For Release on Delivery

Expected at

1 p.m.

Monday,

May 22, 2000

GAO/T-AIMD/GGD-00-179

ELECTRONIC

GOVERNMENT

Federal Initiatives Are

Evolving Rapidly But They

Face Significant

Challenges

Statement of David L. McClure

Associate Director, Governmentwide and Defense

Information Systems

Accounting and Information Management Division

Testimony

Before the Subcommittee on Government Management,

Information and Technology, Committee on Government

Reform, House of Representatives

United States General Accounting Office

GAO
Page 1 GAO/T-AIMD/GGD-00-179

Mr. Chairman and Members of the Subcommittee:

I appreciate the opportunity to be here today to participate in the

Subcommittee’s hearing on electronic government issues. There is perhaps

no topic that generates more lively discussion than the rapid changes that

the Internet is introducing to our personal lives, the economy, and

institutions throughout our society. The United States is the world’s

leading Internet nation, with over 110 million users. By some estimates,

worldwide Internet traffic is doubling every 100 days.

Electronic commerce and business strategies made possible by

widespread Internet access and interconnected systems are transforming

how organizations, both public and private, will operate in the next

decade. This trend is accelerating at a rapid pace, with investments in

information technology expected to account for 40 percent of all capital

investment in the United States by 2004. According to recent forecasts by

the Gartner Group, spending by federal, state, and local governments on egovernment will quadruple over the next 5 years, from $1.5 billion in 2000

to $6.2 billion in 2005.

Mr. Chairman, the rising connectivity and interdependence fostered

through information technology create both benefits and challenges. The

potential for benefits to the public sector is vast. Today, governments at all

levels are using the Internet and other electronic commerce means to

improve internal business operations and to provide on-line public access

to information and services. Opportunities for further improvements

abound. New global Web technology applications and opportunities

undoubtedly will continue to transform the way the federal government

conducts business, communicates, and interacts with citizens, industry,

and other government entities.

As we recently witnessed with the “ILOVEYOU” computer virus, the

potential for improvements in service and productivity offered by the

Internet come intertwined with a whole new set of management

challenges.1 As such, electronic business initiatives must still address the

many costs, benefits, and risks associated with any information

technology decision-making. With the speed and ease of massive

interconnectivity offered by the Internet, improvements in operational

1Critical Infrastructure Protection: “ILOVEYOU” Virus Highlights Need for Improved Alerts and

Coordination Capabilities (GAO/T-AIMD-00-181, May 18, 2000) and Information Security: “ILOVEYOU”

Computer Virus Emphasizes Need for Agency and Governmentwide Improvements (GAO/

T-AIMD-00-171, May 10, 2000).
Page 2 GAO/T-AIMD/GGD-00-179

efficiencies, lower costs, and improved customer service delivery truly can

be dramatic. On the other hand, general business risks such as fraud, theft,

and destruction of assets, along with legal issues such as liability and the

loss of reputation, are exacerbated by the openness of the Internet. Other

matters related to adequate technical infrastructure planning, stability in

the numbers and skills of the technology workforce required to build and

maintain web-enabled products and services, and adequate top

management leadership and involvement further complicate the

underlying challenges.

Congressional interest in both the opportunities and challenges posed by

electronic government is evident from the numerous oversight hearings

and legislative proposals on topics ranging from Internet taxation, privacy,

computer security, consumer protection, open access, and competition. At

GAO, we have numerous reviews underway examining these and other

electronic government issues, such as use of the Internet to improve rulemaking and the implementation of electronic commerce programs at

specific agencies. We expect to be able to provide more comprehensive

information and analyses on many of these topics in the near future.

In my remarks today, I would like to address a few key aspects of the

evolving electronic government environment. Specifically, I’ll focus on the

statutory and policy framework, describe key efforts to implement

electronic government programs, and outline the major challenges

confronting both government and the private sector in making the

transition to on-line business and service environments. Because the terms

electronic commerce and electronic government are often used

interchangeably, let me begin by briefly discussing how they overlap. As I

will discuss shortly, the same capacities that are transforming the business

community offer equal opportunities for government to excel.

Many private sector enterprises are now working hard to take advantage

of the new opportunities created by ubiquitous Internet connectivity. For

these companies, e-commerce has three important aspects. First, it means

streamlining the way business is conducted to reduce paperwork and

delays, increasing operational efficiencies, and enhancing customer

service. Second, beyond enhancing existing business avenues, the world of

e-commerce is leading to the creation of entirely new digital products and

new markets for those products. Finally, in response to these new

products and markets, new classes of buyers and sellers are emerging to

take advantage of those opportunities.

