To gain a better understanding of the overall concept, key acquisitions, and implementation strategy, we reviewed relevant DOD plans, policies, guidance, and other documents pertaining to the GIG. We also reviewed briefings prepared for high-ranking DOD officials and other organizations within the department to obtain more up-to-date information on the status of GIG activities and costs of key components. Funding and cost information was obtained from budget exhibits and other accounting reports compiled by the DOD. We did not conduct a comprehensive review of the financial reports or records. Also, we did not evaluate the content and quality of the GIG architecture and standards. In addition, we interviewed key officials responsible for the GIG in the Office of the Assistant Secretary of Defense for Networks Information and Integration (DOD’s Chief Information Officer); the Defense Information Systems Agency; Office of the Under Secretary of Defense (Comptroller); Office of Program Analysis and Evaluation; Office of the Under Secretary of Defense for Acquisition, Technology and Logistics; and Office of the Joint Chiefs of Staff. We held interviews with officials representing the Offices of the Chief Information Officer for the Air Force, Army, Navy, and U.S. Marine Corps. To identify the challenges associated with GIG implementation, we examined studies, reports, and guides on the GIG; DOD’s effort to transition toward more network-based military operations; and DOD’s efforts to enhance its capability to acquire joint systems that were completed by DOD, the Defense Science Board, and other research entities, such as the Center for Strategic and International Studies. We examined reports and guides completed by the Congressional Research Service, Congressional Budget Office, and GAO on managing technology projects, architectures, and information technology investments. We held interviews with previously identified DOD officials to discuss key challenges associated with the development and implementation of the GIG. We performed our work from November 2003 to June 2004 in accordance with generally accepted government auditing standards. For the past two decades, DOD has been seeking solutions to improve interoperability and information sharing across its business and warfighting operations. Too often weapon and information technology systems have been acquired by the military services and defense agencies without regard for their ability to work in a joint operational environment. As a result, extra layers of redundancy and common systems have been put in place to support military operations, but without the ability to easily and quickly exchange data. DOD defines the GIG as a “globally interconnected, end-to-end set of information capabilities, associated processes, and personnel for collecting, processing, storing, disseminating, and managing information.” The GIG is meant to improve interoperability among DOD’s many information systems and weapon systems. More important, the GIG is to facilitate DOD’s effort to transform to a more network-based, or “netcentric,” way of fighting wars and achieving information superiority over adversaries, much the same way as the Internet has transformed industry and society on a global scale. Netcentric operations and warfare, according to DOD, are the combination of tactics, techniques, and procedures that a networked force can employ to create a decisive warfighting advantage. The GIG’s role is to create an environment in which users can access data on demand at any location without having to rely on (and wait for) organizations in charge of data collection to process and disseminate the information. Data could emanate from a variety of sources, including weapon systems belonging to other military services, space-based intelligence, surveillance, and reconnaissance satellites, and DOD logistics, financial, and other systems that carry out business operations. Ultimately, DOD expects that most of these systems will become part of the GIG. With greater data access and a more robust communications infrastructure, DOD expects the GIG to enable more timely execution of military operations, collaborative mission planning and execution, common views of the battlespace, and more timely assessments of the condition of equipment and the levels of supplies. For example, according to DOD officials, greater information sharing could dramatically increase capabilities to rapidly identify and strike time-critical targets, such as mobile surface-to-air missile sites. In the past, such targets have proved to be elusive because the enemy is able to move them to safety in a shorter time frame than it takes U.S. military forces to detect, assess, and attack the targets. By having greater command of a battle situation, DOD expects that lethality and survivability of equipment and personnel would be increased. Armor protection could be scaled down in favor of more agility. In addition, the GIG would reduce the substantial resources and logistics needed to bring command, control, and communications systems to the war-fighting environment. Table 1 illustrates how DOD envisions the GIG will help transform military operations. The GIG is to be much like the Internet, but with less dependence on ground-based and fixed systems and equipment to transmit and route data and more dependence on space-based and mobile, ad hoc systems to carry out these functions. Figure 1 shows the various layers of the GIG’s overall concept. At the core are communications satellites, next-generation radios, and an installations-based network with significantly expanded bandwidth. These will provide the basic infrastructure through which data will be routed and shared. In addition, the GIG would employ a variety of information technology services and applications to manage the flow of information and ensure the network is reliable and secure. Various information technology tools would be available to help users determine what information is available, where to find it, and how best to use it. DOD envisions that communities of interest would be developed, linking users with common interests who would collaborate on analyzing and sharing information. Ultimately, most of DOD’s sensors, weapon systems, business systems, and systems belonging to decision makers, military units, and allies would be tied into the GIG network—serving as both users and providers of data. DOD has taken a two-pronged approach to build the GIG: (1) invest in a set of core enterprise programs and initiatives to build a core network and information capability and (2) bring other existing and planned weapon systems, command, control, and communications systems, information technology systems, and logistics, personnel, and other business-related systems into the GIG network. The core network acquisitions are to be developed incrementally over time, with the aim of fielding the first increment of the GIG by 2010. The GIG is primarily being developed under the leadership and direction of DOD’s Office of the Assistant Secretary of Defense for Networks and Information Integration in coordination with other components in the Office of the Secretary of Defense and Joint Staff. The Defense Information Systems Agency, military services, combatant commands, and other defense agencies also play roles in implementing the