U.S. GOVERNMENT PRINTING OFFICE

61–119 CC WASHINGTON : 1999

Y2K AND CONTINGENCY AND DAY 1 PLANS:

IF COMPUTERS FAIL, WHAT WILL YOU DO?

JOINT HEARING

BEFORE THE

SUBCOMMITTEE ON GOVERNMENT MANAGEMENT,

INFORMATION, AND TECHNOLOGY

OF THE

COMMITTEE ON GOVERNMENT REFORM

AND THE

SUBCOMMITTEE ON TECHNOLOGY

OF THE

COMMITTEE ON SCIENCE

HOUSE OF REPRESENTATIVES

ONE HUNDRED SIXTH CONGRESS

FIRST SESSION

OCTOBER 29, 1999

Committee on Government Reform

Serial No. 106–51

Committee on Science

Serial No. 106–54

Printed for the use of the Committee on Government Reform and the

Committee on Science

(

Available via the World Wide Web: http://www.house.gov/reform

(II)

COMMITTEE ON GOVERNMENT REFORM

DAN BURTON, Indiana, Chairman

BENJAMIN A. GILMAN, New York

CONSTANCE A. MORELLA, Maryland

CHRISTOPHER SHAYS, Connecticut

ILEANA ROS-LEHTINEN, Florida

JOHN M. MCHUGH, New York

STEPHEN HORN, California

JOHN L. MICA, Florida

THOMAS M. DAVIS, Virginia

DAVID M. MCINTOSH, Indiana

MARK E. SOUDER, Indiana

JOE SCARBOROUGH, Florida

STEVEN C. LATOURETTE, Ohio

MARSHALL ‘‘MARK’’ SANFORD, South

Carolina

BOB BARR, Georgia

DAN MILLER, Florida

ASA HUTCHINSON, Arkansas

LEE TERRY, Nebraska

JUDY BIGGERT, Illinois

GREG WALDEN, Oregon

DOUG OSE, California

PAUL RYAN, Wisconsin

HELEN CHENOWETH-HAGE, Idaho

DAVID VITTER, Louisiana

HENRY A. WAXMAN, California

TOM LANTOS, California

ROBERT E. WISE, JR., West Virginia

MAJOR R. OWENS, New York

EDOLPHUS TOWNS, New York

PAUL E. KANJORSKI, Pennsylvania

PATSY T. MINK, Hawaii

CAROLYN B. MALONEY, New York

ELEANOR HOLMES NORTON, Washington,

DC

CHAKA FATTAH, Pennsylvania

ELIJAH E. CUMMINGS, Maryland

DENNIS J. KUCINICH, Ohio

ROD R. BLAGOJEVICH, Illinois

DANNY K. DAVIS, Illinois

JOHN F. TIERNEY, Massachusetts

JIM TURNER, Texas

THOMAS H. ALLEN, Maine

HAROLD E. FORD, JR., Tennessee

JANICE D. SCHAKOWSKY, Illinois

———

BERNARD SANDERS, Vermont

(Independent)

KEVIN BINGER, Staff Director

DANIEL R. MOLL, Deputy Staff Director

DAVID A. KASS, Deputy Counsel and Parliamentarian

CARLA J. MARTIN, Chief Clerk

PHIL SCHILIRO, Minority Staff Director

SUBCOMMITTEE ON GOVERNMENT MANAGEMENT, INFORMATION, AND TECHNOLOGY

STEPHEN HORN, California, Chairman

JUDY BIGGERT, Illinois

THOMAS M. DAVIS, Virginia

GREG WALDEN, Oregon

DOUG OSE, California

PAUL RYAN, Wisconsin

JIM TURNER, Texas

PAUL E. KANJORSKI, Pennsylvania

MAJOR R. OWENS, New York

PATSY T. MINK, Hawaii

CAROLYN B. MALONEY, New York

EX OFFICIO

DAN BURTON, Indiana HENRY A. WAXMAN, California

J. RUSSELL GEORGE, Staff Director and Chief Counsel

MATT RYAN, Senior Policy Director

CHIP AHLSWEDE, Clerk

TREY HENDERSON, Minority Counsel

(III)

COMMITTEE ON SCIENCE

HON. F. JAMES SENSENBRENNER, JR., (R–Wisconsin), Chairman

SHERWOOD L. BOEHLERT, New York

LAMAR SMITH, Texas

CONSTANCE A. MORELLA, Maryland

CURT WELDON, Pennsylvania

DANA ROHRABACHER, California

JOE BARTON, Texas

KEN CALVERT, California

NICK SMITH, Michigan

ROSCOE G. BARTLETT, Maryland

VERNON J. EHLERS, Michigan*

DAVE WELDON, Florida

GIL GUTKNECHT, Minnesota

THOMAS W. EWING, Illinois

CHRIS CANNON, Utah

KEVIN BRADY, Texas

MERRILL COOK, Utah

GEORGE R. NETHERCUTT, JR., Washington

FRANK D. LUCAS, Oklahoma

MARK GREEN, Wisconsin

STEVEN T. KUYKENDALL, California

GARY G. MILLER, California

JUDY BIGGERT, Illinois

MARSHALL ‘‘MARK’’ SANFORD, South

Carolina

JACK METCALF, Washington

RALPH M. HALL, Texas, RMM**

BART GORDON, Tennessee

JERRY F. COSTELLO, Illinois

JAMES A. BARCIA, Michigan

EDDIE BERNICE JOHNSON, Texas

LYNN C. WOOLSEY, California

LYNN N. RIVERS, Michigan

ZOE LOFGREN, California

MICHAEL F. DOYLE, Pennsylvania

SHEILA JACKSON-LEE, Texas

DEBBIE STABENOW, Michigan

BOB ETHERIDGE, North Carolina

NICK LAMPSON, Texas

JOHN B. LARSON, Connecticut

MARK UDALL, Colorado

DAVID WU, Oregon

ANTHONY D. WEINER, New York

MICHAEL E. CAPUANO, Massachusetts

BRIAN BAIRD, Washington

JOSEPH M. HOEFFEL, Pennsylvania

DENNIS MOORE, Kansas

VACANCY

SUBCOMMITTEE ON TECHNOLOGY

CONSTANCE A. MORELLA, Maryland, Chairwoman

CURT WELDON, Pennsylvania

ROSCOE G. BARTLETT, Maryland

GIL GUTKNECHT, Minnesota*

THOMAS W. EWING, Illinois

CHRIS CANNON, Utah

KEVIN BRADY, Texas

MERRILL COOK, Utah

MARK GREEN, Wisconsin

STEVEN T. KUYKENDALL, California

GARY G. MILLER, California

JAMES A. BARCIA, Michigan**

LYNN N. RIVERS, Michigan

DEBBIE STABENOW, Michigan

MARK UDALL, Colorado

DAVID WU, Oregon

ANTHONY D. WEINER, New York

MICHAEL E. CAPUANO, Massachusetts

BART GORDON, Tennessee

BRIAN BAIRD, Washington

EX OFFICIO

F. JAMES SENSENBRENNER, JR.,

Wisconsin+

RALPH M. HALL, Texas+

(V)

C O N T E N T S

Page

Hearing held on October 29, 1999 .......................................................................... 1

Statement of:

Dyer, John, Principal Deputy, Social Security Administration; Marvin

J. Langston, Deputy Assistant Secretary of Defense for C3I and year

2000, Department of Defense, accompanied by Rear Admiral Bob Willard and Bill Curtis, Department of Defense; John Gilligan, Chief Information Officer, Department of Energy; Paul Cosgrave, Chief Information Officer, Internal Revenue Service; and Norman E. Lorentz, senior

vice president, Chief Technology Officer, U.S. Postal Service .................. 47

Willemssen, Joel C., Director, Civil Agencies Information Systems, U.S.

General Accounting Office; and John Spotila, Administrator, Office of

Information and Regulatory Affairs, Office of Management and Budget 12

Letters, statements, etc., submitted for the record by:

Cosgrave, Paul, Chief Information Officer, Internal Revenue Service, prepared statement of ........................................................................................ 86

Davis, Hon. Thomas M., a Representative in Congress from the State

of Virginia, prepared statement of .............................................................. 11

Dyer, John, Principal Deputy, Social Security Administration, prepared

statement of ................................................................................................... 50

Gilligan, John, Chief Information Officer, Department of Energy, prepared statement of ........................................................................................ 75

Horn, Hon. Stephen, a Representative in Congress from the State of

California, prepared statement of ................................................................ 113

Langston, Marvin J., Deputy Assistant Secretary of Defense for C3I and

year 2000, Department of Defense, prepared statement of ....................... 62

Lorentz, Norman E., senior vice president, Chief Technology Officer, U.S.

Postal Service, prepared statement of ......................................................... 91

Morella, Hon. Constance A., a Representative in Congress from the State

of Maryland:

Letter dated October 15, 1999 .................................................................. 102

Prepared statement of ............................................................................... 3

Spotila, John, Administrator, Office of Information and Regulatory Affairs, Office of Management and Budget, prepared statement of ............. 36

Turner, Hon. Jim, a Representative in Congress from the State of Texas,

prepared statement of ................................................................................... 8

Willemssen, Joel C., Director, Civil Agencies Information Systems, U.S.

General Accounting Office, prepared statement of .................................... 14

(1)

Y2K AND CONTINGENCY AND DAY 1 PLANS: IF

COMPUTERS FAIL, WHAT WILL YOU DO?

FRIDAY, OCTOBER 29, 1999

HOUSE OF REPRESENTATIVES, SUBCOMMITTEE ON GOV- ERNMENT MANAGEMENT, INFORMATION, AND TECH- NOLOGY OF THE COMMITTEE ON GOVERNMENT REFORM, JOINT WITH THE SUBCOMMITTEE ON TECHNOLOGY OF

THE COMMITTEE ON SCIENCE, Washington, DC.

The subcommittees met, pursuant to notice, at 10 a.m., in room

2154, Rayburn House Office Building, Hon. Connie Morella (chairwoman of the Subcommittee on Technology) presiding.

Present: Representatives Morella, Davis, and Turner.

Staff present from the Subcommittee on Government Management, Information, and Technology: J. Russell George, staff director and chief counsel; Matt Ryan, senior policy director; Bonnie

Heald, communications director and professional staff member;

Chip Ahlswede, clerk; Rob Singer, staff assistant; P.J. Caceres and

Deborah Oppenheim, interns; Trey Henderson, minority counsel;

and Jean Gosa, minority staff assistant.

Mr. DAVIS. This hearing will come to order. I would ask unanimous consent that the cochair of the House Task Force on the Year

2000 Problem, the Honorable Connie Morella of Maryland, chairwoman of the House Science Subcommittee on Technology, chair today’s meeting.

Without objection, so ordered.

Mrs. MORELLA. Thank you. Thank you, Mr. Davis.

I want to welcome all of you on, the past 31⁄2 years, my Science

Committee Technology Subcommittee and the Government Reform

Committee’s Government Management, Information, and Technology Subcommittee, chaired by Steve Horn of California, who incidentally couldn’t be here this morning. We have been engaged in

the review of the year 2000 computer problem with a series of joint

hearings and initiatives. Our two subcommittees, which comprise

the House Y2K Working Group, have been pushing for greater Federal Y2K focus to correct the millennium bug.

Since we first began our oversight hearings, we’ve seen vast and

significant progress from our Federal agencies. And in most instances, Y2K was finally mandated as an agencywide priority.

Management leadership was required where previously there was

none, and we’re very pleased with the results we’ve seen.

We have been comforted by the actions of a greater majority of

Federal agencies. But unfortunately, with only 63 days remaining

before the January 1st, 2000, deadline, there still remains some

2

concern about certain agencies, especially with regard to their contingency and day 1 plans. To be fully prepared for Y2K, every organization must ensure that their day 1 strategies are ready and that

practical contingency plans are in place.

Contingency plans provide assurance that a Federal agency has

covered all predictable possibilities to ensure that its mission-critical operations can continue without disruption.

Our day 1 strategy provides a comprehensive set of actions to be

executed by a Federal agency during the last days of 1999 and the

first days of 2000. For those who may have watched the recently

concluded World Series on television, you may have seen an advertisement, teaser, for an upcoming network movie on Y2K. In an effort to hype the movie and to create interest in viewers, in the teaser an ominous voice boomed, Y2K, what if they’re wrong?

Despite its questionable entertainment value, I think the movie

is the one that will actually have it all wrong. One of the most effective methods, however, to survive the movie’s hype and to calm

any fears that may result is for Federal agencies to have effective

contingency plans and day 1 strategies that provide all Americans

adequate assurances our Federal Government will not be adversely

attacked and affected by Y2K.

