# Recent Reports

Reports News from the GAO

- Freedom of Information Act: Additional Guidance and Reliable Data Can Help Address Agency Backlogs What GAO FoundFederal agencies are generally required to process Freedom of Information Act (FOIA) requests within 20 working days. However, the government-wide request backlog has risen over the last decade (see figure), demonstrating that agencies face persistent challenges processing requests within required time frames.Year-End FOIA Request Backlogs Government-wide, Fiscal Years 2013–2022In annual reports, agency Chief FOIA Officers have cited key factors contributing to increases in their backlogs. Factors include the increasing complexity of FOIA requests, staffing challenges, and increasing litigation. Agencies also reported on actions taken to address their backlogs. For example, agencies reported using data to actively monitor the status of requests and inform actions to close them.The Department of Justice's (DOJ) Office of Information Policy (OIP) helps agencies administer FOIA, but additional guidance and other resources could better support agency efforts to address backlogs.OIP directs agencies with significant backlogs to create backlog reduction plans. However, OIP does not specify what agencies should include in these plans so most have not included key elements. Of the 14 agencies directed to develop 2023 plans, two included goals and none included timelines for implementing actions. By providing such guidance, OIP could ensure agencies specify goals, milestones, and metrics to track progress.	OIP instructs agencies to calculate the average time it takes the agency overall to process requests. However, since 2013, many agencies have reported inaccurate times in one or more years. Improvements to OIP's data checks and training could help improve the accuracy of these data.In focus groups with GAO, agency officials and nongovernmental stakeholders suggested various changes to FOIA, such as expanding the records agencies must release without a request, to help agencies address backlogs. However, there was generally little consensus on specific changes they would recommend.Why GAO Did This StudyFOIA requires federal agencies to provide the public with access to government information. FOIA request backlogs hinder government transparency and prevent individuals' timely access to information.GAO was asked to review government-wide issues related to agency FOIA request backlogs. This report (1) describes factors federal agencies identified as causes of backlog increases, (2) describes methods agencies reported using to address backlogs, (3) assesses relevant government-wide guidance and resources, and (4) describes the perspectives of agency officials and nongovernmental stakeholders on proposed FOIA changes to help agencies address backlogs.To address these objectives, GAO analyzed Chief FOIA Officer reports published between 2019 and 2023 by all agencies receiving 50 or more FOIA requests each year. GAO also conducted four focus groups with FOIA officials from major federal agencies and one with nongovernmental stakeholders from academia, media, and the FOIA requester community. GAO analyzed data from FOIA.gov, reviewed government-wide FOIA guidance and resources, and interviewed agency officials.
- Science & Tech Spotlight: Combating Deepfakes Why This MattersMalicious use of deepfakes could erode trust in elections, spread disinformation, undermine national security, and empower harassers.Key TakeawaysCurrent deepfake detection technologies have limited effectiveness in real-world scenarios.	Watermarking and other authentication technologies may slow the spread of disinformation but present challenges.	Identifying deepfakes is not by itself sufficient to prevent abuses. It may not stop the spread of disinformation, even after the media is identified as a deepfake.The TechnologyWhat is it?Deepfakes are videos, audio, or images that have been manipulated using artificial intelligence (AI), often to create, replace, or alter faces or synthesize speech. They can seem authentic to the human eye and ear. They have been maliciously used, for example, to try to influence elections and to create non-consensual pornography. To combat such abuses, technologies can be used to detect deepfakes or enable authentication of genuine media.Detection technologies&nbsp;aim to identify fake media without needing to compare it to the original, unaltered media. These technologies typically use a form of AI known as machine learning. The models are trained on data from known real and fake media. Methods include looking for (1) facial or vocal inconsistencies, (2) evidence of the deepfake generation process, or (3) color abnormalities.Authentication technologies&nbsp;are designed to be embeddedduring the creation of a piece of media. These technologies aim to either prove authenticity or prove that a specific original piece of media has been altered. They include:Digital watermarks&nbsp;can be embedded in a piece of media, which can help detect subsequent deepfakes. One form of watermarking adds pixel or audio patterns that are detectable by a computer but are imperceptible to humans.The patterns disappear in any areas that are modified, enabling the owner to prove that the media is an altered version of the original. Another form of watermarking adds features that cause any deepfake made using the media to look or sound unrealistic.	Metadata—which describe the characteristics of data in a piece of media—can be embedded in a way that is cryptographically secure. Missing or incomplete metadata may indicate that a piece of media has been altered.	Blockchain.&nbsp;Uploading media and metadata to a public blockchain creates a relatively secure version that cannot be altered without the change being obvious to other users. Anyone could then compare a file and its metadata to the blockchain version to prove or disprove authenticity.Figure 1. Examples of Deepfake Detection and AuthenticationHow mature is it?Detection technologies.&nbsp;According to recent studies, existing detection methods and models may not accurately identify deepfakes in real-world scenarios. For example, accuracy may be reduced if lighting conditions, facial expressions, or video or audio quality are different from the data used to train the detection model, or if the deepfake was created using a different method than that used in the training data. Further, future advances in deepfake generation are expected to eliminate hallmarks of current deepfakes, such as abnormal eye blinking.Authentication technologies.&nbsp;These technologies are not new, but their use in combating deepfakes is an emerging area. Several companies offer authentication services, including using digital watermarks, metadata, and blockchain technologies. Some claim to let website visitors authenticate media found on the internet, provided the original is in the company’s database. Prominent social media companies are also beginning to label AI-generated content.OpportunitiesCombined defenses.&nbsp;Using multiple detection and authentication methods may help to identify deepfakes.	Updated training datasets.&nbsp;Including diverse and recent media in training data could help detection models keep up with the latest deepfake generation techniques.	Competitions.&nbsp;Deepfake detection competitions could encourage the development of more accurate detection tools and models. One 2019 competition included over 2,000 participants and generated over 35,000 models.ChallengesDisinformation and public trust.&nbsp;Disinformation can spread from the moment a deepfake is viewed, even if it is identified as fraudulent. Further, trust in real media may be undermined by false claims that real media is a deepfake or if people do not trust a detection model’s results.	Adaptation to detection.&nbsp;Techniques and models used to identify deepfakes tend to lead developers to create more sophisticated deepfake generation techniques.Policy Context and QuestionsAre current laws and regulations adequate to address evolving concerns about the malicious use of deepfakes? How do they address data security, privacy concerns, and First Amendment considerations, such as a deepfake creator’s freedom of speech and expression?	What entities (e.g., government, nonprofit, private company) should make decisions about identifying and blocking deepfakes, or about when and how to sanction those who produce or disseminate them?	How can organizations across society coordinate on the development and improvement of deepfake detection and authentication technologies? What standards could be used or developed to evaluate these technologies?Selected GAO WorkScience &amp; Tech Spotlight: Deepfakes,&nbsp;GAO-20-379SPTechnology Assessment: Blockchain,&nbsp;GAO-22-104625Selected ReferencesGourav Gupta, Kiran Raja, Manish Gupta, Tony Jan, Scott Thompson Whiteside, and Mukesh Prasad, “A Comprehensive Review of DeepFake Detection Using Advanced Machine Learning and Fusion Methods,”Electronics, vol. 13, no. 95 (2024) https://doi.org/10.3390/electronics13010095.National Security Agency, Federal Bureau of Investigation, and Cybersecurity and Infrastructure Security Agency,Contextualizing Deepfake Threats to Organizations, Sept. 2023.For more information, contact Brian Bothwell at (202) 512-6888 or bothwellb@gao.gov.
- International Military Students: DOD and State Should Assess Vetting Implementation and Strengthen Information Sharing What GAO FoundStarting in fiscal year 2020, DOD developed and phased in procedures to vet international military students attending training at Department of Defense (DOD) installations and facilities in the U.S. With few exceptions, DOD vets these students prior to travel to the U.S. for training and periodically during the students' stay. According to training management system data, from October 1, 2019, through March 31, 2023, DOD vetted over 29,000 cases, including students and any accompanying family members. DOD identified findings in 103 cases: four were classified as “high” risk, 18 were “moderate”, and 81 were “low.” DOD denied access to nine students for various security-related reasons.International Military Student Cases by Risk Level and Adjudication Result for October 1, 2019, through March 31, 2023			Risk level									Cases									Approved for training									Denied									Pending									Adjudication not performeda								High risk									4									0									4									0									0								Moderate risk									18									7									3									4									4								Low risk									81									47									2									14									18								No findings									29,202									29,202									0									0									0								Total									29,305									29,256									9									18									22					Source: GAO analysis of data from the Defense Security Cooperation Agency. | GAO-24-106421Note: Vetting of international military students began with basic screening in December 2019 and DOD continued to phase in initial security vetting through March 2022.aDepartment of Defense (DOD) officials stated they did not adjudicate 22 of the moderate and low risk cases for reasons such as training cancellation or the student completed training during the establishment of vetting procedures and has since departed the U.S.DOD has taken some steps to improve implementation of vetting procedures for international military students. However, DOD has not assessed implementation to identify opportunities for improvement. For example, stakeholders told GAO of factors in vetting implementation that could be improved, such as limitations with in-country data collection and a time-consuming process for sharing information between stakeholders. DOD circulated a draft progress report on program metrics, such as the number of students who underwent vetting for fiscal year 2022. However, DOD has not finalized the report, and it is unclear if it will include an assessment of any opportunities for improvement in the vetting procedures. Without an assessment, DOD will not have a full understanding of factors that hinder vetting implementation. DOD also cannot determine whether or how it should take action to improve vetting implementation.The Department of State and DOD share information to support international military student vetting in a variety of ways, such as sharing database access and confirming vetting. However, State and DOD have not ensured that roles and responsibilities are fully clarified in guidance or written agreements. If DOD and State take actions to clarify roles and responsibilities for sharing information on issues related to international military students, the agencies can better coordinate on program management, including communicating relevant policy updates and sharing additional data and analysis regarding vetting.Why GAO Did This StudyDOD provides education and training to foreign military personnel at DOD sites. On December 6, 2019, an international military student killed three U.S. service members and injured eight others while attending training at Naval Air Station Pensacola, Florida. The attack raised questions about personnel safety at DOD sites hosting students for training.The William M. (Mac) Thornberry National Defense Authorization Act for Fiscal Year 2021 includes a provision for GAO to review DOD's implementation of security vetting for international military students and accompanying family members. GAO's report assesses the extent to which (1) DOD has developed vetting procedures for international military students and addressed any implementation challenges; and (2) State and DOD have shared information related to students' training at DOD sites in the U.S.GAO reviewed documentation; analyzed vetting result data for October 1, 2019, through March 31, 2023; and interviewed DOD and State officials and stakeholders from six unified combatant commands and three U.S. embassies.
- Countering Violent Extremism: FBI and DHS Need Strategies and Goals for Sharing Threat Information with Social Media and Gaming Companies What GAO FoundDomestic violent extremists use social media and gaming platforms for several purposes, including to reach wide audiences; to insert their extremist ideas into the mainstream; and to radicalize, recruit, and mobilize others, according to government reports and experts GAO spoke with (see figure). Experts noted that violent extremists generally use a variety of platforms for different purposes, depending on available features, audiences, and content moderation practices.Example of the Viral Nature of Domestic Violent Extremists' Use of Online PlatformsAccording to social media and gaming companies GAO met with, they use various content moderation tools to identify and remove content they determine violates their platforms' policies related to domestic violent extremism on their platforms. For example, they report using machine learning tools to scan for content that violates their policies, as well as reviews by employees. However, companies and experts reported that several factors affect these moderation efforts, such as company financial considerations and diversity in standards of acceptable content. For example, content banned on one platform could be allowed on another.The Federal Bureau of Investigation (FBI) and Department of Homeland Security (DHS) have mechanisms to share and receive domestic violent extremism threat-related information with social media and gaming companies. However, neither agency has developed a strategy that articulates how it identifies and selects companies to engage with or the goals and desired outcomes of those engagements. Without a strategy or goals, the agencies may not be fully aware of how effective their communications are with companies, or how effectively their information-sharing mechanisms serve the agencies' overall missions.Why GAO Did This StudyIn recent years, content on social media and gaming platforms that promotes domestic violent extremism has influenced several high-profile attacks, according to experts and agency officials. As a result, some social media and gaming companies, as well as federal agencies, are making an effort to understand and address online content that promotes domestic violent extremism.GAO was asked to review domestic violent extremists' use of social media and gaming platforms. This report (1) describes the purposes for which domestic violent extremists use these platforms; (2) describes how selected companies report mitigating content promoting domestic violent extremism; and (3) assesses the extent to which the FBI and DHS have developed goals and strategies for sharing threat-related information with companies.GAO reviewed FBI and DHS documentation and interviewed officials. GAO obtained views from 16 subject matter experts identified by the National Academies of Sciences and prior work. GAO also interviewed representatives from a non-generalizable sample of five social media and gaming companies.
