The federal government relies on commercial communications networks to obtain various services, including video conferencing, local and long- distance telephone calls, email, text messages, file transfers, and more. Much of the communications infrastructure is owned or operated by commercial entities. Similarly, federal agencies rely on call centers (also known as contact centers) to handle public inquiries on government programs and services, such as Medicare. These centers utilize automated and live telephone response systems, websites, and trained customer service representatives to provide information to the public. Agencies that contract with industry to meet their telecommunications and call center needs report information about these contracts and their obligations in FPDS-NG—the federal government’s primary database for contract information at the prime contract level. When reporting contract data, agencies report information on the type of product or service being purchased as well as the NAICS code that best describes the principal purpose of the product or service being acquired. See table 1 for a description of the industry categories for businesses that provide telecommunications and call center goods or services. In addition to FPDS-NG, the federal government has developed other contract reporting systems to collect contracting information related to subcontracting. The Electronic Subcontract Reporting System (eSRS) was created in 2005 to streamline contractors’ reporting of progress toward meeting the small business subcontracting goals in their subcontracting plans and to facilitate agency oversight. The Federal Acquisition Regulation (FAR) generally requires that contractors be required to submit an acceptable subcontracting plan when they are awarded a contract that exceeds $700,000 and is expected to have subcontracting possibilities. Depending on the individual contract, the system may contain subcontracting information reported by both the prime contractor as well as multiple subcontractors. The Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) was created in 2010 to provide transparency about federal spending. Prime contractors must register and report subcontract information for first-tier subcontractors, as applicable. Information on subcontracts awarded by first-tier subcontractors to other entities, or lower-tier subcontractors, is not required. USASpending.gov was created in 2007 to promote transparency by providing the public with information about where and how federal dollars are spent. USASpending.gov contains prime contract award data from FPDS-NG and subcontract information from FSRS. Telecommunications and information technology (IT) fields have been merging in recent years due to integration of the technologies and combined operational management of their functions. Federal telecommunications systems can include a multitude of IT equipment and products, as well as services, such as managed network services and IT security services. In addition, telecommunications include such broadband internet services. The Federal Information Security Modernization Act (FISMA) of 2014 provides a comprehensive framework for ensuring that effective information security controls are put in place for information resources and assets that support federal operations and for ensuring the effective oversight of the security of the information. Under FISMA, the Office of Management and Budget (OMB) is responsible for overseeing agency information security policies and practices. To implement FISMA, the National Institute of Standards and Technology (NIST)—a component within the Department of Commerce—developed standards and guidelines for agencies to use to help manage information security risks. Both FISMA and OMB require agencies to comply with applicable NIST standards and guidelines. The NIST framework has many components, but generally provides guidance to agencies to manage information security risks for communication and information technology networks. The framework emphasizes that an organization needs to develop and implement appropriate safeguards to ensure delivery of critical services. To accomplish this goal an agency generally must be able to develop an organizational understanding to manage cybersecurity develop and implement appropriate safeguards to ensure delivery of mitigate those events, and restore system capabilities or services that were impaired due to a cybersecurity event. NIST publications can help agencies mitigate potential risks by providing approaches on how to manage or resolve information technology risks. For example, NIST states that agencies should conduct continuous threat monitoring and suggests control activities to implement to help manage supply chain risks, among other things. Some of the controls that NIST recommends are access controls—authentication requirements and physical access controls to limit or detect inappropriate access to data, equipment, and facilities; security management controls—establish a framework and continuous cycle for assessing data systems for security weaknesses, implementing security procedures, and monitoring the procedures to ensure adequate protection of sensitive or critical resources; and contingency planning and restoration of services—planning for how to provide continued or restored services when system interruptions or problems occur. Various federal laws exist to protect workers, establishing requirements related to wages, hours worked, and worker safety and health, among other things. Some of these laws apply specifically to federal contractors, although the requirements may vary depending on factors such as the type and size of the contract. For example, the Service Contract Act establishes minimum wage, fringe benefit, and safety and health requirements for covered federal service contractors. Telecommunications service contracts are exempt from the Service Contract Act, but call center contracts may be subject to it. Similarly, the Walsh-Healey Act establishes minimum wage, overtime, and workplace safety and health requirements