Recently, the Office of Management and Budget [OMB], provided

guidance to assist Federal agencies in preparing day 1 plans. These

plans are prepared for finite timeframes, like the end of December

through early January, to help mitigate any problems that may

arise. They should address the full scope of agency activity that

will be underway during that period.

For example, agencies must prepare to mitigate the impact of

possible failures in internal systems, buildings and other infrastructures. Furthermore, the plan should include agency efforts to

assess the Y2K impact on its business partners, such as State and

local governments, in delivering the Federal programs.

I’m pleased to welcome representatives of a number of Federal

agencies to discuss and review the status of their contingency plans

and day 1 strategies. And I look forward to the testimony from the

Social Security Administration, the Department of Defense, the Department of Energy, the Internal Revenue Service and the Postal

Service. And in our first panel, we will hear from the General Accounting Office and the Office of Management and Budget.

[The prepared statement of Hon. Constance A. Morella follows:]

3

4

5

6

7

Mrs. MORELLA. And it’s now my pleasure to recognize the ranking member on the Subcommittee on Government Management, Information, and Technology, the gentleman from Texas Mr. Turner.

Mr. TURNER. Thank you, Madam Chairman. I want to commend

you and Chairman Horn, the chairman of my subcommittee, for

your diligence in trying to be sure that we are ready in the Federal

Government for January 1, 2000.

We all know that the public faces some risk that critical services

provided by both the government and the private sector may be

disrupted by the Y2K computer problem. And as we get closer to

January 1st, we need to redouble our efforts to be sure that any

disruption is reduced to a minimum.

Because this is the first time we’ve ever dealt with a problem of

this nature and magnitude, I’m sure that we should expect the unexpected. And for that reason, we’ve asked every Federal agency to

have in place a business continuity and contingency plan, and a

day 1 strategy to reduce the risk of failures occurring in their systems, programs, and services.

Without such plans, when unpredicted failures occur, agencies

would not be able to have a well-defined response, nor have adequate time to remedy whatever problem may arise. So I’m confident that the review of the agencies’ efforts today will be productive. I think if the Federal Government reaches January 1st, 2000,

without significant disruptions, a large part of that credit will be

due to the work of these two subcommittees that for many months

now have diligently worked to be sure that the Federal Government is prepared and ready.

Thank you, Madam Chairman. I look forward to hearing the testimony today.

Mrs. MORELLA. Thank you very much, Mr. Turner. And I appreciate your being here, too.

[The prepared statement of Hon. Jim Turner follows:]

8

9

10

Mrs. MORELLA. There’s recognition that Congress on the House

side is not in session today; therefore, a number of the members

of the subcommittees will be reading the testimony and discussing

it upon their return.

It’s now my pleasure to recognize for an opening statement Mr.

Davis, who is the chairman of one of the subcommittees of Government Reform, the District of Columbia Subcommittee, and is a

member of the Subcommittee on Government Management, Information, and Technology.

Mr. DAVIS. Thank you very much.

This is the 23rd hearing of the year on the year 2000 computer

problem that this subcommittee has held during the first session

of the 106th Congress. Over the last 3 years, the subcommittees

have spent countless hours discussing mission-critical systems and

embedded chips. Federal departments and agencies have spent far

more hours attempting to fix these potential problems.

Most recently we have looked at the Federal programs, such as

Medicare and Medicaid, that affect millions of the Nation’s most

vulnerable citizens, the elderly, the impoverished and the sick. But

now with only 63 days remaining until the January 1st deadline,

it’s time to talk about the contingencies, the what-ifs.

What if, despite the best efforts, some computers fail? What if

they continue working but spew out erroneous data? How prepared

are Federal departments and agencies to cope with these possible

situations? What are their plans? What are their plans for day 1,

the critical days leading up to midnight January 1st and the days

immediately afterwards?

I’m concerned to hear that the Internal Revenue Service has

found some unsolved problems with its inventory. Could other Federal agencies find similar discrepancies? Just, frankly, the IRS

under their leadership at this point, I think, is one of the most progressive in terms of dealing with the computers and the like. The

head of the IRS comes out of that industry.

Clearly, we need to have a candid discussion on contingency

plans today. We need to ensure that the Federal Government and

the services it provides will not fail, whether the date is December

31st, 1999, or January 1st, 2000.

Thank you.

Mrs. MORELLA. Thank you, Mr. Davis.

[The prepared statement of Hon. Thomas M. Davis follows:]

11

12

Mrs. MORELLA. And now as we usually do, we will swear in our

witnesses, and on the first panel, Mr. Willemssen and Mr. Spotila.

[Witnesses sworn.]

Mrs. MORELLA. The record will show that the panelists have

sworn to tell the truth.

And now, as is, again, our tradition, we will give you each about

5 minutes, approximately, to give your testimony, knowing full well

that your entire testimony will be included verbatim in the record.

And so we will start now, as usual, with Mr. Willemssen. I don’t

know how many hearings you’ve been at, sir, but you really have

been stalwart. We feel that you’re part of the committee. Thank

you, Mr. Willemssen.

STATEMENTS OF JOEL C. WILLEMSSEN, DIRECTOR, CIVIL

AGENCIES INFORMATION SYSTEMS, U.S. GENERAL ACCOUNTING OFFICE; AND JOHN SPOTILA, ADMINISTRATOR,

OFFICE OF INFORMATION AND REGULATORY AFFAIRS, OFFICE OF MANAGEMENT AND BUDGET

Mr. WILLEMSSEN. Thank you, Chairwoman Morella, Ranking

Member Turner, Congressman Davis. Thank you for inviting GAO

to testify today on Y2K business continuity and contingency planning and day 1 planning.

As requested, I will briefly summarize our statement. We’ve previously testified on the importance of Y2K business continuity and

contingency planning. No one knows exactly for sure what the rollover period will bring, and, therefore, such planning is essential to

helping ensure continued agency operations in the event that disruptions occur.

Over time we’ve seen major improvements in the Federal agencies’ efforts in business continuity and contingency planning. For

example, in early 1998, we testified that several agencies reported

that they plan to develop contingency plans only if they fell behind

schedule in completing their Y2K work. By contrast, less than a

year later, in January 1999, we testified that many agencies had

reported that they had either completed or had drafted contingency

plans. These improvements continue. For example, we reviewed

agencies’ most recent submissions to OMB of updated continuity

and contingency plans and found that all agencies had identified

key business processes as called for in our guidance. A key aspect

of business continuity and contingency planning is validating or

testing plans. It’s one thing to develop a written plan, but quite another to see whether the plan will actually work as envisioned.

That’s why we’ve emphasized the need for testing of contingency

plans.

In reviewing the high-level plans submitted to OMB, we were

able to identify 20 agencies that discussed their validation strategies. These strategies encompassed a range of activities, including

desktop exercises and simulations. In addition to reviewing these

high-level plans, we’ve previously reported on the business continuity and contingency planning of agencies and their components,

and we found some uneven progress. For example, we found some

agencies have instituted key processes, while other agencies still

have a ways to go.

13

Another important element of business continuity and contingency planning that has not yet been adequately addressed is the

potential cost of implementing plans. Our guide calls on agencies

to assess the costs and benefits of identified alternative contingency

strategies. We also testified in June that OMB’s assessment of

agency plans should consider whether agencies provided estimated

costs, and, if not, OMB should require that this information be submitted so that it is available on a governmentwide basis. However,

OMB has not yet required agencies to provide these cost estimates,

although we did identify five agencies which did so in their submissions.

Regarding day 1 planning, earlier this month we did issue a

guide to assist agencies in implementing their strategies. Briefly

the objectives of a day 1 strategy are to, one, position the organization to readily identify year 2000 induced problems, take needed

corrective actions, and minimize adverse impact on agency operations and key business processes. And second, it’s very important

that the organization be in a position to provide information on

their Y2K condition to their top executives, other business partners

and to the public. Our guidance provides a conceptual framework

for helping agencies address those objectives.

For the day 1 plans that were due on October 15th, OMB asked

agencies to address seven key elements, elements such as a schedule of activities, contractor availability, communications with the

work force, and communications with the public. A review of the

submissions found that about 40 percent of the agencies addressed

all required elements.

Another important part of day 1 planning is ensuring that the

day 1 strategy can actually be executed; therefore, day 1 plans and

their key processes and timetables should be reviewed and, if feasible, rehearsed. Our review of day 1 plans found that 19 agencies

discussed rehearsing their strategies, although some did not provide specific dates of their planned or completed rehearsals.

That completes a summary of my statement. And I would be

pleased to address any questions you may have. Thank you.

Mrs. MORELLA. Thank you Mr. Willemssen.

[The prepared statement of Mr. Willemssen follows:]

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

Mrs. MORELLA. We now look forward to hearing from Mr.

Spotila.

Mr. SPOTILA. Good morning, Chairwoman Morella and Congressman Turner and Congressman Davis. Let me start by thanking you

for your continuing interest in the Y2K problem. As I indicated to

you in my testimony on October 6th, your early and continued involvement in this issue has made a dramatic difference in the Federal Government’s preparedness.

Before discussing our day 1 planning efforts, let me update you

on the status of our other work. As of October, the agencies report

that 99 percent of Federal mission-critical systems are compliant,

an increase from the 98 percent that I reported earlier this month.

This reflects notice from five more departments; Agriculture,

Commerce, Energy, Health and Human Services and Transportation, that their critical systems are ready. Although a small number of critical systems are still not quite done, in all cases the agencies involved have assured us that they will complete their work

before the end of the year. Moreover, they all have contingency

plans in place for these systems. Compared to where we were just

last year, this is a huge accomplishment.

Even though we expect all of our mission-critical systems to be

ready by January 1st, it is still important that every agency have

a business continuity and contingency plan, or BCCP, in place, including a detailed day 1 plan. These plans describe the steps each

agency will take to prepare for the 1st of January. They should address the full scope of agency activity with steps to mitigate the impact of any failures involving internal systems, buildings or other

infrastructure.

Agencies must be ready to assess the impact of any Y2K problem

on their partners and constituencies and to provide them with appropriate assistance. They must also be ready to provide information about any Y2K problem to their management partners and the

public.

As GAO’s day 1 guidance notes, effective day 1 planning will position an agency to identify year 2000 induced problems, take corrective action and minimize adverse impact on agency operations

and key business processes. We are working closely with the agencies and GAO to share information about how best to develop effective plans. GAO and OMB have issued coordinated guidance to the

agencies.

My staff has reviewed agency plans and is working with agencies

to improve those plans. We are all learning as we go. The work we

are asking agencies to do has never been done before. In an organization as large and diversified as the Federal Government, there

is no one-size-fits-all solution, and given this challenge, the agencies have responded well.

Based on our initial review of agency plans, we believe most

large agencies are on track. While they need to add more detail to

the plans, most do address all of the critical elements of effective

day 1 planning. A few of the larger agencies have had more difficulty. Here we have engaged them at a senior level to ensure that

their efforts improve. I have already spoken personally with several

agencies to see that their plans are revised to address our concerns.

35

OMB staff are following up these discussions with each agency

individually. While a few of the small and independent agencies

have done excellent work, a number of them have provided incomplete plans or none at all. To help speed their work, we are meeting with them next week. We will have one or two of the agencies

that provided excellent plans describe what the plans should entail.

I note that GAO has agreed to participate in that meeting as well.

Their work has been invaluable to agency progress in this area.

After further work with the agencies, we will ask them to provide

us with revised plans next month. From our review of the existing

day 1 plans, we are beginning to see some patterns of best practices. The importance of good communications cannot be underestimated. If unforeseen problems arise, agencies must be able to communicate with their work force, their partners and the public.

Assuring the ability to communicate is so important that a redundant communications capability should be put into place. The

best plans provide a detailed schedule of activities that will take

place during the rollover period. They anticipate the sequence and

timing of such activities as shutting down computer systems and

bringing them back up, checking their viability and contacting key

business partners.

The best plans ensure that the right personnel will be available

at the right time, whether on duty or on call and whether on or

offsite. Such personnel may be contractors or employees and may

include building technicians, computer programmers, telecommunications experts, program staff, contracting officers, legal counsel,

public affairs staff and senior management.

Finally, we are aware that the Y2K transition is an opportunity

for those who might want to disrupt agency activity, whether mischiefmakers or those with criminal intent. The best plans describe

additional steps to guard against such security risks, whether to facilities, personnel or systems.

We are all on a learning curve here. As we identify other best

practices, we will share them across agencies. Such cooperation will

continue to be essential to our success in preparing for Y2K. We

are entering the home stretch of our year 2000 efforts. As in any

race, it is time to begin sprinting toward the finish. Day 1 plans

are the critical last piece of our preparations. There will be no

letup in our efforts during the remaining 63 days.