Electronic

Government Can

Build Upon Electronic

Commerce

Experiences and

Approaches
Page 3 GAO/T-AIMD/GGD-00-179

The basic idea of e-commerce has actually been around for quite some

time, but the World Wide Web has brought a lot of changes and new

opportunities in the last few years. Until recently, e-commerce was mainly

identified with electronic data interchange, or EDI. EDI allows one

business’s computer system to send routine information about

transactions to another business’s system, following standardized formats.

Its focus is on business or trading partner data interactions, not serving

consumers directly. The rise of the World Wide Web over the last few

years has dramatically broadened the scope of electronic commerce.

Electronic commerce is now seen as encompassing all aspects of buying

and selling electronically, including marketing, end-to-end transactions

with consumers, and on-line auctions. It is transacted through a variety of

technologies, including EDI, electronic mail, electronic funds transfer, and

web-based applications.

Electronic commerce often involves two kinds of relationships: businessto-business and business-to-consumer. Generally business-to-business

relationships are ongoing and contractually established, involving many

transactions over a long period of time, such as between a commercial

business and its suppliers. Typically, the seller extends credit to the buyer,

and transactions are initiated with purchase orders, which are used to

monitor and control the entire buy-sell-pay process.

The business-to-consumer relationship is a newer one that largely builds

on the emerging power of the World Wide Web. It involves moving

information, products, and services on-line for consumption and purchase

by consumers. Indeed, the Web is forcing businesses and governments

alike to rethink their methods of communicating and interacting with the

public, and, in some cases, rethink how they deliver their core mission

services and products. Already we have seen a wave of new electronic

businesses spring up on the Internet to capitalize on the Web’s advantages

of (1) attracting broad new customer communities, (2) setting up and

maintaining a Web “storefront,” and (3) highly targeted marketing with

tailored offers that the consumer can accept and finalize on the spot.

The recent advances in web-based commerce mean that comparable

advances in e-government are just as possible. Generally speaking,

electronic government refers to government’s use of technology,

particularly web-based Internet applications, to enhance the access to and

delivery of government information and service to citizens, business

partners, employees, other agencies, and government entities. It has the

potential to help build better relationships between government and the

public by making interaction with citizens smoother, easier, and more

efficient. Indeed, government agencies report using electronic commerce
Page 4 GAO/T-AIMD/GGD-00-179

to improve core business operations and deliver information and services

faster, cheaper, and to wider groups of customers. For example, the

Department of Defense (DOD), the National Aeronautics and Space

Administration (NASA), the General Services Administration (GSA) and

other agencies have been implementing on-line procurement operations

for several years. The Internal Revenue Service (IRS), the Department of

Education, and the Social Security Administration have been actively

using electronic commerce techniques to improve service delivery to

taxpayers, students, and senior citizens. As such, e-government includes

many of the same characteristics of electronic commerce used in the

private sector, with the exception of having a more defined customer base

and less focus on revenue generation as a primary business driver.

While market and technology developments in private industry are

inevitably bumping the public sector more and more into the e-business

domain, an evolving framework of laws and policies are influencing the

speed, pace, and direction of electronic government initiatives. In many

cases, statutory requirements authorizing agency programs may explicitly

mandate action that involves electronic and on-line processes. These

agency actions can vary widely, ranging from efforts to improve internal

business operations to mandates for reforms outside the agency. For

example:

• The Clinger-Cohen Act of 1996 requires GSA to provide governmentwide

on-line access to information about products and services available under

the multiple award schedules program.2

• The Fiscal Year 1999 DOD Authorization Act required DOD to establish a

single, Defense-wide electronic mall system for ordering supplies and

materials.3

• The Electronic Benefit Transfer Interoperability and Portability Act of

2000 requires the Department of Agriculture (USDA) to establish a

national standard of interoperability and portability for electronic food

stamp benefit transactions.4

2Sec. 5401, P.L. 104-106, 40 U.S.C. 1501

3Sec. 332, P.L. 105-261, 10 U.S.C. 2451 note.

4P.L. 106-171, 7 U.S.C. 2016.

A Diverse Statutory

and Policy

Framework Underlies

Expectations for

Electronic

Government
Page 5 GAO/T-AIMD/GGD-00-179

Additionally, federal departments and agencies are governed by general

management statutes that affect electronic processes, again, in a variety of

ways. For example:

• In response to the Clinger-Cohen Act, federal agencies are developing

internal investment control and performance management processes

designed to improve their acquisition, use, and management of

information technology. This has spurred attention to new information

systems—many web-based—such as the Information Technology

Information Processing System (I-TIPS) supported by the federal Chief

Information Officers (CIO) Council and currently used by several federal

agencies including the Departments of Housing and Urban Development,

the Treasury, Labor, Energy, and Agriculture.5

• The Privacy Act requires agencies to protect the confidentiality of records

containing personal information and forms the basic requirements that are

now being applied to protecting personal information that is captured by

agency web sites.6

• The Government Paperwork Elimination Act of 1998 sets a deadline of

October 2003 for agencies to develop capabilities to permit, where

practicable, electronic maintenance, submission, or disclosure of

information, including the use of electronic signatures.7

In addition to legal statutes, the executive branch coordinated crossagency projects and issued numerous policies in the last few years

encouraging the growth and adoption of electronic government. For

example, in 1993, the National Performance Review (NPR), initially

developed proposals to implement electronic government. In 1997, NPR

outlined further steps to encourage and increase citizen and business

Internet access to the most commonly requested government services.8

These and other similar efforts reflect two overarching themes supported

5I-TIPS is a web-based Internet or intranet decision support and project management tool for

managing information technology investments. It was initially funded through an award from the

Government IT Services Board and the Interagency Management Council’s IT Innovation Fund.

6P.L. 93-579, 5 U.S.C. 552a; OMB Circular No. A-130, Appendix I, “Federal Agency Responsibilities for

Maintaining Records About Individuals.”

7Title XVII, P.L. 105-277, 44 U.S.C. 3504 note.

8Creating a Government That Works Better and Costs Less: Reengineering Through Information

Technology, accompanying report of the National Performance Review, Vice President Al Gore,

September 1993; and Access America: Reengineering Through Information Technology, National

Performance Review, 1997.
Page 6 GAO/T-AIMD/GGD-00-179

by champions of e-government: (1) a need for the federal government to

tangibly demonstrate an ability to improve its “service and access to the

citizen” and (2) a recognition that web-based technologies can be effective

levers to override cultural and organizational barriers to change. That is,

web-based applications can provide a friendly citizen interface over

confusing and suboptimized government agency structures,

responsibilities, and processes.

Other executive branch policies seek to ensure private sector leadership

and avoid unnecessary governmental regulation. For example, in 1997 the

Administration outlined the following policy principles in a special report:9

• The private sector should lead.

• Governments should avoid undue restrictions on electronic commerce.

• Where governmental involvement is needed, its aim should be to support

and enforce a predictable, minimalist, consistent, and simple legal

environment for commerce.

• Governments should recognize the unique qualities of the Internet.

• Electronic commerce over the Internet should be facilitated on a global

basis.

Particularly in the last 6 months, the administration has devoted increasing

attention to promoting electronic government. On December 17, 1999,

presidential memoranda directed agencies to undertake numerous actions

to provide “one-stop access” to government information and services and

better, more efficient services and accountability, and to promote the

broader social benefits of information technology.10 Among other things,

agencies are tasked with providing easy public access to government

information on the Web, making forms available on-line, and making

assistance benefits available through private, secure on-line transactions.

In addition to these actions taken by the administration, a number of

cross-agency groups have emerged to assist agencies in managing the

transition from paper to electronic services. For example, the Federal

Electronic Commerce Program Office, co-chaired by GSA and DOD, is

9A Framework for Global Electronic Commerce, The White House, July 1, 1997.

10Presidential Memorandum on “Electronic Government” and Presidential Memorandum on “Use of

Information Technology To Improve Our Society,” Dec. 17, 1999.
Page 7 GAO/T-AIMD/GGD-00-179

chartered to provide central leadership, coordination, and reporting on

governmentwide electronic commerce implementation. In addition, the

Interagency Acquisition Internet Council was established to promote ways

of using the Internet to streamline the federal acquisition process.

Similarly, the Interagency Electronic Grants Committee (IAECG) was

established to promote the use of electronic commerce throughout the

federal grants community.

Both the President’s Management Council (PMC) and the CIO Council

have announced initiatives to support the goal of promoting electronic

government. The PMC, for example, has formally set a cross-agency goal

of committing the necessary resources and priorities to ensure creation of

a one-stop on-line help center that will be available through a central web

access point, or portal. The PMC has committed to reprogram the

necessary resources, currently estimated to be several million dollars, to

get this effort started. Called WebGov, it will help guide citizens to various

federal government web sites with the information or services they need.

The PMC is currently evaluating how best to facilitate the efforts of

Internet Service Providers and other Internet companies to improve their

customers’ access to government information.

The CIO Council recently established an e-government committee that is

formulating a strategic plan and undertaking various short-term initiatives.

Several of these efforts involve working in partnership with industry and

state governments. For example, CommerceNet (a nonprofit market and

business development organization) is working with the federal

government to allow citizens to find on-line government surplus items.

For the most part, federal, state, and local governments are in the early

stages of shifting their perspective to citizen-centered services and are just

beginning to move towards the real potential of e-government. In August

1999, GSA in conjunction with the Intergovernmental Advisory Board

(IAB), reported that the development of on-line transactional services is in

its early stages and the number of governments producing a wide variety

of integrated services was still small.11 But government use of Internetbased services is broadening and becoming more sophisticated. In

particular, agencies are increasingly turning to the Internet to conduct

paperless acquisitions (electronic malls), provide interactive electronic

services to the public, and tailor or personalize information. The GSA/IAB

11Integrated Service Delivery: Governments Using Technology to Serve the Citizen, Intergovernmental

Advisory Board, August 1999.

