we were provided 

with Congressional appropriations and other DoD financial system data and found that some 

DDS data was missing. We questioned DFAS and the Army Financial Management Command 

about the missing data in early 2010, and these officials told us that the DoDIG had already made 

them aware of the situation. According to an Army Financial Management Command official, 

the missing transaction data is from two sites in Iraq under SIGIR’s forensic review; Camp 

Speicher, Tikrit, for the period October 2005 through March 2007, and Camp Liberty, Baghdad, 

for the period October 2005 through August 2006. 

An Army Financial Management Command official told us that the data is missing because of a 

computer malfunction and because some DDS users did not follow the appropriate procedures. 

The official said that computers have a limited data storage capacity, and when a computer hard 

drive reaches capacity, units are directed to transfer data from the hard drive to portable 

electronic media, such as compact disks or an external hard drive. The data is then to be 

transferred into DDS’ main system for archiving, as soon as possible thereafter. In one instance 

in which data is missing, a unit transferred its data to another computer. That computer’s hard 

drive crashed, and the data was lost. In another instance, units transferred their data to disks but 

did not complete the transfer of the data to the DDS main system. The units reportedly brought 

the data home when they left Iraq and subsequently lost the disks. The DoDIG made 

recommendations to address this problem1

The Missing Data Is Needed To Meet SIGIR’s Forensic Mandate

, and in April 2009, new procedures were established 

governing the handling and storage of data. 

SIGIR’s interest in the missing data is to satisfy our forensic audit mandate as well as to address 

concerns that the loss may represent an intentional breach of CERP internal controls. Prior 

SIGIR work has shown significant problems with controls over CERP, particularly for cash 

disbursements made through the program. DoD personnel in Iraq are responsible for handling 

the money, creating paper records, and entering the transactions into DDS to record the 

payments. While some of these duties may be segregated, the risk of DoD personnel colluding 

on criminal acts is heightened because the entire disbursement process is handled at the local 

level. To date, SIGIR investigations have resulted in six convictions of DoD personnel involving 

CERP-related payment activities. 

The total amount of information that is missing cannot be determined without reconstructing the 

activity through a review of each voucher. In an effort to evaluate the scope of the missing data, 

SIGIR collected DDS data associated with the Camp Liberty disbursing site for September 2006 

through May 2007. We found that the average monthly payment activity for this period was 

approximately $75 million, and 96% of the transactions were in cash for CERP projects. While 

this average cannot be directly related to the missing transaction data, it suggests that the missing 

data contains a substantial amount of payment activity. 

As of December 2010 the missing data has not been reconstructed. According to a DFAS 

official, the Army would be responsible for reconstructing the data because it controls database 

________________ 

1 Internal Controls Over United States Marine Corps Commercial and Miscellaneous Payments Processed Through 

the Deployable Disbursing System, D-2010-037, 1/25/2010. 
3 

security in the field, to include physical security of its computers and portable data storage. This 

DFAS official noted that, during the time period in question, there was no central DDS 

repository in DFAS, and the Army was responsible for policy and procedures concerning the 

archiving and purging of data and subsequent safekeeping of the data. This official added that 

the propriety of any payment was the responsibility of the disbursing officer for the specific 

DSSNs. According to an Army Financial Management Command official, attempts were made 

to locate the missing data by contacting the units responsible for managing the records. 

However, this effort was unsuccessful because, in many cases, personnel operating the DDS sites 

had changed due to units rotating in and out of Iraq, and no records of the portable media were 

maintained in Iraq. According to a DFAS official, all paper copies of transactions were sent to 

DFAS Rome, New York for reconciliation with the monthly accountability statement. This 

official added that it is possible to reconstruct the missing transaction data using paper records 

associated with the transactions. 

Sensitive and Classified Information May Have Been Lost

While the missing data is of concern to SIGIR because of our forensic audit mandate, it is likely 

that the missing data also contains Personally Identifiable Information (PII) of military members 

and may also include classified information. 

