The Inspector General Act of 1978, as amended, provides that the IG may receive and investigate complaints or information from an employee concerning the possible existence of an activity constituting a violation of law, rules or regulations; gross mismanagement; gross waste of funds; abuse of authority; or a substantial and specific danger to public health or safety. Violation of the law may also include a violation of a provision of criminal law, including the Uniform Code of Military Justice, which is codified in Title 10 of the United States Code. Whistleblowers are protected from reprisal as a result of making a protected disclosure through various statutes, regulations, and presidential policy covering different DOD personnel groups. Table 1 summarizes the statutory and policy authorities covering DOD personnel, along with selected protected disclosures and prohibited personnel actions—which are two required elements of the test for determining whether there was reprisal against a complainant for whistleblowing. A protected disclosure is a disclosure of wrongdoing by a whistleblower to a party that is an eligible recipient of that disclosure, while prohibited personnel actions include those actions that are taken or threatened in response to a protected disclosure, such as termination, reassignment, or a significant change in duties, responsibilities, or working conditions. DODIG and the military service IGs share responsibility for investigating misconduct and whistleblower reprisal complaints. Allegations of misconduct and other whistleblower complaints, including those involving senior officials, may be investigated by DODIG or a military service IG depending on the nature of the allegation or the DOD employees involved. Responsibilities for investigating whistleblower reprisal complaints differ according to DOD personnel type. Specifically, DODIG is responsible for investigating and overseeing DOD component investigations of complaints alleging reprisal against certain DOD civilian employees, and for investigating complaints alleging reprisal against DOD contractor, subcontractor, grantee, and subgrantee employees. For complaints alleging reprisal against a military servicemember, DODIG has the authority to either investigate the complaint or refer it to a military service IG for action. Most reprisal cases involving military servicemembers are investigated by the military services IGs, with DODIG oversight. In order to carry out its responsibilities, DODIG has established several directorates to facilitate the handling and investigation of misconduct and reprisal complaints. Figure 1 provides a high-level depiction of the DODIG and military service IG processes for handling reprisal, senior official misconduct, and internal DODIG employee complaints, along with the basic roles of the DODIG directorates. Whistleblowers confidentiality protections are codified in federal law. The Inspector General Act of 1978, as amended, restricts DODIG and military service IGs from disclosing a whistleblower’s identity without the consent of the whistleblower unless the IG determines that such disclosure is unavoidable during the course of the investigation. For example, if a complaint includes information that poses a personal or public safety concern, disclosing the identity of the complainant may be unavoidable. Additionally, the Privacy Act of 1974 prohibits the disclosure of records on any person to another agency without the consent of the person the record relates to, but allows for the disclosure of an employee’s identity if the purpose is for routine use—that is, a use that is disclosed for a purpose compatible with the purpose for which it was collected. For example, referring an allegation from an IG hotline to an appropriate investigative unit would be considered routine use. The Federal Information Security Modernization Act of 2014 is intended to provide a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support federal operations. The law requires each agency to develop, document, and implement an agency-wide information security program to provide risk-based protections for the information and information systems that support the operations and assets of the agency. The law also requires agencies to comply with NIST standards and the Office of Management and Budget requires agencies to comply with NIST guidelines for protecting federal IT systems. Among other things, NIST defines how agencies should determine the security category of their information and information systems based on the potential impact or magnitude of harm that could occur should there be a loss in the confidentiality, integrity, or availability of the information or information system. NIST also prescribes an array of activities associated with the selection, implementation, and assessment of IT security controls—and the authorization to operate federal IT systems and other products. DOD Instruction 8510.01, Risk Management Framework for DOD Information Technology, established a risk management framework for DOD information technology that is consistent with the principles established in NIST Special Publication 800-37. This framework includes requirements and procedures for identifying, implementing, assessing, and managing security controls. CIGIE’s Quality Standards for Investigations and Quality Standards for Federal Offices of Inspectors General collectively provide a set of overarching principles that IGs should adhere to in conducting their operations. They also provide a framework for conducting high-quality investigations through the definition of general and qualitative standards. General standards, among other things, address the qualifications of investigators, independence, and the concept of due professional care and confidentiality protections throughout the course of an investigation. Qualitative standards focus on the establishment of policies, procedures, and instructions for confidentially handling and processing complaints, along with investigative planning, execution, reporting, and information management. The CIGIE Integrity Committee receives, reviews, and refers for investigation allegations of wrongdoing made against Inspectors General, designated staff members of an IG, and the Special Counsel and Deputy Special Counsel of the Office of Special Counsel. Each Inspector General, including the DODIG, is required to submit a list of designated staff members to the CIGIE Integrity Committee Chairperson annually. DODIG met some but not all internal timeliness goals for fiscal year 2018 related to the intake and referral of whistleblower allegations, as well as the oversight of DOD component investigations. DODIG also did not meet internal goals related to the timeliness of senior official misconduct investigations or internal and statutory goals related to the timeliness of reprisal investigations. Intake is the initial process to determine whether a complaint contains a prima facie allegation of whistleblower reprisal or a credible allegation of misconduct by senior officials. Oversight reviews are conducted by the DODIG whistleblower reprisal and senior official investigations directorates to ensure the quality of DOD component investigations. DODIG officials cited several reasons for not meeting timeliness goals, including a backlog of cases and a lengthy report review process. Further, DODIG officials noted that the number of whistleblower reprisal cases increased from 1,013 to 2,002 (98 percent) over the past 5 years, while an internal DODIG fiscal year 2018 performance report cited other reasons for not meeting timeliness goals, including the assumption of responsibility for all sexual assault victim reprisal cases by the