months, the agency averaged 6,000 minutes per month voice usage. The current plan allows for
16,200 minutes of voice monthly. The OIG-proposed plan provides 10,800 minutes, or about
4,000 minutes over actual use. If the usage rate increases, the agency could simply adjust its
plan upward — e.g., it could revert to 450 minutes of talk time.

By reducing the number of minutes per user each month, the agency would lower the monthly
fee from $68.44 to $49.99, or about $700 per month for all devices. Annualized, this would
result in a savings to the agency of $8,400 — with no decrease in service.

In fairness to OIT, it had plans to review the current plan against alternatives to best meet the
agency’s needs. Ina recent discussion with the Director, OIT, he told us that he recently learned
of the “300 minutes” option and planned to consider this plan along with several others. He also
planned to include in the contract a clause to allow the agency to add additional minutes when
needed in an event the agency goes over its total allocated plan minutes in a given month.

As the plan will expire in approximately two months, and since OIT is planning to revisit the
voice/data plan for the agency, we are not recommending any action beyond what the agency
told us is planned for.

Conclusion

The BlackBerry communication devices are a useful tool enabling FMC executives and
managers to stay connected to the office. It also possesses important emergency capabilities that
provide for continuous communications in a crisis when conventional means of communication
fail. To get the most from the program, it must be managed properly.

The OIG believes that the agency is doing an effective job managing the program. Staff
assigned the devices have used them responsibly. Most indicated that they are used primarily for
official business. Nevertheless, we believe that the agency needs to follow the lead of other
agencies and ask users to sign a user agreement to hold staff accountable should abuse occur, to
remind staff of its responsibilities and to educate staff on select functions.

We believe that some features may be underutilized. The Address Book is a useful tool that is
confusing to use and inconsistent in its provision of contact information. OIT must do more to
standardize the contact information and ensure that people know how to use it. Also, the agency
will be selecting a new voice/data plan at the conclusion of the current contract. In our review of
plans and options, the OIG was assisted by Verizon Wireless representatives who had ready
access to FMC usage records. We found their help valuable and suggest that agency considers
their input when identifying a new plan.

-10-


Office of Inspector General
Audit of the Management of BlackBerry Communication Devices

The Office of Inspector General (OIG) completed an audit of the Federal Maritime
Commission’s (FMC) management of its BlackBerry communication devices. This audit was
performed to assess whether the agency is managing the BlackBerry program efficiently and
effectively, and whether controls are in place to discourage program abuse.

L Background

The BlackBerry is a handheld device that provides users with e-mail, mobile telephone, text
messaging, Internet and other wireless services. In March, 2007, the agency contracted with
Verizon Wireless as its BlackBerry services provider. The primary intent of the program was to
enable senior managers to communicate with each other during various disaster scenarios. The
devices support continued communication during phone and Internet service disruptions through
the use of a dedicated frequency that does not rely on conventional (phone line / Internet)
infrastructure to operate. The devices also enable staff to remain “connected” to the agency when
off-site through mail and voice functions. The agency distributed 36 BlackBerry devices to
Commissioners, their legal counsel, senior management and area representatives.

Currently, the agency has four accounts with Verizon Wireless due to the varied times the
contracts were put into place. However, the agency plans to consolidate the accounts in the Fall
of 2008 when it re-evaluates its telecommunication requirements as part of its Networx!
implementation. Under the current plan, each user has a monthly allowance of 450 minutes that
is shared within that account. Unused minutes are pooled and become available for use to other
FMC users in the current billing cycle only, i.e., no “rollover” or “carryover” minutes. The plan
provides unlimited minutes from 9:01 p.m. to 5:59 a.m. during the week, 9:01 p.m. Friday, to
5:59 a.m. Monday, during the weekend, and unlimited calls to other Verizon Wireless subscribers
at all times. Long distance is included in the plan, although roaming charges may apply. The
calling plan also includes voicemail, call waiting, call forwarding and caller ID. There are no
additional charges for “surfing” the Internet and unlimited e-mail is included in the plan. The
devices have other capabilities, including three-way calling, call transfer and basic text
messaging. Some of these features have associated costs.

The agency pays $68.44 monthly, per BlackBerry, for these basic services. Additional services,
including directory assistance ($1.25 per call); text messages received ($.02 per text) and sent
'($.10 per text), roaming ($0.002 per kilobyte) and global roaming (variable charges), are billed
based on actual usage. During the scope of our review the agency incurred charges totaling $437
for these additional services — about $60 per month. In total, the agency spends about $31,000
per year for BlackBerry functionality.