Thank you for the opportunity to continue to share information

with you on the administration’s progress. I would be pleased to

answer any questions you may have.

Mrs. MORELLA. Thank you, Mr. Spotila.

[The prepared statement of Mr. Spotila follows:]

36

37

38

39

40

Mrs. MORELLA. I am particularly pleased having both of you

here, because you have been partners in trying to make sure that

the Federal agencies, as well as the outreach and end-to-end testing, has been taking place.

As we start our questioning, I will start off with Mr. Willemssen.

In your statement you mention several agencies at risk of not having solid, well-tested contingency plans, including the IRS, that will

be testifying today, Federal Bureau of Investigations, Drug Enforcement Agency, Agency of International Development.

I would like to have you tell us what you see the real-life consequences of not having plans ready.

Mr. WILLEMSSEN. To the extent that agencies do not have contingency plans and continuity plans ready, and to the extent that

those plans haven’t been well tested, those agencies run the risk

that in the event that disruptions occur, their responses to those

disruptions will be more ad hoc and chaotic in nature, rather than

very well planned with a clear roadmap on who is to do what and

when, and who to report to who on what is going on.

That is the whole basis of having these plans in place and testing

these plans. To the extent that that isn’t there, we do run this risk

of an untrained response that is a more ad hoc in nature, that may

not be the right response, and, therefore, the response may not address the Y2K problem that may have occurred.

Mrs. MORELLA. So the planning is critically necessary even

though that may not be the end either, there may be some other

implications and consequences resulting from it, but far better than

to have what could happen without those contingency plans.

You mentioned also in your statement the Y2K risk facing Staterun programs—this concerns me greatly—like Medicaid and unemployment insurance. Again, what are the consequences of not having those plans ready?

Mr. WILLEMSSEN. The likely consequences in those kinds of benefit-driven programs is that, in the event that there are Y2K disruptions and contingency plans aren’t ready to be implemented,

benefits could be delayed or benefit amounts could be inaccurate.

And, therefore, it’s critically important that the contingency plans

be pursued and be tested.

I’m more optimistic actually in this area now because of some of

the fine efforts of the lead Federal agencies in understanding that

this is a critical issue, and States are beginning—even those States

that were lagging behind—are beginning to address this very forcefully. So I think there’s reason for much more optimism, even compared to just a few weeks ago.

Mrs. MORELLA. Agencies should not be advising the public,

should they, of possible consequences in terms of enlightening

them?

Mr. WILLEMSSEN. I think agencies have to make a very reasoned

decision on what they announce to the public and what they don’t.

As a side note, many of the business continuity and contingency

plans and day 1 strategies do have some level of classification such

as for official use only. One of the reasons for that relates to something you had mentioned early on. There’s a possible security risk

to the extent that agencies publish too much information about

what they plan to do in the event of a Y2K disruption. So that’s

41

something that I think agencies have to make a reasoned decision

on.

I think the bottom line is making sure that plans are in place,

that they have been tested, and that all the agencies are poised

during the rollover period to address any disruptions that may result.

Mrs. MORELLA. Thank you.

Mr. Spotila, according to OMB—and I very much appreciate your

coming out with the requirement that by October 15th, the agencies have their day 1 plans and contingency plans in effect. But according to OMB, day 1 plans should include specific data such as

personnel that should be on call or on duty. And I wonder, what

do you believe will be the number of Federal employees that will

be on call or on duty, as the statement designates, on January 1st,

2000?

I guess what I’m asking you is, how does this compare, January

1st, 2000, with a regular day for the Federal Government?

Mr. SPOTILA. We don’t yet have a specific number of people that

we anticipate will be on duty in this effort. One of the general comments that I made in my testimony concerning the day 1 plans was

that a number of the agencies need to supply more detail than they

have. To some degree this is a process where we think we will get

more specific information very quickly in the weeks to come.

Certainly not everyone will be working. We anticipate in each

case that core staffs will be available, targeted much more at the

specific needs of agencies on an individual basis. Some of those

needs relate to verifying that the systems are going to work, bringing them down, bringing them back up again. Some of them involve

response capability. In some cases, there will be people on call who

will not physically be onsite as the rollover occurs.

We will have better information as we get closer to the end of

the year in this regard, but we don’t quite have it yet.

Mrs. MORELLA. But obviously there will be a tremendous number

of people who will be ready who will be on call, as you say—.

Mr. SPOTILA. That’s true.

Mrs. MORELLA [continuing]. Ready to respond? It would be interesting as you continue on in the remaining couple of months to

keep us apprised of that, too.

And one final question, before I turn to Mr. Turner for his line

of questioning, is that Mr. Willemssen mentioned something that

I think you would agree with, and that is that we don’t really have

the cost estimates of what implementation is going to cost. And I’m

curious about what you’re going to do to require it.

I don’t think you’ve required it at this point, cost estimates. And

I think they should be something that we should be able to scrutinize.

Mr. SPOTILA. We have had discussions with the agencies on this

subject. Our sense has been that the most important focus for the

agencies right now should be getting their plans, their detailed

plans, ready so that we know what it is they’re going to do or what

they feel they will need to do.

From a costs standpoint, the agencies understand at the moment

that they are expected to absorb these costs initially; they all have

resources, we think, to do that. We made sure to tell them that if

42

any feel that budget considerations are interfering with their plans,

they need to let us know, and we will make sure that resources are

available.

We certainly will come back to the question of cost estimating,

but we need to do it after the plans are ready in more detail so

we know what it is that we are actually dealing with. It’s not something we’re insensitive to, but it is true we have not made this a

priority equal to getting ready for the event itself.

Mrs. MORELLA. You might consider having at least some estimates submitted to scrutinize, because it was my understanding

that it was in August 1999 when I think it was Department of

Health and Human Services estimated that it would cost about $99

to implement contingency and day 1 plan.

Mr. SPOTILA. I think that we will, in fact, ask for estimates.

We’ve actually gotten some of them in already. We’ve encouraged

agencies to give us estimates as they are ready to do so, and I

think as we proceed closer to the end of the year, that is something

we will be asking of them.

Mrs. MORELLA. Thank you.

I am now pleased to recognize Mr. Turner for his line of questioning.

Mr. TURNER. Thank you, Ms. Morella.

In my opening comments I made reference to the fact that we

probably should all put ourself in the state of mind where we are

ready to expect the unexpected. And one of the things that has concerned me, even after all of our efforts to prepare for Y2K it still

seems to be very possible whether it’s through efforts by those who

would do harm to our country or simply from those who are on

some college campus disseminating information over the Internet,

that perhaps we could have on January 1st a lot of misinformation

designed with ill intent or simply out of a spirit of being a prankster to try to mislead people and to cause people to take certain actions they might not otherwise take based on the information that

that is disseminated.

I was wondering whether or not we have considered, or perhaps

Mr. Koskinen in his efforts has considered creating some type of

rapid response team that would act as a clearinghouse as we enter

the new year to provide a source of credibility regarding misinformation or information that may circulate, whether it be over the

Internet or through some other medium, about the existence or

nonexistence of Y2K problems.

It seems to me that that type of panel would need to be people

of some renown who bear credibility, perhaps a three-member

panel of members who would be the spokespersons regarding Y2K

problems. Madam Chairman, I know you get the same kind of email I do. There’s always some kind of rumor circulating on the

Internet about something the government is about to pass or put

a tax on the Internet or something like that, and we all end up

writing these letters back saying that’s just a rumor, there’s no

basis, there’s no legislation pending on that subject.

It just strikes me that on January 1st, there’s a possibility that

some may try to circulate misinformation that might cause people

to take actions that otherwise they would not take. If we had a

panel in place of credible individuals through which all of that inVerDate 11-MAY-2000 08:32 Mar 26, 2001 Jkt 066429 PO 00000 Frm 00048 Fmt 6633 Sfmt 6602 E:\HEARINGS\61119.TXT pfrm09 PsN: 61119
43

formation could clear, then they could turn to the agencies and

turn to the private sector to get the truth, and then be in a position

to respond through the media regarding what are the facts. Perhaps, we could avoid some problems that might otherwise occur.

Have we given any thought to that, or have any of the efforts of

Mr. Koskinen directed in that way?

Mr. SPOTILA. Actually, Congressman, we’ve been giving quite a

bit of thought to that. Let me address it in two respects. First of

all, as I mentioned in my testimony, from a security standpoint

we’re asking each agency in its day 1 plan to address the question

of protecting systems from anyone who would cause mischief.

That’s an element here.

With respect to misinformation that might be put out, here, too,

agencies will be focused on how that information might relate to

them individually. In a coordinated way, the Information Coordination Center will help, John Koskinen and the President’s Council

on Year 2000 Conversion have a plan for collecting and exchanging

information in this area, working closely with their private sector

coordinators and others throughout State and local government to

be in a position to verify what information is true and to be able

to disseminate it.

The Coordination Center will play a key role in terms of overall

coordination, even though we are also looking at individual agencies to be prepared to address agency specific concerns.

Mr. TURNER. Well, I would urge you to maybe pursue it a little

bit further, because I think if we could enlist the assistance of some

high-profile personalities who have credibility, a Walter Cronkite

type who would be a spokesperson, along perhaps with one or two

others. I don’t think it’s going to help if there’s some rumor or misinformation floating, say, on the Internet, and it’s reported that the

government denies the report. Unfortunately, we all know the government oftentimes does not have the credibility that we might

need.

So it would seem to me if we could attach a personality to that

effort that would be known to be trustworthy by the American public, perhaps we could avoid some problems that otherwise might

occur.

Mr. SPOTILA. I think that’s a very constructive suggestion. We

certainly will bring that up with John Koskinen and see what can

be done in that area.

Mr. TURNER. Thank you. I don’t have any other further questions.

Mrs. MORELLA. What are you going to be doing, Mr. Spotila, on

that day? Where are you going to be?

Mr. SPOTILA. I think I will—actually, I asked my staff to tell me

where they think I should be.

Mrs. MORELLA. Never leave yourself so wide open.

Mr. SPOTILA. I’m certainly making myself available to be right on

duty here. But we’re trying to determine whether that would be

positive or negative in the view of the people that are actually

going to be dealing with our problems.

Mrs. MORELLA. But I appreciate Mr. Turner asking that question

because as we go on, I would like to find out, you know, specifically

how that ICC is going to operate.

44

Mr. SPOTILA. Yes.

Mrs. MORELLA. I have a question, the same question actually for

both of you. IRS is going to be a witness on our next panel, and

recently IRS reported that the poor quality of its computer inventory poses a high risk to its Y2K effort. I quote that exactly. That

was quoted in a letter to Mr. Archer, the chairman of the Ways and

Means Committee. And it says the quality of the IRS’s inventory

currently poses a high risk to the Y2K effort.

Therefore, my question to both of you is, in your opinion, what

can be done to—or what can the IRS do to mitigate that potential

Y2K problem, those failures, and does the IRS have a practical contingency plan in place? They will have an opportunity to respond,

but I wanted to hear from you before we dismiss this first panel.

Mr. WILLEMSSEN. Well, one, Chairwoman Morella, I think it is

of concern to hear a major Federal agency still talking about the

term ‘‘inventory’’ at this late date. In testifying on the IRS, which

I did as far back as February 1997, I know the IRS has a far-flung

information systems structure, many of their systems out in the

field, many of the systems homegrown, so it is a difficult endeavor

to get a handle on all of those.

In terms of your direct question on what should they do, I think

it’s just ensuring that their key business processes, whether they’re

tax refunds or tax processing, however IRS has defined them, that

they have thoroughly decomposed those processes and identified

their key systems that they need to be ready in order to do business as usual come the turn of the year.

Mrs. MORELLA. Do they have time to do that?

Mr. WILLEMSSEN. I think one thing in their favor is given the

background of the Commissioner of the Internal Revenue Service,

he’s made it very clear this has been a top priority for him for some

time, and he also made it clear, I think, in hearings I’ve been at

with him that this was a massive undertaking, that it had risks

associated with it. And I think there is time to focus again on those

most important business processes and decompose them and focus

on the supporting systems.

Mrs. MORELLA. Mr. Spotila.

Mr. SPOTILA. From our perspective, I agree completely with Mr.

Willemssen in all of those respects. We’re concerned. We have not

had quite as much information of IRS as we would like to see. We

recognize the importance of this, and we certainly are going to do

what we can do to help the situation.

Mrs. MORELLA. Well, we will be interested to also hear from IRS

about, you know, what they are doing, particularly in light of that

rather frightening statement.

Let me ask you about GAO, you recently reported that only 40

percent of Federal agencies submitted complete contingency plans

with information on the seven criteria that you have established.

What are you going to do to make sure that agencies complete

these plans?