GIG. In addition, DOD’s Strategic Command has responsibilities for eventually operating the GIG. Table 2 shows the key acquisitions for the GIG’s core network and examples of additional acquisitions that must be integrated with the GIG. According to DOD, the key acquisitions underway to build the GIG network capability include 1) Transformational Satellite (TSAT), a new constellation of communications satellites to transmit and route larger volumes of data; 2) Joint Tactical Radio System (JTRS), a new family of interoperable radio systems; 3) Global Information Grid-Bandwidth Expansion (GIG-BE), which includes state of the art optical network technologies and upgraded routers and switches to increase bandwidth for greater voice, data, and video transmissions as well as improvements in network services at about 90 DOD installations; 4) Network Centric Enterprise Services (NCES), a common set of services and applications to manage the network and help users locate and share information; 5) Cryptography Transformation Initiative, tools to protect sensitive information transmitted across the network and protect the network from attack; and 6) Horizontal Fusion, which is a portfolio of initiatives focused on developing and demonstrating data applications and tools for information sharing and netcentric operations. Table 3 reviews each of the key acquisitions for the GIG’s core capability, including the purpose, the financial investment between fiscal years 2004 and 2009, the military service or defense agency responsible for managing the acquisition, and the current status. Some of these acquisitions will require funding, including sustainment costs, beyond 2009 but amounts are not yet known. In developing the GIG’s core capability, DOD intends to build upon and enhance ongoing terrestrial and space-based networks and systems, such as the Advanced Extremely High Frequency satellite communication system and the Defense Information Systems Network. The new programs underway are intended to improve communications and networking capabilities significantly. For example, according to DOD officials, current telecommunication lines are not robust enough to handle the volume of information needed to facilitate optimal, strategic decision making. The GIG-BE is designed to remove current bandwidth constraints. The GIG-BE is to use advanced fiber-optic backbone and switching technology to upgrade telecommunications lines and provide initially up to 10 gigabytes per second of bandwidth at selected defense installations around the world. Also, unlike DOD’s legacy radio systems that cannot interoperate with one another, JTRS is software-based, meaning that the radios are essentially computers that can be programmed to imitate other types of radios and thus be readily configured to operate in different networks and waveforms based on common standards. JTRS is expected to act as a gateway for users with different hardware radios—a capability that speeds the transition to universal interoperability for DOD military operations. Also, unlike current communication satellites, TSAT is to be equipped with laser-optical payloads for high-capacity links to other air and space platforms. By using laser-optics, TSAT is intended to operate above the radiofrequency spectrum and provide relief to current military bandwidth constraints. NCES is to make use of commercial products and tools to manage messaging, storage, search, and other capabilities across platforms, but also require new and possibly customized services to ensure the sharing of information based on mission demands and priorities. Tools to allow users to “smartly” pull and fuse information will require investing in new data content and management techniques. Enhanced security (information assurance) capabilities will need to be developed, including encryption mechanisms and devices, intrusion detection systems, and secure network management. Most ongoing and planned weapon systems; command, control and communications systems; and business systems will need to be integrated with the GIG network, because they will be the primary providers and receivers of data needed to support future military operations. DOD plans to integrate most weapon systems into the GIG. In fact, some “transformational” weapon systems now under development require a more advanced communications infrastructure to perform as intended and to support voice, data, videoconferencing, and imagery transmissions. Without an integrated network that ties together different systems and enables information to flow freely across the battlefield, the high-paced warfare that DOD envisioned is likely to be constrained, according to DOD. For example, the Army is developing the Future Combat Systems, a new generation of manned and unmanned ground vehicles, air vehicles, and munitions that are to be lighter and more mobile yet lethal and survivable. Rather than rely on heavy armor to withstand an enemy attack, the Future Combat Systems will depend on superior information to see and kill the enemy before being detected. According to DOD, the ability to make this leap depends on (1) a network to collect, process, and deliver vast amounts of information, such as imagery and data, and (2) the performance of the individual systems themselves. Not only must systems within the Future Combat Systems interoperate effectively, they also must interoperate with the GIG. The GIG must perform at a level that enables the Future Combat Systems to quickly collect, process, and deliver data. DOD is also developing a new constellation of satellites— known as Space-Based Radar—to provide a near continuous, all- weather global capability of collecting intelligence, surveillance, and reconnaissance information. Space-Based Radar is expected to be a critical data provider to transformational systems, such as those within the Future Combat Systems. Like the Future Combat Systems, the satellites will require a more robust communications infrastructure to send massive amounts of imagery data in a timely fashion. According to DOD, if TSAT, a key GIG component, is not ready in time or cannot provide the capability originally planned, DOD may need to build additional capability into Space-Based Radar satellites and ground stations to reduce the dependency on the communications infrastructure to transmit data. DOD intends to integrate virtually all command, control, and communications, systems into the GIG. At the same time, DOD intends to develop and modify these systems to provide military commanders and forces with near-real time descriptions of the location and disposition of U.S. military forces and adversaries operating on the ground and in the air and to provide the ability to communicate across all elements involved in military operations. Each of the military services has major architectural initiatives underway (the Air Force’s C2 Constellation and ConstellationNet, the Army’s LandWarNet, and the Navy’s ForceNet) to transform their command, control, and communications systems and information infrastructures into the GIG. For example, the Army’s Warfighter Information Network-Tactical (WIN-T) program (part of LandWarNet) is intended to be the integrating communications network that links Future Combat Systems units with higher Army echelons and with the GIG. In addition, DOD considers numerous other systems