Polar Satellites: NOAA Faces Challenges and Uncertainties that Could Affect the Availability of Critical Weather Data
Published: 2016-07-07T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Polar-orbiting satellites provide data that are essential to support weather observations and forecasts. NOAA is preparing to launch the second satellite in the JPSS program in March 2017, but a near-term gap in polar satellite coverage remains likely. Given the criticality of satellite data to weather forecasts and the potential impact of a satellite data gap, GAO added this area to its High-Risk List in 2013. This statement addresses the status of the JPSS program and plans for future satellites, NOAA's efforts to depict and update satellite timelines, and the JPSS program's implementation of key information security protections. This statement is based on a May 2016 report on JPSS and a draft report on satellite timelines. To develop the draft report, GAO reviewed agency procedures for updating satellite timelines, compared timelines to best practices and agency documentation, and interviewed officials.
section_title: What GAO Found
paragraphs: As highlighted in a May 2016 report, the National Oceanic and Atmospheric Administration's (NOAA) Joint Polar Satellite System (JPSS) program has continued to make progress in developing the JPSS-1 satellite for a March 2017 launch. However, the program has experienced technical challenges which have resulted in delays in interim milestones. In addition, NOAA faces the potential for a near-term gap in satellite coverage of 8 months before the JPSS-1 satellite is launched and completes post-launch testing (see figure). NOAA has also begun planning for future polar satellites. However, uncertainties remained on the best timing for launching these satellites, in part because of the potential for some satellites already in orbit to last longer. NOAA did not provide sufficient evidence that it had evaluated the costs and benefits of launch scenarios for these new satellites based on updated life expectancies. Until this occurs, NOAA may not make the most efficient use of investments in the polar satellite program.
Note: The afternoon orbit is one of three primary polar orbits providing needed coverage for numerical weather models.
As noted in a draft GAO report, NOAA publishes “flyout charts” depicting satellite timelines to support budget requests and appropriations discussions. The agency regularly updates its charts when key changes occur. However, the charts do not always accurately reflect data from other program documentation such as the latest satellite schedules or assessments of satellite availability. NOAA also has not consistently documented its justification for chart updates or depicted lifetimes for satellites beyond their design life, and has not finalized a policy for updating its charts. As a result, the information NOAA provides Congress on the flyout charts is not as accurate as it needs to be, which could result in less-than-optimal decisions.
GAO reported in May 2016 that, although NOAA has established information security policies in key areas recommended by guidance, the JPSS program has not yet fully implemented them. Specifically, while the program has implemented multiple relevant security controls, it has not yet fully implemented almost half of the recommended security controls, did not have all of the information it needed when assessing security controls, and has not addressed key vulnerabilities in a timely manner. Furthermore, NOAA has experienced 10 key information security incidents related to the JPSS ground system, including incidents regarding unauthorized access to web servers and computers. Until NOAA addresses these weaknesses, the JPSS ground system remains at high risk of compromise.
section_title: What GAO Recommends
paragraphs: In its May 2016 report, GAO recommended that NOAA assess the costs and benefits of different launch decisions based on updated satellite life expectancies, and address deficiencies in its information security program. NOAA concurred with these recommendations. GAO's draft report includes recommendations to NOAA to improve the accuracy, consistency, and documentation supporting updates to satellite timelines, and to revise and finalize its draft policy governing timeline updates. This report is currently at the Department of Commerce for comment.

section_title: Letter
paragraphs: Thank you for the opportunity to participate in today’s hearing on an  important satellite acquisition program within the Department of  Commerce’s National Oceanic and Atmospheric Administration (NOAA).  In 2010, NOAA initiated the Joint Polar Satellite System (JPSS) program  with assistance from the National Aeronautics and Space Administration  (NASA). NOAA launched the first satellite in the JPSS program in  October 2011, and plans to launch the next satellite by March 2017.  NOAA also plans to launch other similar satellites in the future.