whistleblower reprisal investigations unit, the number of high-priority senior official cases concurrently open, and the increasing scope and complexity of investigations. DODIG met its fiscal year 2018 timeliness goals for civilian and contractor case intakes and senior official misconduct oversight reviews goals, but did not meet goals related to the average days of senior official misconduct and military reprisal intakes, and the average days for reprisal oversight reviews (see figure 2). In fiscal year 2018, DODIG resolved and closed 631 senior official misconduct cases during the intake review process and it performed intake reviews for 1,032 whistleblower reprisal cases. It also conducted oversight reviews for 157 senior official misconduct cases and 995 reprisal cases. By comparison, DODIG met its fiscal year 2017 targets related to the percentage of intakes and oversight reviews meeting timeliness goals, but it did not meet its goals for the average days of reprisal and senior official misconduct intakes. DODIG did not meet internal or statutory timeliness goals related to the percentage or average days for senior official or reprisal investigations (see figure 3). DODIG closed 73 investigations in fiscal year 2018, including 13 senior official misconduct cases and 60 military, contractor, and civilian reprisal cases. Overall, about 85 percent of all investigations did not meet the timeliness goal. DODIG similarly did not meet its investigation timeliness goals for senior official misconduct and reprisal investigations in fiscal year 2017. However, DODIG officials noted that the record closure of 60 reprisal investigations in fiscal year 2018 was a significant improvement over the 37 closed in fiscal year 2017, and DODIG data showed that the average age of closed and open investigations peaked in April 2018 and June 2018, respectively, and that both were lower as of January 1, 2019. Additionally, DODIG officials stated that they expected to eliminate the case backlog and reach a sustainable state of timeliness during fiscal year 2019. In fiscal year 2018, the DOD Hotline referred 3,872 cases to other entities for inquiry, and it performed oversight of 945 completion reports from DOD components. As shown in figure 4, the DOD Hotline met its timeliness goals, except for the percentage of referrals meeting the goal for priority 1 complaints. Comparatively, in fiscal year 2017, the DOD Hotline did not meet timeliness goals for the average days or percentage of referrals, but did meet its goal for completion reports. Quality goals can enhance the ability of organizations to provide reasonable assurance that they are exercising appropriate safeguards for federal programs, as demonstrated by our prior work. DODIG generally met its fiscal year 2018 internal quality goals related to the thoroughness and completeness of senior official misconduct and whistleblower reprisal investigations, as well as the completeness and accuracy of information in DOD Hotline referrals. DODIG’s internal quality goals for senior official misconduct and reprisal investigations pertain to the thoroughness of required case-file documentation and the integrity and completeness of data in its case management system. Criteria for assessing these goals include whether or not key documentation of the investigation—such as the incoming complaints and required notifications—are present in the proper folders in the case file, and whether start, end, or milestone dates have been recorded in the case management system. Criteria for assessing the completeness and accuracy of information in DOD Hotline referrals include checks on whether whistleblower consent is accurately documented and whether correspondence is addressed to the correct recipient. According to DOD Hotline officials, a weighted checklist was created in June 2018 that has greater focus on those criteria associated with protecting confidentiality. In fiscal year 2018, DODIG reported that it conducted quality reviews for 59 whistleblower reprisal cases and 13 senior official misconduct cases. DODIG further reported conducting reviews related to the quality of DOD component investigations for 80 whistleblower reprisal cases and 80 senior official misconduct cases, while the Hotline reviewed the thoroughness of 1,954 referrals. As shown in table 2, DODIG either met or partially met its quality goals except for the data integrity and completeness goal for senior official investigations and the documentation goal for senior official oversight reviews. While we have reported DODIG’s performance against its quality measures, we recommended in September 2017 that DODIG develop quality performance measures and enhance then-existing timeliness measures to reflect key attributes of successful performance measures, and DODIG concurred. In November 2018, DODIG officials stated that DODIG is currently using the quality measures it had in place prior to fiscal year 2017, and noted that DODIG had developed DOD-wide quality performance measures for 2018 that measure the thoroughness of military service investigations. As a result, we continue to believe that our 2017 recommendation is valid in that DODIG’s performance measures should reflect key attributes of successful performance measures. Military service IGs generally did not meet internal and statutory timeliness goals related to the notification of receipt of allegations of reprisal and misconduct, intake reviews, or senior official misconduct and reprisal investigations. Military service IG officials provided several reasons for not meeting the internal and statutory timeliness goals for notifications, intake reviews, and investigations. Specifically, officials cited an increasing number of complaints; the increasing complexity of complaints, such as those that include multiple allegations and subjects; staffing challenges, such as training related to the rotation of military staff; and the use of reservists, who only work part-time. In addition, a senior official from one military service IG noted that service IGs should be provided greater latitude in dismissing complaints without DODIG review and approval, such as for reprisal complaints where there is no protected communication or personnel action. The military service IGs did not meet fiscal year 2018 timeliness goals for notifying DODIG of allegation receipts, or conducting intake reviews for reprisal cases (see figure 5). In fiscal year 2018, the military service IGs sent 141 senior official misconduct notifications and 876 reprisal notifications to DODIG, and performed 618 reprisal intake reviews. The military service IGs did not meet statutory or internal timeliness goals for senior official misconduct and whistleblower reprisal investigations, with exception of the Marine Corps IG—which met its goal for senior official misconduct investigations (see figure 6). In fiscal year 2018, the military service IGs closed 424 investigations, including 347 reprisal investigations, and 77 senior official misconduct investigations. Military service IGs met fiscal year 2018 quality goals established by DODIG related to the thoroughness of investigations conducted by the service IGs. Specifically, 89 percent of DODIG’s thoroughness criteria were met in the 93 senior official misconduct investigations conducted by the military service IGs and other DOD components, exceeding the 81 percent goal established by DODIG. Similarly, 85 percent of DODIG’s thoroughness criteria were met in the 310 whistleblower reprisal investigations conducted by the military service IGs and other DOD components, exceeding the 81 percent goal established by DODIG. DODIG has established six criteria for assessing the thoroughness of senior