to be important in achieving the GIG, including the Mobile User Objective System (satellite communications), Global Command and Control System/Joint Command and Control, Deployed Joint Command and Control, and Teleports (information transport system). DOD has further identified the need to eventually link the GIG to coalition, allied, and non-DOD users and systems. DOD also intends to integrate its business systems into the GIG. These include acquisition and procurement systems, financial management systems, personnel and health systems, logistics systems, and strategic planning and budgeting systems. Many of these play an important role in supporting military operations. For example, logistics systems are used to plan, control, and carry out the efficient and effective movement and maintenance of forces. The GIG’s success is dependent on DOD’s ability to successfully integrate the majority of its weapon systems, command, control, and communications systems, and business systems with the new core network. To make this happen, DOD has developed a blueprint or architecture for the GIG; developed new policies, guidance, and standards to guide implementation decisions; undertaken proactive efforts to “market” the GIG and its potential benefits; and is attempting to influence key budgeting and acquisition decision-making processes to align with the GIG concept. To help guide decision-making, DOD has developed an initial architecture for the GIG, which, according to DOD, presents the current information technology environment and desired (target) technology environment; describes how the commands, services, and defense agencies will operate in a netcentric environment, based on selected strategic, operational, and tactical scenarios; and identifies the actions and information requirements for conducting operations in a netcentric environment, how systems will need to function to access information, and emerging standards for the development and acquisition of systems. DOD also has developed a reference model so program managers of various architectures and systems can ensure GIG compliance. According to DOD, the reference model’s key purpose is to provide users with an understanding of the GIG through common definitions and terms of reference, standards, and templates for developing more detailed architectures. Future versions of the GIG architecture are to include more complete views of DOD’s operational environment and existing enterprise requirements. Furthermore, DOD is modifying its Joint Technical Architecture, which sets standard technologies and protocols to better ensure interoperability and to complement the GIG architecture. DOD is also in the process of issuing new policies, standards, and guidance to formalize the architecture. Specifically, DOD has created policy that requires all departmental architectures to be GIG compliant. DOD also has developed specific policies, standards, and guidance to implement the GIG and help ensure that the military services acquire systems that integrate with the GIG. Several policies establish the GIG as a cornerstone for enabling DOD to achieve information superiority, formally define the objectives and key elements of the GIG, and assign roles and responsibilities for the GIG on an enterprise basis. Others assign responsibility and define waiver procedures for specific aspects of the GIG, such as ground-based telecommunications networks and NCES. For example, DOD formalized a waiver process to assess network and telecommunications systems (such as local area networks) that are not GIG-compliant. In addition, DOD has set standards to address data connectivity. To provide a common format for the transmission of information across the GIG, DOD recently mandated that GIG systems must be Internet Protocol Version 6 capable, as well as Internet Protocol Version 4 (the Internet currently is based on version 4.), or obtain a waiver. Furthermore, DOD developed a netcentric data strategy, standardizing the way data will be described and used in systems that make up the GIG. Appendix I provides more details on these policies, standards, and guidance. DOD officials who developed the GIG concept also expect to influence decisions by participating in DOD’s key decision-making processes. Over the past couple years, DOD has revised its three primary decision-making processes for determining and delivering military capabilities— requirements setting, acquisition, and budgeting—to focus acquisitions and investment decisions on meeting joint mission needs, particularly with regard to interoperability. In revising these processes, DOD has emphasized compliance with the GIG architecture. DOD officials have taken further action intended to strengthen these decisions by developing tools and criteria for actively participating in the decision-making process—by assisting military services in preparing for major acquisition reviews (as part of integrated product teams) and/or by providing input to decision-making boards. The revisions DOD has made to its requirements setting, acquisition, and budgeting process are all fairly recent. Therefore, it is too early to assess whether they will be successful in achieving their goals. For example, DOD revised its requirements-setting process to shift the focus to a more capabilities-based approach for determining joint war- fighting needs rather than a threat-based approach focused on individual systems and platforms. Under the threat-based approach, the services were primarily responsible for defining requirements, selecting alternatives, and developing systems, which frequently resulted in the fielding of stovepiped systems and duplicating capabilities. DOD’s rationale for shifting to capabilities-based requirements is a recognition that there is greater uncertainty in future military conflicts without a clearly defined adversary and it will need to respond across a broader range of military operations. The new Joint Capabilities Integration and Development System, established in October 2003, is organized around key functional concepts and areas—command and control, force application, battlespace awareness, focused logistics, and force protection--aimed at improving joint warfighting capabilities. In addition, a sixth area has been established—netcentric operations—to enable planning across functional areas and support integration of netcentric capabilities. The Office of the Assistant Secretary of Defense for Networks and Information Integration and Joint Staff officials believe the joint concept will provide a more coherent framework for identifying capabilities gaps, comparing alternatives, aligning requirements to the GIG, and reduce the potential for stovepiped, duplicative capabilities. DOD officials also indicated that the department has begun revising its planning and budgeting process in an effort to instill more collaboration among different components of the department in investment decisions. For example, DOD is asking the military services to plan budgets around guidance that takes a joint perspective. Data collection and management processes are intended to be merged into a portfolio management approach that enables program reviews and budget reviews to occur in a more integrated manner rather than sequentially. To complement this process, DOD is planning to develop an investment portfolio