for covered federal supply contractors. Contractors are also generally subject to a number of non-discrimination and equal employment opportunity requirements under an executive order and federal laws. For example, covered contractors and subcontractors are prohibited from discriminating in employment based on race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or status as a protected veteran. In addition, covered contractors and subcontractors generally are prohibited from discriminating against applicants or employees because they inquire about, discuss, or disclose their compensation or that of others, subject to certain limitations. Along with laws that apply specifically to federal contractors, worker protection requirements of other federal laws may also apply, such as the Fair Labor Standards Act or the Occupational Health and Safety Act. Federal contractors are also generally subject to the requirements set forth in the FAR, which provides uniform policies and procedures for acquisition by executive agencies. Specifically, Part 22 of the FAR, Application of Labor Laws to Government Acquisitions, establishes various labor-related requirements for federal contractors and implements applicable requirements, as described above. Federal contractors may also be subject to specific department or agency regulations. For example, when contracting with DOD, contractors must comply with applicable contract provisions and clauses from the Department of Defense Federal Acquisition Regulation Supplement (DFARS), such as clauses incorporated pursuant to DFARS Part 222, Application of Labor Laws to Government Acquisitions. FAR clauses in the prime contract can indicate whether the contractor’s requirements will flow down to its subcontractors. FAR flow-down clauses may be mandatory or discretionary, and are subject to other considerations such as whether a subcontract is performed extraterritorially. Federal agencies reported obligating a total of over $30 billion to acquire telecommunications products and services during fiscal years 2014 through 2018. Telecommunications spending accounted for 1.2 percent of total federal obligations for the 5-year period. Over these five years, the majority of the government-wide telecommunications obligations—84 percent—were awarded for services, such as internet and satellite services with the remainder going to products. In fiscal year 2018, federal agencies reported obligating $6.2 billion to acquire telecommunications products and services—an amount that is consistent with the preceding 4 fiscal years. DOD accounted for about two-thirds of this amount and civilian agencies for roughly one-third. These obligation levels are consistent with the previous 4 fiscal years. Within DOD, DISA—which has responsibility for providing, operating, and assuring command and control and information-sharing capabilities across the full spectrum of military operations—had the highest obligations for telecommunications services and products. Among civilian agencies, the National Aeronautics and Space Administration, the Department of Transportation, and the Department of Veterans Affairs had the highest obligations. These three agencies consistently had the highest obligations in each of the previous 4 fiscal years. Defense and civilian agencies’ obligations for telecommunications for the 5-year period are shown in figure 1. Agencies procured telecommunications products and services from an average of 1,500 vendors each year across the five telecommunications industry categories. A little more than half of these contractors were classified as small businesses. Ten contractors accounted for 52 percent of total federal telecommunications obligations for fiscal year 2018, which is generally consistent with obligation levels in the preceding 4 fiscal years. Appendix III provides additional information on the top federal telecommunications contractors based on dollars obligated. For the 5- year period we reviewed, our analysis shows that agencies reported the majority of dollars obligated were for purchases for wired telecommunications, as illustrated in figure 2. Agencies reported an average of $800 million annually for call center obligations for fiscal years 2014 through 2018, with HHS accounting for at least 80 percent of total spending. Call center spending accounted for 0.2 percent of all federal spending during the 5-year period we reviewed. Almost all—an average of 99.7 percent—of call center contract obligations were awarded for services each year, such as professional and administrative support, help desk, and technical assistance services. For example, the CMS contract in our sample was awarded to acquire management and staffing services for a call center that handles Medicare beneficiary inquiries for 1-800 MEDICARE and consumer inquiries for the Health Insurance Marketplace. Total government-wide call center obligations for fiscal years 2014 through 2018 are shown in figure 3. An average of 133 different contractors had contracts with obligations for call centers during the 5 years we reviewed and about half were classified as small businesses. One contractor accounted for the majority of all obligations with obligation levels ranging from 80 to 84 percent for fiscal years 2014 through 2018. Appendix IV provides additional information on the top call center contractors based on dollars obligated. Three federal reporting systems provide limited information about subcontracting and no information about offshoring because the systems were not designed to capture the extent of these activities. While FPDS-NG captures data on contracts entered into by federal agencies, it was not designed to include subcontracting data. The system has a field to indicate whether the prime contractor has developed a subcontracting plan, but does not have a field for contracting officials to specify details about what or how much of the products or services will be obtained through subcontracting. In addition, FPDS-NG was not designed to collect data on the extent to which prime contractors may offshore work performed