- 401(k) Plans: Additional Federal Actions Would Help Participants Track and Consolidate Their Retirement Savings What GAO FoundThe CARES Act temporarily expanded access to 401(k) retirement savings for plan participants who were impacted by the COVID-19 pandemic. GAO surveyed 14 selected companies that manage participant account data and transactions for 401(k) plans. GAO found that less than one-third of the plans covered by the surveyed companies offered the CARES Act options. Industry stakeholders GAO interviewed said larger plans and plans in industries subject to furloughs at the beginning of the pandemic, such as airlines and hospitality, were more likely to offer the CARES Act options to participants. The CARES Act options generally allowed participants to access their 401(k) plan savings in two ways in 2020:Participants younger than 591⁄2 could withdraw up to $100,000 from their plan savings without facing an additional 10 percent tax for early withdrawals; they could also choose to repay the amount within 3 years.	Between March 27 and September 22, participants could borrow up to $100,000 from their savings as a loan and delay some payments a year.The 401(k) plans covered by the 14 companies GAO surveyed represented about 64 percent of all active 401(k) participants. Of those represented participants, GAO found that about 80 percent of them had access to the CARES Act options through their plan. Of these participants with access, 6 percent took a Coronavirus-Related Distribution and less than 1 percent took a CARES Act loan. Based on GAO's survey, the amounts of withdrawals and loans were higher during the pandemic in 2020 as compared with 2019 (see table). Industry stakeholders pointed out that workers with the greatest need for emergency funds during the pandemic in 2020—such as lower and middle-income workers—likely did not have a 401(k) plan and, thus, could not take advantage of the CARES Act options.Comparison of Average and Median Hardship Withdrawals and Plan Loans in 2019 with CARES Act Options in 2020			&nbsp;									2019 Hardship Withdrawals									2020 Coronavirus-Related Distributions									2019 Plan Loans									2020 CARES Act Loans								Average Amount									$6,913									$18,344									$9,564									$33,793								Median Amount									$3,144									$9,000									$5,097									$11,998					Source: GAO survey of 14 selected 401(k) plan record keepers. | GAO-24-103577GAO also examined how six selected countries—Australia, Belgium, Denmark, the Netherlands, Norway, and Sweden—help retirement plan participants manage their savings. GAO found that all six countries use pension dashboards and other approaches to help plan participants track, manage, and consolidate their plan savings and reduce fees. For example, all six countries established a centralized pension dashboard that allows participants to view their retirement savings securely online and at no charge. According to experts from the countries, the dashboards help participants keep track of their various workplace retirement accounts as they change jobs.Pension Dashboards Allow Participants to Track Their Plan Savings in One Place To increase the likelihood that participants' savings will be consolidated after a job change, three of the six selected countries allow automatic savings transfers, according to experts GAO interviewed. For example, Australia, Norway, and the Netherlands allow a participant's inactive retirement plan savings from older workplace plans, to be transferred to the participant's current, active plan without the participant's consent. In Australia, plan providers must transfer savings from small inactive accounts to a government agency. The agency then holds the savings until the participant claims them, the agency transfers them to an active account, or the participant is eligible to receive the savings. Australian officials said close to 4.7 million accounts valued at $7.11 billion AUD (about $4.61 billion USD) have been reunited with participants between late 2019 and the end of 2022, helping them consolidate savings into their active accounts.In the U.S., 401(k) participants face challenges tracking and consolidating their accounts. However, federal action could mitigate these challenges. Federal data show that more than 92 million Americans participate in and have saved more than $7 trillion in 401(k) plans. Yet, GAO's nationally-representative survey of 401(k) participants found that participants continue to encounter challenges in managing and tracking their accounts as they move from one job to another. According to GAO's survey, two-thirds of 401(k) participants would find a comprehensive pension dashboard, where they can see all of their current and old plan savings in one place, to be a useful resource. However, no federal agency has statutory authority to establish a pension dashboard.GAO's survey also found that 401(k) participants who recently completed a plan-to-plan rollover faced challenges understanding and complying with their plans' requirements. For example, 25 percent of participants indicated that there were too many steps to follow in the process and 22 percent said they were unclear about questions or information in the rollover form. Allowing plans to automatically roll over participants' savings to their new plan after they change jobs can be beneficial for participants—particularly those unengaged with their plan—because they can benefit from account consolidation without navigating a challenging manual process. However, no federal agency has the statutory authority to establish a system to facilitate automatic plan-to-plan rollovers.Why GAO Did This StudyInvesting in employer-sponsored 401(k) plans has become the most common way for American workers to save for retirement. But plan participants can face challenges when they change jobs and with tracking their accounts. 401(k) savings can sometimes be accessed in emergencies. The CARES Act created additional options for participants to temporarily access their plan savings.GAO was asked to review access to 401(k) plan savings during the pandemic in 2020 and challenges participants have rolling over their retirement savings from one plan to another, both abroad and in the U.S. This report examines: (1) access to and use of the CARES Act 401(k) plan options; (2) approaches other countries use to help workers track, manage, and consolidate their plan savings; and (3) challenges with 401(k) plan-to-plan rollovers and federal actions that can improve the process.GAO's review included a non-representative survey of 401(k) companies and interviews with stakeholders representing different roles in the retirement industry about the CARES Act access options; interviews with experts from six selected countries that have: (1) a pension dashboard, (2) portable workplace retirement savings, and (3) other approaches to help workers track and consolidate their retirement savings; and a nationally-representative survey of 401(k) participants about their recent experience with plan-to-plan rollovers.
- Artificial Intelligence: GAO's Work to Leverage Technology and Ensure Responsible Use What GAO FoundGAO is exploring internal use of artificial intelligence (AI) to make its work for Congress and taxpayers more efficient, in-depth, and effective. For example, GAO recently began deployment of a large language model to explore generative AI capabilities similar to those found in industry, supplemented with GAO-specific information and security. Among other capabilities, this prototype will also support other use cases to help efficiently synthesize past reports, assist with editorial review, and scan congressional documents for mandated work for GAO. By developing these tools, GAO is also gaining insight into the benefits and risks of AI, which will help GAO evaluate other agencies' use and better provide technical assistance to Congress. See the table for details on eight AI use cases GAO is currently exploring.List of Artificial Intelligence Use Cases GAO Is Exploring as of January 2024			Use case									Potential benefits								Organizes large volumes of text, such as public comments from Regulations.gov&nbsp;									Groups contents by similar themes			Prioritizes reviews based on relevant hierarchical topics								Summarizes draft GAO legislative mandates&nbsp;&nbsp;									Increases efficiency and reduces manual processes&nbsp;&nbsp;&nbsp;			Highlights potentially fragmented and duplicative mandates&nbsp;&nbsp;								Assists with copyediting according to GAO's style guide&nbsp;									Automates select copyediting tasks&nbsp;			Enables staff to focus on narrative structure and clarity&nbsp;								Provides automated responses to chat questions on published GAO work&nbsp;									Summarizes published GAO contents to enhance knowledge management and increase efficiency &nbsp;			Enhances specificity and accuracy of results&nbsp;								Summarizes qualitative responses from annual GAO Employee Experience Survey&nbsp;									Identifies trends, patterns, and sentiments quickly			Improves survey interpretation with less manual intervention			Assists with root-cause analyses								Monitors information about congressional committee calendars, press releases, and web contents&nbsp;&nbsp;									Matches congressional interests with relevant GAO work&nbsp;&nbsp;			Enhances timeliness of outreach and technical assistance&nbsp;&nbsp;								Enhances GAO auditing through use of extended reality glasses&nbsp;&nbsp;									Improves data collection and collaboration across locations&nbsp;			Reduces costs and risks&nbsp;			Enables new data capturing and analysis opportunities&nbsp;&nbsp;								Triages IT help desk requests and answers internal GAO policy questions									Provides 24/7 self-service assistance to GAO employees			Allows support staff to focus on more complex requests					Source: GAO. | GAO-24-107237Note: For the full list of use cases, updated periodically, see www.gao.gov/science-technology/artificial-intelligence-use-cases.AI also remains a top priority for many congressional committees and offices. GAO therefore has a robust body of work to meet Congress's need for information on AI's promise and risks. Since 2018, GAO has issued nearly 50 products on AI. It currently has 20 ongoing projects on AI with many more planned, including two technology assessments and one performance audit on generative AI. For example, in a landmark December 2023 report, GAO reviewed the implementation of AI at major federal agencies and made 35 recommendations to 19 agencies to fully implement federal AI requirements. In addition, in 2021, GAO published  Artificial Intelligence: An Accountability Framework for Federal Agencies and Other Entities  , identifying 31 key practices to help ensure accountability and responsible use of AI. GAO's AI use cases are built upon this framework. The following is a selection of GAO AI-related products:Cybersecurity and Privacy Facial Recognition Services: Federal Law Enforcement Agencies Should Take Actions to Implement Training, and Policies for Civil Liberties.  GAO-23-105607. September 5, 2023.Facial Recognition: CBP and TSA are Taking Steps to Implement Programs, but CBP Should Address Privacy and System Performance Issues.  GAO-20-568. September 2, 2020.Facial Recognition Technology: Privacy and Accuracy Issues Related to Commercial Uses.  GAO-20-522. July 13, 2020.AI Opportunities and Challenges Artificial Intelligence in Natural Hazard Modeling: Severe Storms, Hurricanes, Floods, and Wildfires.  GAO-24-106213. December 14, 2023.Generative AI  (Science &amp; Tech Spotlight). GAO-23-106782. June 13, 2023.Digital Twins: Virtual Models of People and Objects.  (Science &amp; Tech Spotlight). GAO-23-106453. February 14, 2023.Federal Research and Management Artificial Intelligence: Agencies Have Begun Implementation but Need to Complete Key Requirements.  GAO-24-105980. December 12, 2023.Artificial Intelligence: DOD Needs Department-Wide Guidance to Inform Acquisitions.  GAO-23-105850. June 29, 2023.Artificial Intelligence: DOD Should Improve Strategies, Inventory Process, and Collaboration Guidance.  GAO-22-105834. March 30, 2022.Federal Workforce Artificial Intelligence: Actions Needed to Improve DOD's Workforce Management  GAO-24-105645. December 14, 2023.FAA Workforce: Better Assessing Employees' Skill Gaps Could Help FAA Prepare for Changes in Technology.  GAO-21-310. May 13, 2021.Automated Technologies: DOT Should Take Steps to Ensure Its Workforce Has Skills Needed to Oversee Safety.  GAO-21-197. December 18, 2020.Defense and Law Enforcement Information Environment: Opportunities and Threats to DOD's National Security Mission.  GAO-22-104714. September 21, 2022.Artificial Intelligence: Status of Developing and Acquiring Capabilities for Weapon Systems.  GAO-22-104765. February 17, 2022.Forensic Technology: Algorithms Strengthen Forensic Analysis, but Several Factors Can Affect Outcomes  . GAO-21-435SP. July 06, 2021.Why GAO Did This StudyAI, in general, refers to computer systems that can solve problems and perform tasks that have traditionally required human intelligence. Many federal agencies are using or planning to use AI, through applications such as facial recognition, automated email responses, and enhanced user experience on websites. At the same time, AI capabilities continue to expand in areas such as medical diagnostics, image generation, and emulating human writing styles.This testimony describes how GAO (1) plans to use AI internally to enhance effectiveness and efficiency across its mission and operations and (2) supports Congress through oversight of federal use of AI and foresight on its wider implementation.GAO performed the work on which this testimony is based in accordance with all applicable sections of GAO's Quality Assurance Framework.For more information, contact Taka Ariga at (202) 512-6888 or ArigaT@gao.gov.