' Networx replaces the FTS 2001 contract which expired January 2008. Networx, centrally managed by the
General Services Administration, allows agencies to buy a “laundry list” of services from among the largest telcom
companies in the United States at reduced rates.


Recommendation #3. We recommend that OIT standardize the contact list to
include (1) name and e-mail address for all FMC staff and (2) Blackberry phone
number for users of the device.

’ Response. The global address list (GAL) provides the name and e-mail address
for all FMC personnel. BB phone numbers were excluded by previous management.
OIT agrees that BB phone numbers should be added to the GAL and will update the
database to include this functionality by the end of FY 2008.

Recommendation #4. The OIG recommends that OIT clarify with Verizon Wireless
representatives the feasibility of centrally managing the PIN functionality and
clarify its use in a disaster situation.

Response. The BBs were acquired as an emergency communication tool for
disaster response and recovery operations for FMC’s critical personnel in the event of a
critical incident or disaster. In the event of major disaster and communication failure,
PIN messaging can be used as an alternative means to send messages instead of email or
voice since PIN messages go directly through the BB network and are not routed through
the internet. PIN information is stored on FMC’s BB Enterprise Server and can be
centrally managed. OA and OIT commit to centrally managing FMC’s PINs repository to
ensure that PINs and contact information is kept current in the BB address book. The
effective date for this corrective action is immediate.

Recommendation #5. The OIG recommends that OIT notify Verizon Wireless that
proper billing procedures require that invoices be sent to BPD for processing and
that future invoices sent to the FMC will be returned to Verizon Wireless without
payment, pending proper procedures.

Response. The OA agrees that proper billing procedures require invoices be sent
to BPD for processing and not directly to OIT. OA and OIT have contacted Verizon
Wireless and BPD to request that future invoices be sent to BPD first for processing, and
will return to Verizon Wireless without payment any invoices received directly from
Verizon, effective immediately.

If you have any questions about these comments, please let me know.

eee Haywood

ce; Director, Office of Information Technology


The agency also incurs additional charges related to broadband access, a service that allows the
user to use the BlackBerry to gain faster Internet capability by connecting the device to a laptop
or computer. OIT procured this service for two employees at a nominal monthly cost to the
agency ($30).

Cc Blackberry Address Book Functionality is Difficult to Use and Inconsistent
in Content

As part of our review, the OIG heard criticisms from staff about missing or inaccurate
information in the BlackBerry’s Address Book. The BlackBerry’s Address Book is “synced” to
the Outlook Contacts e-mail function. Contact information added to Outlook is automatically
uploaded to the BlackBerry Address Book.

Most users we spoke with liked the Address Book, but complained that it was incomplete, i.e., it
did not contain complete contact information for BlackBerry users nor contact information for
general staff (those not issued a BlackBerry). The OIG verified that contact information was
incomplete for BlackBerry users, but found that general staff contact information was available
through the BlackBerry Address Book. At least part of the blame for this misunderstanding lies
in the BlackBerry configuration and inadequate staff training on the BlackBerry’s functions.

From the Address Book “find” feature, employees need only type the first and last name of the
individual at the prompt. Admittedly, we were confused by the set up of the contact list. For
example, when we searched for general staff using the contact list, the device responded with
“No Addresses*.” Our first inclination was to give up. But if we persisted in the face of this
apparent failure, we were eventually provided with the contact information. This required that
we use the flywheel to navigate to the (1) look up and (2) view options, after being told that no
addresses existed for a particular individual. These instructions were not communicated to staff
either verbally or in user tip sheets or manuals. This useful function needs to better advertised
and explained to staff.

The OIG also found that contact information obtained this way is inconsistent. There should be
three data elements for each BlackBerry user (e-mail address, office and mobile numbers) and
two clements for general staff (e-mail address and office phone number). In most cases, the
office number and e-mail address appear for all staff. The BlackBerry phone number for staff
with the device appears for some staff, but not others. This information should be standardized,
e.g., the e-mail address and office number should appear for all staff. For BlackBerry users, the
mobile phone number should also appear.

This function is especially useful because the updates are centrally managed on the agency’s
Outlook server, requiring no effort from the 36 users for updated staff contact information.