Mr. WILLEMSSEN. Well, in terms of their day 1 strategy and the

required seven elements of OMB, I would concur with Mr. Spotila’s

comments that OMB is working with these agencies to followup

where there are holes and where more information is needed. I

45

think we also have to keep in mind that many agencies were out

front and had a lot of this detail all pulled together; many did not.

The requirement for day 1 strategies was initially contained in

OMB’s September 13th quarterly report summary. So that was the

first time a requirement was sent out. OMB’s guidance on what to

include, I believe, came out on October 13th, and then the strategies were due 2 days later.

So we’re talking about a very compressed time. I think we have

to give the agencies that did get a late start some recognition that

they have time to improve, but this has to be a top priority at this

point in time. I think OMB shares that view, and through our reviews and evaluations, we have not seen evidence of agencies resisting day 1 concept. What they don’t have in many cases are all

the details worked out yet, and that’s what they have to focus on

now.

Mrs. MORELLA. I know that GAO is the one who has suggested

that OMB come up with the criteria, which they did so well, established the October 15th deadline. Now, in light of the question that

I asked Mr. Willemssen, which is directed to you now, do you have

another deadline that you have established where you say you now

must get the responses, your contingency plans in effect by another

deadline?

Mr. SPOTILA. We’re proceeding on two levels: one, individually

with agencies, based on what they have submitted to us, or in a

couple of instances where they have not submitted to us, to work

with them to get this fixed.

We’ve also told them informally that we will be asking them for

a new updated report next month, so there is going to be a new

November deadline for them. That has not formally gone out yet,

but they have all been advised that it is coming. Our priority has

been working with GAO and working with the agencies to get these

plans in their proper shape.

Mrs. MORELLA. It appears as though they may be working very

long days in order to do it, and I think you should set an early November deadline for that, too.

Mr. SPOTILA. We intend to.

Mrs. MORELLA. I guess I just have one more question so we can

get on to our next panel. And I know that you have always been

available to respond to other questions that we may submit.

Another day 1 strategy requirement is to include data on contractor availability. Do you believe that this requirement is being

followed, being overlooked? Because I think it’s exceedingly important, and we’ve discussed this in a number of our other hearings,

exceedingly important for interoperability and for the successful operation of many of the Federal mission-critical systems.

What have your investigations revealed thus far with respect to

Federal contractors?

Mr. WILLEMSSEN. In taking a look at the strategies that have

been submitted thus far, it’s a bit of a mix. Some of the agencies

haven’t addressed the issue, and don’t know the availability. Other

agencies are still working on this. I think this is a fairly critical

issue, and it’s critical from a couple respects. One is making sure

from a governmentwide basis that not everyone thinks they have

a relationship with the same vendor, and making sure that that

46

vendor isn’t overextended. And then second is laying out in specified detail exactly who to contact with that contractor or vendor

should disruptions occur.

Mrs. MORELLA. Mr. Spotila, would you like to comment on that?

Mr. SPOTILA. Yes. Once again I would agree. I think in general,

with most of the agencies, we need more detailed information on

this subject. One of our observations is that a number of the agencies need to do more in this area. Some have done real well. Social

Security whom you will be hearing from, has done an excellent job.

NASA and the Department of Transportation have done very well.

But there are a number of agencies that need to add considerable

detail here, and that’s one of the areas we’re pressing.

Mrs. MORELLA. This is going to be one of the questions we’re

going to ask to our second panel what they’re doing, and I’m glad

that you’re both very aware of it and continue to ask for that response.

Just finally the issue of computer security, this is one, as you

know, I think is critically important as it relates to Y2K and even

beyond that. How certain are you that the remediation efforts of

the Federal systems have been conducted by firms that are U.S.-

owned, and then if you would like to comment on what the risks

might be that foreign agents or those with antigovernment views

might have access to sensitive computer data. If I could ask both

of you if you can answer that.

Mr. WILLEMSSEN. I will answer that in two ways. One is to give

you my nonscientific answer that I think overall if you compare

what has happened on remediation to what we thought would happen in the 1996 or 1997 timeframe, we’ve been a little surprised

that more of the remediation work was actually done in-house and

by existing contractors as it pertains to Federal agencies than we

would have thought. There really wasn’t as much work that went

outside of the existing agency-contractor relationships as we would

have envisioned.

Point two, we share your concern about Y2K security risks.

Frankly, we haven’t at this point done a lot of work on this. We

do have some ongoing work looking at that right now with some

high-profile agencies, such as the Federal Aviation Administration

and Department of Energy. At these agencies we are pursuing the

issue to see what kind of controls and processes the agencies have

in place.

Overall, I think that the executive branch is very, very aware of

this particular issue, and it’s brought up in almost every meeting

I’m in on Y2K over the last couple of months.

Mr. SPOTILA. I would echo those comments. In general, OMB

does not have individual agency information in this regard. We’ve

relied on the agencies and their decisionmaking process. We have

worked in coordination with the National Security Council, with

the President’s advisor on counterterrorism Mr. Clark, and the

CIAO office. This is something we are sensitive to. We have looked

at security concerns here, and we think that the right steps are

being taken, but it certainly is not something that we are taking

for granted.

Mrs. MORELLA. Well, I’m glad to hear that because I think it’s

critically important. We focus on it because this whole concept of

47

the potential for the computer security could dwarf the problems of

Y2K.

Mr. Turner, do you have any final comments?

Mr. TURNER. No final questions, thank you.

Mrs. MORELLA. I want to thank panel one for the work you’ve

done not only in your presentations and responses today, but continuously that you’ve done. Thank you very much.

Mr. WILLEMSSEN. Thank you.

Mr. SPOTILA. Thank you.

Mrs. MORELLA. Now we will ask the second panel to come forward. Mr. Dyer, Mr. Langston, Mr. Gilligan, Mr. Cosgrave, Mr. Lorentz.

Gentlemen, before you get comfortable, as we did with the first

panel, I would ask you kindly to stand and raise your right hand.

[Witnesses sworn.]

Mrs. MORELLA. Again, the record will demonstrate affirmative

response to that.

So we’re pleased to have on our second panel John Dyer, Principal Deputy of the Social Security Administration; Dr. Marvin J.

Langston, Deputy Assistant Secretary of Defense for C31 and the

Year 2000, Department of Defense; John Gilligan, Chief Information Officer of the Department of Energy; Mr. Paul Cosgrave, who

is the Chief Information Officer of the Internal Revenue Service;

Mr. Norman E. Lorentz, Senior Vice President, Chief Technology

Officer of the United States Postal Service.

Gentlemen, I’m glad you’re here, it’s very important that we hear

from you. And I think it was appropriate that you also heard the

testimony of GAO and OMB preceding you. And again, following

sort of a 5-minute rule, we’re very flexible about it.

We will start off, and I will let you know that we will hope to

have time for questioning and that your entire statement will be

in the record, so you can give us a synopsis, if you desire. So we

will start off with you then.

Mr. Dyer, thank you for being here.

STATEMENTS OF JOHN DYER, PRINCIPAL DEPUTY, SOCIAL SECURITY ADMINISTRATION; MARVIN J. LANGSTON, DEPUTY

ASSISTANT SECRETARY OF DEFENSE FOR C3I AND YEAR

2000, DEPARTMENT OF DEFENSE, ACCOMPANIED BY REAR

ADMIRAL BOB WILLARD AND BILL CURTIS, DEPARTMENT

OF DEFENSE; JOHN GILLIGAN, CHIEF INFORMATION OFFICER, DEPARTMENT OF ENERGY; PAUL COSGRAVE, CHIEF INFORMATION OFFICER, INTERNAL REVENUE SERVICE; AND

NORMAN E. LORENTZ, SENIOR VICE PRESIDENT, CHIEF

TECHNOLOGY OFFICER, U.S. POSTAL SERVICE

Mr. DYER. Madam Chairwoman and Representative Turner, I appreciate the opportunity to discuss the Social Security Administration’s day 1 and business continuity and contingency plans for the

year 2000 changeover. As a recognized leader in Y2K readiness, we

are confident that our monthly payments to 50 million people and

the earnings records of 145 million workers will not be affected;

however, in the case of the unexpected, we are prepared.

To begin with, all of our mission-critical systems are certified as

year 2000 compliant, along with all of the State disability deterVerDate 11-MAY-2000 08:32 Mar 26, 2001 Jkt 066429 PO 00000 Frm 00053 Fmt 6633 Sfmt 6602 E:\HEARINGS\61119.TXT pfrm09 PsN: 61119
48

mination services referred to as DDSs. Additionally, joint testing of

payment files and direct deposit procedures have been successfully

completed, as is the Federal Reserve Board testing with financial

institutions, including Social Security transactions. Last, as for

trading partners, Treasury and the Postal Service are also on board

to handle ongoing and incoming exchanges.

At this point I would like to review step by step our plans for

the last days of 1999 and the first days of 2000. For December 30th

to January 3rd, designated personnel will inspect, evaluate and report on virtually every office. Social Security headquarters will stop

receiving on-line transactions from field offices at 5 p.m. Eastern

Standard Time on December 30th, allowing all officials to collect all

of our 1999 computer transactions.

On December 31st, our computer systems will finish updating

SSA’s master files. Just before midnight, the Social Security’s main

data center in Baltimore will switch to jet fuel generators until the

power company notifies the agency that everything is fine.

Immediately after midnight, December 31st, 1999, teams will

begin assessing our systems’ capability to process transactions for

the year 2000. Later that day, staff at selected offices across the

country will enter data. We will also test the 800 number.

Throughout New Year’s Day, a group of programmers will run

checks on the computer systems for our 1,400 facilities.

Social Security managers will report to their offices, checking all

equipment and reporting their findings to regional offices, which

will then forward the data to the command center in Baltimore.

Approximately 100 sites will serve as barometer offices, including

the 55 that do the disability determinations.

Agency technical staff will test software systems by conducting

a series of typical transactions. The Baltimore command center will

monitor the processing. If problems are found, teams will be dispatched to make the necessary repairs. Besides assessing Social Security’s infrastructure, our command center will communicate with

several non-SSA sites, such as the Treasury command center, to be

alerted to any problems that banks may have in posting electronic

fund transfers. Moreover, we will advise the White House Information Coordination Center, the media and the Congress of SSA’s status. Then on January 3rd, Social Security will open for business as

usual.

SSA’s day 1 strategy is part of our overall business continuity

and contingency plan. The plan prepares the agency to avoid a possible crisis if its automated systems are unable to recognize the

year 2000. Within this larger plan, we have local plans for each

field office, teleservice centers, processing centers, hearing offices

and the State DDSs. We have developed contingencies for benefit

payment delivery, building operations, human resources and communications.

For over a year both Social Security and SSI payments have been

made with year 2000 compliant systems. Furthermore, we have developed a benefit payment delivery plan with the Treasury Department and the Federal Reserve. In November 1999, next month,

field office employees will receive training as to the actions and

procedures they are to follow if such an unanticipated problem occurs. SSA also has contingency plans that deal with unforeseen

49

emergencies, such as inclement weather, natural disasters, accidents or equipment failure.

We want the public to understand that we’re prepared for the

year 2000 conversion. We want the public to have accurate information. Misinformation and confusion could generate overwhelming workloads and cause disruptions. Therefore we appreciate the Congress and others updating the American public about

the actions Social Security and other Federal agencies have taken

to prepare for the year 2000.

For our part we’re committed to informing Members of Congress

if serious problems develop. If a service to any of our local offices

is interrupted, and contingency plans are implemented, the manager of the affected office will call the congressional office with specific information on how it will provide service to the congressional

representative, congressional offices and to the constituents normally served by that office.

In fact, on September 23rd, we sent a letter to the Congress outlining these steps and listed the names and phone numbers of the

managers of each local office in each State responsible for calling

you.

Because of our early planning and testing, Social Security fully

expects that all of our processes will function properly in the new

millennium, and that we will continue to provide world-class service to the American people.

I’m happy to answer any questions you might have. Thank you.

Mrs. MORELLA. Thank you, Mr. Dyer. I know that Social Security

Administration started in 1989 in their preparation.

[The prepared statement of Mr. Dyer follows:]

50

51

52

53

54

55

56

57

58

59

Mrs. MORELLA. Mr. Langston, Dr. Langston.

Mr. LANGSTON. Chairwoman Morella, Mr. Turner, thank you

very much for your continued interest in this subject. The Department of Defense is very proud of the progress that we have made

over the past 15 months of this ongoing year 2000 preparation effort.

I’m joined this morning by Rear Admiral Bob Willard, who has

been spearheading this effort in our unified forces and services,

and also Mr. Bill Curtis, who has been our full-time person leading

and directing the year 2000 event for the past period of time.

