Our objectives were to (1) identify those Defense long-haul telecommunications networks operating outside of the common-user DISN, (2) evaluate the Department of Defense’s progress in implementing its policies for managing telecommunications services, which include: developing a comprehensive inventory of telecommunications equipment and services, reporting on telecommunications services acquired, trends, and costs, mandating the use of common-user networks, and developing a waiver process to grant exceptions from using common-user networks, and (3) evaluate Defense’s progress in developing performance measures for DISN to ensure effective and efficient use of the department’s telecommunications resources. To determine what long-haul telecommunications networks were planned or operating in Defense, we reviewed applicable Defense directives, instructions, and memorandums regarding the use of common-user networks. We met with officials from DISA and OASD/C3I to assess Defense’s progress in developing a comprehensive inventory of telecommunications equipment and services. We met with representatives of the Joint Staff for Command, Control, Communication and Computers (J-6); the Department of Defense’s Office of Inspector General; the Army, the Navy, the Marines, the Air Force, the Defense Logistics Agency, and the Defense Commissary Agency to assess component efforts to develop inventories. When we learned that no comprehensive inventories of networks exist at the department or component level, we sent a questionnaire to the four military services requesting that, for every non-DISN long-haul network, they report: the name of the network; functional description; types of telecommunications services supported; estimated annual costs; whether the network was planned or operational, and if planned, its status, life-cycle costs, and whether it was scheduled to be replaced by DISN, and when. We did not independently verify the information provided by the Services. However, we consulted with them to confirm our understanding of their responses and to discuss and ask questions we had about information they provided. Appendix I details the results of our survey. To assess progress in reporting on telecommunications services acquired, trends, and costs, we reviewed applicable Defense directives, instructions, and memorandums and discussed Defense’s implementation of these requirements with officials from ASD/C3I and DISA. We analyzed information on costs maintained by DISA and reviewed a recent contractor evaluation of DISA business processes. To assess Defense’s progress in enforcing its policy mandate that Defense components acquire services from common-user networks, we reviewed applicable Defense directives, instructions, and memorandums and met with officials from ASD/C3I, DISA, and the Defense components. During these interviews we asked for documentation showing that existing policies on telecommunications management and the use of common-user networks were being implemented and enforced. We obtained and analyzed network plans, requirements, and other acquisition documentation to determine if Defense components were complying with telecommunications management policies. To assess Defense’s progress in developing a waiver process to grant exceptions from using common-user networks, we reviewed applicable Defense directives, instructions, and memorandums. We met with officials from ASD/C3I and DISA to discuss their plans to implement an interim waiver process and to develop a strategy detailing how and when independent networks will be replaced by their common-user counterparts. Because the interim process began during our review, we met again with DISA officials in April 1998 to assess the agency’s progress to date in granting waivers. To assess Defense’s progress in developing performance measures for DISN, we met with officials from DISA and reviewed DISA’s draft documentation on the issue, which consisted of draft performance measures for information technology acquisitions. We reviewed the Clinger-Cohen Act of 1996, the Federal Acquisition Streamlining Act of 1994, the Chief Financial Officers Act of 1990, the Government Performance and Results Act of 1993, and the Paperwork Reduction Act of 1995 to determine applicable legislative requirements for developing performance measures. We relied on work we performed in developing our recent guide on performance measurement, Executive Guide: Measuring Performance and Demonstrating Results of Information Technology Investments (GAO/AIMD-98-89, March 1998). In addition, we examined network performance measurements used in the private sector. Our review was conducted from December 1996 through April 1998 in accordance with generally accepted government auditing standards. We obtained written comments from Defense on a draft of this report. These comments are discussed in the “Agency Comments and Our Evaluation” section of this letter and are reprinted in appendix II. The military services, Defense agencies, and other Defense components have traditionally acquired and operated many unique telecommunications networks to support a range of mission requirements. As a result, Defense components operate many stovepiped telecommunications systems that are not interoperable and cannot share information across functional and organizational boundaries. For example, between 1988 and 1992 Defense reported several interoperability problems including some arising during the Persian Gulf War. Defense components were unable to use their telecommunications networks and information systems to coordinate the issuance of air tasking orders, the use of air space, and the use of fire