on a federal contract. No field exists for contracting officials to indicate whether the contract involves business activities that include offshoring, regardless of what type of products or services are being acquired. eSRS collects information from prime contractors on their planned use of subcontractors. The FAR generally requires that contractors be required to submit an acceptable subcontracting plan when they are awarded a contract that exceeds $700,000 if subcontracting opportunities exist, and impose subcontracting plan requirements on subcontractors that receive subcontracts above certain thresholds. However, as we previously reported in December 2014, eSRS was not designed to provide a list of subcontractors associated with a particular contract. As a result, the utility of eSRS in linking reported subcontractors to prime contracts is limited. Additionally, in general, prime contractors are not required to report in eSRS if a subcontractor’s services are being performed outside of the United States or its territories. Contracting officials told us that they have limited insight into whether prime contractors subcontract with foreign entities. FSRS is used to collect award and entity information, such as subcontractor names and award amounts, from prime contractors on their subcontract awards. Prime contractors obtain and report information provided by their subcontractors into FSRS. However, in June 2014, we reported that we could not verify the subcontract data in FSRS as agencies frequently do not maintain the records necessary to verify the information reported by the awardees. In light of this, we recommended that the Director of OMB, in collaboration with Treasury’s Fiscal Service, clarify guidance on agency maintenance of records to verify the accuracy of required data reported. OMB generally agreed with our recommendation. As of our latest report in April 2017, OMB had not yet taken action to implement our recommendation. We identified several examples of worker protection requirements in our review of the five selected contracts. We categorized those requirements into three areas: wages and hours, workplace safety and health, and protections against certain employer actions. Wages and Hours. These protections ensure the payment of minimum wage rates and authorize overtime pay, as appropriate, among other things. For example: The GSA Networx services contract and the DISA contract for DOD Information Network operations include requirements to ensure that covered contractor employees are to be paid wages at least at the federal minimum wage rate. The CMS call center operations contract and the DISA emergency telecommunications services contract authorize the contractor to provide overtime pay to certain employees if they work more than their standard hours. The CMS call center operations contract and the DISA contract for DOD Information Network operations identify classes of workers and state the minimum wage rate and fringe benefits that may be or are payable to them. For example, the CMS call center operations contract reflects Department of Labor rates for federal hires. The CMS call center operations contract also includes an HHS- specific requirement related to salary rate limitations that specifies that the contractor shall not use contract funds to pay the direct salary of an individual at a rate that exceeds the Federal Executive Schedule Level II in effect on the date the funding was obligated. Workplace Safety and Health. These protections address dangers in the workplace that might affect the workplace safety or health of contractor employees. All five contracts reviewed contain requirements aimed at promoting or ensuring safe behaviors in the work environment, among other things. For example: All five contracts require the contractor to promote a drug-free workplace environment. DISA’s DOD Information Network operations contract requires the contractor to establish specific safeguards to protect the health of its workers who might work in a federal building complex that is known to be a toxic location, since asbestos and toxic metals have been located in the soil. DISA’s DOD Information Network operations contract also includes requirements for the contractor to ensure its employees have health screenings and vaccinations as applicable to ensure they are physically and psychologically fit to perform the work at specific locations, such as those in military operation zones. All five contracts encourage the contractor to establish policies to ban text messaging while driving. Protections against Certain Employer Actions. These protections are intended to protect workers from potentially harmful actions undertaken by employers—such as discrimination in hiring practices, retaliation for reporting company violations, and participation in human trafficking. For example: All five selected contracts included equal employment opportunity provisions that prohibit discrimination in employment based on specific characteristics, such as being a veteran or a person with a disability. The CMS call center operations contract also included an agency requirement for the contractor to cooperate in any investigations into allegations of employment discrimination. The CMS call center operations contract, the two DISA contracts, and the GSA Networx services contract incorporate clauses requiring their contractors to provide whistleblower protections that protect an employee from reprisal when they inform authorities of fraud, waste, abuse, or violations of contract law by the contractor. All five selected contracts include the clause that prohibits the contractor and its employees from any involvement in trafficking in persons. In addition, DISA’s DOD Information Network operations contract requires the contractor to offer employment to specific groups of people under certain circumstances. Specifically, the contractor is to employ local residents when work is to be performed in Hawaii. In addition, the contractor is to offer employment to former federal employees first when work is to be performed at a military