- Grants Management: Action Needed to Ensure Consistency and Usefulness of New Data Standards What GAO FoundThe Office of Management and Budget (OMB) and the Department of Health and Human Services (HHS) have partially met one of three elapsed deadlines in the Grant Reporting Efficiency and Agreements Transparency Act of 2019 (GREAT Act) related to data standards. OMB and HHS partially met the deadline to establish government-wide data standards by identifying and defining 540 grant data elements in June 2021. This deadline is partially met because 501 of these elements are not fully operationalizable data standards since they do not include important technical specifications that describe their format and structure.Figure: Extent to Which OMB and HHS Met Select Statutory Requirements in the Grants Reporting Efficiency and Agreements Transparency Act of 2019 as of December 2023aFulfillment of this requirement shall occur not later than the earlier of one year after enactment or after data standards establishment. Pub. L. No. 116-103, § 7(c), 133 Stat. 3266, 3271 (2019).Also, these data elements were fully consistent with five of eight statutory requirements but partially consistent with the other three. For example, 501 of the 540 data elements were not machine-readable. OMB and HHS acknowledged the need to develop technical specifications to achieve machine-readability.GAO also found that some of these data elements did not reflect five of 13 leading practices for formulating data definitions. GAO reviewed 50 of the 540 data elements—randomly selected from a subset of the elements identified by experts—and found that 20 of the 50 sampled elements did not meet at least one of the 13 leading practices. For example, the definitions of several data elements were ambiguous. Unclear definitions can lead to inconsistent application and result in data that are not comparable.Although OMB and HHS conducted stakeholder consultation early in the development of the grant data elements, GAO found that they did not have a plan for such engagement moving forward nor a process to ensure regular, timely communication with Congress regarding GREAT Act implementation. Many grant stakeholders informed GAO that OMB and HHS had not consulted them, and congressional staff said that OMB and HHS had not consistently communicated with them. Effective consultation with stakeholders can improve the development and implementation of data standards. Timely communication with Congress can help ensure it has the key facts needed for oversight of the GREAT Act and to address issues involving grant stakeholders and agencies.Why GAO Did This StudyIn 2022, federal aid to tribal, state, local, and territorial governments—primarily through grants—totaled roughly $1.2 trillion. Tracking federal grants spending can be difficult because data are sometimes not consistent government-wide. The GREAT Act seeks to strengthen management and oversight of federal grants through the establishment of governmentwide data standards.GAO was asked to evaluate progress in creating grant reporting data standards as required by the GREAT Act. This report, part of a series reviewing federal grant management, examines (1) the steps OMB and HHS have taken to implement the GREAT Act and meet the act's deadlines, (2) the extent to which grant data elements developed by OMB and HHS met the act's requirements and followed leading practices, and (3) the extent to which OMB and HHS have consulted grant stakeholders.GAO reviewed implementation documents and guidance; assessed the grant data elements against statutory requirements; assessed a sample of data elements against leading practices; and interviewed OMB staff, HHS officials, and grant stakeholders, among others.
- Foreign Investments in U.S. Agricultural Land: Enhancing Efforts to Collect, Track, and Share Key Information Could Better Identify National Security Risks What GAO FoundThe United States Department of Agriculture (USDA) does not share timely data on foreign investments in agricultural land collected under the Agricultural Foreign Investment Disclosure Act of 1978, as amended (AFIDA). Committee on Foreign Investment in the United States (CFIUS) agencies, including the Department of Defense (DOD) and the Department of the Treasury, identify and review transactions that may pose national security risks, such as the proximity of agricultural land to a sensitive military base. USDA annually publishes selected AFIDA information online that CFIUS agencies may use when considering potential national security risks associated with agricultural land. In addition, USDA officials said they respond promptly when they receive requests for information. However, DOD officials noted they need AFIDA information that is more up-to-date and more specific, and they need to receive this information more than once a year. USDA has requested funding to develop a real-time data system that can be accessed by other U.S. government agencies and the public. Meanwhile, sharing current data could help increase visibility into potential national security risks related to foreign investments in U.S. agricultural land.AFIDA Data Are Not Regularly Part of CFIUS ReviewsUSDA implements AFIDA across field offices and headquarters, but its processes to collect, track, and report key information are flawed. USDA collects the required data on paper forms with county or federal offices and reviews them for accuracy, according to USDA officials. However, its processes to do so are unclear and challenging to implement. For example, USDA's AFIDA handbook provides limited instructions on how to collect reliable AFIDA information. In addition, although Congress required USDA to create an online submission process and public database for AFIDA data by the end of 2025, USDA does not have plans and timelines to do so, in part because USDA has not received funding. USDA also does not sufficiently verify and conduct quality reviews to track the accuracy and completeness of its collected AFIDA data. GAO's review of AFIDA data current through calendar year 2021 found errors, such as the largest land holding associated with the People's Republic of China being counted twice. USDA has begun efforts to identify AFIDA non-compliance through data mining, according to officials, and has opportunities to expand this practice. But without improving its internal processes, USDA cannot report reliable information to Congress or the public about where and how much U.S. agricultural land is held by foreign persons.Why GAO Did This StudyUSDA estimated that foreign investment in U.S. agricultural land grew to approximately 40 million acres in 2021. These investments may have consequences for U.S. national security. For example, there may be foreign ownership of U.S. agricultural land close to sensitive military installations.CFIUS is an interagency committee that reviews certain foreign transactions to determine potential effects on U.S. national security. These include foreign investments in U.S. agricultural land. In addition, USDA's AFIDA statute, enacted in 1978, requires foreign persons acquiring or transferring agricultural land to file a disclosure form with USDA.GAO was asked to review foreign investments in U.S. agricultural land. This report examines the extent to which (1) USDA shares information related to foreign investments in U.S. agricultural land with CFIUS for its national security reviews, and (2) USDA's processes enable it to collect, track, and report reliable data on foreign investments in U.S. agricultural land. GAO reviewed laws, regulations, and agency guidance; analyzed USDA data; and interviewed agency officials.
- Artificial Intelligence: Agencies Have Begun Implementation but Need to Complete Key Requirements What GAO FoundTwenty of 23 agencies reported about 1,200 current and planned artificial intelligence (AI) use cases—specific challenges or opportunities that AI may solve. Three agencies reported not having uses for AI. Agency reported uses included analyzing data from cameras and radar to identify border activities, analyzing photographs from drones, and targeting of scientific specimens for planetary rovers. The National Aeronautics and Space Administration (NASA) and the Department of Commerce (Commerce) reported the highest number of AI use cases (see figure).Agency Reported AI Use Cases in Fiscal Year 2022Most of the reported AI use cases were in the planning phase and not yet in production (i.e., currently used) (see figure). In about 200 instances, agencies reported that they were currently using AI.Agency Reported Artificial Intelligence (AI) Use Case Lifecycle Stage, as of Fiscal Year 2022a“Other” includes life cycle stage responses not included in the  2021 Guidance for Creating Agency Inventories of Artificial Intelligence Use Cases,  such as “research and design” and “exploratory.”GAO's analysis of agencies' inventories of use cases identified instances of incomplete and inaccurate data. Specifically, five agencies provided comprehensive information for each of their reported use cases while the other 15 had instances of incomplete and inaccurate data. For example, some inventories did not include required data elements, such as the AI life cycle stage or an indication of whether an AI use case was releasable or not. In addition, two inventories included AI uses that were later determined by the agencies to not be AI. Without accurate inventories, the government's management of its use of AI will be hindered by incomplete and inaccurate data.Federal agencies have taken initial steps to comply with AI requirements in executive orders and federal law; however, more work remains to fully implement these.Commerce and the General Services Administration (GSA) fully implemented selected requirements. Specifically, Commerce created a plan to develop AI technical standards and GSA established the AI Center of Excellence.	The Offices of Management and Budget (OMB) and Personnel Management (OPM) did not fully implement selected requirements. OMB has not yet developed guidance for the acquisition and use of AI. OPM has not yet established or updated an occupational category for those employees performing AI work.	The Office of Science and Technology Policy (OSTP) did not communicate its designation of which agencies were expected to fulfill specific AI requirements.	Ten of 23 agencies implemented all AI requirements specific to their agencies, 12 implemented some but not all, and one was exempt from the requirements. These requirements included preparing an inventory on the use of AI, planning for inventory updates, and planning for AI regulatory authorities.Addressing these requirements will improve agency identification, development, implementation, and oversight of AI.Why GAO Did This StudyWhile there are varying definitions of AI, they generally refer to computing systems that “learn” how to improve their performance. AI has the potential to rapidly change the world and holds substantial promise for improving government operations. However, AI poses risks that can negatively impact individuals, groups, organizations, communities, and society.The President's fiscal year 2023 budget request included $1.8 billion for nondefense research and development investment in AI. In addition, some agencies are using AI operationally to identify information security threats and facilitate the review of large datasets, among other uses. Given the rapid growth in capabilities and widespread adoption of AI, the federal government should have safeguards to manage AI's complexities, risks, and societal consequences.In this report, GAO reviewed the implementation of AI at major federal agencies. This report examines (1) federal agency reported current and planned uses of AI, (2) the extent to which federal agencies' AI reporting was comprehensive and accurate, and (3) the extent to which federal agencies have complied with selected federal policy and guidance on AI.This review focused on agencies with government-wide roles in AI implementation (including OMB and OPM) as well as agencies with individual responsibilities for AI implementation (including 23 of the 24 Chief Financial Officers (CFO) Act of 1990 agencies). The Department of Defense was excluded because GAO had issued recent AI reports on that department.GAO reviewed the 23 civilian CFO Act   agencies' AI inventories and analyzed reported use cases and supporting data. GAO also compared agency reported data to the requirements for developing an AI inventory outlined in federal guidance.In addition, GAO identified requirements from executive orders, OMB guidance, and a law regarding the implementation of AI. GAO then assessed agencies' implementation of these requirements. GAO also interviewed relevant officials.
- Small Business Administration: Exploring Potential Use of Blockchain What GAO FoundBlockchain enables a community of users to record transactions in a ledger shared within that community. Once a transaction is published, any changes are easily detectable. Unlike traditional databases, blockchain ledgers do not require a central authority, such as a bank or government. Multiple federal agencies have explored blockchain's potential to enhance their operations. However, some efforts have concluded and others have not progressed beyond initial pilot phases.Experts shared some potential uses and limitations of blockchain that may be applicable for the Small Business Administration (SBA). For example, they noted that a blockchain-based ledger might improve the timeliness of agency reporting for its Small Business Innovation Research and Small Business Technology Transfer programs, which support research and development projects carried out by small businesses. However, they noted that a blockchain may be unnecessarily complex for these programs, and generally emphasized the importance of analyzing programs' processes, workflows, and underlying challenges before exploring the technology.Why GAO Did This StudyGAO was asked to examine blockchain's potential to address challenges faced by the SBA. This report describes what blockchain is, examples of how selected federal agencies have used or considered using it, factors that entities including SBA could consider in assessing blockchain's potential use, and blockchain's potential uses and limitations in addressing selected SBA program challenges.To conduct this analysis, GAO reviewed its prior reports, as well as those of other organizations and agencies, including the SBA Office of Inspector General and the National Institute of Standards and Technology. In addition, GAO held a virtual panel discussion with experts from a range of stakeholder groups, including federal agencies, academia, and industry.For more information, contact William B. Shear at (202) 512-8678 or shearw@gao.gov.