Government Use of

the Internet Is

Evolving
Page 8 GAO/T-AIMD/GGD-00-179

study mentioned above suggests that the next step is to determine whether

the use of the Internet is actually improving government services and

being integrated across different levels of government.

To provide a better picture of the scope and range of ongoing egovernment activities, I would like to elaborate on some ongoing

individual efforts as they relate to trends in using the Internet to

conducting basic transactional services, on-line procurement, and

interactive communication and information dissemination.

It is increasingly common to find governments are using the Internet for

basic transactional services, such as submitting and paying taxes,

processing renewal fees, and filing applications. For example:

The Electronic Tax Administration (ETA), is designed to reduce taxpayer

burden by making it easier and faster to file returns and communicate with

IRS. IRS expects to receive over 33 million electronically filed individual

tax returns in fiscal year 2000, or over 26 percent of all individual tax

returns. One key initiative for fiscal year 2000 is expanding the use of

identification numbers to facilitate secure filing by tax preparers. IRS also

plans to make more electronic payment options available and to accept

more forms and schedules through electronic filing.

Several state and local governments offer on-line, form-based transactions,

such as job applications, business and professional licensing, and

registering vehicles. For example, the state of Florida’s web site12 offers

easy-to-navigate categories of information and services, including on-line

job applications, consumer complaint forms, and business and

professional license searches. The state of Virginia became the first state

to allow citizens to renew drivers’ licenses via the Web. It allows citizens

to log onto the Department of Motor Vehicle’s web site, check on whether

personal information is correct, and pay the renewal fee with a credit card.

In addition to serving citizens, governments are also using the Internet to

buy the goods and services that support their operations. Many federal

agencies and state governments are using on-line catalogs, ordering,

payment, and posting of contracting opportunities and awards. For

example:

12http://fcn.state.fl.us/gsd/.

Transactions and

Applications

On-line Procurement
Page 9 GAO/T-AIMD/GGD-00-179

• The state of West Virginia has an electronic bid submission program and

the state of Florida has Web site services relating to purchasing and

leasing. The state of Texas also receives electronic bids and proposals and

is establishing an electronic procurement marketplace, which is expected

to be operating statewide by September 2001.

• Since 1998, the GSA has been working with several other agencies to

provide businesses, large and small, with convenient, single point-of-entry

Internet access to synopses of government contracting opportunities,

solicitations, awards, and other acquisition-related documentation. The

Electronic Posting System (EPS) initiative—currently in a pilot stage—

allows vendors to search for contracting opportunities over $25,000,

receive automatic e-mail notification about agencies’ requirements for

specific supplies or services, receive automatic e-mail notification about

changes and amendments to solicitations, download documents related to

a specific procurement; and view summaries of contract awards.

• In September 1995, GSA Advantage went on-line. It was the federal

government’s first electronic catalog on the Internet. Advantage allows

agencies to search for products and services and place orders from GSA’s

federal supply schedule contractors. According to GSA, there are currently

over 2,000 schedule vendors on Advantage and fiscal year 1999 sales were

$86 million.13 We are currently conducting a review of the Advantage

program for this Subcommittee and expect to report on our assessment

later this year.

Governments are also establishing “portals” or integrated web sites for

targeted citizen information and services. Increasingly, agencies are

working together to aggregate government information and services by

category and citizen interest. For example:

• Access America for Seniors14 is designed to be an entry portal for senior

citizens to reach government services and information on such topics as

benefits, taxes, health and nutrition, and consumer protection. Similarly,

the Access America for Students web site15 acts as a gateway to

13In 1998, the GSA Inspector General (IG) reported that GSA was experiencing difficulties in placing

schedule products on-line and vendors were concerned about data formatting and transmission. Some

vendors also felt that Advantage duplicated their own Internet web site development efforts. The IG

recommended that GSA develop a comprehensive plan that outlines the critical actions needed for

achieving Advantage’s objectives.

14http://www.seniors.gov.

15http://www.students.gov.

Interactive

Communication and

Information Dissemination
Page 10 GAO/T-AIMD/GGD-00-179

information of interest to students, with links to some on-line

transactional resources such as applications for federal financial aid, a

calculator (to compute monthly loan repayments), a form to consolidate

loan repayments, selective service applications, and links to the IRS efiling service.