The JPSS program is critical to the United States’ ability to maintain the  continuity of data required for weather forecasting. According to officials  at NOAA, a gap in polar satellite data would result in less accurate and  timely weather forecasts and warnings of extreme events, such as  hurricanes, storm surges, and floods. Such degradation in forecasts and  warnings would place lives, property, and our nation’s critical  infrastructures in danger. Given the criticality of satellite data to weather  forecasts, the possibility of a satellite data gap, and the potential impact of  a gap, we added this area to our High-Risk List in 2013 and it remained  on the High-Risk List in 2015.
This statement summarizes a recently issued report and key findings from  a draft report on (1) the status of the JPSS program and plans for future  satellites, (2) NOAA’s efforts to depict and update satellite timelines; and  (3) the JPSS program’s implementation of key information security  protections. Specifically, this statement is based on a May 2016 report  detailing NOAA’s progress on the JPSS satellite program with respect to  schedule and key risks, its efforts to plan and implement a follow-on polar  satellite program, and the JPSS program’s implementation of key  information security protections. More detailed information on our  objectives, scope, and methodology can be found in the issued report.
This statement is also based on a draft report that includes the results of  work we performed for the House Committee on Appropriations for  information on NOAA’s efforts to depict and update polar satellite timeline  information. For our draft report, we reviewed NOAA policies, procedures,  and documentation on recent updates to its satellite timelines, compared  the timeline updates to other agency documentation and support  materials, and interviewed agency officials. We reviewed information from  the draft report with agency officials and made technical changes as  appropriate. This draft report is currently at the Department of Commerce  for official comment. We expect to issue the report by September 2016.
The work upon which this statement was based was conducted in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: Since the 1960s, the United States has operated polar-orbiting satellite  systems that obtain environmental data to support weather observations  and forecasts. These data are processed to provide graphical weather  images and specialized weather products. Data from polar satellites are  also the predominant input to numerical weather prediction models, which  are a primary tool for forecasting weather days in advance—including  forecasting the path and intensity of hurricanes. These weather products  and models are used to predict the potential impact of severe weather so  that communities and emergency managers can help prevent and  mitigate its effects.
Polar-orbiting satellites circle the earth in a nearly north-south orbit,  providing global observation of conditions that affect the weather and  climate. Each satellite makes about 14 orbits a day. As the earth rotates  beneath it, each polar-orbiting satellite views the entire earth’s surface  twice a day.
Currently, the polar-orbiting satellites that are considered primary  satellites for providing input to weather forecasting models are a  NOAA/NASA satellite (called Suomi National Polar-orbiting Partnership,  or S-NPP), two Department of Defense (DOD) satellites, and a series of  European satellites. These satellites cross the equator in early morning,  mid-morning, and early afternoon orbits, with S-NPP in the early  afternoon orbit. NOAA, the Air Force, and a European weather satellite  organization also maintain older satellites that provide limited backup to  these operational satellites. Figure 1 illustrates the current operational  polar satellite constellation.
According to NOAA, 80 percent of the data assimilated into its National  Weather Service numerical weather prediction models that are used to  produce weather forecasts 3 days and beyond are provided by polar- orbiting satellites. Specifically, a single afternoon polar satellite provides  NOAA 45 percent of the global coverage it needs for its numerical  weather models. NOAA obtains the rest of the polar satellite data it needs  from other satellite programs, including DOD’s early morning satellites  and the European mid-morning satellite.
subsections: section_title: Overview of JPSS Program
paragraphs: NOAA is currently executing a major satellite acquisition program to  replace existing polar satellite systems that are nearing the end of their  expected life spans. NOAA established the JPSS program in 2010 after a  prior tri-agency program was disbanded due to technical and  management challenges, cost growth, and schedule delays. The JPSS  program guided the development and launch of the S-NPP satellite in  2011 and is responsible for two other planned JPSS satellites, known as  JPSS-1 and JPSS-2. The current anticipated launch dates for these two  satellites are March 2017 and December 2021, respectively. More  recently, NOAA has also begun planning the Polar Follow-On (PFO)  program, which is to include the development and launch of a third and  fourth satellite in the series in July 2026 and July 2031, respectively.  These are planned to be nearly identical to the JPSS-2 satellite.