management structure to better manage its information technology resources where decisions about what information technology investments to make, modify, or terminate, are based on the GIG architecture and other objectives, such as mission area goals. Other recent policies have focused on establishing more effective investment processes for information technology systems that need to integrate with the GIG. DOD has developed several mechanisms to complement the decision making that occurs within the Joint Capabilities Integration and Development System, planning and budgeting, and acquisition processes. For example, in November 2003, the Office of the Assistant Secretary of Defense for Networks and Information Integration, in consultation with the Joint Chiefs of Staff, Office of the Under Secretary of Defense for Acquisition Technology and Logistics, and U.S. Joint Forces Command, established a new Net-Ready Key Performance Parameter and review process to focus greater attention on systems interoperability for joint operations as well as the information-sharing requirements of the GIG. The Net-Ready Key Performance Parameter is built around compliance with the GIG architecture, and the reference model will be used to assess system information needs, information assurance, and the technical exchange of information. The Office of the Assistant Secretary of Defense for Networks and Information Integration has also developed a netcentric checklist to guide the Joint Capabilities Integration and Development System and acquisition reviews. The checklist is based on the GIG architecture and will be used to assess whether key standards and protocols are being considered and built into particular capabilities and systems being acquired. In addition, the Office of the Assistant Secretary of Defense for Network and Information Integration has established a systems engineering and evaluation capability to support the reviews. A team of systems engineers will provide end-to-end technical support to the office and funding has been requested to create a facility to test key GIG- related systems and components. DOD will be conducting specific netcentric reviews of major acquisition programs to assess whether they are transitioning to integrate with the future network. About 129 information technology, weapon systems, and business systems have been selected to participate in the initial round of assessments. These reviews are scheduled to be completed later this year. The most critical challenge ahead for DOD is making the GIG a reality. While DOD has taken steps to define its vision and objectives for the GIG on paper and in policy, it is not fully known how DOD will meet these objectives, particularly with respect to setting investment priorities, providing management attention and oversight, transforming operations, and advancing technologies. At the same time, DOD is beginning to make a heavy investment in the GIG as well as systems that will be heavily dependent on the GIG, such as the Army’s Future Combat Systems, and DOD is asking its components and the military services to accept its vision and plan toward it. In addition, DOD faces risks inherent with the nature and scope of the effort it is undertaking, for example, risks related to protecting data within the thousands of systems that will be integrated into the network. DOD recognizes these challenges, and many of the actions it is taking to implement the GIG are meant to address them. However, it is too early to assess how successful DOD will be in addressing the challenges and overcoming long-standing organizational impediments. Table 4 below highlights some of the key challenges facing DOD. While DOD has taken steps to establish a vision and objectives for the GIG, it is still not fully known how DOD will manage, oversee, and invest in this effort. Addressing these questions is a daunting task. DOD must find ways to make and enforce trade-off decisions for literally thousands of information technology systems, weapon systems, command and control systems, intelligence systems, and other systems. These decisions will need to span a wide range of organizations, including the military services and their respective major commands and functional activities, numerous large defense agencies and field activities, and various combatant and joint operational commands that are responsible for military operations for specific geographic regions or theaters of operations. Having accurate and reliable visibility over spending on systems that must integrate with the GIG will be necessary as well as having effective mechanisms for identifying and deciding which systems should be pursued and which should not. In 2003, we reported (as part of a survey of federal agencies enterprise architecture programs) that DOD had made progress in developing the GIG architecture, however, the department had not completed some essential architecture products that describe the desired (target) technology environment and provide a sequencing plan for transitioning to it. More specifically, at this point, DOD is largely leaving it up to its components and services to decide how best to migrate their systems to the GIG. There is no well-defined strategy that identifies what capabilities DOD will invest in and what it will not invest in; identifies how investments will align with the goals and objectives of the GIG architecture; determines what is affordable, particularly in light of near-term and sets out criteria for determining what legacy systems should remain or be phased out; and specifies by whom and how decisions will be enforced. In addition, it is unknown how senior leaders within DOD will be able to focus on the progress of the GIG as a whole, that is, whether it is being developed and fielded within cost and schedule, whether risks are being adequately mitigated, and whether the GIG is providing a worthwhile return on investment, particularly in terms of enhancing military operations. Until DOD implements an investment and oversight strategy for the GIG as a whole, it is at risk of making investments that do not fit its vision for the future. According to DOD officials, the enhancements DOD is making to its planning and budgeting processes are meant to begin addressing these questions. However, these changes may be difficult to implement for a number of reasons. First, to some degree because of the broad scope and crosscutting nature of the GIG concept, no office or single program is in charge of the GIG, making it more difficult to make and enforce trade-off decisions. Moreover, while key acquisition, budgeting, and requirements setting processes have been modified, they still largely operate under the same organizational structure, where it has been difficult to link acquisition and investment decisions to joint concepts like the GIG. Additionally, previous efforts that have been undertaken in past years to foster interoperability among DOD systems have had limited success, principally because management tools and leadership attention were not strong enough to provide sufficient oversight and overcome resistance by the military services to forgo their unique requirements in favor of requirements that would benefit the department, as the following examples illustrate: In our 2001 report on DOD’s efforts to improve its ability to attack