III. Results of Audit

The agency is generally managing the BlackBerry program effectively, but there is room for
improvements that will reduce expenses for the program. We commend staff (i.e. BlackBerry
users) for not abusing the wireless services and management for eliminating unnecessary
features. Actual use of phone minutes is well below the plans’ allowance. While we identified
heavy usage among few employees, the agency’s “pooled minutes” feature ensured that the
agency incurred no additional costs as a result of these exceptions. (The e-mail features allow
for unlimited transactions with no restrictions. Consequently we did not assess usage for this
service). OIT management has issued policies and procedures to help guide staff in the proper
use of the devices. Help Desk staff are available to assist users as needed. OIT reviews invoices
on a monthly basis prior to approving payment and is aware of usage patterns and has responded
to unique needs of select staff for additional work-related features.

Notwithstanding these positive observations, the OIG believes that the agency should take
additional steps to prevent potential problems, reduce vulnerabilities and save money. The
recent (May 2008), revision of the agency’s PDA policy is a step in the right direction.
However, an OIG survey indicates that many users are unfamiliar with their responsibilities
regarding BlackBerry use. Employees are not required to sign agreements with the agency as
other sister agencies require. These agreements hold users accountable for proper use of the
devices and spell out employee responsibilities. This important control will help to ensure that
the agency continues to stay within service plan limits.

BlackBerry users were poorly informed about device’s Address Book functionality. This is a
very useful function that is underused and is poorly configured. It enables users to search the
Address Book for contact information for all FMC employees. The OIG found that the
information available varies by staff. For example, mobile phone numbers for BlackBerry users
were not consistently available in the Address Book. The Address Book also erroneously
notifies users that contact information is unavailable when searching the database.

OIT should take a more active role in managing the PIN functionality of the BlackBerry.
Currently, staff are responsible for updating PIN codes (with OIT assistance, if requested) when
employees leave and/or new employees arrive. The primary intent of issuing BlackBerry devices
is to enable senior staff to communicate during periods of interrupted conventional
communications. Outdated, inaccurate or missing PINs ensure that this functionality will not
operate if needed. We found several instances of outdated and missing PIN codes on BlackBerry
devices.

OIT also needs to scrutinize monthly bills more closely than they do now. We identified
overcharges for minimal amounts that, if not corrected, will continue to be billed. Regardless of
the amounts, this is simply wasteful and is easy to correct.

Finally, the agency should revisit its BlackBerry service plan. Given the agency’s usage pattern
over the prior 12 months, the OIG believes that the agency could save about $8,400 a year
simply by selecting a plan that better reflects this pattern while still providing ample overage
allowances. OIT should also review usage records to identify unused BlackBerry devices that


The Office of Information Technology (OIT) is responsible for managing the agency’s
BlackBerry program, to include procuring devices/services for staff use, assisting staff with
operational issues, monitoring usage, approving monthly invoices for payment and developing
guidance for staff when using the BlackBerry. Primary guidance is contained in OIT-P02,
Personal Digital Assistant (PDA) Policy, dated May 16, 2008. General guidance pertaining to
electronic equipment include OIT-P06, Electronic Mail Policy (May 16, 2007); OIT-P10,
Remote Access Policy (May 16, 2007); and Personal use of FMC Office Equipment
(September 9, 2005).

II. Objective, Scope, and Methodology

The objective of the audit was to assess whether the agency is managing the BlackBerry program
efficiently and effectively. To address the objective, the OIG reviewed the Verizon Wireless
contract with the Federal government through the General Services Administration (GSA). We
identified and verified the BlackBerry inventory and associated Personal Identification Numbers
(PIN) assigned to each user. We reviewed other Verizon Wireless contract plans to compare
rates and services.

The OIG interviewed the OIT Director and staff to obtain an understanding of their
responsibilities in managing the program and staff in the Office of Financial Management
(OFM) regarding invoice processing. The OIG also interviewed representatives from Verizon
Wireless to gain an understanding of services and costs.

The OIG reviewed the agency’s FY 2008 purchase order with Verizon Wireless to identify funds
obligated for BlackBerry procurement and service, and traced invoice payments through the
financial system to reconcile invoices. We selected invoices for the period October 2007
through April 2008 for detailed review. We analyzed the Verizon Wireless report titled
“Overview of Lines” that contained voice and e-mail usage and OIT inventory logs that
contained BlackBerry phone number of employees. This information enabled us to document the
agency’s actual usage, identify ancillary service requirements and opine on whether the agency’s
service plan best meets its needs.