NOAA has organized the JPSS program into flight and ground projects  that have separate areas of responsibility. The flight project includes a set  of five instruments, the spacecraft, and launch services. The ground  project consists of ground-based systems that handle satellite  communications and data processing. The ground system’s versions are  numbered; the version that is currently in use is called Block 1.2, and the  new version that is under development is called Block 2.0. Among other  things, Block 2.0 is to enable the JPSS ground system to support both the  S-NPP and all planned JPSS satellites.
Since 2012, we have issued reports on the JPSS program that  highlighted technical issues, component cost growth, management  challenges, and key risks. In these reports, we made 15  recommendations to NOAA to improve the management of the JPSS  program. These recommendations included addressing key risks,  establishing a comprehensive contingency plan consistent with best  practices, and addressing weaknesses in information security practices.
As we reported in May 2016, the agency had implemented 2  recommendations and was working to address the remainder. In  particular, NOAA established contingency plans to mitigate the possibility  of a polar satellite data gap and began tracking completion dates for its  gap mitigation activities. NOAA has also taken steps such as performing  a new schedule risk analysis, and adding information on the impact of  space debris to its annual assessment of satellite availability. We have  ongoing work reviewing the agency’s progress in implementing these  open recommendations.
section_title: NOAA Continues to Develop JPSS Satellites, but Faces Remaining Challenges and Uncertainties Regarding Future Decisions
paragraphs: Over the past year, the JPSS program has made progress in developing  the JPSS-1 satellite, but continues to face challenges as it approaches  the early 2017 launch date. The program completed all instruments on  the JPSS-1 satellite and integrated them on the spacecraft by early 2016.  As of December 2015, the JPSS program reported that it remained on  track to meet its committed launch date of March 2017.
However, as highlighted in our May 2016 report, the JPSS program  continues to face challenges as it approaches the early 2017 launch  date. Specifically, the JPSS program had experienced delays ranging  from 3 to 10 months on key components since mid-2014, as well as  technical challenges on both the flight and ground systems. For example,  the program recently experienced multiple issues in completing a  component on the spacecraft, called a gimbal, which moved the  component’s planned completion date forward by almost a year before it  was completed in March 2016. These issues in turn delayed the  beginning of the JPSS-1 satellite’s environmental testing. The gimbal  issue also was a factor in the program choosing to move back its launch  readiness date—the date that the JPSS-1 satellite is planned to be ready  for launch—from December 2016 to January 2017.
Regarding the JPSS ground system, the program experienced an  unexpectedly high number of program trouble reports in completing the  upgrade to Block 2.0, which is needed for security and requirements  improvements in tandem with the JPSS-1 satellite’s launch. A key  milestone related to this upgrade was recently delayed from January to  August 2016.
While NOAA satellite timelines show continuous coverage in the  afternoon orbit, the JPSS program still faces the potential for a near-term  gap in satellite coverage. As we reported in May 2016, NOAA had  increased the estimated useful life for S-NPP by up to 4 years. Under this  new scenario, a near-term gap in satellite data would not be expected  because S-NPP would last longer than the expected start of operations  for JPSS-1.
However, subsequent NOAA documentation showed this 4-year period as  “fuel limited life.” NOAA officials explained that this extended period is  based on expected fuel availability, and does not take into account the  likelihood that the instruments and spacecraft will fail before the satellite  runs out of fuel. In other words, the extended useful life depicts the  satellite’s maximum possible life, not its expected life.
As a result, the JPSS program continues to face a potential gap of 8  months between the end of S-NPP’s expected life in October 2016, and  when the JPSS-1 satellite is launched and completes post-launch testing  in June 2017. Figure 2 shows the potential gap period.