- Artificial Intelligence: DOD Needs Department-Wide Guidance to Inform Acquisitions What GAO FoundThe Department of Defense (DOD) designated artificial intelligence (AI) a top modernization area and is allocating considerable spending to develop AI tools and capabilities. AI refers to computer systems designed to replicate a range of human functions and continually get better at their assigned tasks. DOD AI capabilities could be used in various ways, for example in identifying potential threats or targets on the battlefield.GAO obtained information from 13 private sector companies about how they successfully acquire AI capabilities. Elements of these categories, shown below, are also reflected in GAO's June 2021  AI Accountability Framework  report (GAO-21-519SP).Categories of Factors Selected Companies Reported Considering When Acquiring Artificial Intelligence CapabilitiesAlthough numerous entities across DOD are acquiring, developing, or already using AI, DOD has not issued department-wide guidance for how its components should approach acquiring AI. DOD is in the process of planning to develop such guidance, but it has not defined concrete plans and has no timeline to do so. The military services also lack AI acquisition-specific guidance, though military officials noted that such guidance would be helpful to navigate the AI acquisition process. Without department-wide and tailored service-level guidance, DOD is missing an opportunity to ensure that it is consistently acquiring AI capabilities in a manner that accounts for the unique challenges associated with AI.Various DOD components and military services have individually developed or plan to develop their own informal AI acquisition resources. Some of these resources reflect key factors identified by private companies for AI acquisition. For example, DOD's Chief Digital and AI Officer oversees an AI marketplace known as Tradewind, which is designed to expedite the procurement of AI capabilities. Several Tradewind resources emphasize the need to consider intellectual property and data rights concerns when negotiating contracts for AI capabilities, a key factor identified by the companies GAO interviewed.Why GAO Did This StudyDOD has begun to pursue increasingly advanced AI capabilities. DOD has historically struggled to acquire weapon systems software, and AI acquisitions pose additional challenges. In February 2022, GAO described the status of DOD's efforts to develop and acquire AI for weapon systems.Senate Report 116-236 accompanying the National Defense Authorization Act for Fiscal Year 2021 includes a provision for GAO to review DOD's AI acquisition efforts. This is the second report in response to that provision. This report examines (1) key factors that selected private companies reported considering when acquiring AI capabilities, and (2) the extent to which DOD has department-wide AI acquisition guidance and how, if at all, this guidance reflects key factors identified by private sector companies.GAO analyzed information provided by 13 private companies with expertise in designing, developing, and deploying AI systems in various sectors to determine the key factors. GAO also analyzed DOD documentation and compared it with the key factors, and interviewed DOD officials.
- Counterterrorism: Action Needed to Further Develop the Information Sharing Environment What GAO FoundThe Information Sharing Environment (ISE) is a framework to improve terrorism-related information sharing among federal and non-federal partners (i.e., Tribal, state, local, territorial, and private sector partners) through policy guidelines, common standards, and technologies. In 2013, federal officials developed an implementation plan that identified 16 priority objectives (e.g., develop baseline sharing capabilities) needed to implement the framework. As of 2017, federal agencies—including the Office of the Director of the National Intelligence (ODNI), Department of Homeland Security (DHS), and Department of Justice (DOJ)—had completed all but three of the 16 priority objectives.The Information Sharing EnvironmentGAO found that agencies have implemented ISE-related projects to complete the three remaining priority objectives since 2017. However, since that time, there has not been a Program Manager to guide and assess those efforts. Assessing agencies' progress with the ISE is a statutory responsibility of the Program Manager. Without someone in this position to assess agency efforts, how much work is needed to complete the ISE Implementation Plan's' remaining objectives remains undetermined.GAO also identified recent amendments to the statute establishing the ISE that, according to White House and ODNI officials, have complicated efforts to name a new ISE Program Manager. Clarifying that the President has full statutory authority to fill the Program Manager position would help ensure that a new Program Manager is named to continue work on the ISE Implementation Plan and broader federal terrorism information sharing goals.Why GAO Did This StudyEvolving terrorist threats, such as those posed by lone offenders and those who are radicalized online, highlight the continued need for effective information sharing between the federal government and its non-federal partners. In 2004, Congress passed the Intelligence Reform and Terrorism Prevention Act, which required the President to establish and develop the ISE. The ISE Implementation Plan has guided federal efforts in this area.GAO was asked to review federal efforts related to the ISE Implementation Plan. This report examines, among other things, the extent to which agencies took action to complete the plan's objectives. GAO reviewed agency documents and interviewed ODNI, DHS, DOJ and White House officials about their implementation efforts. GAO assessed these efforts against statutory provisions.
- Data Science: NIH Needs to Implement Key Workforce Planning Activities What GAO FoundWhile the National Institutes of Health (NIH) included a data science workforce goal in its June 2018 Strategic Plan for Data Science, the agency has not fully implemented the key workforce planning activities established by federal guidance (see table). For example, NIH developed and implemented plans to enhance its data science workforce; however, these plans were not linked to gaps in its data science workforce. Near the conclusion of GAO's review, officials said that an agency-wide Data Science Workforce Working Group had been established to address priority hiring and retention needs. However, they did not provide documentation supporting the group's activities. Fully addressing the workforce planning activities would help ensure that NIH has the data science workforce it needs to effectively meet its mission.National Institutes of Health's Implementation of Key Activities for Data Science Workforce Planning			Key workforce planning practices and supporting activities 									Rating 								Set the strategic direction for workforce planning  									&nbsp;								Establish and maintain a workforce planning process									Partially implemented								Develop competency and staffing requirements									Partially implemented								Analyze the workforce to identify skill gaps  									&nbsp;								Reassess competency and staffing needs regularly									Not implemented								Determine gaps in competencies and staffing regularly									Not implemented								Develop and implement strategies to address skill gaps  									&nbsp;								Develop strategies and plans to address gaps in competencies and staffing									Partially implemented								Implement activities that address gaps									Partially implemented								Monitor and report progress in addressing skill gaps  									&nbsp;								Monitor the agency's progress in addressing competency and staffing gaps									Not implemented								Report to agency leadership on progress in addressing competency and staffing gaps									Not implemented					Legend: Fully implemented: NIH provided evidence that addressed the activity; partially implemented: NIH provided evidence that it had addressed some, but not all of the activity; not implemented: NIH did not provide evidence that it had addressed any of the activity.Source: GAO analysis of NIH documentation. | GAO-23-105594NIH's data management and sharing policy, effective January 2023, is consistent with relevant Office of Science and Technology Policy data sharing requirements. However, NIH had not finalized the guidance its staff needs to evaluate the data management and sharing plans and determine researchers' compliance with them. In addition, officials stated several times during the course of GAO's review that they had revised their time frames for doing so. The officials said they were delayed in completing the guidance because they were focused on informing the public about the new policy. They also anticipated releasing the guidance by June 2023 in time to assess the first round of plans. However, NIH did not document this new time frame. Documenting the new time frame and monitoring progress against it would ensure NIH's accountability for finalizing the guidance on time. In addition, until the agency finalizes and implements the guidance, its staff are less likely to consistently assess data sharing plans. This, in turn, would limit NIH's goal of maximizing appropriate sharing of scientific data generated from federally funded research.Why GAO Did This StudyNIH, the federal government's leader in supporting biomedical research, faces a shortage of employees with data science expertise needed to, among other things, analyze and extract insights from increasingly large and complex sets of data. In June 2018, NIH developed a Strategic Plan for Data Science, which included an objective to enhance its data science workforce that addresses this need.The explanatory statement accompanying the Further Consolidated Appropriations Act, 2020, contained a provision for GAO to review NIH's data science workforce planning. This report, among other things, determines the extent to which 1) NIH has conducted data science workforce strategic planning in accordance with key practices and 2) NIH's data management and sharing policy and guidance are consistent with federal guidance.To do so, GAO assessed agency documentation against key workforce planning practices identified in prior GAO work. It also compared NIH's data management and sharing policy and plans to relevant federal requirements, and interviewed NIH officials.
- Science & Tech Spotlight: Generative AI Why This MattersUse of generative AI, such as ChatGPT and Bard, has exploded to over 100 million users due to enhanced capabilities and user interest. This technology may dramatically increase productivity and transform daily tasks across much of society. Generative AI may also spread disinformation and presents substantial risks to national security and in other domains.The TechnologyWhat is it?  Generative artificial intelligence (AI) is a technology that can create content, including text, images, audio, or video, when prompted by a user. Generative AI systems create responses using algorithms that are trained often on open-source information, such as text and images from the internet. However, generative AI systems are not cognitive and lack human judgment.Generative AI has potential applications across a wide range of fields, including education, government, medicine, and law. Using prompts—questions or descriptions entered by a user to generate and refine the results—these systems can quickly write a speech in a particular tone, summarize complex research, or assess legal documents. Generative AI can also create artworks, including realistic images for video games, musical compositions, and poetic language, using only text prompts. In addition, it can aid complex design processes, such as designing molecules for new drugs or generating programming codes.How does it work?  Generative AI systems learn patterns and relationships from massive amounts of data, which enables them to generate new content that may be similar, but not identical, to the underlying training data. They process and create content using sophisticated machine learning algorithms and statistical models. For example, large language models use training data to learn patterns in written language. Generative AI can then use models to emulate a human writing style. Generative AI can also learn to use many other data types, including programming codes, molecular structures, or images.The systems generally require a user to submit prompts that guide the generation of new content (see fig. 1). Many iterations may be required to produce the intended result because generative AI is sensitive to the wording of prompts.Figure 1. Example of a generative AI system creating an image from prompts. How mature is it?  Advanced chatbots, virtual assistants, and language translation tools are mature generative AI systems in widespread use. Improved computing power that can process large amounts of data for training has expanded generative AI capabilities. As of early 2023, emerging generative AI systems have reached more than 100 million users and attracted global attention to their potential applications. For example, a research hospital is piloting a generative AI program to create responses to patient questions and reduce the administrative workload of health care providers. Other companies could adapt pre-trained models to improve communications with customers.OpportunitiesSummarizing information.  By rapidly aggregating a wide range of content and simplifying the search process, generative AI quickens access to ideas and knowledge and can help people more efficiently gather new information. For example, researchers can identify a new chemical for a drug based on an AI-generated analysis of established drugs.	Enabling automation.  Generative AI could help automate a wide variety of administrative or other repetitive tasks. For example, it could be used to draft legal templates, which could then be reviewed and completed by a lawyer. It can also improve customer support by creating more nuanced automated responses to customer inquiries.	Improving productivity.  Because it is capable of quickly automating a variety of tasks, generative AI has the potential to enhance the productivity of many industries. Multiple studies and working papers have shown generative AI can enhance the speed of administrative tasks and computer programming, although users may need to edit the generated result.ChallengesTrust and oversight concerns.  In June 2021, GAO identified key practices, such as a commitment to values and principles for responsible use, to help ensure accountability and responsible use of AI across the federal government and other entities. Generative AI systems can respond to harmful instructions, which could increase the speed and scale of real-world harms. For example, generative AI could help produce new chemical warfare compounds. Additionally, generative AI systems share challenges to oversight similar to other AI applications—such as assessing the reliability of data used to develop the model—because their inputs and operations are not always visible. The White House announced in May 2023 that a working group would provide, among other things, input on how best to ensure that generative AI is developed and deployed equitably, responsibly, and safely. Other agencies, such as the National Institute of Standards and Technology, have also promoted responsible use of generative AI.	False information.  Generative AI tools may produce “hallucinations”—erroneous responses that seem credible. One reason hallucinations occur is when a user requests information not in the training data. Additionally, a user could use AI to purposefully and quickly create inaccurate or misleading text, thus enabling the spread of disinformation. For example, generative AI can create phishing e-mails or fake but realistic social media posts with misleading information. Further, bias in the training data can amplify the potential for harm caused by generative AI output.	Economic issues.  Generative AI systems could be trained on copyrighted, proprietary, or sensitive data, without the owner's or subject's knowledge. There are unresolved questions about how copyright concepts, such as authorship, infringement, and fair use, will apply to content created or used by generative AI.	Privacy risks.  Specific technical features of generative AI systems may reduce privacy for users, including minors. For example, a generative AI system may be unable to “forget” sensitive information that a user wishes to delete. Additionally, if a user enters personally identifiable information, that data could be used indefinitely in the future for other purposes without the user's knowledge. Section 230 of the Communications Decency Act of 1996 shields online service providers and users from legal liability for hosting or sharing third-party content, but it is unclear how this statute might apply to AI-generating content systems and their creators.	National security risks.  Information about how and when some generative AI systems retain and use information entered into them is sparse or unavailable to many users, which poses risks for using these tools. For example, if a user enters sensitive information into a prompt, it could be stored and misused or aggregated with other information in the future. Furthermore, when systems are publically and internationally accessible, they could provide benefits to an adversary. For example, generative AI could help rewrite code making it harder to attribute cyberattacks. It may also generate code for more effective cyberattacks even by attackers with limited computer programming skills.Policy Context and QuestionsWhat AI guidelines can best ensure generative AI systems are used responsibly, and are generative AI systems following existing guidance?	What standards could be used or developed to evaluate the methods and materials used to train generative AI models and ensure fairness and accuracy of their responses for different use cases?	How can public, private, academic, and nonprofit organizations strengthen their workforce to ensure responsible and accountable use of generative AI technologies?	What privacy laws can be used or developed to protect sensitive information used or collected by generative AI systems, including information provided by minors?For more information, contact Brian Bothwell at (202) 512-6888 or bothwellb@gao.gov and Kevin Walsh at (202) 512-6151 or walshk@gao.gov.