We reviewed the agency’s wireless communications policies and procedures for PDA and
electronic equipment usage to assess the quality of the guidance available to staff and to
determine whether staff are properly informed of its responsibilities. We surveyed the agency’s
BlackBerry users to determine their familiarity with program rules, provisions and limits.

We conducted this performance audit from April, 2008, through July, 2008, in accordance with
generally accepted government auditing standards. Those standards require that we plan and
perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our
findings and conclusions based on our audit objectives. We believe that the evidence obtained
provides a reasonable basis for our findings and conclusions based on our audit objectives.


The survey also revealed that respondents used the BlackBerry approximately 73 percent of the
time for e-mail communication; 16 percent for voice communication and 11 percent for other
applications such as Internet, calendar, text messaging, etc. These features were used for official
business approximately 97 percent of the time.

The agency provides broadband access on the BlackBerry upon request based on documented
need. However, the new policy did not provide any guidance to address this service.

Recommendation

1 We recommend OIT require PDA users to sign an acknowledgement of their
understanding of the PDA Policy and maintain the agreement within the OIT. At a
minimum, the agreement should discuss “free versus anytime” minutes, e-mail and
Internet use. The agreement should also, as discussed in the PDA policy, hold employees
accountable for proper use, including the types of information that can be transmitted.

The OIG has attached a policy used by a sister agency as a template for use by the FMC.

B. Additional Charges Incurred

The Verizon Wireless calling plan includes features such as call waiting, call forwarding, caller
ID, directory assistance, three-way calling, call transfer, basic voicemail, basic text messaging,
and global and national roaming minutes. Select features are billed to the agency on a per usage
basis, including directory assistance, basic text messaging, national access and global roaming.

The directory assistance feature allows the user to obtain a phone number with a connect feature
for a fee of $1.25 per call. This feature has the greatest potential for abuse with concomitant
costs to the agency. OIT should alert users to these charges to reduce unnecessary personal and
business use of this feature. Basic text messages received or sent from the BlackBerry device are
$.02 per text and $.10 per text, respectively.> Global roaming minutes is based on kilobyte (Kb)
usage with varied costs and national access roaming minutes is based on Kb used which is
$0.002.

We reviewed the invoices for services rendered on October 2007 through April 2008 and found
employees incurred additional charges of $436.73, or just over $60 per month. We could not
determine how much, if any, of these additional charges were for personal versus business use.
These amounts do not appear to us to be excessive and we do not believe that they require
additional controls to curtail non-business portions of this use at this time — beyond informing
staff as mentioned above.

5 Management told the OIG it disabled text message send option to eliminate the associated costs.


Audit of the Management of
Blackberry
Communication Devices
A08-05

August 2008


manage the PIN without specialized software through Outlook’s Global Address Book, a feature
currently used to sync contact information with the Blackberry, as discussed above.

Management also told us that PINs can be changed by users, discounting their utility in a crisis
situation. Verizon Wireless representatives told the OIG that in order to change the PIN, a user
needs certain network privileges, which users outside of OIT simply do not have.

Recommendation

4. The OIG recommends that OIT clarify with Verizon Wireless representatives the
feasibility of centrally managing the PIN functionality and clarify its use in a disaster
situation.

E. Payments Made Against Wireless Obligation

OIT is responsible for obtaining services for employees after the approval of the Director of
Administration. The Director of OIT is the Contracting Officer Technical Representative
(COTR) for the contract and is responsible for approving and maintaining files of paid invoices.

According to language in the agency’s agreement with Verizon Wireless, monthly invoices for
the BlackBerries are to be sent from Verizon Wireless directly to the Bureau of Public Debt
(BPD), the agency’s agent for processing invoices. When BPD receives the invoices, they are
date stamped, scanned and forwarded to the OFM’s accounts payable e-mail box. Staff from
OFM print the invoices, date stamp them and forward a copy to the COTR for approval.

Centralizing the receipt and tracking of invoices helps to ensure that these bills will be paid on
time. Conversely, when invoices are sent directly to the agency / COTR by the vendor, errors
and omissions are more likely because tracking invoices by payment due date is not a routine
part of the bill-paying process for program staff. Individuals can simply forget about the invoice.

The OIG learned that Verizon Wireless sends invoices to BPD and to the agency, although not to
both locations during the same billing cycle. However, Verizon Wireless should be instructed
that invoices sent to the FMC will be returned for proper invoicing procedures.