support for joint operations. To improve the interoperability of its military communications services as well as to reduce costs associated with operating redundant systems, Defense began in 1991 to plan and implement DISN to serve as the department’s primary worldwide telecommunications and information transfer network. The DISN strategy focuses on replacing older data communications systems, using emerging technologies and cost-effective acquisition strategies that provide secure and interoperable voice, data, video, and imagery communications services. Under the DISN program, the military services and Defense agencies are still responsible for acquiring telecommunications services for their local bases and installations as well as deployed communications networks. DISA is responsible for acquiring the long-haul services that will interconnect these base-level and deployed networks within and between the continental United States, Europe, and the Pacific. Defense issued a number of policies and directives in 1991 aimed at ensuring that the department could identify and replace redundant networks with DISN and manage DISN efficiently and effectively. These policies directed components to develop comprehensive inventories of their telecommunications equipment and services, and DISA to develop a comprehensive Defense-wide inventory; directed DISA to report annually on telecommunications equipment acquisitions, trends, and associated costs; mandated the use of common-user networks; and directed DISA to develop a waiver process to grant exceptions from using common-user networks when these networks could not satisfy Defense components’ requirements. In a previous review of the DISN program, we found that Defense was not doing enough to ensure that the program would be managed efficiently and effectively. Specifically, the department lacked performance measures that would help Defense track whether DISA was meeting its objectives, efficiently allocating resources, and learning from mistakes. In response, Defense agreed to establish measures for the program. In order for the DISN program to work, Defense needs to know how many networks are operating in the department and what functions they support. This is the foundation for identifying redundant and stovepiped networks and ensuring that they are replaced by DISN. However, Defense lacks the basic information necessary to determine how many networks are operating in the department, what functions they support, or what they cost. In order to estimate the number and cost of networks that are operating outside of DISN, we conducted our own survey, which identified 87 such networks operated by the military services alone. DISA initiated a similar data call to the military services and Defense agencies after we began our survey and identified 153 networks planned or operating throughout Defense. The results of our survey are presented in appendix I and summarized in table 1. To manage telecommunications cost effectively, Defense must know what networks are operating in the department. In 1991, Defense directed DISA to establish a central inventory of all long-haul telecommunications equipment and services in Defense, and directed the heads of Defense components to do likewise. However, the central inventory was never established and DISA staff are still discovering new networks as they process new telecommunications service requests from Defense components. Defense components have also failed to develop inventories of their own networks. During our initial meetings, Army, Navy, and Air Force officials stated that they could not readily identify all of their networks or describe what their functions are because they do not centrally manage their telecommunications resources. Our experience with the Navy illustrates the depth of this problem. The Navy’s initial response to our survey only identified three independent long-haul networks. Other Navy networks known to exist, such as the Naval Aviation Systems Team Wide Area Network (NAVWAN), were not reported in the survey. Navy’s headquarters telecommunication staff acknowledged that they were unable to identify all of the Navy’s long-haul networks. Careful analysis is needed to determine whether any of the independent networks identified in our survey can or should be replaced by DISN common user services. However, on the basis of our interviews with the military services and our survey results, we were able to determine that overlaps exist between telecommunications services offered by independent networks and services offered by DISN. For example: NAVWAN offers its users data communications services using Internet Protocol (IP); similar services are provided by DISA on DISN’s Unclassified but Sensitive (N-Level) IP Router Network (NIPRNET). The Army’s Installation Transition Processing (ITP) Network also offers IP router services similar to those provided by DISN’s NIPRNET. The Navy Sea Systems Command’s Enterprisewide Network (NEWNET, now known as Smart Link) relies on asynchronous transfer mode-based data communications services; similar services are now offered by DISA on a limited basis. The Army’s planned Regional Transition Network (ARTNET, now known as the Circuit Bundling Initiative) also relies on asynchronous transfer mode-based data services, similar to services offered by DISA. To ensure that a common-user network is efficiently and effectively managed, it is essential to closely monitor its acquisitions of telecommunications services, costs, and trends in usage, that is, the volumes and types of traffic it carries. This monitoring helps an agency ensure that the network is properly sized (i.e., neither