SIGIR’s review of DDS data has found that it includes the names of military and civilian 

personnel responsible for making payments of Iraq reconstruction funds. DoD’s Guidance on 

Protecting PII (August 2006) requires that all PII information be evaluated for impact of loss or 

unauthorized disclosure and protected accordingly. For example, any collection of electronic 

records stored on a single device containing PII on more than 500 people is to be encrypted. 

However, according to a DFAS official, archived data in the 2006 and 2007 time period was not 

encrypted. Federal laws and Office of Management and Budget guidance2

It is also possible that classified information is included in the missing data. In 2009, the DoDIG 

reported

also require agencies 

to develop policies and procedures, and implement a notification process if PII information is 

lost. In determining whether notification is required, this guidance instructs agencies to assess 

the potential for harm due to a breach by considering the risk factors of the data. DoD 

implemented these procedures, but the Army Financial Management Command has not assessed 

the circumstances of the breach to determine whether notification of impacted personnel is 

required. 

3

________________ 

2 Federal Information Security Management Act of 2002, 44 USC § 3541, Privacy Act of 1974, 5 USC § 552a, and 

Safeguarding Against and Responding to the Breach of Personally Identifiable Information, Office of Management 

and Budget M-07-16, 05/22/2007.

 that DoD personnel had entered classified information into two unclassified DoD 

systems, one of which was DDS. Therefore, it is possible that the missing DDS data from 2006 

and 2007 may contain classified information, such as the names of intelligence sources, which 

could expose the sources and their associates to considerable risk. As with PII, existing DoD 

3 Identification of Classified Information in Unclassified DoD Systems During the Audit of Internal Controls and 

Data Reliability in the Deployable Disbursing System, D-2009-054, 2/17/2009.
4 

guidance4

According to a DFAS official, during the time frame in question, the DDS Program Management 

Office was not aware of any sensitive data being processed in DDS. This official added that, 

subsequent to this time period, and with the development of the repository, all historical data has 

been through a cleansing process and all new data goes through a similar review process prior to 

importing to the repository. 

 requires that known or suspected instances of unauthorized public disclosure of 

classified information are to be reported promptly and investigated to decide the nature and 

circumstances of the disclosure. To date, the Army Financial Management Command has not 

determined whether classified information was included in the missing DDS data or whether this 

information was disclosed. 

Conclusions, Recommendation, and Management Comments

Conclusions 

The missing DDS data prevents SIGIR from meeting its mandate to forensically audit Iraq 

reconstruction funds. The fact that the missing data involves high risk cash transactions from 

CERP also raises SIGIR’s concern.

Moreover, unless these records are reconstructed, the Army cannot determine whether PII and 

classified information was lost. Determining whether PII and classified information is missing is 

necessary to mitigate any potential consequences resulting from the loss of this information. 

Recommendations 

SIGIR recommends that the Director, Army Budget, Office of the Assistant Secretary of the 

Army (Financial Management and Comptroller) direct the Army Financial Management 

Command to 

1. Reconstruct all missing transactions by using available DFAS records, and provide this 

information to SIGIR. 

2. Review the reconstructed transactions to determine whether they include any PII and 

classified information, and take appropriate action pursuant to federal law and applicable 

guidance.

Management Comments and Audit Response

In written comments on a draft of this report, the Army concurred with the report’s conclusions 

and recommendations. Comments are reprinted in their entirety in Appendix D. While the 

Army concurred with the draft report, SIGIR identified some areas of the written response that 

required clarification. For example, the Army noted that “An ongoing DOD IG audit previously 

identified this electronic information gap and determined that the loss represented less than one 

one-hundredth of a percent of the total DDS payments for the period...” SIGIR contacted a 

DOD IG official associated with the ongoing audit for verification. The DOD IG official told

________________ 

4 Directive 5210.50 Unauthorized Disclosure of Classified Information to the Public, Department of Defense, 

7/22/2005.
5 

SIGIR that the data they identified as missing from DDS was based on a limited review. They 

added that it is not possible to determine the percentage missing until the hard copy payment 

vouchers are fully reconciled to DDS data." 