• Several federal agencies are developing expert systems and intelligent

technology to provide businesses compliance assistance and to reduce

burden. For example, the Department of Labor has developed 18 “E-law

Advisors,” web-based expert systems that the public can query through

menus and routine questions to better understand and comply with DOL

regulations. Occupational Safety and Health Administration is working on

the next generation of these systems that would combine interactive

questionnaires and electronic forms with legal analysis.

• More than 20 federal agencies are participating in the Federal Commons,

an interagency effort to use electronic commerce to streamline grants

administration. The federal government has over 800 grant programs

managed by 33 agencies. Each program has a unique legislative base. As a

result, there is a plethora of different forms, procedures, award decisionmaking processing systems, and payment systems. The Federal Commons

web site is expected to become the single point of entry for federal grants

programs and a central repository for grant-related information. At

present, the site accepts data from grant applicants and recipients for the

20 participating agencies in any format and transmits the data to each

agency in its desired format.

As you can see, Mr. Chairman, the opportunities for the growing use of egovernment to provide faster, convenient, and efficient on-line services to

citizens are immense. Many innovative applications and services are just in

early development and adoption stages. However, past mistakes serve to

remind us that technology solutions may often involve risks in addition to

expected benefits. Let me briefly address some significant challenges

confronting government in making the transition to full electronic service

delivery. None are insurmountable, but they deserve attention and must be

addressed to ensure successful e-government outcomes.

Effective top management leadership, involvement, and ownership are a

cornerstone of any information technology investment strategy. Effective

and responsive management processes must support electronic

government initiatives—like any other information technology project—

Challenges in

Transitioning to

Electronic

Government

Effective Executive

Leadership and

Management
Page 11 GAO/T-AIMD/GGD-00-179

and decision-making that is focused on achievements in quality

improvements, cost-effectiveness, speed in service delivery, or operational

effectiveness.

As government expands the volume and scope of its electronic business

transactions and the diversity of the users of electronic services, it will

become increasingly important for government leaders and managers to

devote time and attention to interagency and intergovernmental design,

implementation, and coordination of these programs. Information

technology (IT), particularly web-based applications, provide the

opportunity to reengineer government and to allow government services

to be organized in ways that fit the needs of citizens rather than the

requirements of bureaucracies.

In government’s rush to electronic service delivery, it is important to

remember that fundamental principles and practices of good IT planning

and management apply equally as well to effective customer-centric webbased applications. Some of these fundamentals include

• developing a well-defined project purpose and scope and realistic,

measurable expectations,

• understanding and improving business processes before applying

technology,

• performing risk assessments and developing appropriate risk mitigation

strategies,

• using industry standard technology and solutions where appropriate,

• adopting and abiding by data standards,

• training thoroughly and supporting users, and

• reviewing and evaluating performance metrics.

An immediate and complex leadership challenge confronting government

policymakers and managers is the need to adopt informed strategies to

guide agencies in how best to use the Internet to deliver services to all

citizens and business partners. Today there is considerable disparity in

access to and use of the Internet among citizen groups and businesses.

Those with limited access include many small businesses and citizens who

live in remote areas and the inner city, businesses and citizens with little

or no computer knowledge, and the disabled. An important policy

consideration governments face is how to provide services and access to
Page 12 GAO/T-AIMD/GGD-00-179

these segments of the population and ensure their participation in this new

electronic environment. Multiple access methods to government services

and processes—in person, by phone, via fax, using public kiosks—may be

essential to supplement Internet use.

Today, governments at all levels increasingly recognize the individual

citizen and citizen “communities of interest” as customers. However,

translating this growing awareness into better, efficient, and friendly

services can be challenging. Among other things, it requires commitment

to a “customer-centric” vision throughout the agency, and a long-term,

enterprisewide view of operations rather than the “silo” thinking that has

long characterized the way governments have operated.

Just as the Internet and web-based technologies force organizations to

rethink their business processes, they force organizations to reconsider

their customers—specifically how their customers need, perceive, and

digest information and services in a viewable, electronic format. For

example, private industry web sites are increasingly being tailored to allow

for individual preferences and needs to restrict information only to those

products and services desired. Interactive and e-mail messages are

transmitted to remind specific customers of products, services, and

information that they have expressed past interests in. “Interactive”

consumers meanwhile are starting to demand even more convenience and

operational excellence from the on-line companies they deal with on a

regular basis. Although there are privacy concerns related to these

practices, the same expectations can surface for electronic government

service delivery as well.

Government agencies and other organizations have identified a number of

areas in which there needs to be a governmentwide strategy, guidance,

and framework of policies and practices to ensure effective design,

development, and implementation of customer-focused electronic service

delivery. For example, some agency officials have pointed out that the

public will expect a more consistent level of service across agencies,

including navigable web sites with intelligent search capabilities, similar

user interface conventions, and interoperable authentication policies and

methods.