The June 2017 completion date also assumes a 3 month period for the  JPSS-1 satellite’s on-orbit checkout. However, based on on-orbit  checkout periods from past polar satellites, it is likely that checkout could  take longer than this, potentially lengthening the gap. As a precedent, it  took the JPSS program about 2 years to fully validate the highest-priority  data products from the S-NPP satellite. If S-NPP unexpectedly fails  sooner, or the JPSS-1 launch date is delayed, a longer gap could result.
subsections: section_title: Uncertainties Remain on Key Future JPSS Development Dates
paragraphs: In addition to its work in completing the JPSS-1 satellite, NOAA has  begun planning for new satellites to ensure the future continuity of polar  satellite data. In a new program, called the Polar Follow-On (PFO), NOAA  plans to build two new satellites, JPSS-3 and JPSS-4, that are copies of  the JPSS-2 satellite. Like JPSS-2, these satellites are to include all three  key performance parameter instruments, as well as a fourth  environmental sensor. NOAA plans to complete development of JPSS-3  and JPSS-4 several years ahead of their planned launch date. In the  nearer term, NOAA plans to build a smaller satellite that can provide a  replacement for some data produced by one of the most essential JPSS  instruments.
NOAA’s decisions on what PFO will include are based on what the  agency calls a robust constellation, creating a situation where it would  take two failures to create a gap on data from key instruments, and where  the agency would be able to restore full coverage in a year in the event of  a failure.
We reported in May 2016 that NOAA has taken several steps in planning  the PFO program, including establishing goal launch dates and high-level  budget estimates. However, it had not completed formulation documents  such as high-level requirements, a project plan, or budget information for  key components.
In addition, uncertainties remain about whether early development of  JPSS-3 and JPSS-4 is necessary to achieve robustness. For instance, in  its initial calendar for PFO, NOAA considered lifetimes of 10 years or  more for the JPSS-1 and JPSS-2 satellites, while NOAA charts used for  budget justification continue to show only 7 year lifetimes. If satellites are  likely to last longer than expected, there could be unnecessary  redundancy in coverage. Until NOAA ensures that its plans for future  polar satellite development are based on the full range of estimated lives  of potential satellites, the agency may not be making the most efficient  use of the nation’s sizable investment in the polar satellite program.
As a result of this uncertainty, we recommended that NOAA evaluate the  costs and benefits of different launch scenarios for the JPSS PFO  program, based on updated satellite life expectancies, to ensure satellite  continuity while minimizing program costs. NOAA concurred and noted  that it had evaluated the costs and benefits of different launch scenarios  using the latest estimates of satellite lives as part of its budget  submission. However, the agency did not provide sufficient supporting  evidence or artifacts showing that it had evaluated costs and benefits of  launch scenarios in this way.
section_title: NOAA’s Timelines for Current and Future NOAA Polar Satellites Are Not Consistently Accurate and Useful
paragraphs: NOAA’s National Environmental Satellite Data and Information Service  (NESDIS) regularly publishes “flyout charts” for its satellites which depict  timelines for the launch, on-orbit storage, and operational life of its  satellites. Among other things, NOAA uses these charts to support budget  requests, alert users when new satellites will be operational, and keep the  public informed on plans to maintain satellite continuity.
In a draft report currently at the Department of Commerce for comment,  we reported that NOAA has updated its polar flyout charts three times in  the last 2-and-a-half years. Key changes that can result in an update  include adding newly planned satellites; removing a satellite that has  reached the end of its life; and adjusting planned dates for when satellites  are to launch, begin operations, or reach the end of their useful lives.  Among the data NOAA uses in updating its charts are health status  information of operational satellites, planned schedules for new satellites,  and analysis from operational satellite experts.
However, while NOAA regularly updates its charts and most of the data  on them were aligned with other program documentation, the agency has  not consistently ensured that its charts were accurate, supported by  stringent analysis, and fully documented. Specifically:
The charts were at times inconsistent with other program data. For  example, in one out of 10 available instances for comparison, flyout  chart data did not match underlying program data. JPSS program  data as of April 2015 listed the JPSS-2 satellite launch as November  2021, but the flyout chart from that month showed it 4 months earlier,  in July 2021.
The flyout charts also inconsistently reflected data from annual  satellite availability assessments performed by the JPSS program. In  addition, weaknesses remained in the latest annual availability  assessment from 2015. For example, NOAA assumed that JPSS-1  data from key instruments will be available to users 3 months after  launch. However, based on on-orbit checkout periods from past polar  satellites, it is likely that checkout could take much longer than this,  potentially lengthening the gap.