We reviewed the fiscal year 2008 purchase order for the BlackBerries and payments made
against the obligation. We reconciled the invoices with the report from BPD’s financial system.
We also reviewed the listing provided by BPD which provides a description and cost of service
by user name and phone number.

Through our reconciliation of the invoices to payments we found that the agency erroneously
applied a small credit ($30.83) to a January 2008 bill. We also found that the agency paid taxes
on two occasions on invoices, even though the agency is tax exempt. Management attributed
this error to BPD. However, BPD can not make a payment against any obligation without the
approval of the agency. In both cases, the amounts were small ($11.53). But, as time goes on,


Recommendations

De We recommend that OIT prepare a short description (i.c., tip sheet) on how to access staff
contact information from the BlackBerry’s Address Book.

3. We recommend that OIT standardize the contact list to include (1) name and e-mail
address for all FMC staff and (2) BlackBerry phone number for users of the device.

D. Managing User Personal Identification Numbers (PIN)

The agency’s BlackBerry devices support “PIN to PIN” communications in addition to the more
conventional and widely used e-mail and voice communications. The PIN is a unique cight digit
number assigned to each BlackBerry device on the wireless network. It allows the employce to
send messages that bypass the mail server.* The PIN must be accurate to ensure communications
are received.

We spoke with the OIT Director about maintaining the PIN listing, including updating for new
staff and removing departing staff. Unlike general contact information in the Address Book, it is
the responsibility of the BlackBerry users to update the PIN information on their own devices.
OIT assists the user with this task by providing a listing through the agency’s intranet of the
user’s name, BlackBerry and PIN number, along with instructions for updating the PINs. The
OIG believes that this responsibility is not well known or understood among users.

We believe that requiring 36 users to perform this identical function multiple times a year is not
an efficient use of the agency’s time. Also it is not clear to us how staff will learn that a new
employee will be a BlackBerry user, unless staff proactively performs a periodic crosscheck of
the PIN user page on the intranet. The OIG learned of two new BlackBerry users, the Chicf
Information Officer and the Information System Security Officer, following this methodology.
Several staff we spoke with told the OIG that they did not have PIN information for these two
critical personnel on their devices.”

The OIG believes that it is far more efficient and effective to have one person centrally update all
accounts periodically (e.g., monthly) than to require 36 users to do the same function as often.
Verizon Wireless representatives told the OIG that PIN management can easily be performed
centrally. Even if the Blackberry Enterprise Server (BES) goes down during a disaster, the
BlackBerry user will still have the capability to communicate through “PIN to PIN” messaging.

Management told the OIG that the agency tried unsuccessfully to centrally manage the PINs.
Both management and Verizon Wireless representatives agree that specialized software is needed
to sync these devices. On the other hand, Verizon Wireless representatives told us that they

* To compose a PIN message, the employee would enable the BlackBerry’s mail application and choose “Compose
PIN.” When the screen appears, it resembles an e-mail message; however, the message does not appear on the
agency’s desktop e-mail system.

The OIG spoke to seven users regarding updating staff contact listings. No users had updated PIN information
on their devices.


the agency pays for even though these devices are not being used. We found four BlackBerry
devices that are assigned to staff that were rarely turned on.

Details of these and other findings are provided below.

A. PDA Policy Needs Further Refinement

The OIG reviewed four agency policies covering BlackBerry use by staff? The May 2008
revised PDA Policy provides guidance on monthly “minutes” allocations for users and identifies
procedures for lost or stolen devices containing agency information. The policy also provides
detailed guidance for use of non-FMC PDAs.

The OIG believes that the revised policy represents an improvement over the prior policy in that
it identifies the plan minutes, which enables staff to monitor their usage against the plan limits.
The PDA policy document does not discuss personal use of the device, other than to warn
employees against abuse of the phone (e.g., excessive personal calls). The policy does not
provide guidance as to what constitutes excessive usage. The policy also is silent on Internet and
e-mail usage.

The revised policy refers to the agency’s workstation policy for additional PDA guidance. The
FMC workstation use permits employees “limited” use of Commission office equipment for
personal needs if the use does not interfere with official business and involves minimal
additional expense to the government. The limited personal use of Commission office
equipment should occur during the employee’s non-work time. The agency also goes to great
lengths to provide guidance for staff using personal PDA’s to log into the FMC network. The
majority of the PDA policy focuses on this type of transaction, yet OIT managers told us that
they are not aware of any such devices in use at the agency.