We have addressed this issue in four major activities. Those activities comprise systems compliance, operational evaluation and

testing, contingency planning, leadership preparation and a transition period which has begun. I will just spend a few minutes outlining the activity in these areas for you.

In the systems compliance area we are tracking and repairing

over 7,500 systems. Over 2,000 of those are mission-critical systems. The rest are non-mission-critical systems. And in addition,

we have 600 installations and 350 domains among our main

megacenter mainframe computers that we have worked to repair.

Of those systems we are confident that all of them will be repaired

and ready to go for this event, and currently we are over 98 percent

of our mission-critical systems.

In the operational evaluation and testing area, this is the largest

effort in DOD’s history. We have never conducted such an integrated and large operational evaluation of our systems. We have

done it in two major ways. We have enlisted the uniformed services

through the support from the chairman of the Joint Chiefs of Staff

to conduct operational evaluations, which are threaded evaluations

of systems operations that support our primary military functions.

And we’ve also conducted functional evaluations of all of the support operations that foundation the Department; for example, financial systems, logistics systems, and personnel systems.

We have also conducted a whole series of service integration

tests which are specific to each of our military services and verify

that those systems of systems among the services are capable of

supporting our needs.

In the contingency planning and leadership preparation area, the

chairman of the Joint Chiefs of Staff has conducted a series of

chairman contingency assessments personally led by the chairman

and supported by our four-star uniformed commanders. They address mobilization, deployment operations and sustainment. And

these evaluations were 2 week-long periods of removing tens of

major systems from each of those areas to evaluate the impact of

the loss of those systems and the support of the contingency plans

that would be put in place should those systems be removed on

military operations.

In each of those cases we determined that our contingency plans

were an important element of what was needed, and that we, in

fact, could conduct military operations should we lose those large

number of systems.

We also conducted business continuity planning in terms of both

systems continuity plans and operational continuity plans, meaning

that we have a continuity plan for every system, and we have a

60

continuity plan for every operational functional area that is a combination of systems or a larger function, and therefore we have a

way to support loss of capability in any one of these events.

We’ve also enlisted the support of all of our inspector generals,

both the service inspector generals and the DOD inspector generals, on all of our assessment agencies to make sure that we have

prepared good contingency plans and they are in good shape for

these operations.

And finally, in preparation for our leadership, we have conducted

a series of table top exercises which were literally day-long workshops that prepared the senior leaders to explore an enormous

amount of unknown, what-if types of questions to determine how

we would operate the Department through any kind of unknown

surprise events.

Finally, the fourth area is a transition day 1 operations period

which we did begin in September, the 1st of September, and we

will operate through the 1st of March or the end of March of this

coming year. A major part of this activity has been the preparation

of a consequence management plan to help all of our warfighting

commanders and base commanders understand how they can respond to situations and external requests from the Department for

aid and support throughout the United States or other nations in

the world. And in that process, we have also established a posturelevel instruction which allows across five posture levels each of our

commanders to understand how we are postured and how they are

to respond specifically to those posture levels.

For example, in this consequence management activity our first

priority is, as Dr. Hamre, the Deputy Secretary, has reiterated several times, is to support national command authority or military

operations in any form. Our second priority is to support standing

operations. Our third priority is to support civil authorities and

public health and safety. And our fourth priority is to support civil

authorities in support of economic or national quality of life. These

are all well laid out and detailed plans which we continue to refine

wherever we find the need for such.

Finally, I would point out that we have had an ongoing operation

with foreign nations and our NATO allies with a large amount of

effort concentrated on the Russians and their interaction with us

for early warning events and for mitigating any nuclear mishaps

or missteps related to nuclear weapons. We are currently planning

to put in place our Center for Year 2000 Strategic Stability in Colorado Springs. We have conducted successful negotiations with the

Russians for them to participate in this event. They will be arriving in Colorado Springs on the 22nd of December and working with

us through the 15th of January for that particular operation.

So in conclusion, I would suggest that we have conducted a very

extensive activity over this past year. The activity actually transformed when Secretary Cohen and Dr. Hamre tasked the uniform

commanders and the under secretaries of the functional support

areas to be personally responsible for the operations and mission

continuity through this period of time. I believe that it’s fair to say

that the Department literally does contingency planning all the

time because of the nature of our business. We do continuously report activities on a 24 by 7 basis throughout the normal year, and

61

the year 2000 event for us is a significant event that we do not

take lightly, but it does fit directly into our normal operations, and

we feel that we will be ready and prepared to support any national

security situation throughout this period. Thank you.

Mrs. MORELLA. Thank you, Dr. Langston.

[The prepared statement of Mr. Langston follows:]

62

63

64

65

66

67

68

69

70

71

72

Mrs. MORELLA. Mr. Gilligan, pleasure to hear from you sir.

Mr. GILLIGAN. Thank you, Madam Chairwoman Morella and

Congressman Turner. I welcome this opportunity this morning to

discuss the Department of Energy’s contingency, business continuity and zero day plans. As Chief Information Officer for the Department of Energy, I am responsible for the oversight, coordination and facilitation of the Department’s ongoing efforts to address

year 2000 issues.

The Department has made great progress since the last time we

testified before this subcommittee in June 1998, and I am pleased

to be here to discuss our progress with you. Achieving 100 percent

year 2000 compliance has been one of Secretary Richardson’s top

goals for the Department. When I joined the Department in October 1998, the Department was the recipient of a failing grade on

its year 2000 progress from this committee, and turning around the

year 2000 program was my highest priority.

As you are aware, we were able to rapidly improve our progress

to a B grade in early 1999. I am pleased to report to you today that

100 percent of the Department’s 420 mission-critical systems are

year 2000 compliant and have approved contingency plans, and

that the Department is more than 99.8 percent complete in remediating over 200,000 non-mission-critical systems, embedded chips,

telecommunications systems, data exchanges and work stations.

The Department has taken a phased approach similar to other

large government agencies to its year 2000 preparation activities.

Phase I of our program focused on remediating the Department’s

420 mission-critical systems and approximately 200,000 non-mission-critical systems.

Phase II focused on implementation of additional risk reduction

and mitigation measures to help ensure that no Department mission is compromised due to year 2000 transition, and development

of business continuity and zero day plans to ensure the continuation of the Department’s core business processes in the event of

a year 2000 related failure.

Phase III of our program is now focusing on refining our business

continuity and zero day plans that we have developed. This will ensure that we have clear processes to deal with potential year 2000

induced problems and that we have identified individual roles and

responsibilities for monitoring, evaluating and responding to year

2000 related events across the Department.

As I mentioned earlier, phase I of our year 2000 program is nearly 100 percent complete. During the course of our phase I year

2000 activities, the Department has also focused particular attention on the systems that protect the health and safety of the public,

our workers and the environment. As of the 1st of October, all of

our more than 540 health and safety-related systems are either

year 2000 compliant or year 2000 ready, and we will continue to

focus close attention on these systems. Furthermore, positive validation of the functionality of all operational health and safety systems will be required within 12 hours of the year 2000 transition

to ensure the continued safety of the public, our workers and the

environment.

Phase II of our year 2000 program is almost fully complete as

well. During phase II we focused on implementation of additional

73

risk reduction and mitigation measures to help ensure that no departmental mission is compromised due to the year 2000 transition. We have conducted external independent verification and validation of the year 2000 remediation efforts as well as end-to-end

testing for all mission-critical systems and health and safety-related systems with year 2000 date-related issues. I am pleased to

report that external IV&V and end-to-end testing activities are

complete for more than 99 percent of these systems.

Phase II of our program also focused on developing business continuity and zero day plans to ensure the continuation of our core

business processes in the event that year 2000 failures occur. Due

to the complexity and diversity of the Department’s missions and

activities and the recognition that the year 2000 transition poses

a unique risk for each site, the Department required business continuity plans for each of our 42 sites. Sites have exercised their

contingency and continuity plans during phase II of our program.

Our first formal readiness exercise was conducted on April 9th and

resulted in lessons learned and best practices on contingency plans.

On September 8th and 9th, 42 sites participated in our second year

2000 exercise. Sites tested failure scenarios and their planned response to year 2000 related events, rehearsed their zero day procedures and tested the Department’s procedures for reporting year

2000 events to our headquarters. Sites reported that the exercise

was very helpful in evaluating contingency and business continuity

plans and shared with my office a significant number of lessons

learned.

We also sponsored two Department-wide workshops on business

and continuity planning in May and October to share our year

2000 lessons learned and best practices.

We are now implementing phase III of our program, which involves refining our business continuity and zero day plans. In our

review of site and business continuity plans, we have found that

they have addressed many of the elements contained in the General Accounting Office’s day 1 planning guidance. However, we recently received comments from the Office of Management and

Budget that our headquarters business continuity plan had some

weaknesses, in particular with respect to lack of prioritization of

key processes, inadequate discussion of our cybersecurity efforts

and insufficient detail on our procedures and responsibilities during the rollover period.

I have reviewed the plan and concur with OMB’s assessment.

Fortunately, with the solid foundation of contingency planning already completed, these weaknesses can be corrected quickly. I have

directed actions to revise our headquarters business continuity

plan by November 12th and resubmit it to OMB.

However, even after November 12th, we will continue to finetune our plans to reflect final staffing decisions and the results of

year 2000 preparation drills within the Department and with the

President’s Information Coordination Center.

At the Department’s headquarters our zero day procedures include the coordination of the Department of Energy as well as national and international energy sector year 2000 monitoring and reporting activities. We have developed plans with the electricity, oil

and natural gas industries to receive reports of year 2000 related

74

events as well as to analyze potential impacts of any disruptions,

including potential cybersecurity incidents.

Our Emergency Operations Center at the Forrestal Building will

operate as the year 2000 command center for the collection, compilation and analysis and reporting of departmental site and energy sector year 2000 status information to the President’s Information Coordination Center.

Since March 1999, my staff and I have visited more than 30 departmental sites to assess their progress toward implementing

OMB and departmental guidance, to assess the compliance of the

status of their systems and to share year 2000 best practices and

lessons learned. I can say firsthand that all of the Department’s

employees are focused on year 2000 and continue to work aggressively that we will have a successful and smooth transition. In my

opinion, each site is well-positioned to manage the risk potential of

year 2000 related failures. Final efforts over the next 63 days will

ensure that we will effectively handle any year 2000 events regardless of source.

Secretary Richardson and I are proud of the Department’s efforts

to ensure that 100 percent of our systems are year 2000 compliant,

and we are confident in our planning efforts for the year 2000 transition. Our focus and commitment will continue as we complete our

preparation efforts. I look forward to your questions. Thank you.

Mrs. MORELLA. Thank you, Mr. Gilligan.

[The prepared statement of Mr. Gilligan follows:]

75

76

77

78

79

80

81

82

83

84

Mrs. MORELLA. Now pleased to recognize Mr. Cosgrave.

Mr. COSGRAVE. Thank you, Madam Chairwoman, and thank you,

Representative Turner. I’m very happy to be here today to discuss

the status of the Internal Revenue Service’s Y2K business continuity and contingency plans and day 1, or as we refer to it, our

end game plans. I’m joined to as well by Bob Albicker, my deputy.

Mr. Albicker along with myself and our Commissioner Mr. Rossotti

have all personally made this our No. 1 priority. I am also joined

today by Mr. John Yost, who is our full-time executive managing

this program. This is a program that he oversees consisting of approximately 100 people that are directly in his program office, plus

he directly oversees the thousands of people in the Internal Revenue Service who engage in Y2K activities on a daily basis.

In order to save time, I’ll refer you to our general update on the

overall status of our program which is in my written testimony,

and I’ll focus just on contingency planning and day 1 planning.

The IRS is taking every step it can to mitigate the risks that are

involved with the Y2K challenge. Two ways that the IRS is a prepared to address risks are through business continuity and contingency plans as well as day 1 plans. With respect to contingency

plans, the IRS has developed 40 individual contingency plans that

are aligned with the 40 most critical business processes that outline the necessary procedures to follow in the event any of our mission-critical tax-processing systems suffers a major failure.

We followed the planning format suggested to us last year by the

General Accounting Office. We’ve completed testing all but two of

those plans and have addressed GAO’s suggestions from a recent

review of those plans. These contingency plans concentrate on

those areas that have the greatest impact on tax-processing activities in addition to areas that could be particularly affected by the

Y2K problem. Because of the extensive renovation and testing work

that we have performed, we do not anticipate a major failure; however, we have developed the necessary contingency plans, and we

are ready in the event they are needed.

These plans address such issues as preserving files and data,

how to handle personnel, and procedural issues and delivery of

service until computer systems are restored. I must emphasize,

however, that these plans do not provide replacement computer

systems for our existing computer systems, and instead they rely

on alternative manual processes. Because we have performed extensive end-to-end testing, we believe that it is highly unlikely that

we will need to invoke such plans; nevertheless, we have tested

them and are prepared to implement them if necessary.