base that is closing. Observations on Offshoring. We did not identify offshoring of the products or services being acquired in the five contracts we reviewed. Generally, if a prime contractor awards a subcontract, the contractor will flow down applicable requirements to the first-tier subcontractor and other subcontractors at lower tiers, unless otherwise specified. We identified only one worker protection clause that would flow down to the subcontractor in the event of offshoring—the requirement to prohibit involvement in trafficking in persons. The five selected contracts we reviewed include examples of various safeguards—such as limiting access to data systems and data, system management controls, contingency planning and restoration of services, and restrictions on the use of equipment—to protect data systems and personally identifiable information from unauthorized access and use. These safeguards are all part of NIST standards. Access Controls. Physical access controls and authentication requirements limit, block, or detect inappropriate access to data, equipment, and facilities. These controls help to reduce the chances of data systems being used for malicious purposes and protect the systems from unauthorized modification, loss, or disclosure. For example: The GSA Alaska telecommunications services contract states that the physical access point to the telecommunications closet must be limited to personnel with appropriate identification. In addition, this contract requires the contractor to follow agency security procedures, such as having personnel sign into and out of physical locations and abide by escort procedures. Further, the contractor is required to ensure that all employees have identification that meets specific federal guidelines. The contract also states that subcontractors are subject to personal identity verification, and are to comply with applicable standards. The CMS call center operations contract requires a multifactor authentication—which requires two pieces of identifying information to log in—for call center employees to remotely access sensitive government-owned data on computer systems. In addition, the contract requires all employees who have access to data systems and personally identifying information to pass a background check. Further, the contract reduces the ability of employees to copy or transmit a customer’s personal information by requiring the contractor to ensure a secure floor that prohibits cell phone usage or note taking on paper. According to the CMS officials, the call center employees are required to leave all personal items, such as cell phones, in lockers, and the scripts they reference during calls are laminated. In addition, the supervisor on duty checks desks to ensure personal items are not present. According to CMS officials these steps help protect callers’ sensitive data, such as their medical information. The DISA contract for the day-to-day operations for the DOD Information Network states that the contractor must have a plan in place that includes physical security and protection of the system infrastructure. Security Management Controls. These controls establish a framework and continuous cycle for assessing data systems for security weaknesses, implementing security procedures, and monitoring the procedures to ensure adequate protection of sensitive or critical resources. A variety of security management control requirements were included in the selected contracts. For example: The GSA Networx contract, which provides a variety of network services to the federal government, states that a contractor must comply with FISMA and NIST standards. According to a GSA contracting official, contractors have to show that their information systems are adequately protected against cybersecurity threats before performing any services on a task order. Government officials will certify the system once they agree the system is adequately protected. This certification occurs after a contract has been awarded, but before work begins. According to a government official, these systems are periodically reviewed and monitored to ensure the systems stay protected. The DISA contract for the day-to-day operations for the DOD Information Network requires the contractor to assist the government to ensure that all networks and information systems are accredited in accordance with DOD’s Certification and Accreditation Program, which requires certain cybersecurity protections are in place. This contract also requires that the contractor or any subcontractor implement safeguarding requirements to protect covered contractor information systems, such as limiting access to authorized users, verifying and controlling connections to and use of external information systems, authenticating the identities of users before allowing access to information systems, and limiting physical access to systems and equipment. The contract also requires that the government have access to the contractor’s databases in order to carry out vulnerability testing and audits to safeguard against threats to the integrity, availability, and confidentiality of data or to the functions of information technology systems operated on behalf DISA or DOD. The DISA contract that provides priority telecommunications for executive branch staff in case of an emergency requires that the contractor must identify and analyze threats to the system on a 24- hours-a-day, 7-days-a-week basis, and offer solutions to fix identified weaknesses. DISA contracting officials stated that threats to the data systems are mitigated before contract award because the government is trying to prevent attacks and not just react to threats. Additionally, the contractor has to provide periodic maintenance of the installed networking infrastructure to certify proper functioning of the equipment. The CMS call center operations contract requires that the contractor perform annual vulnerability assessments, which includes tests that attempt to break into the contractor’s systems, the contractor’s system programs, and the contractor’s facility in accordance