In addition, the Army indicated in its response that, since any missing data was encrypted and 

password-protected, it was unnecessary to locate vouchers associated with the data in an effort to 

determine whether it contained PII or classified information. However, we were told by DFAS 

officials with knowledge of DDS in Iraq that transaction data during the time period in question 

was not encrypted. Consequently, we believe action should be taken by the Army to rule out the 

possibility of PII or classified data spillage. 

In addition to written comments from the Army, SIGIR also received technical comments from 

DFAS and modified the report as appropriate.

- - - - 

We appreciate the courtesies extended to the SIGIR staff. For additional information on the 

report, please contact Glenn D. Furbish, Assistant Inspector General for Audits (Washington, 

DC), (703) 604-1388/ glenn.furbish@sigir.mil, or Nancee Needham, Deputy Assistant Inspector 

General for Audits (Baghdad), (240) 553-0581 ext. 3793/ nancee.needham@iraq.centcom.mil. 

Stuart W. Bowen, Jr. 

Inspector General

cc: Commander, U.S. Central Command 

 Commanding General, U.S. Forces-Iraq

 Director, Defense Finance and Accounting Service 
6 

Appendix A—Scope and Methodology

In December 2008, the Special Inspector General for Iraq Reconstruction (SIGIR) initiated 

Project 9005 to meet, in part, a Congressional mandate to forensically audit the Department of 

Defense’s (DoD) management of funds appropriated for the reconstruction of Iraq. SIGIR is 

required to prepare a final forensic audit of these pursuant to Public Law 108-106 and 

periodically issues interim reports, such as this report (Project 9005c), to keep the Congress 

informed of the results of our ongoing efforts. Our reporting objective is to determine the extent 

to which DoD has attempted to retrieve transaction data missing from DDS and evaluate the 

sensitivity of missing data and follow-up steps it must take to address missing data. We 

performed the audit under authority of Public Law 108-106, as amended, which also incorporates 

the duties and responsibilities of inspectors general under the Inspector General Act of 1978. 

SIGIR conducted this particular review from March 2010 to December 2010. 

To accomplish our objective we obtained DDS transaction data from the Department of Defense. 

We reconciled this information with Congressional appropriations and other DoD financial 

systems that maintained similar information to ensure the data we were provided was accurate 

and complete. Our analysis showed that data was likely missing from the DDS. We then held 

discussions with officials from the Army Financial Management Command and the Defense 

Finance and Accounting Service, who confirmed that DDS data was missing. We reviewed the 

Army’s internal controls processes and procedures to oversee and manage DDS data to 

determine if there were weaknesses in their system of controls. Last, we obtained and reviewed 

guidance from the Office of Management and Budget and DoD to determine what action should 

be taken, if any, when DoD loses control of Personally Identifiable Information and classified 

data.

This audit was conducted in accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain sufficient and appropriate 

evidence to provide a reasonable basis for our findings and conclusions based on our audit 

objective. We believe that the evidence obtained provides a reasonable basis for our findings 

and conclusions based on our audit objective. 

Use of Computer-processed Data

This report discusses difficulties SIGIR encountered in utilizing DDS data to respond to its 

Congressional mandate to prepare a final forensic audit report on all amounts appropriated or 

otherwise made available for the reconstruction of Iraq. During the course of our data collection 

process, we reconciled the DDS data we were provided with Congressional appropriations and 

other DoD financial system data and found that some DDS data was missing. 

Internal Controls

We reviewed Army internal controls to oversee, manage, and secure DDS data. Specifically, 

SIGIR identified and assessed internal controls the Army used in managing portable electronic 
7 

storage devices and sensitive transaction data. The results of the review are presented in this 

report.

Prior Coverage 

We reviewed the following reports issued by SIGIR and the Department of Defense, Office of 

the Inspector General:

SIGIR

Forensic Audit Methodologies Used To Collect and Analyze Electronic Disbursements of Iraq 

Reconstruction Funds, SIGIR 11-006, 10/28/2010. 