The OIG noted that the PDA policy was not provided to users, and users were not informed of its
recent (May 2008) update. The policy resides on the agency’s intranet, requiring staff to search a
drop-down menu at the bottom of the agency’s intranet page. This may explain why half of the
respondents to the OIG user survey indicated that they have not read the policy. As the chart
below illustrates, most (75 percent) of the respondents to the survey were unfamiliar with the
personal use policy as it pertained to the PDA.

Do you know: Y N
a) The number of “plan minutes” allocated to each PDA 4 10
b) The availability of unlimited or “free” voice minutes 5 9
c) Restrictions on e-mail (volume) usage 1 13
d) Limitations on Internet browsing 3 11

? ‘The OIG reviewed the PDA Policy dated May 16, 2007, and the May 16, 2008, revision. We also reviewed the
agency’s Electronic Mail Policy, dated May 16, 2007; Remote Access Policy, dated May 16, 2007; and Personal
Use of FMC Office Equipment, dated September 9, 2005.

-4-


I. BACKGROUND

TABLE OF CONTENTS

Il. OBJECTIVE, SCOPE AND METHODOLOGY.........sccscssssssssssnsasensnsnsesenensassceseseosens 2
THT. RESULTS OF AUDIT .........ccccssssssssesesssccssssssesssssnccesecnesesesscseseesenensscencnencaseneneneasseneasans 3
A. PDA Policy Needs Further Refinement ..
B. Additional Charges Incurred .........sssssssssssssssssesessesensesenensenenensaseneneneseeneaconssenensosenes 5
C. BlackBerry Address Book Functionality is Difficult to Use and Inconsistent in
Conten........ccccccscsscscescsccscsscsrscsscnssassssscnssosessscnssasessssnsesrossssnssssossscnssessssscnsceesasestecsees 6
D. Managing User Personal Identification Numbers (PIN)...
E. Payments Made Against Wireless Obligation ...............c.csssssssssssssssssseeesenenenenenesenes 8
F. Current Plan vs. Proposed Plan ........scsssssssssssssssssssssssscssscssssssssassscsssssesssssescsnseeees 9

IV. Appendix ....

V. MANAGEMENT COMMENTS .....scsscsssssssssssssssssensacenensosenenensnssnsssessnensssssnesorecesensecens 13


Appendix

Blackberry Device User Agreement

PERSONAL INFORMATION
Last Name. First Name Middle Initial __
Location Phone Number

Organization
BLACKBERRY INFORMATION

Barcode Number Serial Number

Applicability:

This BlackBerry Device Users’ agreement applies to any handheld BlackBerry device, which is
ace to download e-mail from the Blackberry Server located at Headquarters,

Background:

Because security features of the BlackBerry system are limited, each user must follow a strict set of
security guidelines to prevent unauthorized use of the BlackBerry device and potential compromise of
the = network. The BlackBerry device is a computing device and as such must be used in strict
accordance with [iJ Computer Security policy.

1. This Blackberry device is provided for official U.S. Government use exclusively. Only
official U.S. government information may be stored on or transmitted by this device. Only
authorized users may use this device. Consequently, individuals using this device have NO
EXPECTATION OF PRIVACY in either the use of or the information processed by this
device.

2. The use of this device and signing this agreement constitutes CONSENT TO CONTINUOUS
MONITORING of real time communications as well as stored information for all authorized
purposes including monitoring by the National Security Agency for communications security
purposes.

3. THIS DEVICE IS NOT SECURE. IT CANNOT, UNDER ANY CIRCUMSTANCES,
BE USED TO TRANSMIT CLASSIFIED OR SENSITIVE INFORMATION.

4. The user should assume that any messages transmitted or received by this device could
become public knowledge.

5. Users may not change any of the device’s default settings without prior approval of the Help
Desk.

6. The user will not disclose their Blackberry device PIN to others. The BlackBerry PIN is not
the same as the paging PIN.

Ps i Os


FEDERAL MARITIME COMMISSION

Office of Administration

Memorandum
To ' : Inspector General Date: 28 August 2008
From : Deputy Director of Administration

Subject : Comments on Draft Review of Audit of the Management of Blackberry
Communication Devices

I have reviewed the recommendations in the instant Review. Below are our
comments regarding corrective actions which will be effected to address the
recommendations.