As for day 1 or end game planning, the IRS has devised an end

game strategy that will guide our activities during the critical rollover weekend of December 31st, 1999, through January 2, 2000.

The end game strategy builds on our current information system

problem reporting resolution process and identifies specific validation checklists to be used during the rollover weekend.

The plan also recognizes a unique problem facing the IRS. This

problem is a result of the annual startup of the filing season, which

this year occurs simultaneous with the millennium rollover weekend.

85

To ensure maximum risk reduction, therefore, the IRS is taking

the following actions. No. 1, we are backing up and then quiescing

the systems beginning at 10 p.m. On December 29th, 1999. This

means the systems will be turned on, but will not be running business applications. On January 1, 2000, the systems will be brought

back up to their normal operating status, this time updated with

our filing season 2000 programs and validated against quality control checklists prior to the first day of business on January 3rd,

2000.

Second, we are ensuring that sites and systems are operational

before the first business day of the new year by conducting a validation check of all systems end facilities at over 500 different posts

of duty.

Third, we are reporting any problems that are encountered

throughout the weekend through our existing problem reporting

channels. All our organizations will be required to affirm that they

have checked critical facilities and systems at their sites to our

year 2000 command center, which will serve as the IRS nerve center during the rollover weekend. Reports will be provided to the

Commissioner, myself, Mr. Albicker, et cetera, on a regular basis

as well as to the Department of Treasury every 4 hours during the

rollover weekend.

Please keep in mind the successful rollover weekend is just a

small part, however, of meeting the Y2K challenge. Problems for us

may arise well into the new year impacting the filing season. For

example, our computers may generate erroneous notices to taxpayers as late as March or April. However, we have procedures in

place to resolve any problems that arise, including scanning for

large erroneous dollar amounts and dates specifying 1900. Additionally, the command center will continue to operate through April

15th, 2000, or longer if necessary, depending on the status of the

filing season. We will rehearse our rollover weekend plan on November 20th, 1999, to prepare participants for this event and to

fine-tune our end game strategy.

In conclusion, we’re confident the IRS will be capable of fulfilling

its mission in the year 2000 and beyond. While we recognize that

risks still exist, we believe we are taking the necessary steps to address them. Thank you.

Mrs. MORELLA. Thank you, Mr. Cosgrave.

[The prepared statement of Mr. Cosgrave follows:]

86

87

88

89

Mrs. MORELLA. I’m now pleased to recognize Mr. Lorentz of the

Postal Service.

Mr. LORENTZ. Good morning, Chairwoman Morella and Representative Turner. With me this morning are Nick Barranca, who

is the Vice President of Operations Planning, and Rick Weirich,

who is our Vice President of Information Systems and our Chief Information Officer.

I’m pleased to report this morning that we have completed all

the technical work on our mission-critical systems, including independent verification, testing, and implementation of a system

freeze.

We began testing our mail processing equipment in 1998 and extended to other sites last year. In August, at our Merrifield northern Virginia site, we started a 6-week test of critical mail processing equipment. This equipment ran continuously in a year 2000

calendar mode, in a live processing environment, testing all equipment types and all mail types. This facility handles 5 million pieces

of mail a day, and we have experienced no problems.

We have also created plans to protect against potential disruptions of other systems and processes. We respond to disruptions

every day. In the last 2 weeks we’ve dealt with Hurricane Irene in

Florida and the Hector Mines earthquake in Los Angeles. Locally,

last year’s storm in Montgomery County left 48 of 60 Montgomery

County delivery units that were without power, and we delivered

mail. I know in my home in Bethesda, all 3 days that we were

without power, I got normal mail delivery even though I had to

walk outside to read it.

Our business continuity plans and contingency plans are building

on our experience and formalizing our response to disruption, both

internal and external. Our continuity plans deal with the external

infrastructure. Our internal contingency component plans deal with

the infrastructure all the way from timekeeping to mail processing.

Our plans includes working with customers, with other Federal

agencies, and particularly with agencies that deliver benefit payments to the American people.

We anticipate that some of the mailers may divert electronic

communications to hard copy mail. With that in mind, we’re holding the enlarged infrastructure that we normally put in place for

the holiday season, including staff, transportation, and sorting capability, through January.

So what is day 1 going to look like for us? First of all, it’s going

to be business as usual, but prepared for whatever might occur. Robust day 1 plans are developed to preempt any kind of problems.

Systems are in place to identify, report, track, resolve any Y2K

issues.

To communicate internally, with customers, with employees and

with all stakeholders, we have emergency communication capability. Our network operations center has been converted into an

internal ICC. Our national and field operations centers will operate

24 by 7 to assess USPS status and provide resource and decision

support.

Our day 1 activities will also involve onsite participation at the

President’s Council’s Information Coordination Center and Joint

Public Information Center. At a recent meeting of the President’s

90

Council on Year 2000, Chairman John Koskinen recognized us as

the early warning beacon. We are the only organization that goes

everywhere, every day, and we’ll be very happy to perform in that

role.

Our plans have focused on Y2K as a business problem. And we

have three very simple goals: To protect our customers by delivering the mail, to protect our employees’ safety and pay; and to

protect our business by collecting the money due and paying what

we owe.

We also have a heightened awareness to security problems. We

have engaged reputable contractors with full security background

checks and clearances, and we are providing instructions to the

field to protect against any viruses. In a forward-looking mode,

we’re also working with the President’s Council on cyber assurance

issues. Protecting our work protects America’s mail.

We believe that the United States Postal Service is ready, and

I look forward to answering your questions.

Mrs. MORELLA. Thank you, Mr. Lorentz.

[The prepared statement of Mr. Lorentz follows:]

91

92

93

94

95

96

Mrs. MORELLA. I won’t ask you about whether those ponies are

ready. But it’s interesting, as I scrutinized the panel, that it was

planned that we picked those five agencies that—I don’t mean to

prioritize as the most important, but have the greatest influence or

effect on our American economy and our Nation: Social Security,

Department of Defense, Department of Energy, Internal Revenue

Service and the Postal Service. And I appreciate your being here.

I think I’ll try to ask each of you maybe one question and then see

if it evolves into others.

First of all, as I mentioned, Mr. Dyer, I commend you on having

started looking to Y2K and what needed to be done back in 1989.

We have recognized your leadership in this regard. And yet what

if the computers fail; what specific plans does Social Security Administration have to ensure that its millions of recipients receive

their Social Security checks? I mean, you are very close to the people.

Mr. DYER. We are, of course, concerned, and we are committed

to delivering those checks. The Supplemental Security Income

checks go out before the end of the year. They’ll be issued on

Thursday. So they’re before we turn over. The regular Title II or

Social Security checks, they go out on Monday. We have worked

very closely with the Federal Reserve, the Department of Treasury

and the Postal Service to assure that we can get the direct deposit

or the checks that go through mail there on time. We’re positioning

the checks and the tapes in advance. We worked through and tested it from beginning to end.

So we’re very confident that the payments are going to go. If,

however, some areas, checks do not reach it, we have fall-back

plans. If it’s with a financial institution with a direct deposit,

where the bank fails to be able to push through the direct deposit,

we would find another bank that could do the direct deposit, and

if not, we would work out how to get a paper check to the individual.

If it’s in terms of the paper checks, we’re very confident because

we’ve worked out contingency plans with the Postal Service, and,

as you know, in hurricanes and other disasters, we’ve always been

able with the Postal Service to be right there onsite and get the

checks to the people.

Mrs. MORELLA. So we can tell the viewers, listeners, our constituents, do not worry, the check is in the mail or you will get the

check.

Mr. DYER. You will get your check, or you will get your direct deposit in your bank.

Mrs. MORELLA. Exactly. And we will be continuing to watch to

make sure that that you can continue that way, and feel confident

that you will.

With regard to, Dr. Langston, the Department of Defense, it really is—you’re really the largest Federal entity in terms of personnel

and Y2K mission-critical systems. I think you have like 37 percent

of all the mission-critical systems are within the Department of Defense. Consequently your mission-critical contingency plans or your

contingency plans for all of your missions have got to be very detailed. I wonder how many personnel that you’re planning to have

ready on December 31st to implement the day 1 plan? And do you

97

have any idea what the cost might be to implement your day 1

plan? Have you estimated?

Mr. LANGSTON. I thought about both of those questions when you

asked them earlier. In terms of our contingency planning personnel

operations, as I mentioned earlier, we are, of course, on duty 24

hours a day, 7 days a week, around the world. That operation is

actually just being augmented by folks that support the year 2000

systems. So in other words, we have compiled detailed lists of technical experts or operational experts that support any of the contingency plans; those names, telephone numbers, all the contact

points have been established. We are establishing augmentation

cells for the year 2000 to support any of our normal watch stations

or command centers, if you will, in major command areas like our

unified commanders, and like our Pentagon command center, and

for the service command centers as well as the Joint Chiefs.

In terms of my—I do not have an actual number for you. My estimate is that we’re operating—we will be operating 5 to 10 percent

more personnel in a duty—nonduty status than we normally operate. In terms of how many—how much money we have spent to

support contingency planning, we, of course, continue to report to

OMB the expenditures for Y2K. Our most recent report, I believe,

specified that we will spend by the time we’re through with this transition phase about $3.6 billion on the year 2000. My estimate,

although I do not have this broken out exactly in the reports, is

that approximately 25 percent of our effort has been toward consequence management, contingency planning or preparation other

than the remediation and testing events that we have conducted.

Mrs. MORELLA. Do you think that money, that you could find

that within your budget?

Mr. LANGSTON. Could we have found that money?

Mrs. MORELLA. Have you thought about finding that money within the budget that’s already been allocated?

Mr. LANGSTON. Well, of that $3.6 billion, all of it was DOD

money with the exception of the $1.1 billion augmentation budget

that we were provided. We have been committed all along to doing

whatever we had to do to find the money to support this. This has

been Dr. Hamre and Secretary Cohen’s No. 1 priority for the Department other than national security.

Mrs. MORELLA. So your financial planning has been done satisfactorily up to this point.

Mr. LANGSTON. Yes, ma’am.

Mrs. MORELLA. All right. I’m interested in how we connect with

Russia and what we are doing to help Russia. I know you’ve got

the command station that you mentioned in Colorado and in the

Denver area. When will that U.S.-Russia strategic command be

ready?

Mr. LANGSTON. It’s actually ready now. And as I mentioned, we

will have Russian people arriving on the 22nd of December and

staying in this operational sense through the 15th. We have been

conducting a series of meetings with Russia, both in Russia and in

the United States. The most recent meeting was on the 18th

through the 21st of October in Russia. And we will continue to

interact with them as much as possible to do everything we can to

prepare for this event.

98

Mrs. MORELLA. Have they been cooperating?

Mr. LANGSTON. Yes, ma’am. They have been very cooperative

with the exception of the period of time through the Kosovo operations when we were, for political reasons, stopped for this activity.

Mrs. MORELLA. Do you have any interface with the other—as

they call them, the NIS, the newly emerging States? That would

be like Georgia, Armenia, Azerbaijan.

Mr. LANGSTON. We have not had extra activity associated with

those folks. We have had a large host nation support interaction

ongoing. We cooperate and work with the State Department on

that, and we have also been working with all of our NATO allies

in support of their preparations for these events. And our local

base commanders, wherever they reside in foreign countries, are

working with those local organizations to ensure the support or

verify as much as possible how much support we will get through

this period of time. That has been part of our host Nation support

activity.

Mrs. MORELLA. You have a tremendous task, and I commend you

and want you to know that we really want to help whenever we

can and stay with it.

With regard to Mr. Gilligan and Energy, I’m curious. This afternoon I’m going to be going to the Nuclear Regulatory Commission

for the swearing in of the new Director. And I’m just wondering

how do you, Department of Energy, coordinate with the Nuclear

Regulatory Commission to ensure that our nuclear power plants

will be ready for the year 2000? I know that it’s not within your

jurisdiction, NRC specifically, but your interconnection?

Mr. GILLIGAN. The Nuclear Regulatory Commission, as you

know, has the regulatory legal authority over the domestic nuclear

power plants, and so they have been issuing guidance, and that

guidance has been implemented within the plants. We have been

monitoring those activities through two means: One, we have a relationship with the North American Electric Reliability Council,

NERC, which has been assigned domestically for electricity and to

coordinate the Y2K activities.

As the nuclear plants are part of our electricity generators, they

are being monitored through the reporting activities, and those activities are then reported to us.