- Electronic Health Records: VA Needs to Address Management Challenges with New System What GAO FoundThe Department of Veterans Affairs (VA) organizational change management activities for the Electronic Health Record Modernization (EHRM) program were partially consistent with seven leading practices and not consistent with one leading practice (see table).Extent to Which the Electronic Health Record Modernization (EHRM) Program's Activities Were Consistent with Organizational Change Management Leading Practices			Leading practice 									GAO assessment 								Developing a vision for change									Partially consistent								Identifying and managing stakeholders									Partially consistent								Communicating effectively									Partially consistent								Assessing the readiness for change									Partially consistent								Increasing workforce skills and competencies									Not consistent								Identifying and addressing potential barriers to change									Partially consistent								Establishing targets and metrics for change									Partially consistent								Assessing the results of change									Partially consistent					Source: GAO analysis of Department of Veterans Affairs (VA) data. | GAO-23-106731Until the program fully implements the leading practices for change management, future deployments risk continuing change management challenges that can hinder effective use of the new electronic health record (EHR) system.Most users have expressed dissatisfaction with the new system. VA's 2021 and 2022 surveys showed that users were not satisfied with the system's performance or training. About 79 percent (1,640 of 2,066) of users disagreed or strongly disagreed that the system enabled quality care. In addition, about 89 percent (1,852 of 2,074) of users disagreed or strongly disagreed that the system made them as efficient as possible. Further, VA has not established targets (i.e., goals) to assess user satisfaction. Until it does so, VA lacks a basis for determining when satisfaction has sufficiently improved for the system to be deployed at additional sites. Such a basis helps ensure that the system is not deployed prematurely, which could risk patients' safety.VA did not adequately identify and address system issues. Specifically, VA did not ensure that trouble tickets for the new EHR system were resolved within timeliness goals. It subsequently worked with the contractor to reduce the number of tickets that were over 45 days old. Nevertheless, the overall number of open tickets has steadily increased since 2020. Accordingly, it is critical that system issues be resolved in a timely manner. Additionally, although VA has assessed the system's performance at two sites, as of January 2023, it had not conducted an independent operational assessment, as originally planned and consistent with leading practices for software verification and validation. Without such an independent assessment, VA will be limited in its ability to (1) validate that the system is operationally suitable and effective, and (2) identify, track, and resolve key operational issues.In April 2023, VA announced that it planned to halt future deployments of the new EHR system to focus on making improvements at the five sites currently using the system.Why GAO Did This StudyVA uses the Veterans Health Information Systems and Technology Architecture (VistA), which includes the department's legacy EHR system, to manage health care for its patients. VistA is technically complex, costly to maintain, and does not fully support the need to exchange health data with other organizations. In June 2017, VA initiated the EHRM program to replace VistA.Congressional report language associated with the VA appropriations for fiscal years 2020 through 2022 contained provisions for GAO to review VA's EHR deployment. GAO's objectives were to determine the extent to which VA has (1) followed leading organizational change management practices for the EHRM program, (2) assessed satisfaction with the new system, and (3) identified and addressed EHR system issues. GAO identified leading change management practices and evaluated VA's activities against these practices. It also reviewed the results of surveys that VA conducted to determine users' satisfaction with the new EHR, conducted interviews with selected users, and interviewed officials on user satisfaction goals. Further, GAO analyzed VA's data on the contractor's performance meeting time frames for addressing system trouble tickets.
- Artificial Intelligence: Key Practices to Help Ensure Accountability in Federal Use What GAO FoundArtificial intelligence (AI) is evolving at a rapid pace and the federal government cannot afford to be reactive to its complexities, risks, and societal consequences. Federal guidance has focused on ensuring AI is responsible, equitable, traceable, reliable, and governable. Third-party assessments and audits are important to achieving these goals. However, a critical mass of workforce expertise is needed to enable federal agencies to accelerate the delivery and adoption of AI.Participants in an October 2021 roundtable convened by GAO discussed agencies' needs for digital services staff, the types of work that a more technical workforce could execute in areas such as artificial intelligence, and challenges associated with current hiring methods. They noted such staff would require a variety of digital and government-related skills. Participants also discussed challenges associated with existing policies, infrastructure, laws, and regulations that may hinder agency recruitment and retention of digital services staff.During a September 2020 Comptroller General Forum on AI, experts discussed approaches to ensure federal workers have the skills and expertise needed for AI implementation. Experts also discussed how principles and frameworks on the use of AI can be operationalized into practices for managers and supervisors of these systems, as well as third-party assessors. Following the forum, GAO developed an AI Accountability Framework of key practices to help ensure responsible AI use by federal agencies and other entities involved in AI systems. The Framework is organized around four complementary principles: governance, data, performance, and monitoring.Artificial Intelligence (AI) Accountability FrameworkWhy GAO Did This StudyTo help managers ensure accountability and the responsible use of AI in government programs and processes, GAO has developed an AI Accountability Framework. Separately, GAO has identified mission-critical gaps in federal workforce skills and expertise in science and technology as high-risk areas since 2001.This testimony summarizes two related reports—GAO-22-105388 and GAO-21-519SP. The first report addresses the digital skills needed to modernize the federal government. The second report describes discussions by experts on the types of risks and challenges in applying AI systems in the public sector.To develop the June 2021 AI Framework, GAO convened a Comptroller General Forum in September 2020 with AI experts from across the federal government, industry, and nonprofit sectors. The Framework was informed by an extensive literature review, and the key practices were independently validated by program officials and subject matter experts.For the November 2021 report on digital workforce skills, GAO convened a roundtable discussion in October 2021 comprised of chief technology officers, chief data officers, and chief information officers, among others. Participants discussed ways to develop a dedicated talent pool to help meet the federal government's needs for digital expertise.For more information, contact Taka Ariga at (202) 512-6888 or arigat@gao.gov.
- Electronic Health Records: Challenges with VA's New System Call for Management Improvements What GAO FoundThe Department of Veterans Affairs (VA) organizational change management activities for the Electronic Health Record Modernization (EHRM) program were partially consistent with seven leading practices and not consistent with one leading practice (see table).Extent to Which the Electronic Health Record Modernization (EHRM) Program's Activities Were Consistent with Organizational Change Management Leading Practices			Leading practice 									GAO assessment 								Developing a vision for change									Partially consistent								Identifying and managing stakeholders									Partially consistent								Communicating effectively									Partially consistent								Assessing the readiness for change									Partially consistent								Increasing workforce skills and competencies									Not consistent								Identifying and addressing potential barriers to change									Partially consistent								Establishing targets and metrics for change									Partially consistent								Assessing the results of change									Partially consistent					Source: GAO analysis of Department of Veterans Affairs (VA) data. | GAO-23-106785Until the program fully implements the leading practices for change management, future deployments risk continuing change management challenges that can hinder effective use of the new electronic health record (EHR) system.Most users expressed dissatisfaction with the new system. VA's surveys showed that users were not satisfied with the system's performance and training. About 79 percent (1,640 of 2,066) of responding users disagreed or strongly disagreed that the system enabled quality care. In addition, users in GAO's structured interviews said the pharmacy-related system module presented challenges, such as incorrect medication orders and increased prescription processing times, which contributed to patient safety risks. Further, VA has not established targets (i.e., goals) to assess user satisfaction. Until it does so, VA lacks a basis for determining when satisfaction has sufficiently improved for the system to be deployed at additional sites. Such a basis helps ensure that the system is not deployed prematurely, which could risk patients' safety.VA did not adequately identify and address system issues. Specifically, VA did not ensure that trouble tickets for the new EHR system were resolved within timeliness goals. It subsequently worked with the contractor to reduce the number of tickets that were over 45 days old. Nevertheless, the overall number of open tickets has steadily increased since 2020. Accordingly, it is critical that system issues be resolved in a timely manner. Additionally, although VA has assessed the system's performance at two sites, as of January 2023, it had not conducted an independent operational assessment, as originally planned and consistent with leading practices for software verification and validation. Without such an independent assessment, VA will be limited in its ability to validate that the system is operationally suitable and effective.Subsequent to GAO's review, VA announced that it planned to halt future deployments of the new EHR system to focus on making improvements at the five sites currently using the system.Why GAO Did This StudyVA uses the Veterans Health Information Systems and Technology Architecture (VistA), which includes the department's legacy EHR system, to manage health care for its patients. VistA is technically complex, costly to maintain, and does not fully support the need to exchange health data with other organizations. In June 2017, VA initiated the EHRM program to replace VistA. VA has reported obligating about $9.42 billion on EHRM from fiscal year 2018 through the first quarter of fiscal year 2023.GAO was asked to testify on its recent review to determine the extent to which VA has (1) followed leading organizational change management practices for the EHRM program, (2) assessed satisfaction with the new system, and (3) identified and addressed EHR system issues. For its recent review GAO identified leading change management practices and evaluated VA's activities against these practices. It also reviewed results of surveys that VA conducted to determine users' satisfaction with the new EHR, conducted interviews with selected users, and interviewed officials on user satisfaction goals. Further, GAO analyzed system trouble ticket and related data regarding VA's service level agreement with its contractor.
- Data Center Optimization: Agencies Continue to Report Progress What GAO FoundFederal agencies continue to close data centers and report related cost savings under the Data Center Optimization Initiative (DCOI). In fiscal year 2021, federal agencies closed 58 data centers. In fiscal year 2022, agencies closed 20 data centers by August 2022, and planned to close 58 additional data centers through the end of the fiscal year. Moreover, 22 of the 24 agencies met their related cost savings goals for fiscal year 2021, identifying a total of $612.326 million in cost savings. Agencies also planned to meet their cost savings goals for fiscal year 2022; as of August 2022, they had identified $334.324 million in cost savings. Agencies have a cumulative total of $6.6 billion in cost savings and avoidances from fiscal years 2012 through 2021.In fiscal year 2022, federal agencies reported mixed progress in meeting the Office of Management and Budget's (OMB) data center optimization targets. These targets consist of virtualization, data center availability, advance energy metering, and underutilized servers. As of September 2022, 13 agencies reported meeting the virtualization target, 17 met the availability target, and 14 met the metering and utilization targets. In addition, seven agencies do not have any agency-owned data centers or their remaining centers are exempted from optimization by OMB; therefore, reporting on optimization metrics for these agencies was not applicable. (See figure)24 Agencies Reported Progress towards Meeting Office of Management and Budget (OMB) Data Center Optimization Targets, as of September 2022GAO has made 126 recommendations since 2016 to help agencies meet their DCOI targets, and the agencies have implemented 110 of them. Once agencies fully address all previous GAO recommendations to meet their optimization performance targets, they should fully realize the expected benefits, including cost savings from DCOI.Why GAO Did This StudyIn 2010, OMB established a government-wide effort to reduce the number of duplicative or outdated federal data centers. In December 2014, Congress enacted federal IT acquisition reform legislation known as FITARA, which included provisions related to ongoing federal data center consolidation efforts. Less than two years later, OMB's Federal Chief Information Officer launched DCOI to build on prior efforts. Specifically, it required, among other things, that agencies consolidate and optimize existing facilities.FITARA included a provision for GAO to annually review agencies' data center inventories and strategies. This report addresses (1) agencies' progress on data center closures and the related savings and agencies' plans for future closures and savings; and (2) agencies' progress against OMB's data center optimization targets.GAO reviewed the 24 DCOI agencies' data center inventories as of March and August 2022, including their reported cost savings and data center optimization strategic plans, and interviewed relevant agency officials.