official investigations, including whether all allegations were addressed, whether the complainant and subject were interviewed, and whether relevant documents were obtained. DODIG has seven criteria for assessing the thoroughness of reprisal investigations, including whether protected communications and personnel actions were identified, and whether the report of investigation was approved. The Army, the Air Force, and the Marine Corps IGs also met internal quality goals for fiscal year 2018 related to the percentage of cases returned by DODIG for rework due to quality issues. Specifically, Army IG officials stated that they met their goal of having no more than 5 percent of the investigations they submitted to DODIG for review returned by DODIG due to quality issues, and Air Force IG officials stated that they met their goals of obtaining DODIG concurrence on all of the senior official investigations they submitted for review, and having no more than 5 percent of reprisal investigations returned for rework. Similarly, the Marine Corps IG achieved its goal of having no investigations returned for rework, according to a senior Marine Corps IG official. The Naval IG did not provide us with any internal quality goals. Aside from the quality goals, DODIG also conducted quality assurance reviews for the Air Force (2017), Army (2018), and Naval (2016) IGs, in which the quality of a sample of case files was examined. The reviews concluded that the military service IGs reviewed were generally complying with internal regulations and CIGIE standards for quality. In addition, in accordance with recommendations made in the quality assurance reviews, each of the service IGs reviewed by DODIG has developed or plans to develop checklists to help ensure that all required documentation is present in their case files, according to service IG officials and documentation. DODIG and the military service IGs have implemented and planned various initiatives to improve the timeliness of their processing of senior official misconduct and reprisal complaints. Table 3 shows examples of recent DODIG and military service IG initiatives. While these initiatives are positive steps, given that the performance of some measures is far below the goals, additional efforts could be made to improve performance against unmet timeliness goals—including those pertaining to senior official misconduct investigations conducted by the military service IGs, military service IG notifications made to DODIG, and military service IG intake reviews for reprisal cases. Additionally, DODIG and some of the military service IGs do not agree on the timeframes prescribed by DOD policy for military service IGs to notify DODIG of the receipt of a complaint, thereby complicating achievement of these goals. For example, officials from the Air Force IG stated that they notify DODIG of the receipt of misconduct allegations only after making a credibility determination, instead of within the five working days of receipt prescribed by DOD policy for senior official allegations. Similarly, Marine Corps IG officials stated that senior official allegations should be reported to DODIG within five days of a credibility determination. Standards for Internal Control in the Federal Government state that management should complete and document corrective actions to remediate internal control deficiencies in a timely manner. Expanding initiatives to target unmet goals related to military service senior official investigations, notifications, and intakes could provide DODIG and the military service IGs a more comprehensive approach to improving timeliness and better position the IGs to improve upon the timeliness goals prescribed by DOD policy. In addition, resolving disagreements related to notification timeliness could improve the military service IGs’ ability to achieve those goals. Further, additional initiatives could provide greater assurance to potential whistleblowers that their cases will be handled expeditiously. DODIG has established policies and procedures to implement key statutory requirements and CIGIE standards for protecting the confidentiality of whistleblowers from the receipt of a whistleblower complaint through its investigation. The Inspector General Act of 1978, as amended, states that the Inspectors General shall not, without consent from the employee, disclose the identity of an employee who reports misconduct or provides information, unless the Inspector General determines that such disclosure is unavoidable during the course of the investigation. Further, CIGIE’s Quality Standards for Investigations states that policies, procedures and instructions for handling and processing complaints should be in place to ensure that basic information is recorded, held confidential, and tracked to final resolution. Table 4 shows examples of key confidentiality protections included in DOD Hotline and senior official misconduct and whistleblower reprisal investigation policies. DODIG officials stated that they routinely emphasize the importance of protecting whistleblower confidentiality and that confidentiality policies and procedures are addressed through internal training, staff meetings, and on-the-job instruction. Further, 69 of 86 (80 percent) DODIG respondents to our survey reported believing that the guidance they received on protecting confidentiality is sufficient to maintain the confidentiality of individuals involved in IG investigations, citing many of the processes identified in table 4 above as examples of guidance they have received. The DODIG Office of Professional Responsibility’s investigations manual on handling misconduct complaints against internal DODIG employees requires that complainant information be strictly controlled in order to protect the integrity of the investigative process and to avoid potential harm to the privacy and reputation of the employee. This guidance also includes some steps to protect whistleblower information such as redacting substantiated reports of investigation to be provided to investigation subjects. As previously noted, DOD Hotline guidance also includes steps to protect the confidentiality of internal DODIG whistleblowers. However, the Office of Professional Responsibility guidance does not include several key steps and procedures that some DODIG officials reported taking to protect whistleblower confidentiality, such as excluding complainant information from notifications sent to subjects and not identifying complainants during interviews with case subjects. In addition, DODIG’s Office of General Counsel does not have documented procedures for controlling access to cases involving designated DODIG staff members subject to review by the CIGIE Integrity Committee. DODIG designated staff members include the Principal Deputy Inspector General, Deputy Inspectors General, General Counsel, and Senior Advisor to the Inspector General, among other staff members. Guidance on handling complaints alleging internal DODIG misconduct is also outdated and does not reflect recent organizational changes. In particular, the Office of Professional Responsibility’s investigations manual does not reflect its updated roles and responsibilities since splitting from the Quality Assurance and Standards directorate in October 2016, and certain chapters do not recognize that it now reports directly to the Inspector General. Further, sections of the manual have been revised at different points in time and do not align with the office’s current functions. For example, the section covering the office’s organization, mission, and authorities has not been updated since July 2009. Similarly, the section detailing investigation policies and procedures has not been updated