with agency specific standards. Contingency Planning and Restoration of Services. Planning for how to provide continued or restored services when system interruptions or problems occur is necessary because even a minor interruption can result in lost or incorrectly processed data. NIST has published guidance on the contingency planning process. Several of the contracts we reviewed required the contractor to have contingency plans in place in case of any disruption of services and specified how quickly services are to be restored if disrupted. For example: The GSA Alaska telecommunication services contract requires that the contractor restore service within 4 hours of any system disruption. According to the contracting officer, not restoring the system within 4 hours, unless a longer time is agreed to by the contracting officer, would be considered a performance issue and would count against the contractor during its performance review. This includes restoring any equipment, transmission station, circuit, or area that the government deems critical. The DISA DOD Information Network services contract requires the contractor to ensure that there is no disruption of services on the government networks during routine maintenance of systems, during system upgrades, or while the system has vulnerability testing, among others. The CMS call center contract requires that the contractor develop a business continuity plan that identifies and prioritizes critical systems and recovery strategies, as well as a consolidated business continuity plan. The consolidated plan needs to account for the interdependence between applications and operations and address procedures for sustaining essential business operations while recovering from significant disruptions, including contingencies for a catastrophic loss of equipment required to deliver its services. Restricting the Purchase and Use of Equipment from Identified Countries or Manufacturers. As we reported in July 2018, reliance on a global supply chain introduces multiple risks to federal information systems, including the installation of intentionally harmful hardware or software, reliance on malicious service providers, or installation of hardware or software containing unintentional vulnerabilities such as defective code. NIST published several guidelines to help federal agencies select controls and activities relevant to managing supply chain risk. Our selected contracts included several requirements related to mitigating supply chain risks. For example: Under the CMS call center contract, certain government-provided systems are supplied to the contractor to meet the requirements of the contract. By providing the systems, the government controls what type of equipment is being used and reduces the risk that any compromised equipment is introduced in its network. The DISA contract for the day-to-day operations for the DOD Information Network requires the contractor to use the DISA-approved products list for purchasing equipment for use in repair and similar functional activities. According to a DISA contracting official, this list is continuously updated to make sure that vulnerable products are not being purchased. In addition, this contract specifically prohibits contractors from using certain Chinese-manufactured equipment or services utilizing that equipment. This requirement extends to any equipment or services provided by subcontractors. According to the contracting officer, the contractor requests confirmation from its subcontractors that they are not using prohibited equipment. The contractor then notifies the contracting officer that prohibited equipment is not used on the contract. All five contracts include a restriction on purchases of most goods and services from specific countries, such as Cuba and Iran. The contract requires this restriction to flow down to any subcontractor. Privacy for Personally Identifiable Information. The CMS call center contract involves handling personally identifiable information, such as private medical information. As part of the contract terms, contractor personnel are required to follow specific health care privacy requirements to protect customers’ personal health information. In addition, the contract includes agency-specific requirements to protect personally identifiable information and personal health information. Observations on Offshoring. The five contracts we reviewed included requirements that limited the contractors’ opportunity to use offshoring for labor. The DISA contract for the day-to-day operations for the DOD Information Network stipulates that only U.S. citizens can be hired to perform services. According to the contracting officer, the DISA contract that provides priority telecommunications for executive branch staff in case of an emergency also requires that the contractor hire only U.S. citizens. In addition, the GSA Networx services contract states that work on some orders may require U.S. citizenship. The GSA Alaska telecommunications services contract states that contractor personnel may be required to successfully pass a background check to work in controlled areas under the contract. The CMS call center contract requires that the call center be located in a facility within the continental United States. According to officials, this requirement helps protect data and privacy information. CMS officials stated that generally for call center contracts the contractor must obtain prior approval from the agency’s contracting officer in writing if it wants to subcontract or move operations to a location outside of the United States or its territories. According to CMS contracting officials, they have never received a request to offshore call center operations. We provided a draft of this product to DOD, DOL, GSA, and HHS for review and comment. DOL, GSA, and HHS provided technical comments, which we incorporated as appropriate. DOD informed us that it had no comments on the draft report. We are sending copies of this report to the appropriate congressional committees and the Secretaries of Defense, Labor, and Health and Human Services and the Administrator of General Services. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact William T. Woods at (202) 512-4841 or woodsw@gao.gov or Cindy S. Brown Barnes art (202) 512-7215 or brownbarnesc@gao.gov. Contact points for our Office of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix V. Our review of data from the Bureau of Labor Statistics (BLS) Quarterly Census of Employment and Wages shows that employment in the telecommunications sector overall declined 12 percent from calendar years 2014 through 2018, as illustrated in figure 4. In contrast, during the same 5-year period, total employment across all industries in the United States grew by 7 percent. According to BLS data, the decline in telecommunications employment has been underway since at least 2009. BLS projects this decline will continue through at least 2028. Department of Labor (DOL) data series on trends in employment are not designed to identify causes of employment changes. However, BLS officials and other researchers cited the role of technology as a possible cause of the decline in telecommunications employment. For example, BLS officials said the move toward newer technologies, such as satellite transmissions, has had an adverse impact on employment. Additionally, representatives of a major telecommunications contractor told us that technological advances either resulted in fewer employees being needed to perform specific functions or replaced previous manual operations with automated processes. In addition, the representatives stated that uses of artificial intelligence, such as smart networks and machine learning, facilitate tasks that in the past relied extensively on human labor. Finally, the effect of technology on employment in telecommunications has also been noted by an industry analyst. Employment in the telecommunications industry has been marked by job gains as well as losses in the last 5 years, although generally, losses have exceeded gains. BLS’s Business Employment Dynamics data capture the gross number of job gains from establishment openings and expansions and job losses from establishment closings and contractions across the U.S. economy. In the last 5 years, new jobs in telecommunications have been generated; however, job losses have exceeded job gains in almost every quarter since 2014, as shown in figure 5. The effect of offshoring on employment in telecommunications, if any, is unknown due to the absence of data. Although U.S. employment in telecommunications has declined, the role of offshoring as a potential contributor to the decline is unclear, due to a lack of data and because offshoring is one of many factors that can affect employment levels. According to BLS officials, no public or private data exist that estimate the extent of offshoring in this or any industry sector. BLS officials told us that little interest has been expressed in collecting data on offshoring. They noted that if BLS were to develop a new survey aimed at measuring the extent of offshoring, technical issues—including determining what data should be collected that would give such insight—would need to be resolved. Furthermore, the BLS officials stated that they did not identify offshoring as a factor contributing to recent employment declines in telecommunications based on their industry research, which included interviews with industry specialists. According to BLS researchers, offshoring is one of many factors that can affect job gains and losses for occupations within an industry. In a 2008 article estimating the susceptibility of different occupations to offshoring, BLS researchers cautioned that “no attempt should be made to attribute growth rates in an occupation, or differences between occupations, to offshoring.” Overall, employment in call centers has fluctuated recently, but appears relatively stable over the period of calendar years 2014 through 2018, though it remains higher than during the previous 5 years. As shown in figure 6, after rising for a few years, in 2018 employment returned to a level slightly below that reached in 2015. According to BLS officials, employment in the business support services industry, which includes call centers, is projected to increase modestly through 2028. BLS officials said it is not clear why employment in call centers declined in 2018. Although GAO and others have identified call centers as potentially subject to offshoring, the full extent of offshoring occurring within the U.S. call center industry is unknown. Some anecdotal evidence exists about the purported growth of offshore call centers that serve U.S. companies. However, we found no analyses in our literature review regarding the effects of offshoring on call center jobs overall. Just as with telecommunications, many other factors potentially affect call center employment, such as technological advances. For example, interactive voice response technology has been used to provide responses to simple inquiries, which to some extent may reduce or eliminate some call center work. Although we did not find studies that address the effects of offshoring on telecommunications and call centers specifically, the literature we reviewed discussed some characteristics of workers, services, and companies that potentially influence offshoring decisions, in general, across industries. As such, offshoring decisions may involve, but are not limited to, considerations of the presumed interchangeability of U.S.- based and overseas workers, workers’ languages and cultures, technical requirements for the services being offshored, and companies’ ability to manage offshoring. This report addresses: (1) total federal obligations for telecommunications and call center contracts; (2) worker protections identified in selected telecommunications and call center contracts; and (3) data security and privacy protection requirements identified in these contracts. This report also includes observations on the extent and effect of offshoring. For the purposes of this report we define “telecommunications” to encompass the preparation, transmission, communication, or related processing of information that can be in the form of voice, video, or data; “call centers” to include centers handling inquiries via multiple channels such as telephone, Web page, e-mail, and postal mail; and “offshoring” to mean the obtaining of goods or services from non-U.S.