- Information Management: Agencies Need to Streamline Electronic Services What GAO FoundWith certain enumerated exceptions, the Privacy Act of 1974 prohibits disclosure of records to any person or agency, unless disclosure is pursuant to the prior written request by, or with the prior written consent of, the individual to whom the record pertains. As required by the Creating Advanced Streamlined Electronic Services for Constituents Act of 2019, the Office of Management and Budget (OMB) issued guidance that outlined agencies' responsibilities for accepting digitally-formatted access and consent forms from individuals who are properly identity proofed and authenticated. Agencies were to implement the requirements in the OMB guidance by November 2021. As of September 2022, one of the selected agencies—the Securities and Exchange Commission (SEC)—reported that they had fully implemented OMB's guidance. The remaining 16 agencies reported encountering technical challenges and competing priorities that have delayed them from fully implementing OMB's guidance. However, five of these agencies have established time frames for full implementation. Sharing information on SEC's success could benefit other agencies' efforts to implement OMB's requirements.Why GAO Did This StudyThe Privacy Act prohibits disclosure of records to any person or agency, unless disclosure is pursuant to the prior written request by, or with the prior written consent of, the individual to whom the record pertains. Accordingly, agencies have developed various procedures and forms by which individuals may establish their identity and request access to or provide written consent for the disclosure of their records.To simplify and modernize this process, the CASES Act required OMB to issue applicable guidance. This guidance was to: (1) require agencies to accept electronic identity proofing and authentication; (2) create a template for electronic consent and access forms and requires each agency to post the template on the agency website; and (3) require each agency to accept electronic consent and access forms from individuals that have been properly identity proofed and authenticated.GAO was asked to review the implementation of the CASES Act at OMB and federal agencies. GAO selected 17 agencies for review that had received 5,000 or more Freedom of Information Act requests in fiscal year 2020.
- Chief Data Officer Council: Progress in Strengthening Federal Evidence-Based Policymaking What GAO FoundThe Chief Data Officer Council—established by the Foundations for Evidence-Based Policymaking Act of 2018 (Evidence Act)—has taken a range of actions intended to strengthen federal evidence-building activities. The act established the Council as an entity within the Office of Management and Budget, and it receives administrative support from the General Services Administration. The Council's membership includes Chief Data Officers from each agency (82 as of October 2022) and other officials from across the federal government.GAO's analysis found that the Council has taken one or more actions related to each of its five statutory requirements. Those requirements outline how it should contribute to federal efforts to generate and use evidence (see figure).Chief Data Officer Council Requirements and Examples of Related Actions During a meeting with Council officials in June 2022, GAO shared observations that the Council did not have fully formed plans and performance management activities for meeting its statutory requirements, which could limit continued progress. In response, the Council provided an updated planning document to GAO in August 2022 that identified how the Council's goals and planned activities now support each requirement, along with related performance measures. Moving forward, these tools will provide the Council with performance information it can use to assess progress and ensure it sufficiently addresses each requirement before its authorization expires in December 2024.GAO also identified various actions that selected agencies took to improve their ability to use different types of evidence. These include several that reflect the Council's actions identified above. For example:To help agencies make more informed decisions, the Office of Personnel Management is developing tools—expected in summer 2023—to analyze and visualize key government-wide workforce data.	Based on an assessment that identified gaps in the data skills of its staff, the General Services Administration began offering training courses in February 2022 tailored to its employees' roles and responsibilities.Why GAO Did This StudyFederal decision makers need evidence about whether federal programs and activities are achieving intended results. The Evidence Act created a framework for enhancing the federal government's capacity to build and use evidence in decision-making.The act includes provisions for GAO to review its implementation at various points. This report (1) assesses the extent to which the Chief Data Officer Council took actions intended to address its statutory requirements to enhance the development and use of evidence in the federal government, and (2) describes examples of actions selected agencies took to improve their use of different types of evidence.To address these objectives, GAO reviewed documents and interviewed officials from the Chief Data Officer Council and six federal agencies: the Departments of Commerce, Energy, the Treasury, and Veterans Affairs; the General Services Administration; and the Office of Personnel Management. GAO selected these agencies to reflect a range of sizes and variability in their evidence-building capacities, as identified by GAO's past work. GAO assessed the Council's activities and identified actions it took related to its statutory requirements.The Chief Data Officer Council, Office of Management and Budget, and six selected agencies had no comments on a draft of this report.For more information, contact Alissa H. Czyz at (202) 512-6806 or czyza@gao.gov.
- Technology Business Management: OMB and GSA Need to Strengthen Efforts to Lead Federal Adoption What GAO FoundThe Office of Management and Budget (OMB) and General Services Administration (GSA) have taken steps to lead government-wide Technology Business Management adoption, but progress and results are limited.OMB's initial 2017 plans for government-wide adoption required agencies to report IT spending using categories in the first two layers. OMB continued to require reporting of these two layers in subsequent plans. However, 5 years after establishing initial plans, OMB had not expanded on requirements to include the rest of the taxonomy—the categories in layers 3 and 4, and subcategories for all layers (see figure).Extent That the Office of Management and Budget's (OMB) Plans Addressed Elements of the Technology Business Management Taxonomy Version 3.0OMB and GSA assisted agency efforts to implement the Technology Business Management framework by, for example, developing implementation guidance and a maturity model assessment tool. However, OMB and GSA have not assessed agency maturity. Further, they have not analyzed the quality of agencies' data reported in the first two layers.	OMB and GSA released agency-reported data on the federal government's IT Dashboard (layers 1 and 2), but did not disclose that about $31 billion in fiscal year 2021 investments were excluded. Further, they have not analyzed inconsistencies in fiscal year 2022 data, or addressed use of benchmarking that would enable spending comparisons to organizations of similar size or mission.OMB and GSA officials maintain that Technology Business Management implementation continues to be a priority. Nevertheless, until OMB establishes documented plans and agency expectations for the remainder of the taxonomy, uncertainty will cloud agency efforts. Further, the continuing absence of OMB direction could prevent the federal government from fully achieving intended benefits such as optimizing IT spending.Why GAO Did This StudyThe government has faced longstanding challenges in IT management and spending transparency. In 2017, OMB announced its intention to improve insights into IT spending through government-wide adoption of the Technology Business Management Council's framework.This framework provides a standard taxonomy that is organized into four layers (cost pools, IT towers, products and services, and business units and capabilities) intended to show an organization's total IT spending from different perspectives. These four layers are comprised of spending categories and subcategories.GAO was asked to report on Technology Business Management implementation. GAO's objective was to identify progress OMB and GSA have made in the government-wide adoption effort. To do so, GAO analyzed and compared plans against relevant criteria, such as Technology Business Management Council guidance. It also analyzed data, as reported by agencies for fiscal years 2021 and 2022, and interviewed relevant officials.
- Tracking the Funds: Specific Fiscal Year 2022 Provisions for National Archives and Records Administration What GAO FoundThe Consolidated Appropriations Act, 2022 appropriated $36.8 million to the National Archives and Records Administration (NARA) for 13 projects at the request of Members of Congress. The act includes specific provisions that designate an amount of funding for a particular recipient to use for a specific project. These provisions are called "Congressionally Directed Spending" in the U.S. Senate and "Community Project Funding" in the House of Representatives.GAO described, among other things, information about the intended uses for these funds, the recipients to whom they were designated, and when NARA expects recipients will have access to the funds:The intended uses of these funds are to support efforts to preserve historical records and improve Presidential libraries. Examples of projects include facility improvements and records digitization.The designated recipients of these funds include historical societies, libraries, museums, and universities in 11 states. Presidential libraries received the largest amount of support, while projects for other recipients received an average of $500,000.NARA expects timeframes to vary for when recipients will have access to the funds depending on the type of project. NARA did not have an estimate for when funds would be available to Presidential libraries, but officials expected other recipients would have access to the funds by the end of September 2022. NARA officials estimated projects would take between 2 and 5 years to complete.Why GAO Did This StudyThe joint explanatory statement accompanying the Consolidated Appropriations Act, 2022 includes a provision for GAO to review agencies' implementation of Community Project Funding/Congressionally Directed Spending.For more information, contact Marisol Cruz Cain at (202) 512-5017 or cruzcainm@gao.gov.
- Bank Secrecy Act: Action Needed to Improve DOJ Statistics on Use of Reports on Suspicious Financial Transactions What GAO FoundThe Financial Crimes Enforcement Network (FinCEN) is responsible for administering the Bank Secrecy Act (BSA), which requires financial institutions to file reports about suspicious financial transactions. FinCEN provides BSA report access to law enforcement agencies, which use those reports to support investigations. FinCEN receives limited data from law enforcement agencies on their use of BSA reports or the reports' impact on case outcomes because agencies largely do not collect such data. As a result, FinCEN cannot provide comprehensive feedback to financial institutions on the usefulness of the BSA reports they file.Feedback Loop for Bank Secrecy Act (BSA) ReportingThe 2021 National Defense Authorization Act (NDAA) directs the Department of Justice (DOJ) to provide annual statistics, metrics, and other information to the Secretary of the Treasury on agencies' use of BSA reports, including how often reports contributed to arrests and convictions. But none of the agencies that DOJ contacted, including DOJ component agencies, provided the statistics described in the NDAA. DOJ's first annual report focused on qualitative information and statistics already available to FinCEN. DOJ stated that agencies faced challenges collecting data that connect their use of BSA reports to case outcomes using current data systems.DOJ has opportunities to leverage existing initiatives and expertise to improve its annual statistical report on agencies' use of BSA reports.DOJ has been implementing a comprehensive, agency-wide data strategy to improve its data collection and infrastructure, but BSA-related data have not been included in the agencies' efforts. Including these data would give DOJ an opportunity to examine how to improve its component agencies' data collection on their use of BSA reports.	DOJ's first annual statistical report on BSA reflected some methodological weaknesses. For example, it did not include data from two agencies that track some uses of BSA reports because DOJ did not have procedures for following up on its data requests. The DOJ office that drafted the report did not collaborate with DOJ's Chief Information Officer or Statistical Official in the report's design. By involving the expertise of these DOJ offices in the development of future annual reports, DOJ could better ensure a rigorous methodology for collecting and presenting the report's required statistics.Why GAO Did This StudyBSA provisions for reporting suspicious financial transactions are intended to help law enforcement detect and investigate illicit finance activity. In GAO-19-582, GAO reported that financial institutions wanted more feedback on the usefulness of the BSA reports they file with FinCEN.The 2021 NDAA directs DOJ to annually report statistics on law enforcement agencies' use of BSA reports, and directs FinCEN to provide additional feedback. The 2021 NDAA also contains a provision for GAO to report on practices that could improve BSA-related feedback. Among its objectives, this report examines steps DOJ and FinCEN have taken to implement these provisions.GAO reviewed applicable laws, regulations, and agency documents, and interviewed officials from FinCEN, DOJ, other law enforcement agencies, and industry associations.