Electronic government will only succeed when all its participants—

including government agencies, private businesses, and individual

citizens—feel comfortable using electronic means to carry out private,

sensitive transactions, such as obtaining a license, bidding on a contract,

Developing and Sustaining

a “Citizen as Customer”

Focus

Security and Privacy
Page 13 GAO/T-AIMD/GGD-00-179

or making a benefit claim. While progress is being made, the necessary

comfort level is not there yet. Stories in the press of hacker attacks, web

page defacements, and credit card information being posted on electronic

bulletin boards makes many federal agency officials—as well as the

general public—reluctant to do “real” business over the Internet. Their

concerns are not unjustified. In recent years we have consistently found

security weaknesses at many federal government agencies.16 Weaknesses

at agencies such as IRS, the Health Care Financing Administration, the

Social Security Administration, or the Department of Veterans Affairs

could place sensitive tax, medical, and other personal records at risk of

unauthorized disclosure. Moreover, federal web sites themselves have

been subject to cyber-attacks.17

A big piece of the solution to this problem will be in the development and

implementation of so-called Public Key Infrastructure or “PKI” technology.

I would like to address this in some detail because it is integral to ensuring

a successful future for e-government. A PKI is a system of computers,

software, and data that relies on certain sophisticated cryptographic

techniques to secure on-line messages or transactions. A key component is

the use of electronic “certificates” that vouch for a particular user’s

identity. A properly implemented and maintained PKI can offer several

security services. Specifically, it can provide assurance that (1) the parties

to an electronic transaction are really the people they claim to be, (2) the

information has not been altered or shared with any unauthorized entity,

and (3) neither party will be able to wrongfully deny that they took part in

the transaction. Key federal security experts believe these assurances

would provide the comfort level necessary to spark widespread

implementation of electronic government services.

The federal government is aggressively promoting the deployment of PKI

technology. Currently federal agencies—including NASA, DOD, and the

Patent and Trademark Office—are experimenting with 24 pilot PKI

programs. A Federal Public Key Infrastructure Steering Committee has

been established to coordinate PKI pilot projects on a governmentwide

basis and to take initiatives to encourage the adoption of PKIs. For

example, the Steering Committee has sponsored the development of a

prototype Federal Bridge Certification Authority, which is a mechanism

16Federal Information Security: Actions Needed to Address Widespread Weaknesses (GAO/

T-AIMD-00-135, March 29, 2000) and Information Security: Serious Weaknesses Place Critical Federal

Operations and Assets at Risk (GAO/AIMD-98-92, Sept. 23, 1998).

17Information Security: Recent Attacks on Federal Websites Underscore Need for Stronger

Information Security Management (GAO/T-AIMD-99-223, June 24, 1999).
Page 14 GAO/T-AIMD/GGD-00-179

that will allow disparate agency PKIs to recognize each other’s electronic

certificates. GSA built the prototype on behalf of the steering committee,

and it was demonstrated in April 2000. The intent of the demonstration

was to show that the bridge authority can interoperate with other PKI

domains with varying certificate policies, including DOD’s separate

demonstration bridge certification authority. However, the Federal Bridge

Certification Authority is still a prototype, and so far it has only been

demonstrated in a test environment. Questions have been raised as to

whether the technology will be able to handle large numbers of users and

transactions in a real-world environment.

Furthermore, GSA has been working since 1996 on a program called

Access Certificates for Electronic Services (ACES), which is intended to

help jumpstart agency adoption of PKI technology to provide the public

with secure access to privacy-related government information and

services. In 1999, GSA awarded ACES contracts to three vendors to

provide a range of support services to agencies wishing to adopt PKI

technology.18 The first vendor was authorized to issue ACES certificates in

April 2000, so the capability has only very recently become available. The

significant feature of ACES is that it can support the use of digital

signature certificates without individual agencies having to build their own

PKIs. In this kind of arrangement, certificates are provided to the public

for free, and whenever they are used to support a transaction, the agency

involved must pay a fee to the relevant ACES vendor.19

Some agency officials believe it will be difficult to budget for ACES

certificates because the total cost, which depends on how heavily the

service is used, is not known. Agency officials also worry that if their

programs are successful and heavily used, their ACES costs may be high.

In addition, it would be advantageous for certificates to be interoperable

and certificate policies to be consistent across the government.

Guaranteeing the authentication of certificate holders, for example, can be

problematic if agencies and vendors all use different processes.

Despite all the useful development work that has been conducted to date,

PKIs are not yet commonplace, either in the private sector or in

government. And a number of significant challenges must still be

overcome before the technology can be widely deployed and

implemented. For example:

18The three vendors are AT&T, Inc.; Digital Signature Trust Co., Inc.; and Operational Research

Consultants, Inc.