oversized nor undersized) and offers cost-effective services. Since 1991, DISA has been required to report annually on telecommunications services acquired, trends (volumes and types of traffic), and associated costs throughout Defense. However, it has not done so, and it lacks the data needed to begin developing such reports. For example, as noted previously, DISA lacks a comprehensive inventory of telecommunications equipment and services across the department. Therefore, it cannot effectively report annually on acquisitions. In addition, DISA has not collected data that would help it identify trends in network traffic throughout Defense, which in turn would help it plan for future growth and identify the need for new telecommunications services. This would include data on the number of anticipated users, the nature of business functions requiring telecommunications support, and the potential costs and benefits of new technologies. Further, Defense managers lack reliable cost information on their networks. For example, senior Defense managers rely on Defense components to voluntarily report telecommunications resource requirements during annual budget preparations. But because communications resources are embedded in noncommunications budget items, this process does not allow Defense to identify costs by network or to identify costs for services obtained by users outside of DISA channels. In addition, DISA does not have a cost accounting system or any other effective means of determining DISN’s actual operating costs. Until Defense managers have good data on status and trends in telecommunications equipment and services, acquisitions, and costs, they will not have a sound basis for making decisions on reducing telecommunications costs across the department, improving network operations, and reliably determining how efficiently and cost effectively to meet user needs. Under Title 10 of the United States Code, the military services have wide latitude to expend resources to train and sustain their forces. Because the mandate to use DISN restricts this latitude, compliance will only be achieved if Defense institutes an effective enforcement process. Since it began the DISN program in 1991, Defense has never effectively enforced the use of common-user networks. While OASD/C3I staff stated that financial pressure could be brought to bear in the budget process to enforce the mandate, they were unable to articulate how this enforcement would occur. Further, even though the military services have implemented several major long-haul networks during the past 5 years, OASD/C3I staff were unable to identify a single instance in which they formally analyzed the military services’ plans for acquiring long-haul networks and insisted that common-user networks be used instead. In May 1997, ASD/C3I issued a memorandum that reiterated Defense policy mandating the use of common-user networks for long-haul telecommunications and reaffirming DISA’s role as the manager and sole provider of long-haul telecommunications. Defense is now preparing an update to this memorandum that it states will reflect the department’s changing organization and mission, and changes in telecommunications technology. However, unless Defense defines and implements a process to enforce this policy, it will remain ineffective. In August 1997, DISA began implementing an interim waiver process which outlined the steps that Defense components must follow to operate independent networks: First, operators of all independent long-haul networks must, as of August 1997, request a waiver to policy mandating common-user networks. Second, DISA must assess the request and issue a waiver in those cases where telecommunications requirements cannot currently be technically or economically satisfied by DISN or another common-user system such as FTS 2000/2001. Neither of these steps, however, is well-defined. For example, the guidance does not describe data that the required justifications should include or criteria DISA will use in evaluating them. In addition, it does not specify how DISA will determine if components’ requirements can be cost effectively satisfied by DISN or FTS 2000/2001. To date, the Services and Defense agencies have largely ignored the interim waiver process. Only 9 percent of the operators of the 131 non-DISA-managed independent networks that DISA identified in its survey has requested a waiver from use of DISN services. Performance measures are central to effectively managing any significant information system undertaking and are required by several federal statutes, including the Federal Acquisition Streamlining Act (FASA) of 1994 and the Clinger-Cohen Act of 1996. For example, under FASA, the Secretary of Defense is required to establish and approve the cost, performance, and schedule goals for major defense acquisition programs and for each phase of the acquisition cycle. Under Clinger-Cohen, agencies must define mission-related performance measures before making information technology investments, and must determine actual mission-related benefits achieved from this information technology, to help ensure an adequate return on investment. For the DISN program, appropriate performance measures would be those that facilitate comparisons between DISN and the independent networks, as well as those that identify potential problems (for example, network reliability, network availability, and measures of customer service, including responsiveness to customer requests for maintenance or for new services). In our 1996 report on the DISN program, we recommended that Defense establish performance measures for DISN. Although it agreed to develop