time-critical targets, we noted that DOD had undertaken numerous efforts to achieve system interoperability, including the development of guidance, oversight controls, directives and policies, and technology demonstrations. However, success was limited because DOD had not yet overcome resistance from the military services, it lacked an architecture to guide interoperability efforts and some current oversight and control mechanisms, such as the interoperability certification process, were not working or were not being enforced. In 2003, we reported that two joint acquisition programs lacked mechanisms to overcome parochialism and stovepipes at the military service level. The JTRS program lacked a strong management structure to resolve operational requirements and funding issues among the services and DOD’s approach to planning Unmanned Aerial Vehicles lacked an effective strategic plan to ensure the military services and other defense agencies focus their development efforts on systems that complement each other. In 2004, we reported that DOD was making limited progress with its business modernization initiative—a departmentwide effort focused on transforming DOD business operations, including standardizing and optimizing business systems across DOD and reducing duplication. After 3 years of effort, we reported that we have not seen any significant change in the content of DOD’s business systems modernization architecture (which is to be integrated into the GIG architecture) or in DOD’s approach to investing billions of dollars in existing and new business systems. Further, DOD had not yet implemented an effective management structure and processes to provide adequate control and accountability over its $5 billion annual investment in business systems modernization. In particular, we reported that DOD had not yet clearly defined the roles and responsibilities for its new business investment domains, established common investment criteria, and conducted a comprehensive review of its existing business systems to ensure that they are consistent with the business modernization architecture. DOD acknowledged that it still had much more to do, including developing the business systems modernization architecture to a necessary level of detail, defining specific performance metrics, and clarifying the roles and responsibilities associated with managing the domains of portfolios of business systems and ensuring that these systems comply with the architecture. Several recent studies sponsored by DOD recognize that developing an investment strategy and adopting better management tools is critical for the success of the GIG. For example, a 1999 Defense Science Board study assessed DOD’s strategies and processes for attaining information superiority and advocated that (1) an executive office be established to lead and implement the GIG and that (2) the office develop an implementation plan, including technical milestones and measurable interim goals, and identify resources to permit the transition to and completion of the GIG. A 2004 report by the U.S. Joint Forces Command, documenting the processes and planned activities underway to achieve transformational improvements in joint military capabilities, recommended, among other things, that the GIG should include a time- phased plan for how future capabilities will link to current investments. In addition, the report recommends that such a plan should show how network development efforts underway by each of the military services will contribute to and be compatible with the GIG. Other studies have pointed to the need to strengthen current management processes to ensure warfighters themselves have more input into investment decisions. For example, a 2003 study chartered by the Secretary of Defense to examine how DOD develops, resources and provides joint capabilities, recommended moderate to more radical actions to streamline existing processes and/or establish alternative organizations to better integrate defense capabilities in support of joint military objectives. Organizational alternatives for strengthening the acquisition process ranged from the establishment of joint program executives for each of the Joint Capabilities Integration and Development System’s functional capabilities areas that would provide input and oversee resources on joint programs, to capability acquisition executives for each of the capability areas who would have direct oversight and decision authority over all programs. A 2004 study by the Center for Strategic and International Studies identified defense reforms needed to meet the challenges of a new strategic era and made a number of recommendations, including several to improve the acquisition of joint capabilities and establish a more effective resource allocation process. For example, the study recommended that the Joint Staff (J-6—Command, Control, Communications, and Computers) be expanded into a departmentwide, joint task force with budgetary and acquisition authority for joint command and control capabilities. In addition, to improve trade- off decisions across mission areas, the study advocates building capacities in the combatant commands for a stronger role in the resource allocation process. There are also many unknowns concerning how DOD will meet its requirements and vision in terms of people, processes, and, ultimately, operations. First, DOD has yet to determine how much information should be posted on the network; when it should be posted; and how and where it should be used. Once these factors are determined, DOD must develop rules of operation to ensure the network can work as intended without precluding the benefits that can be derived from more flexible and dynamic information sharing. Currently, various offices within DOD are working through questions on whether unlimited amounts of data should be made available through the GIG, including unprocessed intelligence, surveillance, and reconnaissance data, without the benefit of some assimilation and analysis. These are important questions that need to be addressed in the near future because they could affect the direction of investments in netcentric systems and non-network systems as well as changes that need to be made in how the intelligence community operates. Even after these questions are settled, significant operational challenges remain. Joint commanders and the military services may need to find ways to adapt to an environment where data can be more readily obtained and shared by lower levels in the chains of command. New operational concepts are being developed to guide how military operations are to be conducted in this enhanced technology environment. They will need to be followed by associated doctrine, tactics, techniques, and procedures. Developing joint operational concepts is one of the key tenets under the Joint Capabilities Integration and Development System; however, it is unclear how the concepts will be developed and translated by these boards into more detailed tactics, techniques and procedures. We recently reported that DOD had been proceeding with the JTRS program for several years without clear definition of how JTRS capabilities should be used in an operational environment and that the program’s concept of operations did not reflect the joint vision of JTRS but instead the service- centric radio-replacement