since November 2012. Some of the DODIG employees we surveyed reported concern that DODIG’s process for reporting employee misconduct and resolving internal complaints may not protect whistleblower confidentiality. For example, 14 (16 percent) survey respondents reported believing that DODIG’s internal process for reporting misconduct did not protect DODIG employee confidentiality or only protected it slightly. Also, 36 (42 percent) survey respondents reported not knowing whether or not DODIG’s internal process for reporting misconduct protects confidentiality, and 36 (42 percent) reported believing that it protects confidentiality somewhat or very well. Additionally, 14 of 86 (16 percent) and 9 of 86 (10 percent) employees surveyed reported having considered but ultimately choosing not to resolve an issue through the Office of the Ombuds—which may receive some internal misconduct complaints—or report misconduct through DODIG’s internal process on or after October 1, 2016, respectively, because they feared that their confidentiality could be compromised. Table 5 shows the distribution of these responses. Survey respondents identified some concerns related to the confidentiality, objectivity, and independence of DODIG’s internal process for reporting misconduct and suggested some related improvements. For example, although it has separated from the Quality Assurance and Standards directorate, the Office of Professional Responsibility continues to share office space with the directorate and hold complainant and witness interviews in the shared space. Also, it was suggested that an online form could be used so that internal complaints are routed directly to the Office of Professional Responsibility instead of through the DOD Hotline. DODIG officials told us that there are record-keeping and performance measure-related bases for continuing to use the DOD Hotline to receive complaints of internal misconduct, but that they would carefully evaluate the suggestion. CIGIE Quality Standards for Federal Offices of Inspector General state that IGs should establish and follow policies and procedures for receiving and reviewing allegations and ensure that whistleblower identities are not disclosed without consent, unless the IG determines that such disclosure is unavoidable during the course of the investigation. CIGIE Quality Standards for Investigations also state that policies and procedures should be revised regularly to align with current laws and regulations. DODIG officials told us in November 2018 that the Office of Professional Responsibility investigations manual is in the process of being updated but were unable to provide a timetable for the completion of these updates, and stated that all of the provisions—including the confidentiality protections—are subject to changes and updates. In addition, in January 2019 DODIG officials noted, after discussion with GAO, that they intended to implement guidance for making referrals to the CIGIE Integrity Committee. Until DODIG develops guidance that incorporates procedures to protect confidentiality and documents how to maintain whistleblower confidentiality throughout the CIGIE referral process, it will lack reasonable assurance that its process for investigating internal misconduct allegations can fully protect the confidentiality of whistleblowers. Military service IG guidance identifies confidentiality as a core tenet of handling and investigating whistleblower complaints. For example, military service IG guidance states that consent should generally be obtained from complainants before each military service IG can share a complainant’s identity with officials who will investigate the allegations, and provides that complaints may be redacted or summarized to omit personally identifiable information—such as when consent is not given or for other purposes. In addition, military service IG guidance state that a complainant’s identity may only be disclosed without consent when an authorized official has determined that such disclosure is unavoidable in order to investigate an allegation. Aside from these shared provisions, each of the military service IGs’ guidance includes additional precautions aimed at protecting whistleblower confidentiality. For example, Air Force Instruction 90-301 instructs Hotline personnel to coordinate communication between the complainant and investigator if a complainant does not give consent to disclose his or her identity. In addition, Army and Marine Corps IG guidance stipulate that whistleblowers will be notified if it becomes necessary to disclose their identity without their consent, and Naval IG guidance requires investigators to inform complainants that although the use of their testimony may be necessary under administrative action procedures, their identity will be released as a witness, not a complainant, to safeguard their identity. While all military service IGs acknowledge the need to preserve confidentiality, we found gaps in confidentiality protections in Air Force, Naval, and Marine Corps IG guidance, but not Army IG guidance. For example, we found that Air Force, Naval, and Marine Corps IG guidance did not include requirements outlined in DOD Instruction 7050.01 related to the specific conditions under which information disclosures may be made without complainant consent. According to DOD Instruction 7050.01, these include circumstances when a complainant has made it known outside IG channels that he or she submitted the complaint, there is an emergency situation or health or safety issue, or the allegation is being transferred outside of DOD to another IG. Air Force, Naval, and Marine Corps IG guidance predate DOD Instruction 7050.01, updated in October 2017, and reference an older instruction that omits this disclosure guidance. Additionally, DODIG’s 2016 and 2017 quality assurance reviews of the Naval IG and Air Force IG concluded that confidentiality protections could be improved. Specifically, DODIG found that the Air Force IG did not have written procedures for handling and restricting IG employee access to complaints against individuals with access to the Air Force IG’s whistleblower database, including both IG employees and contractors that support the database. In addition, DODIG found that the Naval IG Hotline program instruction needed to be updated and that it did not have a hotline standard operating procedure with guidance to redact complainant identities before releasing investigation reports to installation commanders or other military officials. Air Force, Naval, and Marine Corps IG officials stated that they are currently in the process of updating their guidance to better incorporate confidentiality protections. For example, Naval IG officials told us that the Naval IG is updating its Hotline instruction, which will provide guidance to obtain consent from complainants prior to releasing investigation reports to installation commanders or other military officials, or redact the complainant’s name. According to Naval IG officials, the updated instruction should be finalized in the first quarter of fiscal year 2019. CIGIE Quality Standards for Federal Offices of Inspector General state that IGs should establish and follow policies and procedures for receiving and reviewing allegations and ensure that whistleblower identities are not disclosed without consent, unless the IG determines that such disclosure is unavoidable during the course of the investigation. Further, CIGIE Quality Standards for Investigations state that policies and procedures should be revised regularly to align with current laws and regulations, and that confidentiality should be considered throughout an investigation, to include drafting reports, validating