performance measures in response to that review, Defense has never developed measures for the DISN program. Until it does so, Defense will not be able to demonstrate to the Services and other components that DISN is a better choice than their various independent networks, nor will it be able to target and direct management attention to problem areas. In the 7 years that it has been implementing the DISN program and striving to improve telecommunications management in the department, Defense has done very little to implement the basic management controls it believed were needed to ensure success. Numerous independent networks continue to exist without DISA’s knowledge; Defense does not have a comprehensive inventory of telecommunications equipment and services; DISA does not collect data and report on acquisitions, trends, and costs; Defense does not enforce the use of common-user networks; Defense has not implemented an effective waiver process that includes the objective evaluation of alternative telecommunications solutions; and Defense has not established good performance measures. As a result, Defense has not achieved its goals for an interoperable telecommunications environment, cannot support any claims that the long-haul networks it operates are cost-effective, and cannot determine which independent long-haul networks should be replaced by common user networks such as DISN or FTS 2000/2001. We recommend that the Secretary of Defense direct the Assistant Secretary of Defense for Command, Control, Communications, and Intelligence to ensure that existing policies are clearly defined, documented, and enforced. Specifically, ASD/C3I should develop and maintain a comprehensive inventory of Defense’s telecommunications equipment and services; track acquisitions of telecommunications services throughout Defense, the actual costs of those services, and trends in usage (that is, the volumes and types of traffic that networks carry); define and institute an effective process for evaluating the cost-effectiveness of Defense networks and mandating the use of common-user networks for long-haul telecommunications where appropriate. As part of this process, define the criteria that DISA will use to make waiver determinations, including how DISA will measure technical, economic, and customer service factors in granting waivers. In addition, we recommend that the Secretary direct the Assistant Secretary of Defense for Command, Control, Communications, and Intelligence to develop and adopt user-based provisioning, pricing, and performance metrics as minimum performance measures for DISN. The Senior Civilian Official for the Office of the Assistant Secretary of Defense for Command, Control, Communications, and Intelligence (ASD/C3I) provided written comments on a draft of this report. Defense concurred with all of our recommendations. However, Defense expressed concern that the body of the draft report may lead the reader to believe that Defense has done nothing to implement or enforce its own long-haul telecommunications policies. In its response, the department notes that it has: (1) established the Defense Information Systems Database (DISD) as a comprehensive inventory of long-haul telecommunications networks throughout Defense, (2) clarified existing policy by issuing an ASD/C3I memorandum dated May 5, 1997, that reaffirms DISA’s role as the sole manager and provider of long-haul telecommunications systems and services, (3) developed a process for determining how individual telecommunications requirements can best be satisfied, (4) developed a process for granting temporary waivers, and (5) begun the process of establishing performance metrics for DISN. We incorporated additional information in the report to more clearly reflect actions DISA has initiated. However, while these plans are a necessary first step, they must be effectively implemented to bring about real improvements in telecommunications management, which is the focus of the body of our report. Defense recognizes this in its discussion and expresses its commitment to effectively implementing our recommendations. Defense’s comments are presented in appendix II. Detailed GAO responses follow in the same appendix. We will send copies of this report to the Chairman of your Committee; the Chairmen and Ranking Minority Members of the House Committee on Government Reform and Oversight, the House and Senate Appropriations Committees, the House National Security Committee, the Senate Armed Services Committee, and other interested congressional committees; the Secretary of Defense; and the Director of the Office of Management and Budget. Copies will be made available to others upon request. Please contact me at (202) 512-6240 if you or your staff have any questions. Major contributors to this report are listed in appendix III. Naval Education & Training Management Systems Network (NETMSN) NAVSEA Enterprise Wide Area Network (NEWNET/Smart Link) Puget Sound Metropolitan Area Network (MAN) Tidewater Metropolitan Area Network (MAN) Naval Facilities Engineering Command Wide Area Network (NAVFAC WAN) Pensacola Metropolitan Area Network (MAN) Corpus Christi Metropolitan Area Network (MAN) NCTAMS LANT Det. Video Teleconferencing NCTAMS LANT Det. Advanced Digital Multiplexer System (ADMS) NCTAMS LANT Det. U.S. Atlantic Command Net (USACONNET) NCTAMS LANT Det. Navy C2 System (NCCS) Guam Unclassified Metropolitan Area Network (MAN) Guam Administrative Telephone Switching System Planned — San Diego Metropolitan Area Network (MAN) Information on these networks came from DISA’s survey which does not include cost data. The Marine Corps did not provide this information or provided insufficient information to determine costs by fiscal year. The Air Force did not provide this information or provided insufficient information to determine costs by fiscal year. The following are GAO’s comments on the Department of Defense letter dated July 16, 1998. 