perspective. If DOD is to achieve its long-term goals for netcentric warfare, it is imperative that it develop concepts and processes for how individual systems, such as JTRS, can be used to leverage DOD’s new network infrastructure and maximize interoperability and collaboration in military operations. Moreover, DOD must successfully persuade data owners to accept the value of sharing data with a broader audience and to trust the network enough to post data. We spoke with several officials in charge of GIG programs who acknowledged that facilitating these cultural changes— particularly with the intelligence community—will be difficult. In addition, DOD also faces a formidable task in persuading the military services and other users of the network to rely on information technology applications and services being developed by the Defense Information Systems Agency. This agency has been tasked with developing and providing key voice, video, and data connectivity through core enterprise services for the GIG, such as data query (search or discovery) capabilities and information assurance. However, the military services and defense agencies have historically been reluctant to rely on the Defense Information Systems Agency for these services. We have reported in the past that the military services have regularly bypassed Defense Information Systems Agency, preferring instead to procure their own telecommunications networks and commercial satellites bandwidth services because they were dissatisfied with the level of service provided by the agency as well as the cost and length of time it took to procure these services centrally. Building a reliable, secure network that will operate on the move, virtually anywhere and provide the necessary information and services to enable netcentric military operations presents considerable technical challenges. While DOD intends to utilize existing commercial communications and networking technologies, which have advanced significantly in recent years, the GIG requires DOD to advance a number of key technologies, develop a series of complex systems and software, field them without delay so schedules for other dependent systems are not disrupted, and develop the means to effectively manage and protect the network and its data. At this time, however, DOD is pushing ahead on several programs with immature technologies and with aggressive development and fielding schedules. As a result, DOD is at risk of not delivering required capabilities within budgeted resources. This, in turn, may affect schedules and funding for other systems depending on the GIG. For example, two key GIG- related programs—JTRS and TSAT—are facing schedule and performance risks, which are largely rooted in attempts to move these programs into product development without sufficient knowledge that their technologies can work as intended. In March 2004, we reported that none of the 20 critical hardware and software technologies for the Army’s initial JTRS radio development for ground vehicles and helicopters were sufficiently mature according to best practice standards. When product development began in June 2002, the Army determined that while many of the technologies within the program had been used in other radio applications, they could not be assessed as mature because they had not been integrated into a complex radio, such as JTRS. Mature backup technologies exist for some critical technologies, but program officials have cautioned that substituting them could complicate integration or result in degraded performance. Moreover, the program recently experienced a 4-month schedule slip that officials attribute to short-term technology deviations affecting size, weight, and power requirements for the radio sets. Further, the program entered product development with an ambitious schedule that program officials recognized as high risk. In particular, the program has a compressed test and evaluation phase that leaves little room for error and rework. We also recently reported that the TSAT program entered into product development with only one of its six critical technologies sufficiently mature. The remaining five technologies are not expected to reach maturity until 2006. Backup technologies exist for three of the five immature technologies, but they would degrade system performance. The other technology—single access laser communications—has no backup and program officials indicated any delay in maturing this technology would cause the first satellite launch date to slip significantly. DOD believes it has adequate measures to mitigate these risks, however, concern over TSAT technology readiness led the Air Force to schedule an interim review for November 2004, which will determine whether the program’s technology development has progressed sufficiently or whether alternative action should be taken. Similar risks extend to the systems that must be integrated with the GIG and on which DOD is dependent for achieving its vision for netcentric warfare. For example, our review of the Future Combat Systems determined that the program is at significant risk, in part because more than 75 percent of its critical technologies were immature at the start of development and many will not be sufficiently mature until the production decision. First prototypes for the systems that make up the Future Combat Systems will not be delivered until just before the production decision, and full demonstration of the Future Combat Systems’ ability to work and meet its goals will not occur until after production has begun. If the lessons learned from best practices and the experiences of past programs have any bearing, the Future Combat Systems program is likely to encounter “late-cycle churn,” a phrase used by private industry to describe the discovery of significant problems late in development and the resulting search for fixes when costs are high and time is short. Networking, network management, and secure network management challenges are considerable. Currently, mobile networking is limited, mainly to narrowband, fixed infrastructures, and relatively stable user groups. The GIG network will require new wideband waveforms that can handle the expected high data rates, throughput of information, and ability to transmit integrated voice, data, and video simultaneously. In addition, dynamic networking capabilities that can automatically adjust to changing circumstances, such as intrusions or node failures, are needed; however, the scalability of network management technologies for a network like the GIG with such a large number of nodes is unproven. To facilitate timely and prioritized access to information from a wide variety of sources, the network will require enhanced quality of service mechanisms and algorithms to manage bandwidth allocation and handle the flow of information and security. Furthermore, advances will be needed in several other technological areas, such as antennas, power sources, and the miniaturization of components to facilitate mobile communications. For example, current antennas do not support all of the portions of the radio frequency spectrum where the GIG network will operate and are limited to specific communications waveforms. Advanced multiband antennas will be needed to support mobile and simultaneous communications across different portions of the spectrum. Integrating