contents, and submitting the final report. Without updated policies and procedures that fully implement confidentiality standards for complaint handling and investigation, the Air Force IG, the Naval IG, and the Marine Corps IG may not be able to ensure the consistent implementation of confidentiality protections within their offices. DODIG and military service IGs do not experience significant challenges in accessing sensitive or classified information necessary to handle whistleblower complaints, according to cognizant IG officials. Such information includes documentary evidence or witness statements. Similarly, 79 of 86 (92 percent) DODIG respondents to our survey reported that they are generally able to access all types of unclassified information necessary to perform the duties of their position, while 82 of 86 (95 percent) respondents stated that they are either able to access classified information as necessary or do not require access to classified information. DODIG and the military service IGs have also taken steps to safeguard physical and electronic classified whistleblower information in accordance with DOD policy, which requires that DOD components establish a system of technical, physical, and personnel controls to ensure access to classified information is limited to authorized persons. Cases including classified information constituted a small percentage of cases closed by DODIG and the military service IGs in fiscal year 2017, with the percentage of those closed by DODIG directorates—including the DOD Hotline and the whistleblower reprisal and senior official investigations— ranging from 0.2 percent to 0.5 percent, according to DODIG officials. Officials from each of the military service IGs reported closing no classified cases in fiscal year 2017. In addition, DODIG and military service IG officials reported having an adequate number of staff with clearances at the requisite levels (e.g., SECRET) to handle classified case information, along with processes for physically and electronically storing and accessing information at different classification levels. DODIG and most military service IGs are following DOD’s IT risk management process, which involves the assessment of and authorization to operate IT used to manage DOD information—including sensitive but unclassified whistleblower information. The Naval IG has not authorized its case management system in accordance with DOD policy, which implements NIST and Office of Management and Budget federal IT security guidelines related to IT systems and applications, including those used by the IGs. However, it is taking steps to do so. DODIG and the Naval IG use IT systems to manage sensitive whistleblower information, while the Air Force, Army, and Marine Corps IGs use IT applications—which are not subject to the full IT risk management authorization process, as discussed below. DODIG has followed the DOD IT risk management process by authorizing the Defense Case Activity Tracking System (D-CATS)—its whistleblower case management system—to operate in accordance with DOD policy and federal IT security guidelines. DOD’s risk management process requires that IT systems be authorized to operate using a multistep process that entails the identification, implementation, and assessment of system security controls, along with the corresponding development and approval of a system security plan, security assessment report, and plan of action and milestones. The process requires systems to be reassessed and reauthorized every 3 years in order to ensure the continued effectiveness of security controls, and allows for ongoing authorizations through a system-level strategy for the continuous monitoring of security controls employed within or inherited by the system. The strategy should include a plan for annually assessing a subset of system security controls. DOD policy states that component heads may only operate systems with a current authorization to operate, and that authorization termination dates must be enforced. DODIG last authorized D-CATS to operate in May 2017, determining that overall system security risk was acceptable based on a review of the system security plan, security assessment report, and plan of action and milestones. Our review of DODIG’s system authorization documents also found that they addressed key, required content elements. For example, the system security plan specified the security controls intended to be in place based on the system’s risk classification, and the security assessment report documented findings of compliance and the methods used by the assessor to evaluate security controls when implementing DODIG’s continuous monitoring strategy. Additionally, the plan of action and milestones identified tasks needed to mitigate identified vulnerabilities along with resources and milestones to accomplish the tasks. However, as of December 2018, the Naval IG had not authorized its case management system in accordance with the DOD risk management process, and the system remained in operation. The Naval IG was issued an interim authorization to operate its case management system in March 2017 by the Commander, U.S. Fleet Cyber Command. The interim authorization—which expired in January 2018—required the Naval IG to transition from the department’s prior IT risk management process to the current process by the time of its expiration, noting that the overall risk of the system was high due to incomplete testing. Subsequently, in June 2018, the Naval IG requested and was eventually granted, in September 2018, a conditional authorization to continue operating the case management system through October 2018. In early December 2018, the Naval IG requested another conditional authorization to operate the case management system until September 2019. According to Naval IG officials, the conditional authorization is needed because the whistleblower case management system’s host environment is not expected to attain its authorization until September 2019. As a result, the Naval IG was taking steps beyond the conditional authorization request to manage IT security risks as it works towards compliance with the new DOD risk management process. For example, Naval IG officials stated that new leadership was put in place to oversee the case management system; that a senior system administrator would be hired to help maintain IT security; and that the case management system was undergoing regular scans to assess security risks, with any resultant issues being remediated. NIST guidelines state that organizations should design and prioritize activities to mitigate security risks, and that alternative strategies may be needed when an organization cannot apply controls to adequately reduce or mitigate risk. As noted, the Naval IG’s case management system was not authorized as of December 2018 and it was not yet able to transition to the current DOD risk management process. However, if completed, the actions planned and underway—including the conditional authorization and security scans—should help to mitigate system security risks and provide greater assurance that existing system security controls safeguard sensitive whistleblower information. The IGs of the Air Force, the Army, and the Marine Corps are following DOD’s IT risk management procedures for their primary case management applications, which are not subject to the full IT risk management authorization process. According to DOD Instruction 8510.01, Risk Management Framework (RMF) for DOD Information Technology (IT), DOD IT such as applications must be securely configured in accordance with applicable DOD policies, and application security controls must undergo special assessment of their functional and security-related