-based employer subcontractors located outside of the United States and its territories that use non-U.S. citizen employees. In addition, we gathered information on employment trends for the telecommunications and call center industries for calendar years 2014 through 2018. To determine the level of federal obligations for telecommunications and call centers, we used data from the Federal Procurement Data System- Next Generation (FPDS-NG) for fiscal years 2014-2018. We identified obligations for telecommunications and call center contracts by using the associated North American Industry Classification System (NAICS) codes for these industry sectors. As defined in the NAICS manual, telecommunications contracts are identified as having a NAICS code starting with the prefix 517, and call center contracts are identified as having a NAICS code starting with the prefix 56142. To identify examples of worker protections and data security and privacy protections in federal contracts, we selected a nongeneralizable sample of five contracts from three agencies with some of the highest obligations for telecommunications and call center contracts during fiscal years 2014 through 2018. Specifically, we selected (1) the Department of Defense (DOD) because it obligated the highest amount for telecommunications contracts; (2) the Department of Health and Human Services (HHS) because it obligated the highest amount for call center contracts; and (3) the General Services Administration (GSA), which is among the top ten agencies with the highest amounts for telecommunications contracts, because it provides a government-wide contract available for agencies to place orders for telecommunications and call centers. We then identified the component within each agency that obligated the most for these services or that provides a large government-wide contract vehicle. The components were DOD’s Defense Information Systems Agency, GSA’s Federal Acquisition Service, and HHS’s Center for Medicare and Medicaid Services (CMS). We selected contracts that included a large call center and a large government-wide telecommunications contract vehicle. We also selected a variety of telecommunications contracts that were among the highest obligations during fiscal years 2014 through 2018, and represented different types of telecommunications services procured during the period, such as wired and wireless services. Table 2 provides a synopsis of the 5 contracts included in our review. We reviewed documentation from the five selected contracts, along with the relevant federal acquisition regulations for worker protections, data security and privacy protections, subcontracting, and offshoring. We interviewed cognizant contracting officials to clarify our understanding of the contract requirements we identified related to worker protection and data security and privacy protections. We also met with representatives from three contractors to obtain their insights into contracting with the government, relevant contract requirements, and industry trends. The purpose of our contract review was to illustrate the different worker protections and data security and privacy protections that may be included in these types of contracts. To address the employment trends in telecommunications and call centers and how they were affected by offshoring, we reviewed employment data from the Quarterly Census of Employment and Wages published by the Bureau of Labor Statistics (BLS) within the Department of Labor. The Quarterly Census of Employment and Wages program publishes a quarterly count of employment and wages reported by employers that covers more than 95 percent of U.S. jobs and is supported by quarterly reports from all private sector employers. We also reviewed data from BLS’ employment projections program, which draws from several BLS data collections as well as interviews with industry specialists and reviews of relevant articles to develop information about the labor market for the nation as a whole for 10 years in the future. In addition, we reviewed BLS’ Business Employment Dynamics data, which consist of a quarterly series of statistics on gross job gains and gross job losses for the entire economy. Gross job gains and gross job losses reveal some aspects of business dynamics, including establishment openings and expansions, and establishment closings and contractions. The quarterly data series include the number and percent of gross jobs gained by opening and expanding establishments, and the number and percent of gross jobs lost by closing and contracting establishments. Furthermore, we reviewed DOL data on layoffs collected by the Trade Adjustment Assistance program that are considered to be caused by trade through shifts in production or services to a foreign country. While the data include layoffs in telecommunications, DOL officials did not believe the data would be useful for this report. Specifically, the data do not necessarily reflect all layoffs in a given sector, but only those associated with requests for investigations by DOL as to the role of trade in the layoff, and initial estimates of affected workers—those facing layoffs and those threatened by layoffs—are not representative. To review the potential effect of offshoring on employment trends, we performed a literature review of selected economic research and other relevant articles, and discussed the results with DOL officials. To identify relevant material—including reports, dissertations, working papers, and journal articles—we searched databases including the National Bureau of Economic Research, Bureau of Economic Analysis, Business Source Corporate Plus, EBSCO, EconLit, ProQuest (including dissertations and theses), Social SciSearch, Public Affairs Information Service via DIALOG, Lexis Trade