other elements of the network will also be challenging. The increased bandwidth capability provided by the GIG-BE program may not be fully realized if the military services and defense agencies do not use compatible technologies and protocols in upgrading their networks. Even if the technologies and protocols are compatible, bandwidth may be limited if these networks are not properly designed and integrated to manage voice, data, and imagery transmissions. Network management policies may pose challenges if common agreement cannot be reached across the military services and defense agencies on standards and information assurance requirements. For example, DOD and the intelligence community have not yet reached agreement on how they will exchange information and verify security credentials on the GIG network. Information assurance itself may be one of the most critical challenges facing DOD. While building a network based on Internet protocols is expected by DOD to provide a more viable path to achieve interoperability and enable more dynamic and flexible information sharing, it also exposes DOD to the same vulnerabilities that face all users of the Internet, and it increases the opportunity for potential attackers with limited knowledge and technical skills to cause a great deal of damage. Establishing network and system security safeguards—such as firewalls, identifying the sender and recipient of information, protecting information from unauthorized access, and safeguarding data to prevent accidental and deliberate alterations—will be essential but difficult given the size the network and the thousands of systems and users that will be linked to it. Moreover, if the network is to be used to provide warfighters on the move with access to intelligence and other sensitive information on demand, information will need to be encrypted to safeguard data from misuse. However, the technologies needed to secure communications, such as software programmable encryption devices are still in their infancy. Further, the complexity and magnitude of enabling hundreds of systems and applications to operate in a secure, Web-based environment will require careful planning and coordination. Comprehensive plans will be needed to ensure that sensitive data and communications are safeguarded across diverse platforms. This will require DOD to identify sensitive data as well as applications, databases, storage subsystems, and media used to process and store the data. Once systems have been examined, data access models must be applied to determine proper security levels for information and how integration can occur across platforms without disrupting network and near-real time operations. No one security solution likely will address GIG requirements. Lastly, the enterprise information services planned for the GIG pose timing challenges. For example, in the near-term, DOD has established a goal to complete the transition to Internet Protocol Version 6 by fiscal year 2008. According DOD officials, the commercial industry may not be able to provide the necessary products for Internet Protocol Version 6 by the targeted milestone. Also, the transition will not be completed until a Joint Staff developed set of performance and technical criteria can be met. In addition, because of the enormous amount of data that will become available, new data fusion methods will need to be developed to help users rapidly identify, access, and make sense of available information. DOD is depending on the GIG to enable a fundamental transformation in the way military operations are conducted. While DOD’s vision of the GIG is compelling, the breadth and depth of the GIG and DOD’s objectives for netcentric warfare, present enormous challenges and risks—many of which have not been successfully overcome in smaller-scale efforts and many of which require significant changes in DOD’s culture. Moreover, even though DOD has begun to make heavy investments to implement the new network and to ask the military services to accept its vision for the GIG, important questions as to how DOD will make the GIG a reality and how it will oversee progress as a whole and ensure the GIG is providing an adequate return on DOD’s investment are only just beginning to be addressed, leaving DOD at risk of making investments that may not fit in with its vision for the future. Moreover, many new weapon systems and sensors, which are costing DOD tens of billions of dollars, are critically dependent on the future network to successfully achieve their own capabilities. Any disruptions in the schedule for key systems that support the network, therefore, can have significant ramifications. As such, it is important that DOD ensure it has sufficient knowledge about these systems (e.g., requirements, technologies, security) as it makes additional commitments to them and that it has effective risk mitigation plans to ensure that they can deliver promised capability on time. Our future work, therefore, will assess DOD’s progress in addressing these challenges in more depth as well as its progress in managing key acquisitions related to the GIG. DOD provided technical comments on a draft of this report that we incorporated where appropriate. We plan to provide copies of this report to the Secretary of Defense, the Assistant Secretary of Defense for Networks and Information Integration, the Under Secretary of Defense for Acquisition, Technology and Logistics, the Under Secretary of Defense (Comptroller), the Director of the Defense Information Systems Agency, and interested congressional committees. We will make copies available to others upon request. In addition, the report will be available at no charge on the GAO Web site at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-3519, Cristina Chaplain at (202) 512-4859, or John Oppenheim at (202) 512-3111. Other individuals making key contributions to this report are Lily Chin, Arturo Holguin, and Yvonne Vigil. This policy establishes the Defense Information Systems Network (DISN) as DOD’s networking capability for the transfer of information in support of military operation in the context of the Global Information Grid (GIG). It further specifies that DISN shall be the means for wide-area and metropolitan-area networking unless granted a waiver through the DISN/GIG waiver board. This directive establishes policies for DOD information resources management, including information technology, and delineates, authorities, duties, and responsibilities for DOD information resources management activities. It also provides direction on establishing Chief Information Officers at various levels. This instruction implements an approach that considers both materiel (acquisition or procurement) and nonmateriel (doctrine, organizational, training, leadership, and personnel) aspects to ensure life-cycle interoperability and supportability of information technology and national security systems throughout DOD. It also implements an outcome-based, mission area focused process whereby information technology and national security systems interoperability and supportability requirements for new, modified, and fielded systems are documented, coordinated, implemented, verified, and approved to achieve an integrated, and secure information technology and national security systems infrastructure supporting global operations