Second, we have established a relationship, we actually have an

ongoing relationship, with the Nuclear Regulatory Commission. We

have participation in their emergency operations facilities, and we

are continuing to track their progress, and we expect that one of

the key partnerships that we will have during the rollover will be

with their command centers, as well as, we will have Nuclear Regulatory Commission participation at our energy sector desk in the

Information Coordination Center.

Mrs. MORELLA. I think you also said in your statement that you

have found that you are all 100 percent compliant?

Mr. GILLIGAN. For our mission-critical and health and safety systems, that’s correct.

Mrs. MORELLA. That’s great. How about your liaison with contractors, would you like to comment on that?

Mr. GILLIGAN. Sure. As you may know, the Department of Energy is structured where we have very heavy reliance on contracVerDate 11-MAY-2000 08:32 Mar 26, 2001 Jkt 066429 PO 00000 Frm 00104 Fmt 6633 Sfmt 6602 E:\HEARINGS\61119.TXT pfrm09 PsN: 61119
99

tors. So of our roughly 120,000 employees, about 110,000 are contractors. And so we have an in-house, if you will, body of contractors, and it has been those contractors that we rely on day in and

day out who have done the vast majority of our Y2K remediation

activities. We have brought in external independent verification

and validation contractors to help oversee the process to ensure

that we were getting objectivity, and that’s worked very well. We

only have isolated incidents where we have brought in new contractors for the purpose of doing Y2K remediation at our sites.

Mrs. MORELLA. So you feel the selection of your validation crew

is adequate for total assurance that the contractors are following

through?

Mr. GILLIGAN. We believe that this was critical to our process,

because of the potential danger of a contractor who does this work

day in and day out potentially missing something, that we require

the external and independent verification and validation. We defined a process for conducting that. We defined a reporting process

that went through line management at each of our sites for each

of our mission-critical and health and safety systems. So this became a very important part of our confidence building through the

line management chain that our remediation activities had been

done properly. And I’m pleased to report that we found very few

discrepancies or items of concern in our independent verification

and validation.

Mrs. MORELLA. I’m glad to hear that.

Mr. Turner’s been very kind to let me continue to ask each of you

a question, then I’ll turn to him.

And, Mr. Cosgrave, you knew—you knew we were coming to you

with regard to what I had posed to the first panel and that letter

that was written to Bill Archer on October 15th that you reported

that the quality of your computer systems’ inventory currently

poses a high risk to the Y2K effort. You addressed it a little bit in

your statement, your oral statement. I just wondered if you would

give us an update of the status to complete the inventory process.

I wonder when it will be completed, why did it take so long. I

mean, were there some glitches here that if could you go back you

would have changed? And how would you adequately plan contingencies in the event of—given the fact that you’re still determining

the systems that you now have, how would you adequately plan

contingencies in the event of a Y2K problem or failure?

Mr. COSGRAVE. Thank you for asking the question. Let me try to

answer the questions. Let me try to hit them all. I need to first explain some background on this.

Tracking inventory in a large enterprise such as the Internal

Revenue Service is a major problem for any large enterprise. It’s

significantly more difficult for us because of the highly decentralized nature of the way the Internal Revenue Service has historically operated and, frankly, because of the level of detail at which

we are now trying to track this data.

Based on my 25 years of working in private industry, I don’t

think the problem is different for anybody else on the panel or anybody else in private industry. It is just made more difficult at the

IRS by the highly decentralized nature of our operations. To give

you an example of how complicated this is, we have recognized this

100

problem as a material weakness in the Internal Revenue Service

dating back to 1984. So it has been recognized as a 15-year-old

problem we still haven’t been able to solve.

Specifically for Y2K purposes we are tracking about 800,000

items in our inventory, 800,000. To give you an example, we would

track every PC, every piece of equipment, every piece of software

that is on that equipment, and for Y2K purposes we have to track

every release version of every piece of software that’s on every computer. So it gets extremely detailed when you’re up to 800,000 individual items.

However, maybe this is a good example of where Y2K has finally

given us the push to solve a long-standing problem. In fact, prior

to starting our Y2K program, we were probably in many cases at

best 50 percent accurate in our inventories. I can report to you

today that based on some of our most recent tests, we’re now over

the 90 percent level. However, there still are issues.

We have a three-step process in place right now to bring this together and make sure it’s in place not only for January 1st, but

also for October 1st, which was a critical date for establishing a

year-end evaluation for the fiscal year for financial purposes. So

we’re working both those problems simultaneously for the financial

records as well as for the Y2K inventory.

We are addressing the problem now with three specific actions.

We’re doing on-the-ground, wall-to-wall inventories in all our computing centers, all our service centers and 11 of our 33 districts.

We, furthermore, are doing independent verification and validation

of those results here at the national office for all our largest computers, our tier 1, tier 2 computers, and doing detailed comparisons

between what’s recorded from the inventory and what we have actually on the floor.

And then third, we have started the independent audit and readiness verification, which is also going out to all our computer centers, all our service centers, and, again, 13 of the 33 districts, different ones this time, to essentially make sure that we, in fact, can

validate, get as close as 100 percent.

What’s different now most importantly is that the CIO is now

100 percent responsible for the inventory. That was not the case

prior to my arrival last July. The inventory responsibility was a decentralized responsibility, and as a result we were not able to adequately get our hands around this. Longer term the solution to this

problem will clearly be automatic tracking, which we’re in the process of implementing so that, in fact, we can automatically record

everything that’s on our network.

Mrs. MORELLA. Could—I know the people who are listening and

watching would like to know could IRS computer problems result

in more citizens being audited?

Mr. COSGRAVE. I’m not sure that that would be a concern. I think

from the perspective of the individual person looking at this testimony, I would think their major concern would be probably around

whether they’re going to get their refund on time. So we’re implementing special processes, much like the ones that Social Security

described, to make sure that refund checks are processed on a

timely basis. Of course, our process for sending out refunds would

start toward the end of January rather than the beginning of JanuVerDate 11-MAY-2000 08:32 Mar 26, 2001 Jkt 066429 PO 00000 Frm 00106 Fmt 6633 Sfmt 6602 E:\HEARINGS\61119.TXT pfrm09 PsN: 61119
101

ary. So we have a little more ample time to make sure that everything is working properly. But we go through exactly the same

processes that SSA described in working with FMS and the Postal

Office to make sure that those checks get distributed. So I think

probably that is the thing that your viewers would be most concerned about.

Mrs. MORELLA. Is there anything that the public should do to

protect themselves against possible IRS computer failure?

Mr. COSGRAVE. What the public needs to do is what the tax preparers would recommend they do every year, and that is keep tax

records at home. I mean, they will need tax records if, in fact, they

are summoned in for an examination, and therefore they need to

keep good, accurate records like they would any other year.

Mrs. MORELLA. Thank you. I’m going to ask unanimous consent

that the letter from IRS sent to Chairman Archer be included in

the record. Without objection, it will be so ordered. Thank you.

[The information referred to follows:]

102

103

104

105

106

Mrs. MORELLA. Now for our Postal Service. At the hearing we

had back in February of this year, Mr. Lorentz, you stated that the

Postal Service’s contingency plan was itself. And you kind of implied that today, too; that is, there is no other organization that

can deliver mail in the event of unforeseen computer failures. And

you say that mail will be delivered. I wonder who can deliver the

mail in the event of unforeseen computer problems? And what are

your main contingency plan risks, and what have you done then to

mitigate your risks?

Mr. LORENTZ. The answer to the first issue is that for our own

computer systems, we have focused on the severe and critical systems. For severe and critical systems, 33 percent of the

functionality has already been tested with the fiscal year turn. We

have experienced no operational failures at all. We’ve had 17 anomalies where the wrong data appeared on a screen or perhaps printed on a piece of paper, but no operational failures whatsoever in

the system so far. And as I mentioned previously, we have tested

our mail processing equipment in many locations under full volume, so we’re very confident that those systems have been mitigated. We are the ultimate contingency.

So how will the mail be delivered? It wasn’t too many years ago

that our sortation and delivery was done manually with little

mechanization. We have not forgotten those tool sets. I think the

major risk that we have that we’ve also addressed in our continuity

plans is loss of major infrastructure capabilities, power, telecommunications, et cetera. We have detailed plans in place to mitigate that. We do that as a normal manner of course. We just did

it in Florida. We just did it in North Carolina. We had to do it in

L.A. We’re used to working with without those capabilities. So we

can do that just like anyone else. If it was a more of a general failure, that would be the highest risk.

Mrs. MORELLA. And you would probably take care of that by

manually making sure the mail is—.

Mr. LORENTZ. Absolutely.

Mrs. MORELLA [continuing]. Delivered. I thank you.

I now would like to turn to the distinguished ranking member,

Mr. Turner, for his turn at any questioning or statements.

Mr. TURNER. Thank you, Madam Chairman.

You know, I’ve often wondered when we go through January 1st

if we go through it with relatively minor disruption, if we want to

look back and wonder if we avoided one of the greatest threats to

our domestic tranquility and threats to national security that we’ve

ever experienced in this country, or whether we’ll look back and

think, well, we dealt with one of the most overstated, overstudied,

overdiscussed problems that cost us literally billions of dollars in

both the public and private sector.

I thought it would be helpful in terms of trying to allow the general public to understand what all of this study, all these contingency plans, all these validation efforts have been about if I could

ask each of you to give us an example of one specific problem that

you did discover, that you did fix, and if you haven’t fixed it, what

would have been the significant consequence of the failure to have

discovered it and fixed it?

107

And I’ll give you a little time to think about that. I have a few

other questions I want to address. I’ll leave that for my last question for each of you, because I think if we could come up with a

good example from each of you, it might help the public understand

what all this effort and expenditure was really all about. You

know, it’s all well and good to hear we’re checking our systems, we

validate, we know there’s not going to be a problem, but I think

it’s also helpful to know what problem was really found and fixed.

One long-term consequence, I think, of the effort that you’ve

made that will have lasting value is in terms of our national security. We all know that we talk a lot about the threat of nuclear

warfare, the threat of chemical warfare, the threat of biological

warfare. But we also know that at the end of this century we also

face the threat of cyber warfare. And I want to address this question to Dr. Langston because I think that it is important for us,

having gone through the effort to address the Y2K problem, that

once we hopefully successfully move through it, that we not take

all of our contingency plans and throw them in the wastebasket.

But recognize that they do perhaps have some long-term benefit in

terms of being prepared for the threat of cyber warfare.

Dr. Langston, if you would, just address the implications of what

you have done in the Department of Defense which would obviously

be directly related to the issue I raised as well as what you might

see as the benefits of the efforts that have been made all across the

public and private sector with regard to preparation for cyber warfare.

Mr. LANGSTON. Thank you sir for that question. We currently operate, as I mentioned, with year 2000 as our highest priority in the

Department short of military operations, and we also operate with

cyber threat as our second highest priority for everything that relates to the movement of information within the Department. We

have in this past year stood up what we call a Joint Task Force

for Computer Network Defense, which has now been moved under

the Unified Commander for CINC Space, signifying the importance

of this operation. In other words, we believe that it is an operational four-star commander’s importance level, level of importance

for supporting and monitoring and preparing for computer network

defense. That’s an indication that our operational forces have realized that these computer networks are critical and integral part of

all our war-fighting operations, and they include, of course, support

operations, logistics, finance, personnel, as well as direct military

mission operations.

So therefore, we plan to continue on through the preparation and

development of cyber warfare defensive measures. We posture and

are working right now on what we call an information assurance

architecture, which is literally a defense in-depth architecture that

will allow us to specify for all of our operational forces and systems

how we want them to use the technologies of today and the technologies that emerge for information assurance.

In addition, we have already put policy in place—I’m talking

about policy signed out by Dr. Hamre, the Deputy Secretary, to install key infrastructure. These are encrypted certificates that will

allow us to understand who it is that is at the end of every computer transaction, both internal to our Department and external to

108

the Department, and to put these in place in the next 3 years. And

in addition, we have taken a step to move toward using the new

smart card technology, which are literally credit cards with a chip

in them, as a part of this security network defense operation to

allow these smart card chips to become hardware stanchions of

these encrypted certificates to represent who we are.

So we take it all very seriously. We believe that the pressure

that has been applied through both the executive branch and the

congressional legislative branch for critical infrastructure protection is vitally important to all of us. And we work very hard with

judicial department and State Department and others to help put

in place these efforts and make them a major part of what we do.

Mr. TURNER. It seems obvious to me that our technological superiority which has caused us to be the world’s greatest military force

perhaps is also our greatest vulnerability.

What about my suggestion that the other agencies of government

and perhaps the private sector are not simply putting all of their

plans in the wastebasket, but remember that there is an ongoing

national security threat to all of us that perhaps those plans would

be useful in preparing for?