capabilities and deficiencies. The results of such assessments are to be documented within an application-level security assessment report and reviewed by a security manager to ensure that the product does not introduce vulnerabilities into its host system. We found that while the Army, Air Force, and Marine Corps IGs have not produced the required application-level security assessment reports for their primary applications, they have met the intent of these requirements through other actions. Specifically, we noted that the Air Force and Army IGs’ primary case management applications reside in host systems that were authorized to operate under the risk management process within the last 3 years, and that the assessments associated with the host system authorizations included a review of application-level security controls, according to IG officials. Similarly, the Marine Corps IG’s case management application was exempted from assessment by its authorizing official because it was determined that the application did not introduce additional risk into its authorized host system. As previously discussed, DODIG has taken steps to restrict employee access to whistleblower information, such as by restricting access to cases in which a complainant has not consented to releasing his or her identity. DOD Hotline also applies additional restrictions to all cases involving internal misconduct referrals to the Office of Professional Responsibility and CIGIE Integrity Committee, and it has the capability to further restrict records, according to DODIG officials. Beyond restricting records, the case management system also includes user roles, which govern users’ view of information. However, employees at the three DODIG directorates that are principally responsible for handling whistleblower information are generally able to access sensitive whistleblower information belonging to other directorates in both the Defense Case Activity Tracking System (D-CATS)–DODIG’s whistleblower case management system—and an associated document repository, that is not necessary to accomplish assigned tasks. NIST Special Publication 800-53, Security and Privacy Controls for Federal Information Systems and Organizations, states that organizations should employ the core security principle of least privilege, which allows only authorized access for users that is necessary to accomplish assigned tasks in accordance with organizational missions and business functions. DODIG employees in the DOD Hotline, senior official investigations directorate, and whistleblower reprisal investigations directorate are able to access whistleblower information belonging to other DODIG directorates in both D-CATS and its associated document management repository because DODIG has not developed sufficient system controls needed to restrict access across the three directorates. For example, a DODIG employee in either the senior officials or reprisal investigations directorates can access Hotline records in D-CATS that the employee does not have a need to access, with the exception of cases specifically restricted by the DOD Hotline to prevent unauthorized access. According to an August 2018 internal DODIG memo, the lack of controls to restrict access to information across the three directorates has been known since the system was established in 2012. DODIG plans to establish controls to restrict access among the DODIG directorates in a new enterprise system (D-CATSe), which will eventually replace D-CATS and the case management systems used by the military service IGs. D-CATSe is intended to provide a common case activity tracking system capable of supporting mandatory reporting requirements and collecting, storing, and exchanging IG records related to complaints and administrative investigations throughout a complaint’s lifecycle. According to DODIG officials, D-CATSe will restrict access both within and among user IGs, including the DODIG directorates and military service IGs, each of which may have unique access requirements based on their different types of user groups. According to DODIG officials, this will be accomplished through the establishment of unique business units at different organizational levels, teams, and user roles, which will collectively determine what information a user can access. However, as shown in figure 7 below, the incremental release schedule for D-CATSe has been delayed, and the IGs are not expected to fully transition to the new system until fiscal year 2021. NIST guidelines state that organizations should design and prioritize activities to mitigate security risks, and that alternative strategies (such as plans) may be needed when an organization cannot apply controls to adequately reduce or mitigate risk. Further, NIST guidelines state that addressing assurance-related controls during system development can help organizations obtain sufficiently trustworthy information systems and components that are more reliable and less likely to fail. However, DODIG does not plan to take other actions to address the lack of cross- directorate controls before the advent of the enterprise system. Additionally, while DODIG is designing such controls and plans for each system release to provide a requirements basis for subsequent releases, it has not developed an assurance plan for testing controls, according to DODIG officials, or fully defined the system requirements needed to implement these controls and ensure it has achieved least privilege both within and across the user IGs. Without considering interim actions to address the lack of D-CATS cross-directorate access controls, DODIG may be unable to sufficiently mitigate security risks while D-CATSe is developed. Also, without developing a plan with assurance controls for achieving least privilege in D-CATSe, DODIG may be unable to ensure the confidentiality and integrity of sensitive whistleblower information during its implementation. Separate from the lack of cross-directorate controls, DODIG has identified multiple instances in which sensitive but unclassified whistleblower information in the DODIG Administrative Investigations directorate whistleblower case management system and document repository was accessible to DODIG personnel who did not have a need to know this information. These instances involve DOD Hotline records that are specifically restricted to protect complainants requesting confidentiality, along with records belonging to DODIG’s Office of Professional Responsibility—which handles internal DODIG misconduct complaints. Table 6 shows examples of recent instances in which DODIG determined that sensitive whistleblower records were accessible to DODIG personnel without a need to know. According to DODIG officials, as of January 2019, there were no known instances of anyone without a need to know actually accessing these records. These officials also stated that corrective action had been taken for each instance in table 6, including by blocking access to information while the underlying issues were resolved; that at no time was information available to the public; and that the instances did not result in any disclosure outside of DODIG. NIST guidelines state that the need for certain user privileges may change over time, necessitating the periodic review of assigned user privileges in order to determine if the rationale for assigning such privileges remains valid. DODIG has determined that its user access issues are broadly attributable to system administration and application problems, including permission changes resulting from system updates. To address such issues, DODIG has taken several remedial actions and identified additional recommended steps, including: reconciling user accounts