Recommendation #1. We recommend OIT require PDA users to sign an
acknowledgment of their understanding of the PDA Policy and maintain the
agreement within the OIT. At a minimum, the agreement should discuss “free
versus anytime” minutes, e-mail and Internet use. The agreement should also, as
discussed in the PDA policy, hold employees accountable for proper use, including
the types of information that can be transmitted.

Response. OIT is completing a new User Agreement which it will recommend to
the SES staff for comment/approval by first quarter of FY 2009.

Recommendation #2. We recommend that OIT prepare a short description (i.e., tip
sheet) on how to access staff contact information from the Blackberry’s Address
Book.

Response. OIT offers training to users when they are issued a Blackberry (BB).
Only a few FMC staff approached OIT to request additional help that was quickly
granted. OIT provided a user guide to each BB user that addresses how to use the
address book and the look-up. In September 2008 OIT will be upgrading the BBs and
issuing new user guides. OIT will inform users at that time about how useful the lookup
feature is and encourage them to research it in the user’s guide. OIT will continue to
offer any assistance needed to users on the use of their BBs when requested.


BlackBerry users were poorly informed about the device’s Address Book
functionality. This is a very useful function that is underused and is poorly configured. It
enables users to search the Address Book for contact information for all FMC employees.

The OIG found that the information available varies by staff. For example, mobile phone
numbers for BlackBerry users were not consistently available in the Address Book.

OIT should take a more active role in managing the PIN functionality of the
BlackBerry. Currently, staff are responsible for updating PIN codes (with OIT
assistance, if requested) when employees leave and/or new employees arrive. The
primary intent of issuing BlackBerry devices is to enable senior staff to communicate
during periods of interrupted conventional communications. Outdated, inaccurate or
missing PINs ensure that this functionality will not operate if needed. We found several
instances of outdated and missing PIN codes on BlackBerry devices.

OIT also needs to scrutinize monthly bills more closely than they do now. We
identified overcharges for minimal amounts that, if not corrected, will continue to be
billed. Regardless of the amounts, this is simply wasteful and is easy to correct.

Finally, the agency should revisit its BlackBerry service plan. Given the agency’s
usage pattern over the prior 12 months, the OIG believes that the agency could save about
$8,400 a year simply by selecting a plan that better reflects this pattern while still
providing ample overage allowances. OIT should also review usage records to identify
unused BlackBerry devices that the agency pays for even though these devices are not
being used. We found four BlackBerry devices that are assigned to staff that were rarely
turned on.

The OIG made five recommendations to correct deficiencies noted in the report.
Two of the recommended actions have already been taken and management has informed
the OIG that the remaining recommendations will be implemented by the end of this
year. Management’s comments to the report’s findings and recommendations are
attached.

Finally, we would like to thank OIT management and staff for their cooperation
and assistance on this audit.

oe: Commissioners


FEDERAL MARITIME COMMISSION
800 North Capitol Street, N.W.
Washington, DC 20573

August 29, 2008

Office of Inspector General

TO: Anthony Haywood, Deputy Director

Office of Administration

SUBJECT: Transmittal of OIG Audit Report

FROM: Adam R. Trzeciak
Inspector Gener:

Attached for your information is a recently completed Office of Inspector General
(OIG) report entitled Audit of the Management of BlackBerry Communication Devices
(A08-05). The objectives of the audit were to assess whether the agency is managing the
BlackBerry program efficiently and effectively, and whether controls are in place to
discourage program abuse.

The OIG found that the agency is generally managing the BlackBerry program
effectively, but there is room for improvements that will reduce program expenses. We
commend staff (i.e. BlackBerry users) for not abusing the wireless services and
management for eliminating unnecessary features. Actual use of phone minutes is well
below the plans’ allowance. While we identified heavy usage among a few employees,
the agency’s “pooled minutes” feature ensured that the agency incurred no additional
costs as a result of these exceptions. OIT management has issued policies and procedures
to help guide staff in the proper use of the devices. Help Desk staff are available to assist
users as needed. OIT is aware of usage patterns and has responded to unique needs of
select staff for additional work-related features.