NOAA did not consistently document the justification for updates to its  polar satellite flyout charts. For example, the NOAA department  responsible for providing summary packages for each flyout chart  update provided justification for the key changes in only one of three  documentation packages. Furthermore, standard summary  documents, such as a routing list and information on the disposition of  comments, were included for only one of the three documentation  packages for polar flyout charts.
NOAA also does not consistently depict how long a satellite might last  once it is beyond its design life. For instance, NESDIS, the NOAA  entity responsible for satellite operations, recently added a 4-year  extension to the useful life of the S-NPP satellite. This extension was  meant to depict maximum potential life, assuming all instruments and  the spacecraft continue functioning. However, the agency did not  clearly define this term on its charts, thereby allowing readers to  assume the agency expects the satellites to last through the end of  the fuel-limited life period.
Also, as stated above, in its justification for funding for the PFO  program, NOAA considered lifetimes for JPSS-1 and JPSS-2 to be  longer by several years when compared to the lifetimes listed on its  flyout charts. Program officials indicated that the estimates they  develop prior to a satellite’s launch are more conservative due to  greater uncertainty at that stage. However, inconsistencies such as  these have the effect of implying that some satellites will reach their  end-of-life sooner or later than the agency anticipates.
Part of the reason for these process shortfalls is that NOAA has not  finalized a policy with standard steps to follow when making chart  updates. Consequently, the information that NOAA provides Congress on  the flyout charts is not as accurate as it needs to be, which could result in  less-than-optimal decisions. Furthermore, lack of communication of the  potential ambiguities inherent in changes to satellite lifetimes could have  major effects on future decision-making.
To address these weaknesses, our draft report includes a series of  recommendations to NOAA, including requiring satellite programs to  perform regular assessments of satellite availability, implementing a  consistent approach to depicting satellites beyond their design lives, and  revising and finalizing the policy for updating flyout charts.
section_title: The JPSS Program Needs to Address Critical Information Security Weaknesses
paragraphs: Safeguarding federal computer systems and systems supporting national  infrastructure is essential to protecting public health and safety. Federal  law and guidance specify requirements for protecting federal information  and information systems. In particular, the Federal Information Security  Modernization Act of 2014 (FISMA) requires executive branch agencies  to develop, document, and implement an agency-wide information  security program.
FISMA also requires the National Institute of Standards and Technology  (NIST) to develop standards and guidelines for agencies to use in  categorizing their information systems and minimum requirements for  each category. Accordingly, NIST developed a risk management  framework of standards and guidelines to follow in developing information  security programs. Figure 3 shows an overview of the steps in this  framework, including components of the risk management lifecycle as  well as key activities and artifacts.
As we reported in May 2016, NOAA had established information security  policies in key areas detailed by FISMA and recommended by NIST  guidance and the JPSS program had made progress in implementing  these policies. However, we found that the program had weaknesses in  several areas related to its ground system which, if not addressed, could  put the JPSS ground system at high risk of compromise.
Key controls not fully implemented. The JPSS program, using  NIST guidance on system categorization, identified its ground system  as a high-impact system, meaning that a loss of confidentiality,  integrity, or availability could be expected to have a catastrophic effect  on operations, and identified needed security controls based on this  classification. However, the program had fully implemented only 53  percent of required security controls, and had fully implemented  controls in only one area.
Limitations in controls assessment. The program developed an  assessment plan to identify weaknesses in the controls established by  the program, and implemented the assessment. However, the  assessment had significant limitations, including inconsistencies in  maintaining a valid inventory, uncertainty about the physical locations  for program components, and a discrepancy between the inventory  used for testing and the actual live inventory of the program’s  systems.
Delay in fixing critical weaknesses. In accordance with NOAA  policy, the program established plans of action and milestones to  address control weaknesses in both the current and future version of  its ground system, and had made progress in addressing many of its  security weaknesses through this process. However, many  vulnerabilities remain unaddressed because the program did not  comply with Department of Commerce policy to remediate critical and  high-risk vulnerabilities within 30 days.
As of its 2015 assessment of program controls, the JPSS program  had 146 critical and 951 high-risk vulnerabilities on the current  iteration of the ground system, and 102 critical and 295 high-risk  vulnerabilities on the next iteration of the ground system.  Vulnerabilities remaining open include instances of outdated software,  an obsolete web server, as well as more than 200 instances of use of  outdated definitions used to scan and identify viruses. Figure 4  graphically shows the number of open vulnerabilities on the current  JPSS ground system over time.