across the peace-conflict spectrum. The directive states that the GIG shall support all DOD missions with information technology, for national security systems, joint operations, joint task force, and/or combined-task for commands in a manner that offers the most effective, efficient, and assured information handling capabilities available, consistent with national military strategy, operational requirements, and best-value enterprise-level business practices. The policy assigns responsibilities to achieve DOD information assurance through a defense-in-depth approach that integrates the capabilities of personnel, operations, and technology, and supports the evolution to network- centric warfare. The instructions implements policy, assigns responsibilities, and prescribes procedures for applying integrated, layered protection of the DOD information systems and networks referenced in DOD Directive 8500.1. The policy establishes a goal to converge voice, video, and data traffic over DOD’s inter- network and the National Security Agency (NSA) as lead in developing the information assurance component of the GIG architecture. The policy establishes a goal of transitioning all DOD networking to the next generation of Internet Protocol, IPv6, by fiscal year 2008. As part of this transition, the strategy will be to minimize costs by ensuring products and systems procured, acquired, or in development after October 1, 2003, are capable of operating in IPv6 networks. The policy establishes a DOD-wide goal to institutionalize the practice of identifying all data assets on the GIG by fiscal year 2008. Information will be provided on each data asset to standardize the way data are described and used for all IT and national security systems. This practice will enable DOD to create tools to query data assets across platforms. The policy establishes a program to begin the development of core enterprise services within the GIG as part of the fiscal year 2006 program review process. Core enterprise services—such as messaging, collaboration, services management, security, discovery, and mediation—are to be developed to provide access and the delivery of data and services across the department. This instruction establishes polices and procedures for developing, evaluating and providing interoperability and supportability certification in support of the Joint Capabilities Integration and Development System for acquisition category, nonacquisition category and fielded capabilities. This instruction establishes the policies and procedures of the Joint Capabilities Integration and Development System. Procedures established in this instruction support the Chairman of the Joint Chiefs of Staff and the Joint Requirements Oversight Council in identifying, assessing, and prioritizing joint military capability needs. This policy assigns responsibilities for managing information technology investments as portfolios. It also establishes that decisions on what information technology investments to make, modify or terminate shall be based on architectures, risk tolerance levels, potential returns, outcome goals, and performance. This policy assigns responsibilities for the use of commercial wireless devices, services, and technologies in the DOD Global Information Grid. It also directs the development and use of a knowledge management process to promote the sharing of wireless technology capabilities, vulnerabilities, and vulnerability mitigation strategies throughout DOD and promotes joint interoperability using open standards throughout DOD for commercial wireless services, devices, and technological implementations. The directive updates DOD responsibilities for interoperability and supportability of information technology, including national security systems, and implements DOD Chief Information Officer’s responsibilities. It also defines a capability-focused, effects-based approach to advance information technology and national security systems interoperability and supportability across DOD and establishes the Net-Ready Key Performance Parameter to assess net-ready attributes required for both the technical exchange of information and the end-to-end operational effectiveness of that exchange.

Summary: The Department of Defense (DOD) is in the midst of transforming military capabilities. The transformation relies in part on the Global Information Grid (GIG), which is focused on building a new Internet-like network capability that DOD envisions will enable weapons and other systems and people to share information quickly, allowing warfighters to identify threats more effectively and to respond with greater precision and lethality. DOD plans to spend at least $21 billion through 2010 to build a core GIG capability. GAO was asked (1) to describe the GIG, including the concept, key acquisitions, and implementation and (2) to identify significant challenges facing DOD in implementing the GIG. The GIG is a huge and complex undertaking that is intended to integrate virtually all of DOD's information systems, services, and applications into one seamless, reliable, and secure network. DOD's overall concept is to enable data access for a variety of systems and users in the network no matter which military service owns a weapon system or where a user might be located around the world. DOD is looking to the GIG to form the basis of a network-centric or "netcentric" way of fighting wars and to create a decisive advantage over adversaries. DOD has taken the following two-pronged approach to building the GIG: (1) invest in key acquisitions to build a core networking capability, including new communication satellites, next-generation interoperable radios, a new ground-based communication network with significantly expanded bandwidth, and services and applications to manage and protect the network and help users locate, post, and share information; and (2) integrate other existing and planned weapon systems, information technology systems, and logistics, personnel, and other business-related systems into the GIG. To integrate other systems, DOD officials who created the concept for the GIG have developed an initial blueprint or architecture for the GIG and policies to formalize the GIG, and they are attempting to influence key acquisition and budgeting decisions to align investments and systems with the GIG. The most critical challenge ahead for DOD is making the GIG a reality. While DOD has taken steps to define its vision and objectives for the GIG on paper and in policy and is beginning to make a heavy investment in the GIG as well as systems that will be heavily dependent on the GIG, it is not fully known how DOD will meet these objectives. For example, it is not known which investments should take priority over others and how these decisions will be enforced. Moreover, it is not known how DOD will assess the overall progress of the GIG and determine whether the network as a whole is providing a worthwhile return on investment, particularly in terms of enhancing and even transforming military operations. According to DOD officials, the enhancements DOD is making to its planning and budgeting processes are meant to begin addressing these questions. Until DOD implements an investment and oversight strategy for the GIG as a whole, it is at risk of making investments that do not fit DOD's vision for the future.