- Contact Tracing for Air Travel: CDC's Data System Needs Substantial Improvement What GAO FoundThe Centers for Disease Control and Prevention (CDC) plays a key role in contact tracing for air travel—the process of identifying and notifying passengers who may have come into contact with a person infected with a communicable disease during a flight. However, several factors affect CDC's ability to collect timely, accurate, and complete air passenger information to support contact tracing by local public health authorities. For example, airlines may not have accurate and complete information about passengers to share with CDC because the contact information provided to book a ticket may be for a third party, like a travel agent, not for passengers. Further, because no single, complete, and reliable source of passenger information exists, CDC often conducts research to fill in gaps, extending the time it takes to share information with local public health authorities.Overview of Process for Collecting Air Passengers' Contact Information Since the start of the COVID-19 pandemic, CDC has taken some actions to improve the quality of information it collects. For example, since November 2021, CDC has required airlines to collect certain information—including name, phone number, email, and physical address—no more than 72 hours before departure from passengers traveling on flights into the United States and to transmit the information to CDC in a defined format.However, limitations in how CDC collects and manages air passengers' contact information—including CDC's use of an outdated data management system—hinder the agency's ability to monitor public health risks and facilitate contact tracing. The data management system—developed in the mid-2000s—was not designed for rapid assessment or aggregation of public health data across individual cases. For example, CDC is unable to quickly and accurately identify the number of passengers exposed to a specific infected passenger on a flight. Nor does the system contain the necessary data fields to assess the quality of air passenger information CDC receives, such as a field to determine the timeliness of airlines' responses to CDC's request. Consequently, CDC is not positioned to efficiently analyze and disseminate data to inform public health policies and respond to disease threats. Nor is it positioned to evaluate its performance in collecting and sharing quality passenger information.Why GAO Did This StudyThe COVID-19 pandemic has underscored the importance of public health measures aimed at controlling the transmission of communicable diseases. Air travel can play a role in quickly spreading communicable diseases across the world and throughout communities. Given this potential, contact tracing for air passengers is an important measure for protecting public health.GAO was asked to examine CDC's process for collecting and managing air passengers' contact information to facilitate contact tracing. This report addresses: (1) the factors that affect CDC's ability to collect this information, (2) recent actions CDC has taken to improve the quality of the information it collects, and (3) how effectively it collects and manages this information.GAO reviewed relevant federal documentation, including regulations, orders, technical guidance, and public comments, as well as available CDC data. GAO also interviewed officials from CDC, U.S. Customs and Border Protection, and the Federal Aviation Administration, and selected representatives from the aviation, travel, and public health industries.
- Facial Recognition Technology: Federal Agencies' Use and Related Privacy Protections What GAO FoundIn August 2021, GAO reported its survey results on facial recognition technology (FRT) activities, which found that 18 of 24 agencies reported using FRT for one or more purposes, with digital access and domestic law enforcement as the most common. For example, two agencies reported testing FRT to verify identities of persons accessing government websites and other agencies used FRT to generate leads in criminal investigations. Agencies also reported accessing FRT systems of other entities, such as those owned by other federal agencies, state and local governments, and the private sector. In addition, ten agencies reported conducting or supporting FRT-related research and development. For example, the Department of Justice reported conducting applied research on the relationship between skin tone and false match rates in facial recognition algorithms, among other efforts.Examples of Facial Recognition Technology Uses by Federal AgenciesIn June 2021, GAO reported the results of another survey of 42 federal agencies that employ law enforcement officers. Fourteen agencies reported using FRT to support criminal investigations; however, GAO found that 13 of these agencies did not track employee use of non-federal (e.g., state and commercial) FRT systems. For example, one agency conducted a poll and learned that its employees had used a non-federal system to conduct more than 1,000 facial recognition searches. The lack of awareness about employees' use of non-federal FRT systems can have privacy implications—including a risk of not adhering to privacy laws or that system owners may share sensitive information used for searches. In September 2020, GAO also found that U.S. Customs and Border Protection's (CBP) Biometric Entry-Exit Program incorporated some privacy protections, but the implementation of privacy notices and audits were inconsistent. For example, CBP had audited only one of its more than 20 commercial airline partners and did not have a plan to audit all its partners for compliance with the program's privacy requirements.Why GAO Did This StudyUse of FRT has become increasingly common across the government and private sector. As the use of FRT continues to expand, advocacy organizations and others have highlighted the importance of understanding FRT uses in federal agencies and related privacy risks.This statement describes (1) use of FRT at federal agencies and (2) privacy protections present in FRT systems used by federal agencies.This statement is based on recent GAO reports on the use of FRT, including (1) an August 2021 report on current and planned use of FRT across federal agencies that included a survey of the 24 largest agencies, (2) a June 2021 report on federal law enforcement agencies' use of FRT that included a survey administered to 42 agencies that employ law enforcement officers, and (3) a 2020 report on use of FRT for airport and port security. To conduct this prior work, GAO reviewed relevant documents and interviewed agency officials.
- COVID-19: Pandemic Lessons Highlight Need for Public Health Situational Awareness Network What GAO FoundSince 2006, multiple federal laws have mandated that the Department of Health and Human Services (HHS) take steps to improve the nation's situational awareness of threats related to public health emergencies, such as the COVID-19 pandemic. Specifically, HHS was required to establish a near real-time electronic nationwide public health situational awareness capability through an interoperable network of systems. This network was to be used to facilitate early detection of and rapid response to potentially catastrophic infectious disease outbreaks.More than 15 years after the law initially mandated it, the federal government does not yet have this needed situational awareness network capability. If this network had been available, it could have been used to provide vital information to better manage a timely COVID-19 response.The Pandemic and All-Hazards Preparedness and Advancing Innovation Act of 2019 reiterated the need for HHS to improve situational awareness capabilities. The following summarizes key requirements in the act and the extent to which HHS has implemented them as of March 2022.Summary of statutory requirements related to the improvement of situational awareness for public health emergencies and the extent to which HHS has implemented them as of March 2022			Summary of requirements									Implementation status								Adopt technical and reporting standards.									●								Provide grants to establish integrated systems.									◑								Develop a plan for sharing and securing information.									○								Establish a near real-time electronic nationwide public health situational awareness and biosurveillance capability.									○								Facilitate coordination among relevant agencies.									○								Conduct a public meeting with experts in public health by December 21, 2019.									○								Utilize applicable interoperability standards and define minimal data elements.									○								Develop a strategy and implementation plan by December 24, 2020.									○								Conduct a review of the data and information transmitted by the network by June 24, 2021   and every 6 years thereafter.									○								Develop a budget plan by June 24, 2021, and on an annual basis thereafter.									○					Legend: ● Requirement is fully implemented; ◑ Requirement is partially implemented; ○ Requirement is not implemented Source: GAO analysis of The Pandemic and All-Hazards Preparedness and Advancing Innovation Act of 2019 and other related laws, and Department of Health and Human Services (HHS) data. I GAO-22-104600The lack of significant progress in implementing the requirements in the act is due, in part, to the department failing to prioritize the requirements of the act and not establishing an appropriate management and governance structure. Such a structure would include a lead operational division with defined roles and responsibilities for implementation of statutory requirements, and an organization to provide oversight of these efforts. During GAO's review, HHS began drafting a work plan intended to address the requirements of the 2019 act. However, HHS has not provided a time frame for completing the work plan.In January 2022, GAO designated HHS leadership and coordination of a range of public health emergencies as high risk. For more than a decade, GAO has reported on HHS's execution of its lead role in preparing for, and responding to, public health emergencies and have found persistent deficiencies in its ability to perform this role. Similarly, HHS has not provided the leadership necessary to carry out its required responsibilities in the 2019 act.Public health entities experienced a variety of challenges and identified lessons learned from the COVID-19 pandemic that could better inform HHS in developing and implementing the public health situational awareness and biosurveillance network. Specifically, state survey respondents identified a number of information-sharing challenges that they experienced in the management of public health information. The following summarizes the top four challenges state survey respondents most often rated as challenging.State Reported Challenges in Managing Public Health Information during COVID-19Additional challenges—limitations on data collected, increased reporting requirements, and impediments to health-related data sharing and collaboration—were identified by public health organizations at the national, state, and local levels. Thirty states identified lessons that HHS could use in planning for the network. The three lessons that states identified most often wereimprove public health reporting  by, for example, standardizing and sharing data among federal entities and states to improve surveillance needs;  	collaborate early with stakeholders  by, for example, involving state and local stakeholders throughout the entirety of emergency reponse activities; and	establish a public health infrastructure to enable data sharing  by, for example, implementing the network required by the 2019 act.After having over two years of experience in responding to COVID-19, HHS had not taken steps, as of March 2022, to identify, document, and share all of the challenges and lessons learned from the pandemic. These challenges and lessons could be incorporated into the planning and implementation of the public health situational awareness and biosurveillance network. Until HHS takes steps to identify, document, share, and incorporate lessons learned from the COVID-19 pandemic, opportunities to improve the response to future and ongoing public health emergencies by learning from past challenges will likely be missed.Why GAO Did This StudyThe COVID-19 pandemic has drawn attention to the urgent need for public health officials to access real-time information about emerging threats to enable them to make timely, responsive decisions. For over a decade, federal law has mandated that HHS improve the nation's situational awareness of these threats.The most recent mandate, enacted in 2019, included a provision for GAO to report on HHS's efforts to implement these improvements. The CARES Act also included a provision for GAO to conduct monitoring and oversight of the federal response to the pandemic.This report examines (1) the extent to which HHS has made progress toward implementing the requirements in the 2019 act; and (2) the challenges and lessons learned from COVID-19 that HHS could incorporate in planning for a situational awareness and biosurveillance network.GAO reviewed HHS documentation, such as grants provided to states, technical and reporting standards, and adoption plans. It also analyzed documentation and compared it to requirements in the act.In addition, GAO surveyed public health officials from 50 U.S. states, the District of Columbia, and five U.S. territories. Thirty-nine states, the District of Columbia and three U.S. territories (hereinafter collectively referred to as states) responded to the survey, for a response rate of 77 percent. GAO assessed these responses to identify COVID-19 challenges and lessons learned.&nbsp;Further, GAO interviewed representatives from eight public health organizations representing state and local levels, such as the National Governors Association and National Association of County and City Health Officials, as well as HHS officials.
- Electronic Health Records: Additional DOD Actions Could Improve Cost and Schedule Estimating for New System What GAO FoundThe Department of Defense (DOD) began deploying Military Health System (MHS) GENESIS—a commercial electronic health record system intended to integrate inpatient and outpatient medical and dental information in 2017. MHS GENESIS's contract award totals $5.5 billion. DOD's plans call for implementing MHS GENESIS in 24 waves or phases. The first wave was completed in October 2017 with the last wave expected to be deployed by December 2023 and additional activities planned through 2025.DOD has not fully met the characteristics and associated best practices for developing MHS GENESIS cost and schedule estimates, as shown below.GAO Assessment of DOD Cost and Schedule Estimates against Best Practice Characteristics			Cost estimate characteristic									Assessment of cost estimate									Schedule estimate characteristic									Assessment of schedule estimate								Comprehensive									Substantially met									Comprehensive									Substantially met								Well-documented									Partially met									Well-constructed									Partially met								Accurate									Substantially met									Credible									Partially met								Credible									Minimally met									Controlled									Substantially met					Legend: substantially met = DOD provided evidence that satisfies a large portion of the criterion; partially met = DOD provided evidence that satisfies about one-half of the criterion; minimally met = DOD provided evidence that satisfies a small portion of the criterionSource: GAO assessment of the Department of Defense (DOD) Military Health System GENESIS program documentation. | GAO-22-104521MHS GENESIS's cost estimate was unreliable because it did not substantially meet all four characteristics of a reliable cost estimate, as described in GAO's cost guide. Specifically, DOD minimally met the “credible” characteristic associated with reliable cost estimates, in part, because it did not provide evidence that a sensitivity analysis, a risk and uncertainty analysis, or an independent cost estimate were conducted. Reliable cost estimates are critical for successfully delivering IT programs.In addition, the subproject schedules did not meet all four characteristics of a high quality, reliable schedule. Because an integrated master schedule consolidates subproject schedules, errors and reliability issues in subproject schedules will be reflected in higher-level schedules. Therefore, the larger master schedule is unreliable. Specifically, the subproject schedules partially met the “well-constructed” characteristic associated with reliable schedule estimates, in part because their critical paths could not be validated or they exhibited total float values that could allow activities and milestones to slip months or years before delaying key program activities. A reliable schedule can assist with the systematic execution of a program and the means by which to gauge progress, identify and address potential problems, and promote accountability.Because the MHS GENESIS program cost and schedule estimates were not reliable, DOD increases the risk that management will not have the information necessary for effective decision-making. Following cost and schedule best practices can help minimize the risk of cost overruns and schedule delays, and would better position DOD for successful program implementation.Why GAO Did This StudyDOD operates one of the nation's largest health care systems providing health care to about 9.6 million beneficiaries. It relies on multiple legacy electronic health record systems to create, maintain, and manage patient health information. DOD determined that these systems, implemented over the past three decades, require modernization and replacement with a comprehensive, real-time electronic health record, MHS GENESIS.Congress included a provision in the Joint Explanatory Statement accompanying the  Consolidated Appropriations Act, 2021  for GAO to review DOD's deployment of MHS GENESIS. This report determines the extent to which DOD's MHS GENESIS's cost estimate and program schedule are consistent with best practices. GAO reviewed documentation supporting the program's October 2020 cost estimate against best practices. In addition, GAO reviewed the program's February 2021 integrated master schedule, specifically assessing three subproject schedules. Further, GAO interviewed DOD officials within the program office to understand their practices for developing and maintaining the cost estimate and program schedule.