19The fee will range from $0.40 to $1.20 per transaction.
Page 15 GAO/T-AIMD/GGD-00-179

• Most large-scale implementations have been limited to pilot environments

or specific applications. Issues have been raised regarding how well PKI

technology can scale to the level of hundreds of thousands or millions of

users, as will be encountered in government applications. A network of

trusted registration authorities may be needed to verify the identities of all

users. In addition, another vast network of electronic directories will need

to be in place so that every user’s identity can be looked up and verified

before any transaction takes place. As such, problems with verification

failures or unacceptably slow response times are possible until further

operational experience is gained with large-scale PKI implementation.

• It can be expensive to establish a PKI. A significant up-front cost is

involved with fielding and maintaining a PKI capability in a production

environment. New systems must be set up to positively identify users,

issue them electronic certificates, and manage the exchange and

verification of certificates. In addition, existing software applications and

legacy systems must be modified so they can interact with the PKI. These

activities can involve significant costs. Funding for some key

governmentwide PKI infrastructure has not yet been established but they

will be needed to build and maintain an operational federal bridge

certificate authority for fiscal years 2001 and beyond.

• Although many PKI products are currently on the market, they generally

are not interoperable. Choosing among them means taking the risk of

adopting a “dead end” technological approach that may soon need to be

replaced. The Federal Bridge Certification Authority may help resolve

some agency-to-agency interoperability issues, but it is not yet operational.

Having additional standards to help facilitate interoperability can also help

resolve this issue.

• PKI implementations are not always user-friendly. Some early adopters of

PKI have found it difficult for users to interact with PKI systems. Users

need proper training to perform functions such as generating their

private/public keys, protecting their private keys, backing up and using

their certificates. As you know, in the world of computers, a system that is

too difficult to use probably won’t be used at all.

• Compounding the security problem are concerns about sharing private

information electronically. Individuals should be able to determine when,

how, and to what extent personal information is collected and used.

However, if not properly implemented and managed, the technologies that

have been developed to manage massive volumes of personal information

could also be abused. It is no longer technically difficult for the

government to establish databases that collect extensive personal
Page 16 GAO/T-AIMD/GGD-00-179

information about large numbers of individual citizens. This means that

when technologies such as PKI are implemented, extra care must be taken

to avoid improperly gathering or using personal information.

As you know, we are currently reviewing the development and

implementation of PKI technology throughout the federal government at

your request and will be providing a fuller report later this year.

A solid technical foundation needs to be in place before e-government

services can be offered reliably and effectively to the public. We have

already reported some trial-and-error attempts, such as the Social Security

Administration’s effort to provide earnings and benefits statements over

the Web in 1997.20 In that case, concerns were raised that one person could

access another individual’s record if the first individual knew the second

person’s personal authenticating information. It was held that the

information needed to answer these questions was relatively easy to

obtain from sources other than the Social Security Administration. In

short, the public was not comfortable with the way the service had been

implemented. After approximately 1 month of service, the capability was

withdrawn.

The key to success in e-government is to plan for and implement an

adequate technical infrastructure that will support a user’s experience of

easy and reliable electronic access to government. Elements of this

supporting infrastructure include:

• Adequate network capacity, or bandwidth. Government agencies will need

to consider the amount of electronic traffic that will be generated by an

electronic offering and provide adequate connectivity to support that load.

Some web sites have been completely overwhelmed and disabled when far

greater numbers of users visited the sites than their developers had

anticipated.

• Platform and software application reliability. The web servers and other

computer platforms that support e-government services—including their

operating systems and the software that connects them—must also be

capable of supporting potentially heavy user demands and must run

reliably. The system must reliably confirm that a transaction is complete

and also must reliably abort a transaction completely and consistently in

20Social Security Administration: Internet Access to Personal Earnings and Benefits Information

(GAO/T-AIMD/HEHS-97-123, May 6, 1997).

Technology-Related

Challenges
Page 17 GAO/T-AIMD/GGD-00-179

the event that some problem intervenes. The technology in use today does

not always respond consistently and unambiguously. Users may fill out

lengthy on-line forms and submit them without getting any clear response

from the system at all, leaving them unsure whether their submission was

received and accepted.

• Interoperability. Even a smoothly operating electronic delivery service will

fail to fulfill the promise of e-government if it is isolated from or unable to

work with other related applications. Instead, e-government applications

should be able to communicate and exchange relevant data with each

other. To ensure interoperability, government officials need to recognize

its importance and design it in from the start. The emergence of key

technical standards for electronic business will help.