Without addressing these vulnerabilities in a timely manner, the  program remains at increased risk of potential exploits.
Security incidents reported but not consistently tracked. In  accordance with NOAA policy, the JPSS program established a  continuous monitoring plan to track security incidents and intrusions  and to ensure that information security controls are working.  Specifically, NOAA officials reported 10 medium and high-severity  incidents related to the JPSS ground system, including incidents  involving unauthorized access to web servers and computers,  between August 2014 and August 2015. Of these, NOAA closed 6  incidents involving hostile probes, improper usage, unauthorized  access, password sharing, and other IT-related security concerns.
However, the agency did not consistently track all incidents.  Specifically, there were differences between what is being tracked by  the JPSS program, and what is closed by NOAA’s incident response  team. For example, 2 of the 4 incidents that were recommended for  closure by the JPSS program office are currently still open according  to the incident report. Until NOAA and the JPSS program have a  consistent understanding of the status of incidents, there is an  increased risk that key vulnerabilities will not be identified or properly  addressed.
To address these deficiencies, we recommended in our May 2016 report  that the Secretary of Commerce direct the Administrator of NOAA to  establish a plan to address the limitations in the program’s efforts to test  security controls, including ensuring that (1) any changes in the system’s  inventory do not materially affect test results; (2) critical and high-risk  vulnerabilities are addressed within 30 days, as required by agency  policy; and (3) the agency and program are tracking and closing a  consistent set of incident response activities.
NOAA concurred with our recommendations. Regarding critical and high- risk vulnerabilities, NOAA noted that the JPSS program would continue to  follow agency policy allowing its authorizing official to accept risks when  remediation cannot be performed as anticipated. However, the program  did not have documentation from the authorizing official accepting the risk  of a delayed remediation schedule for critical and high-risk vulnerabilities.
In summary, NOAA is making progress in developing and testing the  JPSS-1 satellite as it moves toward a March 2017 launch date, but  continues to experience issues in remaining ground system development,  and faces a potential near-term data gap in the period before this satellite  becomes operational. In addition, NOAA is planning to launch a future set  of satellites to ensure continuity of future satellite data, but it is uncertain  which launch timing will best meet the agency’s criteria for a robust  constellation. Without ensuring that its plans for future satellite  development are based on the full range of estimated lives of potential  satellites, the agency may not be making the most efficient use of the  nation’s sizable investment in the polar satellite program.
Further, findings from a draft report show that NOAA’s efforts to depict  and update key polar satellite information, such as timelines and  operational life, need to be improved. Its flyout charts, used to inform  users of potential gaps and support budget requests, did not always  accurately reflect current program data or consistently present key  information, such as a satellite’s lifetime once beyond its original design  life. This is in part because NOAA has not finalized a policy that includes  standard steps for updating its charts. Until NOAA addresses these  shortfalls, it runs an increased risk that its flyout charts will mislead  Congress and may lead to less-than-optimal decisions.
As a part of JPSS ground system development, NOAA has established  policies in key information security areas called for by guidance.  However, the program has not fully implemented the policy in several  areas. For example, the program fully implemented just over half of its  required security controls, a recent security assessment itself had  significant limitations, and the program has not remediated critical and  high-risk vulnerabilities in a timely manner. Until NOAA addresses these  weaknesses, the JPSS ground system remains at high risk of  compromise.
Chairman Bridenstine, Ranking Member Bonamici, and Members of the  Subcommittee, this completes my prepared statement. I would be  pleased to respond to any questions that you may have at this time.
section_title: GAO Contacts and Staff Acknowledgments
paragraphs: If you have any questions on matters discussed in this testimony, please  contact David A. Powner at (202) 512-9286 or at pownerd@gao.gov.  Other contributors include Colleen Phillips (Assistant Director), Shaun  Byrnes (Analyst-in-Charge), Christopher Businsky, Torrey Hardee, Lee  McCracken, and Umesh Thakkar.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.