and validating permissions related to restricted records; reviewing policies related to protecting complainant confidentiality and conducting awareness training with personnel, as appropriate; and developing enhanced user management procedures and internal controls related to establishing user accounts, reconciling current user permissions, and controlling access to restricted records. In addition, in October 2018, DODIG instituted a process whereby user privileges associated with its case management system and document repository will be reviewed, validated, and corrected, if necessary, on a quarterly basis. If fully implemented, this process, along with the proposed actions, should help ensure that assigned user privileges are periodically validated and aligned with business needs. However, DODIG’s process does not include steps to test document repository permissions after case management system updates, which were determined by DODIG to be the cause of some permission issues. Without including such steps in its process, DODIG lacks assurance that system permissions will align with business needs on an ongoing basis, and therefore may not be able to appropriately control user accounts to prevent unauthorized access by system users. The military service IGs’ case management systems and applications incorporate IT controls, such as authenticated user accounts and unique permissions, to protect certain whistleblower information. However, service IG systems and applications do not fully restrict employee access to sensitive whistleblower information only to information that is necessary to accomplish assigned tasks. As previously discussed, NIST guidelines state that organizations should only provide authorized access to users which is necessary to accomplish assigned tasks in accordance with organizational missions and business functions. As shown in Table 7, DODIG’s quality assurance reviews and our work identified issues related to IG employee access restrictions. At the time of our review, the military service IGs had not taken steps to fully address the identified access issues. Specifically, Air Force officials stated that they did not plan to address the application access issues because they did not have funding to continue developing their existing application prior to transitioning to D-CATSe, although they would explore whether solutions were possible within current fiscal constraints during the next system maintenance evaluation. Similarly, Army IG officials stated that while the Army IG had resources to further develop its existing case management application, they had elected to not use those resources to remedy the identified access issue in light of the future arrival of D-CATSe. In addition, Naval IG officials reported taking action to restrict senor official investigations, but did not provide information to us on actions taken to address DODIG’s recommendation to restrict cases involving internal Naval IG personnel. Finally, Marine Corps IG officials stated that access restrictions would be implemented as part of an application redesign scheduled to be complete by the end of 2018. However, these officials also noted that they have not identified the root of the access problem or developed a plan to ensure that needed access restrictions are implemented and functioning properly, raising questions as to whether the redesign will fully restrict access on a continuing basis. As mentioned previously, the Marine Corps’ case management application is also exempt from testing under the DOD IT risk management process, and therefore is not subject to routine security assurance testing. Federal Standards for Internal Control state that management should analyze and respond to risks, and evaluate and remediate internal control deficiencies on a timely basis, including those related to audit findings. Further, NIST guidelines state that organizations should design and prioritize activities to mitigate security risks, and that alternative strategies, such as plans, may be needed when an organization cannot apply controls to adequately reduce or mitigate risk. These guidelines also encourage organizations to obtain assurance-related evidence on an ongoing basis in order to maintain the trustworthiness of information systems. As previously discussed, D-CATSe is being implemented incrementally, with releases for the Naval IG and the Air Force and Army IGs not scheduled to occur until fiscal years 2020 and 2021, respectively. By considering actions prior to the advent of D-CATSe, the Air Force, Army, and Naval IGs could mitigate existing risks to whistleblower confidentiality by reducing the potential for unauthorized employee access of whistleblower records. Also, by developing a plan to ensure that access restrictions function properly, the Marine Corps IG could better ensure the confidentiality and integrity of sensitive whistleblower information in its redesigned case management application on a continuing basis. Potential violations of whistleblower confidentiality may be reported to DODIG, the service IGs, the Office of Special Counsel, or CIGIE. IGs identified some substantiated violations of whistleblower confidentiality between fiscal years 2013 and 2018. Specifically, DODIG identified 8 substantiated violations of whistleblower confidentiality between fiscal years 2013 and 2018, representing approximately .01 percent of the 95,613 contacts handled by DODIG during that timeframe, according to DODIG officials. Army IG identified 6 substantiated violations of whistleblower confidentiality between these years. These violations include the improper release of IG information, disclosures made to individuals who do not have a need to know, and unauthorized access to whistleblower records by IG personnel. DODIG officials noted that in some instances, violations were determined not to result from employee misconduct because the complainant’s identify was disclosed unwittingly. According to DODIG and Army IG officials, disciplinary or corrective action was taken in all but one of the 14 substantiated violations because the DODIG employee involved resigned prior to action being taken. Officials from the Air Force, Naval, and Marine Corps IGs stated that they were unaware of any substantiated incidences of confidentiality violations between fiscal years 2013 and 2018 and that they were unable to specifically track such incidents in their case management systems. Similarly, CIGIE Integrity Committee and Office of Special Counsel officials stated that they were unaware of and do not specifically track confidentiality violations, and we did not identify any confidentiality violations in the fiscal year 2013-2018 data they provided to us that involved DODIG employees. Respondents to our survey of DODIG employees separately reported potential violations of whistleblower confidentiality. Specifically, 15 of the 86 respondents (about 17 percent) reported being aware of at least one instance since June 1, 2017, where the identity of a complainant or source was avoidably disclosed by a DODIG employee to an organization or individual without a need to know, and nine of these 15 were aware of more than one instance. These responses are not intended to be a count of separate instances because respondents may have recalled the same instance(s), including one or more of the 8 substantiated violations reported to us by DODIG. The most common avoidable disclosure described by survey respondents involved distributing whistleblower materials to the wrong official or agency. Survey respondents reported that in such instances corrective action included recalling the complaint and deleting the erroneously sent record, or, in some cases, sending a