Notwithstanding these observations, the OIG believes that the agency should take
additional steps to prevent potential problems, reduce vulnerabilities and save money.
The recent (May 2008), revision of the agency’s PDA policy is a step in the right
direction. However, an OIG survey indicates that many users are unfamiliar with their
responsibilities regarding BlackBerry use. Employees are not required to sign
agreements with the agency as other sister agencies require. These agreements hold users
accountable for proper use of the devices and spell out employee responsibilities. This
important control will help to ensure that the agency continues to stay within service plan
limits.


errors, unless corrected, reappear and become more difficult to catch. OIT staff told the OIG that
it reviews costs by comparing the current and prior month’s Verizon Wireless’ usage reports and
unless there are significant deviations, a line by line comparison is not made. To assist in this
review the COTR should maintain a spreadsheet to include the obligations, modifications,
invoiced amounts and credits against obligations to maintain an accurate accountability of
charges against the obligation.

Discussions with BPD revealed that other charges to the agency went undetected. We suspect it
is due to OIT’s review methodology. BPD confirmed that overcharges occurring in May 2007
are still unresolved with Verizon Wireless.

Recommendation

5. The OIG recommends that OIT notify Verizon Wireless that proper billing procedures
require that invoices be sent to BPD for processing and that future invoices sent to the
FMC will be returned to Verizon Wireless without payment, pending proper procedures.
F. Current Plan vs. Proposed Plan

The current Verizon Wireless plan with GSA has a period of performance of December 3, 2005

through December 2, 2008. The FMC is currently on an annual contact with a performance
period of October 1, 2007, through September 30, 2008.

We reviewed Verizon Wireless
report titled “Overview of
Lines” to compare actual
usage to the plan’s allowance
to determine whether the
current plan best meets the
agency’s needs. We found
that most lines did not use
near the 450 minutes allotted
per the plan. With the shared
feature, the agency was paying
for thousands of unused
minutes each month, as
depicted by the chart to the
left.

Current Plan vs. Proposed Plan

eve)
Actual Mira Used
Proposed Pian Alowanee (900 minutes per
deve)

iS Plan Allowance (450 minutes per
lo

Rather than paying for unused minutes, the OIG researched the costs of plans with identical
features, but less monthly (pooled) minutes. Discussions with Verizon Wireless revealed that a
plan providing 300 minutes per user with “pooling” would meet the agency’s needs while still
providing an adequate “cushion” for occasional overages. For example, over the previous seven


7. The user agrees to change the BlackBerry device password as defined by ied security policy.
Be aware that this may limit the symbols used for the BlackBerry password, since they are not
all selectable from the BlackBerry device standard keyboard.

8. Ifthe user notices that the stored email messages are suddenly missing for no apparent
explanation or the device otherwise malfunctions, DO NOT USE THE DEVICE OR TRY
TO FIX IT. It may have been tampered with. Return the device as soon as practicable to the
HELP DESK.

9. The user agrees not to add any unauthorized software to the BlackBerry. To add any needed
software, user will contact the HELP DESK.

10. The user agrees not to install any software downloaded through e-mail, workstation, or
through the Internet on the BlackBerry.

11. The user agrees not to deliberately load any file with an <.exe>, <.com>, <.bat>, or <.vbs>
extension to the BlackBerry.

12. The user agrees to delete any files with an <.exe>, <.com>, <.bat>, or <.vbs> extension which
may be accidentally loaded from the BlackBerry to the BlackBerry Server. When this occurs,
the user does not have to contact HELP DESK unless the file in question is executed. If there
are any uncertainties, the user agrees to contact the HELP DESK.

13. If the BlackBerry is believed to be lost or stolen, the user agrees to report the loss to the HELP
DESK immediately.

14. The user agrees to report immediately any potential breaches in security to the HELP DESK,
where it will then be reported to the Information Security Systems Officer.

15. Misuse of this device will subject the user to appropriate disciplinary or criminal action.
By signing this user agreement, you are providing your consent to monitoring for all authorized

purposes and you are acknowledging that you accept all the terms described above, as well as
those explained in the security briefing, and agree to abide by them.

Privacy Act Statement

We collect this information under the Federal Information Security Management Act (Pub. L. No. 107-347, t. III), the Government
Employees Training Act (5 U.S.C. 4118), and Office of Personnel Management regulations (5 CFR part 930). Our principal
purpose is to ensure compliance with federal information security training requirements. [Optional: list any other major "routine
uses” that are compatible with the purpose for which the information is being collected.] Please visit

http://www. gov/foia/listofpasystems.htm to read about other routine uses of the information, which will be kept in the agency's
personnel and computer systems user records. Although this form is voluntary, we may deny you access to agency computers
or other information technology resources if you do not complete it.

Agreed to By:

User Name/Office Symbol/Phone # Signature Date

Pa