Mr. LANGSTON. Thank you for reminding me of that question. I

meant to suggest as we went through our—what I call our chairman’s contingency assessment where we took major systems off

line from our operational forces, in every one of those events, the

unified commanders came back and said to the chairman, this was

a very useful exercise, it was money and energy well spent. It allowed us to update our contingency plans, and it reminded us that

we need to refine and continue to exercise those plans.

We, of course, in the military have always had contingency plans

and always had back-up plans for everything we do. But like any

organization, it’s easy to not exercise them as often as you might

need to given the press of ongoing business. So we plan to continue

to use the contingency plans as an operation. And, in fact, working

with the GAO and recent legislation in the appropriations bill, we

plan to follow on with our year 2000 data base to support the

tracking of these information systems and the evolution of this entire information assurance architecture that I suggested.

Mr. TURNER. Let me ask the question that I posed at the outset,

and starting with Mr. Dyer, could you cite for us one problem that

was discovered that you fixed and share with us the consequence

that may have resulted had you failed to fix it? When we started

out this effort many months, years ago, we all heard there wasn’t

enough computer programmers available to fix all these problems.

Some months ago we asked at one hearing whether or not that was

still the case, and we learned that really wasn’t a real problem. So,

obviously we’ve been able to cope thus far with the available personnel. I still assume that it took many man-hours of computer

programmers to check out these systems, and in the process they

found some things that they fixed. If you would, Mr. Dyer, give us

a good example from your agency of something you found and

fixed.

Mr. DYER. As Madam Chairwoman said, we started back in 1989,

so we’ve had a long time to do it. As we’ve been updating software

over the years, we’ve been continuously doing it. I’ll give you the

109

major problems that would have happened. If the software was not

adjusted, when the software ran, the computers would get the

dates and everything confused; which would have meant that the

calculations for what our beneficiaries would have been paid for the

month would be all wrong and, on top of that, would probably stop

the messages from going through to actually print out the checks

and send the direct deposits.

In terms of very small kinds of things, as we went through telecommunications systems and looked at them, what would have

happened is that certain data that we would have been transmitting over satellites to move various things around the country

would just not have happened.

Mr. TURNER. Dr. Langston, without breaching national security

or revealing anything that might be top secret, could you give us

an example of something that was found and fixed and the consequence of failure to do so?

Mr. LANGSTON. Yes, sir. An indication of how critical this has become for us is that many people in the early days of the year 2000

problem dismissed it as not a very significant or real problem. And

as each of our folks, including our very senior managers and leaders, have gotten involved with it, they have all been very—become

very serious about the importance of it as they’ve discovered what

kinds of examples have come forward.

Let me just give you a couple of examples. In our finance and accounting systems, we have found that we would not have been able

to move money between ourselves and our vendors our through the

financial system, and we would not have been able to make payment to our retirees without fixing those systems.

In our medical equipment systems, we have found many examples of where we would have not been able to support the medical

records or even the medical processes that distributed medical activity to the medical recipients. In a very vivid example, our communications switches, which are commercial switches, but which

we purchase over long periods of time, often don’t keep them up to

date with the latest changes in the commercial switch market. We

found over 120 switches that would have gone down during the

Y2K period of time and literally taken down all of our telephones

within the Department and therefore rendered us virtually without

communications to support anything we’ve done.

And even in the weapons systems area, we have weapons planning systems that support the distribution of plans out to our

weapons platforms, and there were Y2K problems in those systems

that would have created a need for contingency backups.

Mr. TURNER. Thank you. Mr. Gilligan.

Mr. GILLIGAN. As you know, the Department of Energy has a

range of missions, from nuclear missions to academic oriented research. The example that I would like to discuss is at one of our

nuclear waste processing plants at our Savannah River site in

Aiken, SC. We have a series of systems that are interconnected

that provide for processing and treatment of nuclear waste, high

level nuclear waste products, containerizing them and shipping

them. In the course of the analysis and the inventorying of those

systems, we found that many of the embedded processor chips that

were involved with the process control of moving the waste from

110

one station to another, as well as those computers that monitored

the exhaust stacks for possible increased levels of radiation, had

Y2K related problems.

Those were, in many cases, easily fixed. In some cases, they redesigned new special-purpose computers in order to be able to fix the

problems. And so—and those systems then were installed. They

had to be installed during downtimes of the process so they would

not disrupt operations. Now, many would fear that a possible Y2K

failure would result in a nuclear accident.

That is not, in fact, the case. In all of those circumstances, what

would have happened if we had not repaired those systems is that

the processor would have failed, would have triggered automatic

shut-down procedures. But the automatic shut-down procedures,

while they protect against any nuclear release of contamination,

they do cost money because we would have an approximately $3

million a day impact in cost of lost opportunity if, in fact, those systems had not been prepared. That is an example where obviously

there is high visibility because of the nuclear processing. We felt

confident, even though these problems existed, they would not have

caused a health and safety consequence; but they would have had

a fairly significant financial impact if we had not repaired them

prior to January 1st.

Mr. TURNER. Thank you. Mr. Cosgrave.

Mr. COSGRAVE. Mr. Turner, if I may, I would like to give you

three quick examples, all stemming, frankly, from the neglect that

allowed us to have an antiquated infrastructure that hadn’t been

addressed in a long time.

The first example, probably the most important, is we have replaced the entire submissions and remittent processing system that

operates in our service centers for processing the tax returns when

they come in. The system was, in many cases, 15- and 20-year-old

hardware that, frankly, we couldn’t even get replacement parts

that were Y2K compliant to meet the needs. So we had no choice

but to replace that entire system with modern technology. So we

literally would not have been able to process tax returns.

The second example is with respect to security. We have been

running a fairly old security environment that was decentralized

like many things at the IRS, and it was very clear that we needed

to bring that up to speed and up to date. So we have made a major

improvement in our security environment as a result of the Y2K

effort.

The third example, and probably the most dramatic to people listening in, is that when our revenue agents went out and visited

taxpayers, they were often embarrassed because they were carrying

with them either a PC that was of 286- or 386-type vintage. If you

don’t follow the Intel market, they were issued back in the early

1980’s. Quite honestly, that is not adequate given what they are

facing when they deal with the taxpayers today who quite often

have much more sophisticated technology. So we have replaced all

of those PCs with modern Pentium computers and now at least are

on an even par with the taxpayers.

Mr. TURNER. Thank you. Dr. Lorentz.

Mr. LORENTZ. I guess I would answer the question two ways. The

two specific examples I would give are: First of all, we identified

111

an accounts payable problem, one that if it hadn’t been identified,

if the process hadn’t pointed it out to us, would have resulted in

late or no payments at all going to some of our suppliers.

The second example is our air dispatch system. In that case, we

have an automated system that literally takes the mail once it has

been sorted and prepared and dispatches it to aircraft. A substantial portion of the mail is airborne now. So it would have given us

an inability to do that in a mechanized way.

Those were two significant areas that were very constructive.

The second answer to the question is that this has caused us to put

process discipline in our business and we now have business owners of these issues, not just technology owners. So we literally

have—we are going to leverage this in how we look at security.

Security is not a chief technology officer issue. It is a business

issue. To give you an example in a more pedestrian way, we had

the best close of our financial books that we have had in recent

memory because we had significant configuration management in

place. So the discipline that has been caused by going through Y2K

preparation, as well as the retirement of unneeded systems, has

given us a positive outcome.

Mr. TURNER. Thank you. I must say that listening to all of you,

the direct and secondary benefits of the efforts seem to be very apparent. Thank you, Mr. Chairman.

Mrs. MORELLA. Thank you, Mr. Turner. Following up on the

questions that you asked, I thought that was excellent, did any of

you have any trouble with 9–9–99? Can we just very quickly, did

you have any trouble?

Mr. LANGSTON. No, ma’am; but I would point out that in our

testing efforts, we have found as many problems in the leap year

rollover period which will occur the end of February as we have in

the Y2K period, the rollover date.

Mrs. MORELLA. So you are preparing for that. I think that we all

should—. Mr. LANGSTON. That is why our transition period includes that.

Mrs. MORELLA. Mr. Gilligan.

Mr. GILLIGAN. We had no problems on the 9th of September. We

did, in fact though, have one system at the beginning of our fiscal

year of October 1st that experienced a failure. This was a failure

of a subportion of our procurement data tracking system. It was

fixed within about a half hour, and the transactions were rerun

and the permanent fix was done within about 24 hours. But it did

give us clear indication that we need to have processes in place to

be able to respond.

Mrs. MORELLA. OK. Mr. Cosgrave.

Mr. COSGRAVE. Our experience was very similar to what the Department of Defense is experiencing. I would reiterate the leapyear problem because we are focused on that as part of our testing

as well.

Mr. LORENTZ. Not to our knowledge we didn’t have any 9–9–99

problems. We did have a couple of cases where we printed the

wrong dates, but it didn’t do anything to the internal code.

Mrs. MORELLA. Several of you have already commented on the

information computer security problem. Not only is it enormous

with DOD, but obviously very important with all of you. I just wonVerDate 11-MAY-2000 08:32 Mar 26, 2001 Jkt 066429 PO 00000 Frm 00117 Fmt 6633 Sfmt 6602 E:\HEARINGS\61119.TXT pfrm09 PsN: 61119
112

dered if you are taking precautions. Now, I heard what you said

that is being done, Dr. Lorentz. You talked a little bit about it, Mr.

Cosgrave. I wondered if the others might want to comment. Are

you taking any precautions for this day 1 plan in terms of the information technology security?

Mr. DYER. We are quite concerned about security. We are going

to be doing extra monitoring of all of our systems. We have a special team in place to concentrate totally on all of the security

issues.

Mrs. MORELLA. Mr. Gilligan.

Mr. GILLIGAN. We have an organization called the Computer Incident Advisory Capability that is co-located at Lawrence Livermore Laboratory. They are our cyber-security investigation and response cell. They will be active as will their points of contact at all

of our sites. We have established reporting procedures. They will

be part of our emergency operations center contingent active

through this rollover period.

Mr. LORENTZ. We have put in place all of the industry standard

firewalls and virus protection on our case-hardened side. We have

given specific special instructions to the field on what to look for

in the intervention of viruses. The additional area that we are looking at both as far as the day 1 as well as the future, is more ecommerce exposure.

We have, so far, issued 150,000 digital certificates for the online

stamp capability. We see potential exposure certainly in e-commerce along with everybody else. We are especially monitoring

those aspects of the business. We are also participating in the

cyber assurance effort as part of the Y2K council in partnership

with other agencies.

Mrs. MORELLA. Thank you. I think you have all done a great job

of sharing the experiences looking back, looking ahead, but more

needs to be done of your agencies. I want to announce that—do you

have any other questions or comments?

Mr. TURNER. No.

Mrs. MORELLA. It has been an excellent hearing. Please note that

all of the members of the subcommittee again will get the full testimony. We would like your permission to be able to submit any further questioning to you from ourselves and other members of the

subcommittee.

I am going to ask unanimous consent that Chairman Horn’s

opening statement be included in the record. If no objection, it will

be so ordered.

[The prepared statement of Hon. Stephen Horn follows:]

113

114

115

Mrs. MORELLA. The next hearing of the House Y2K working

group is going to be held next Thursday, November 4. It will be at

2 o’clock in the afternoon, room 2318 of this building. The hearing

is going to be entitled ‘‘Y2K Myths and Realties; What Every American Needs to Know in the Remaining 50 days.’’ it is now count

down 63 today, but it will be 50 at that time. The hearing is designated to be the culmination of our over 31⁄2 years and over 100

congressional hearings on the Y2K computer glitch.

I just want to thank the following people who have been involved

in some way in putting this hearing together: The majority staff of

the Government Reform Committee: J. Russell George, staff director and chief counsel; Matt Ryan, senior policy advisor; Bonnie

Heald, the communications director and professional staff member;

Chip Ahlswede, clerk; Rob Singer staff assistant; P.J. Caceres, an

intern; Deborah Oppenheim, an intern; the Technology Subcommittee: Jeff Grove, staff director; Ben Wu, professional staff

member; Joe Sullivan, staff assistant; minority staff of Government

Reform: Trey Henderson, minority counsel; Jean Gosa, staff assistant; of the Technology Subcommittee minority staff: Michael

Quear, professional staff assistant; Marty Ralston, staff assistant;

the court reporters: Cindy Sebo and Randy Sandefer who has come

on the scene here, too.

And so I thank all of them. I want to thank Congressman Turner

for being with us for the entire hearing. I want very much to thank

both of our panels. We appreciate it very much. Thank you very

much.

The subcommittee is now adjourned.

[Whereupon, at 12:12 p.m., the subcommittee was adjourned.]

Æ