Iraq Reconstruction Funds: Forensic Audits Identifying Fraud, Waste, and Abuse – Interim 

Report #5, SIGIR 11-005, 10/28/2010. 

Iraq Reconstruction Funds: Forensic Audits Identifying Fraud, Waste, and Abuse – Interim 

Report #4, SIGIR 10-019, 7/26/2010. 

Iraq Reconstruction Funds: Forensic Audits Identifying Fraud, Waste, and Abuse – Interim 

Report #3, SIGIR 10-017, 4/28/2010. 

Iraq Reconstruction Funds: Forensic Audits Identifying Fraud, Waste, and Abuse – Interim 

Report #2, SIGIR 10-011, 1/28/2010. 

Iraq Reconstruction Funds: Forensic Audits Identifying Fraud, Waste, and Abuse – Interim 

Report #1, SIGIR 10-004, 10/28/2009.

Department of Defense, Office of the Inspector General

Internal Controls Over United States Marine Corps Commercial and Miscellaneous Payments 

Processed Through the Deployable Disbursing System, D-2010-037, 1/25/2010. 

Identification of Classified Information in Unclassified DoD Systems During Audit of Internal 

Controls and Reliability in the Deployable Disbursing System, D-2009-054, 2/17/2009. 

Internal Controls Over Payments Made in Iraq, Kuwait and Egypt, D-2008-098, 5/22/2008. 
8 

Appendix B—Acronyms 

Acronym Description

CERP Commander’s Emergency Response Program

DDS Deployable Disbursing System

DFAS Defense Finance and Accounting Service

DoD Department of Defense

PII Personally Identifiable Information

SIGIR Special Inspector General for Iraq Reconstruction
9 

Appendix C—Audit Team Members 

This report was prepared and the audit conducted under the direction of Glenn D. Furbish, 

Assistant Inspector General for Audits, Office of the Special Inspector General for Iraq 

Reconstruction. 

The staff members who conducted the review and contributed to the report include: 

Adam Hatton

Richard Newbold 
10 

Appendix D—Management Comments 
11 
12 

Appendix E—SIGIR Mission and Contact Information

SIGIR’s Mission Regarding the U.S. reconstruction plans, programs, and 

operations in Iraq, the Special Inspector General for Iraq 

Reconstruction provides independent and objective: 

• oversight and review through comprehensive audits, 

inspections, and investigations 

• advice and recommendations on policies to promote 

economy, efficiency, and effectiveness

• deterrence of malfeasance through the prevention and 

detection of fraud, waste, and abuse 

• information and analysis to the Secretary of State, the 

Secretary of Defense, the Congress, and the American 

people through Quarterly Reports 

Obtaining Copies of SIGIR 

Reports and Testimonies

To obtain copies of SIGIR documents at no cost, go to 

SIGIR’s Web site (www.sigir.mil).

To Report Fraud, Waste, and 

Abuse in Iraq Relief and 

Reconstruction Programs

Help prevent fraud, waste, and abuse by reporting 

suspicious or illegal activities to the SIGIR Hotline:

• Web: www.sigir.mil/submit_fraud.html 

• Phone: 703-602-4063 

• Toll Free: 866-301-2003 

Congressional Affairs Hillel Weinberg

Assistant Inspector General for Congressional 

Affairs 

Mail: Office of the Special Inspector General

for Iraq Reconstruction 

 400 Army Navy Drive 

 Arlington, VA 22202-4704 

Phone 703-428-1059 

Email hillel.weinberg@sigir.mil

Public Affairs Deborah Horan

Office of Public Affairs 

Mail: Office of the Special Inspector General for Iraq 

Reconstruction 

 400 Army Navy Drive

 Arlington, VA 22202-4704 

Phone: 703-428-1217 

Fax: 703-428-0817 

Email: PublicAffairs@sigir.mil