files, SSRN, WorldCat, National Academies Press, and National Technical Information Service. We used search terms that included variations on “telecommunications” and “call centers,” as well as “offshoring,” “offshore outsourcing,” “labor market impact,” “worker displacement,” “layoffs,” “employment trends,” and “hiring trends.” From our initial literature search we selected 13 documents for more in-depth review. We excluded references that addressed the effects of offshoring on non-U.S. economies and labor forces, or were otherwise beyond our scope, such as working conditions, work flow, collective bargaining, customer service, service quality, or training in call centers. Based on this research, we identified reasonable observations about employment trends and offshoring in telecommunications and call centers. As noted in this report, research on the questions addressed in this report reaches different conclusions. The relevant research that we reviewed provided some insights on how offshoring could potentially affect the telecommunications and call center industries, but provided no information regarding the extent of the impact. Because of this and other data limitations, we were unable to determine the extent to which offshoring may be occurring and what effect offshoring is having on the telecommunications and call center industries. We conducted this performance audit from March 2019 to April 2020 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Agencies reported obligations for approximately 1,500 different contractors that provided telecommunications products and services each year during fiscal years 2014 through 2018. Ten of these contractors accounted for 52 percent of obligations for telecommunications contracts in fiscal year 2018. The top contractor received 10 percent of the total telecommunications obligations in fiscal year 2018, and was also one of the top three contractors in the preceding fiscal years. Figure 7 shows the top 10 telecommunications contractors’ based on total obligations during fiscal years 2014 through 2018. Agencies reported obligations for approximately 133 different call center contractors each year during fiscal years 2014 through 2018. Ten contractors accounted for 94 percent of obligations for call centers in fiscal year 2018; with one contractor accounting for 83 percent of total obligations for the 5-year period we reviewed. Figure 8 shows the top 10 telecommunications contractors’ based on total obligations during fiscal years 2014 through 2018. Although the amount of obligations each year changed, these contractors were generally among the top 10 across all 5 fiscal years. In addition to the contacts named above, Candice Wright (Assistant Director), Blake Ainsworth (Assistant Director), R. Eli DeVan (Analyst-in- Charge), Pedro Almoguerra, Sarah Cornetto, Lorraine Ettaro, Suellen Foth, Stephanie Gustafson, Victoria Klepacz, Chris Morehouse, Patricia Powell, Miranda Riemer, Roxanna Sun, Alyssa Weir, and April Yeaney made key contributions to this report.

Summary: The federal government relies on an extensive global telecommunications network to carry out operations and provide information to the public. These networks and call centers, which handle public inquiries, are often maintained or supported by contractors. Concerns have been raised about the extent to which federal contractors are subcontracting or offshoring work, and have in place worker protections and mechanisms to secure the technologies and the data they handle. GAO was asked to review aspects of contracting for federal telecommunications and call centers, including the extent of subcontracting and offshoring. This report provides information on, among other things (1) federal obligations on telecommunications and call center contracts, (2) worker protections identified in selected contracts, and (3) data security and privacy protections identified in selected contracts. GAO analyzed federal procurement data for fiscal years 2014 through 2018 (the most recent available), reviewed a nongeneralizable sample of five contracts from three agencies with significant telecommunications and call center procurements to identify worker protections and data security and privacy protections; and interviewed relevant officials and federal contractors about contracting and industry trends. The federal government obligated over $30 billion for telecommunications contracts and almost $4 billion for call center contracts from fiscal years 2014 through 2018. On average for the 5-year period, telecommunications and call center obligations were a nominal portion of total federal spending—accounting for 1.2 percent and less than 0.2 percent, respectively. Defense agency obligations accounted for the majority of federal telecommunications spending to support a range of information capabilities across the full spectrum of military operations. The Department of Health and Human Services accounted for the majority of call center obligations to support customer inquiries about Medicare and the health insurance marketplace, among other services. Federal procurement data systems do not collect information that can provide insight into the extent of subcontracting or offshoring—including for telecommunications and call center contracts—because they were not designed to do so. GAO's review of selected contracts found that four of the five contracts expressly stated that some or all work must be performed within the continental United States or by U.S. citizens. GAO identified several examples of worker protection requirements in the five selected contracts, generally falling into the areas of wages and hours, workplace safety and health, and protections against certain employer actions. With regard to data security and privacy protections, the five selected contracts GAO reviewed included requirements to limit access to data systems and data maintained, establish security management procedures for and monitoring of data systems, or establish contingency plans for how to provide continued or restored services when system interruptions or problems occur.