1. We acknowledge in this report that ASD/C3I has clarified existing long-haul telecommunications policy by issuing a May 5, 1997, memorandum. We have added information regarding Defense’s update of 1991 policy that will reflect changes in technology, organization, and mission. Nevertheless, Defense’s actions remain preliminary, and unless that policy is properly implemented and enforced it will remain ineffective. 2. As indicated in the reply, Defense does not maintain a comprehensive inventory of independent long-haul telecommunications networks, and therefore does not know how many networks are operating throughout the department or what functions they support. As Defense notes in its comments, additional guidance and procedures are needed to ensure that all requirements for long-haul telecommunications equipment and services are identified and placed in the Defense Information Systems Database. 3. Defense affirms in its comment what we state in this report, that DISA currently lacks well-defined steps for determining whether a long-haul telecommunications requirement can be most effectively satisfied by a common-user network. We note Defense’s plan to develop and employ a standard requirements evaluation model. This model, if properly developed and implemented, could assist Defense in making cost-effective decisions on individual telecommunications requirements. However, the model may not be effective without the cooperation of Defense components, which may choose not to submit their requirements through DISA. The model may also not be effective if other steps mentioned in this report, such as adequate data gathering on telecommunications trends and costs, and use of performance measures, are not taken. 4. Two years ago we highlighted the need for DISN performance measures in a report on the DISN program (GAO/AIMD-97-9, November 27, 1996). We recognize that Defense now intends to take action on our recommendation that it implement user-based performance measures for DISN, and we agree that such metrics should be applied to all long-haul telecommunications. We are unable to make further comment, however, until Defense takes concrete steps to implement these performance measures. Franklin W. Deffer, Assistant Director Kevin E. Conway, Assistant Director Mary T. Marshall, Senior Information Systems Analyst Cristina T. Chaplain, Communications Analyst The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touchtone phone. A recorded menu will provide information on how to obtain these lists.

Summary: Pursuant to a congressional request, GAO reviewed the Department of Defense's (DOD) efforts to implement the Defense Information Systems Network (DISN), focusing on: (1) those DOD long-haul telecommunications networks operating outside of the common-user DISN; (2) DOD's progress in implementing its policies for managing DISN; and (3) DOD's progress in developing performance measures for DISN, which DOD agreed to do in response to GAO's previous review of the DISN program. GAO noted that: (1) although DOD has been implementing the DISN program for 7 years, numerous networks continue to exist without the Defense Information Systems Agency's (DISA) knowledge; (2) GAO's survey found that the military services are operating at least 87 independent networks that support a variety of long-haul telecommunications requirements; (3) the services reported costs on 68 of these networks totalling more than $89 million annually; (4) DOD's inability to restrict the number of networks operating across the department stems from its failure to implement basic telecommunications management policies established at the beginning of the DISN program and its failure to develop objective performance measures for the program; (5) DISA has not developed a comprehensive inventory of telecommunications networks throughout DOD nor have the military services developed inventories of their own networks; (6) DISA has not reported on telecommunications acquisitions, trends (volumes and types of traffic) and costs throughout DOD, and it lacks the data to develop such reports; (7) DOD has not effectively enforced the use of common-user services, nor were Assistant Secretary of Defense for Command, Control, Communications, and Intelligence (ASD/C3I) officials clear on how enforcement would occur; (8) DOD has only recently begun to implement an interim waiver process to exempt DOD components from using common-user networks--a final process has yet to be implemented; (9) DOD has not developed performance measures for the DISN program even though it agreed with GAO's previous report that these measures were essential to ensuring DISN was efficiently and effectively managed; (10) by not implementing the above, DOD lacks the basic management controls to ensure that it can achieve its goal for an interoperable and cost-effective telecommunications environment; (11) specifically, it lacks a foundation for identifying stovepiped and redundant networks that are not interoperable and cannot share information, and replacing them with mandated common-user services; it lacks a basis for maximizing the efficiency and cost-effectiveness of DISN; it cannot quantify problems; and it cannot learn from mistakes; and (12) as a result, DOD's stated goals for DISN are at risk, and DOD cannot ensure that DISN is the most cost-effective solution to DOD's telecommunications service requirements.