• Technical roadmaps. Application developers will need to agree upon an

overall systems roadmap to guide the development and evolution of egovernment systems. Architecture development is a primary means of

integrating systems and business processes across an organization in a

cost-effective manner. Architectures align information system

requirements with the business areas and processes that they support and

promote systems that readily exchange and share information. They also

can help avoid inconsistent design and development decisions and their

associated increased costs and performance shortfalls. Our work at other

agencies, such as the Customs Service and IRS, has illustrated the

criticality of an agencywide architecture in helping reduce systems

development risk and minimizing investment costs.21

• Alternative media, such as wireless devices. Finally, it is important to note

that technology is continuing to evolve at a rapid pace, and today’s webbased applications are not necessarily the final incarnation that egovernment will take. As the public moves to more compact wireless

devices, the government will need to move as well, perhaps supporting a

variety of media through which to conduct transactions, from traditional

paper-based methods on end of the spectrum to small wireless receivers

on the other.

21Tax Systems Modernization: Blueprint Is a Good Start But Not Yet Sufficiently Complete

to Build or Acquire Systems (GAO/AIMD/GGD-98-54, Feb. 24, 1998) and Customs Service

Modernization: Architecture Must Be Complete and Enforced to Effectively Build and

Maintain Systems (GAO/AIMD-98-70, May 5, 1998).
Page 18 GAO/T-AIMD/GGD-00-179

As governments at all levels increase their efforts to provide electronic

service delivery systems, they face the reality that IT human resources to

develop and manage web-based Internet applications are in short supply.

The demand for IT workers is large and growing. Employers will attempt

to fill 1.6 million new IT jobs in 2000. The largest skill gaps are for

enterprise systems integration and web development positions. These

positions have high complexity and a scarcity of qualified applicants. The

increasing need for qualified IT professionals puts governments in direct

competition with the private sector for scarce resources. In addition, the

increasing government reliance on private sector service providers and

outsourced application development has created a growing demand in the

federal workplace for more traditional skills, such as contract

management and project and program management.

Agencies are also becoming acutely aware that electronic government

technology applications work only if people have the right training to

execute them properly. The challenge of new technology and the mandate

on improving customer service have led to an increased commitment to

training. Without fully developing staff capabilities, agencies stand to miss

out on the potential customer service benefits presented by technology.

Employees must have the training and tools they need to do their jobs. The

process of adopting a new system can be made much less difficult by

offering well-designed, user-oriented training sessions that demonstrate

not only how the system works, but how it fits into the larger work picture

and “citizen as customer” orientation. A significant challenge for all

agencies is providing internal incentives for customer service, reducing

employee complaints, and cutting the time employees spend on noncustomer-related activities.

Mr. Chairman, our government stands today poised for a dramatic

transformation. When the transition is complete, our citizens will view

obtaining government services no differently than conducting any other

business transactions. Standard interactions with government—like

renewing a driver’s license or claiming social security benefits—may be no

different than buying a book today from Amazon.com. As some of the

limited examples I have discussed today illustrate, significant progress is

being made. New opportunities for further changes brought on by webbased and other information technologies are just now emerging. Clearly,

there is a substantial amount of legislation and policies issued that

provides strong incentives for government agencies to adapt to this new

electronic environment.

Human Capital: Demand

for IT Skills

Conclusions
Page 19 GAO/T-AIMD/GGD-00-179

Nevertheless, despite its promise, technology advancement is not a

panacea for government performance problems. I want to emphasize that

we still face some formidable challenges. While considerable technological

progress has been made, successful e-government must still deal with

some of the same basic challenges that have plagued information systems

for decades—inadequate attention to technical and business architecture,

adherence to standards, and security. We still have limited experience in

implementing the mechanisms for security and privacy—especially PKI—

which is just one among many factors affecting the large-scale use of ecommerce and e-government. We also need systems that operate together

seamlessly behind the scenes, offering a single face to the public and

allowing transactions to occur in a way that is reliable, and easy to

navigate.

Beyond technology, government executives and senior managers must

recognize and embrace the efficiencies offered by e-government proposals

and develop effective investment strategies and plans to make them

reality. Moreover, top leadership must effectively merge the power of

electronic interactions—among agencies, with businesses, and with the

public—with necessary and corresponding management and process

improvements that will better ensure positive outcomes. In addition, the

Web provides new challenges for several traditional information policy

areas. The mechanisms used to ensure freedom of information, copyright

protections, records management, and privacy may need to be reevaluated

given increasing reliance on the Web and its capacity to distribute and

present information to both known and unknown audiences. These, too,

are familiar themes behind recent information management reforms and

should not be ignored.

Mr. Chairman, that concludes my statement. I would be happy to answer

any questions that you or other members of the Subcommittee may have.

(511976)
Orders by Internet

For information on how to access GAO reports on the Internet, send

an e-mail message with “info” in the body to:

Info@www.gao.gov

or visit GAO’s World Wide Web home page at:

http://www.gao.gov

Contact one:

Web site: http://www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

1-800-424-5454 (automated answering system)

Ordering Information

To Report Fraud,

Waste, and Abuse in

Federal Programs