- Artificial Intelligence: DOD Should Improve Strategies, Inventory Process, and Collaboration Guidance What GAO FoundThe 2018  Department of Defense (DOD) Artificial Intelligence (AI) Strategy  defines AI as the ability of machines to perform tasks that normally require human intelligence. The strategy and associated plans include some, but not all, characteristics of a comprehensive strategy.   For example, DOD's nine AI-related strategies and plans do not include full descriptions of resources and investments and risk associated with adoption of AI-enabled technologies (See fig.). Issuing guidance to include all characteristics of a comprehensive strategy in future AI-related strategies could help DOD be better positioned to help managers ensure accountability and responsible use of AI.Assessment of DOD Artificial Intelligence-Related Strategies and PlansDOD has begun to identify and report on its AI activities, but limitations exist in its AI baseline inventory, such as the exclusion of classified activities. DOD officials said these limitations will be addressed in subsequent phases of the AI inventory identification process. However, DOD has not yet developed a high-level plan or roadmap that captures all requirements and milestones. Such a plan would provide DOD with a high-level, end-to-end view of all the features necessary to accomplish the program's goal to provide a complete and accurate inventory of AI activities to Congress and to DOD decision makers.DOD organizations collaborate on AI activities, but can more fully incorporate leading collaboration practices. DOD uses a variety of formal and informal collaborative mechanisms that GAO's prior work has identified, such as interagency groups. DOD has partially incorporated leading collaboration practices, such as identifying leadership. However, DOD officials told us they are in the process of developing guidance and agreements that clearly define the roles and responsibilities of DOD components that participate in AI activities. By finalizing and issuing such guidance, DOD could help ensure all participants agree upon responsibilities and decision making on AI efforts across the department.Why GAO Did This StudyDOD strategies state that AI will transform the character of warfare, and failure to adopt AI technology could hinder the capability of warfighters to defend our nation. DOD is making organizational changes and investing billions of dollars to incorporate AI technology, such as establishing the Joint AI Center to accelerate the delivery of AI-enabled capabilities across DOD.House Report 116-442 accompanying the National Defense Authorization Act for Fiscal Year 2021, includes a provision for GAO to assess DOD's resources, capabilities, and plans for AI technology. This report evaluates the extent to which (1) DOD's AI Strategy and associated plans include characteristics of a comprehensive strategy; (2) DOD has identified and reported AI activities across the department; and (3) DOD collaborates on its AI activities. GAO reviewed relevant laws and DOD strategies that outline plans and processes to manage AI across the department, interviewed officials, and conducted a department-wide survey. This is a public version of a sensitive report that GAO issued in February 2022. Information that DOD deemed sensitive has been omitted.
- Freedom of Information Act: Selected Agencies Adapted to COVID-19 Challenges but Actions Needed to Reduce Backlogs What GAO FoundIn January 2022, GAO reported that the COVID-19 pandemic affected selected government-wide measures of Freedom of Information Act (FOIA) administration, while other indicators reflected ongoing longer-term trends. FOIA requests received declined by 8 percent and requests processed declined by 12 percent in fiscal year 2020, the first year of the pandemic, compared to the previous year.FOIA Requests Received and Processed Government-wide, Fiscal Years 2012 through 2020This report also found that four of five selected agencies--the Departments of Agriculture, Homeland Security, and Labor, and the Environmental Protection Agency—initially encountered temporary challenges preparing employees to work in the maximum telework environment. These challenges including working in a virtual environment and ensuring access to equipment at home. The agencies subsequently used various practices, such as providing interim releases of requested information, to help maintain operations.GAO has reported that selected agencies faced continuing challenges with FOIA request backlogs. From fiscal years 2012 to 2020, the government-wide backlog increased by 97 percent. GAO has made several recommendations to address these challenges, including that agencies develop specific plans to reduce backlogs. However, three of these recommendations from its January 2022 report and two from its 2018 review have not yet been implemented.Further, in 2021, GAO found that selected agencies had not (1) updated their policies and processes to reflect current proactive disclosure requirements, and (2) accurately and completely reported disclosures. Accordingly, it made six recommendations to these agencies to improve their management of proactive disclosures, which have not yet been implemented.Taking actions to address backlogs and make proactive disclosures could help enhance government transparency and the efficient use of agency resources.Why GAO Did This StudyFOIA seeks to improve the public's access to government information and promote openness and accountability in government. However, the COVID-19 pandemic presented challenges for FOIA administration by significantly affecting how federal employees performed their work as agencies adopted a maximum telework posture and limited on-site work.GAO was asked to testify on FOIA government-wide performance and the associated impact of the pandemic. Specifically, this statement summarizes the results from GAO's previously issued reports on (1) government-wide FOIA performance for fiscal year 2020 compared to fiscal year 2019 and long-term trends from fiscal years 2012 through 2020; (2) selected agencies' initial pandemic-related challenges and their use of leading practices to maintain FOIA operations; (3) selected agencies' continuing challenges with FOIA request backlogs; and (4) selected agencies' use of proactive information disclosures—making records publicly available without waiting for specific requests.To address these objectives, GAO summarized the results of pertinent FOIA reports it issued from 2018 to 2022. It also followed up with selected agencies on the extent to which they had implemented GAO's prior recommendations related to FOIA operations.For more information, contact James R. McTigue, Jr. at (202) 512-6806 or McTigueJ@gao.gov.
- Critical Infrastructure Protection: CISA Should Improve Priority Setting, Stakeholder Involvement, and Threat Information Sharing What GAO FoundThrough the National Critical Infrastructure Prioritization Program, the Cybersecurity and Infrastructure Security Agency (CISA) is to identify a list of systems and assets that, if destroyed or disrupted, would cause national or regional catastrophic effects. Consistent with the Implementing Recommendations of the 9/11 Commission Act of 2007, the program works to annually update and prioritize the list. The program's list is used to inform the awarding of preparedness grants to states. However, nine of 12 CISA officials and all 10 of the infrastructure stakeholders GAO interviewed questioned the relevance and usefulness of the program. For example, stakeholders identified cyberattacks as among the most prevalent threats they faced but said that the program's list was not reflective of this threat. Further, according to CISA data, since fiscal year 2017, no more than 14 states (of 56 states and territories) provided updates to the program in any given fiscal year. Ensuring that its process for determining priorities reflects current threats, such as cyberattacks, and incorporates input from additional states would give CISA greater assurance that it and stakeholders are focused on the highest priorities.In 2019, CISA published a set of 55 critical functions of government and the private sector considered vital to the security, economy, and public health and safety of the nation. According to CISA officials, this new National Critical Functions framework is intended to better assess how failures in key systems, assets, components, and technologies may cascade across the 16 critical infrastructure sectors. Examples of critical functions are shown below in CISA's four broad categories of “connect” (nine of the 55 functions), “distribute” (nine), “manage” (24), and “supply” (13).Examples of Cybersecurity and Infrastructure Security Agency (CISA) National Critical FunctionsCISA is currently carrying out a process to break down each of the 55 national critical functions (such as “supply water”) into systems (such as “public water systems”) and assets (including infrastructure such as “water treatment plants”), as illustrated below.Examples of Critical Infrastructure Systems and Assets That Support the National Critical Function “Supply Water”CISA plans to integrate the National Critical Functions framework into broader prioritization and risk management efforts, and has already used it to inform key agency actions. For example, CISA used the framework to analyze the impact of COVID-19 on critical infrastructure. Although CISA initiated the functions framework in 2019, most of the federal and nonfederal critical infrastructure stakeholders that GAO interviewed reported being generally uninvolved with, unaware of, or not understanding the goals of the framework. Specifically, stakeholders did not understand how the framework related to prioritizing infrastructure, how it affected planning and operations, or where their particular organizations fell within it. In response, CISA officials stated that stakeholders with local operational responsibilities were the least likely to be familiar with the National Critical Functions, which were intended to improve the analysis and management of cross-sector and national risks. Still, CISA officials acknowledged the need to improve connection between the National Critical Functions framework and local and operational risk management activities and communications. In addition, CISA lacks an available documented framework plan with goals and strategies that describe what it intends to achieve and how. Without such a documented plan, stakeholders' questions regarding the framework will likely persist.CISA offers physical and cybersecurity assessments to critical infrastructure partners, but the agency's 2020 reorganization resulted in challenges in communicating and coordinating the delivery of some cybersecurity services. According to regional staff, their ability to effectively coordinate the cybersecurity services that CISA headquarters delivered was impaired because of staff placement following the reorganization. Specifically, staff conducting outreach and offering a suite of cybersecurity assessments to critical infrastructure stakeholders are located in regional offices, while CISA offers additional cyber assessment services using staff from a different division—the Cybersecurity Division—which operates out of headquarters. Addressing these communication and coordination challenges can improve CISA's cybersecurity support.CISA analyzes and shares threat information related to critical infrastructure; however, stakeholders reported needing more regionally specific information to address those threats. For instance, selected stakeholders that GAO spoke to said that CISA's threat information helped them to understand the broader threat landscape, such as threats to election security and COVID-19 response efforts. Almost half (12 of 25) of the stakeholders reported needing additional information related to the threats specific to their regions and local infrastructure. Specifically, stakeholders told us that organizations in their regions were primarily concerned with active shooters, chemical spills, or biological attacks and, thus, needed information that was applicable to those threats.Why GAO Did This StudyThe risk environment for critical infrastructure ranges from extreme weather events to physical and cybersecurity attacks. The majority of critical infrastructure is owned and operated by the private sector, making it vital that the federal government work with the private sector, along with state, local, tribal, and territorial partners. CISA is the lead federal agency responsible for overseeing domestic critical infrastructure protection efforts.GAO was asked to review CISA's critical infrastructure prioritization activities. This report examines (1) the extent to which the National Critical Infrastructure Prioritization Program currently identifies and prioritizes nationally significant critical infrastructure, (2) CISA's development of the National Critical Functions framework, and (3) key services and information that CISA provides to mitigate critical infrastructure risks.GAO analyzed agency documentation and conducted interviews with critical infrastructure stakeholders representing the energy, water and wastewater systems, critical manufacturing, and information technology sectors; six of 10 CISA regions; and six states to understand the need for any improvements to CISA's efforts, among other things. GAO selected these six states based on population size and the amounts of grant awards received from DHS's State Homeland Security Program.