complaint to DODIG’s Office of Professional Responsibility for the investigation of possible misconduct. While the number of known violations is small, IT access issues related to the case management systems and applications used by DODIG and the military service IGs create the potential for additional violations of whistleblower confidentiality. As previously discussed, issues such as the absence of cross-directorate access controls within DODIG’s case management system and the ability for non-Air Force IG users of the Air Force IG case management system to view IG case information allow for the improper access of sensitive whistleblower information. Recognizing this potential, a senior DODIG official noted concern regarding the possible extent of confidentiality violations stemming from these and the other access issues previously discussed in this report. Additionally, DODIG requested that the Defense Criminal Investigative Service investigate the April 2018 incident involving 946 case folders to determine who accessed the identified records. Without steps to address these ongoing IT access issues, the potential for additional violations of whistleblower confidentiality will persist. DODIG closed 129 misconduct and reprisal cases in fiscal years 2013 through 2017 with complaints involving a civilian DOD Presidential appointee with Senate confirmation (PAS) subject. Of the 129 cases closed, DODIG dismissed without investigation 125 cases and investigated the remaining four. Figure 8 shows the number of cases closed in each fiscal year, by case disposition. Our review of the 125 case files for dismissed misconduct and reprisal cases found that key documentation and data needed to demonstrate compliance with significant aspects of the case-handling process were generally present. Key documentation and data for dismissed cases include the case open and close dates, the incoming complaint, disposition of the case, and the dismissal approval and rationale. CIGIE standards state that the degree to which an organization efficiently achieves its goals is affected by the quality and relevance of information that is collected, stored, retrieved, and analyzed, and that the results of investigative activities should be accurately and completely documented in the case file. Examples of data and documentation consistently present. Our review of 125 case files for dismissed cases closed in fiscal years 2013 through 2017 found that key documentation and data were generally present. For example: 100 percent of the cases we reviewed included the incoming complaint. Approximately 99 percent of the dismissed misconduct cases included a dismissal rationale that aligned with dismissal criteria in DODIG policy. 100 percent of the dismissed reprisal cases that involved a closure letter informing the complainant of case dismissal listed a rationale for dismissal in the closure letter. 100 percent of the dismissed reprisal cases that did not involve a closure letter to the complainant had a rationale for dismissal elsewhere in the case file. Approximately 99 percent of dismissed misconduct cases included a required entry recording the intake disposition. Documents or data that were not material. Our review of case files for dismissed cases closed in fiscal years 2013 through 2017 found that some other documentation or data that are needed to demonstrate compliance with DODIG policy were missing. The deficiencies we found were not material to case outcomes. For example, approximately 77 percent of dismissed misconduct cases did not include a recording of case dismissal approval by IG supervisory staff. However, DODIG officials told us that the presence of the required entry recording the intake disposition indicated that the case dismissal had been approved by the appropriate authority. Similarly, approximately 55 percent of dismissed misconduct cases did not include a notification letter to the appropriate military service IG in the case file. DODIG officials stated that while there is guidance to send these letters, it is not a required practice. DODIG reported most credible allegations concerning civilian DOD PAS officials to the Secretary of Defense as required. DODIG also reported some investigation results involving these officials to Congress prior to the enactment of the Inspector General Empowerment Act of 2016, which required the reporting of results of substantiated investigations involving DOD senior officials. DODIG investigated four of the 129 cases closed in fiscal years 2013 through 2017, with two of those investigations leading to substantiated allegations of misconduct. DODIG generally met DOD requirements to report credible allegations of misconduct against civilian DOD PAS officials to the Secretary of Defense. DOD Directive 5505.06 requires that DODIG notify the Secretary of Defense of all credible allegations or investigations involving presidential appointees and others of significance, including Senate- confirmed civilian officials. We found documentary evidence that DODIG notified the Secretary of credible allegations in three of the four misconduct and reprisal investigations closed from fiscal years 2013 through 2017, and the secretary of a military service was notified in the fourth case. In addition, DODIG officials stated that the Principal Deputy IG provides the Secretary of Defense periodic updates on current investigations and other periodic updates of incoming allegations, as necessary and appropriate. Separately, the Inspector General Empowerment Act of 2016 requires that DODIG report in its semiannual reports to Congress on all substantiated allegations of misconduct involving senior officials. Prior to 2016, there was no requirement to notify Congress of substantiated allegations of misconduct involving senior officials. We found evidence that DODIG communicated investigation results to Congress in two of the four civilian DOD PAS official investigations closed between fiscal years 2013 and 2017, but not in the other two because it was not required. For one investigated case, a report of investigation was provided to Congress upon request, and for another investigation, which had a substantiated allegation, the results of the investigation were published in narrative detail in a semi-annual report to Congress. DODIG now reports in its semi-annual reports to Congress summary results of substantiated and unsubstantiated cases closed during the corresponding period, but it has not closed any civilian DOD PAS official allegations since the statutory requirement to report to Congress on all substantiated cases was established. Maintaining a program that instills trust and confidence for potential whistleblowers to come forward is critical to minimizing fraud, waste, abuse, and personnel misconduct in the federal government. Important components of a credible whistleblower program are timeliness of case processing and safeguarding confidentiality to the maximum extent possible. It is encouraging that DODIG and the service IGs have met some key goals and have policies that address whistleblower confidentiality. In addition, DODIG generally met key documentation and data requirements for the 125 cases dismissed by DODIG involving civilian DOD PAS officials, and reported most credible allegations, as required. However, the IGs face challenges in addressing unmet timeliness goals and updating guidance to ensure full alignment with current confidentiality requirements. By pursuing more targeted, collective efforts with additional initiatives aimed at improving performance against unmet timeliness goals, the IGs can better assure current and potential whistleblowers that their complaints will be processed expeditiously. Additionally, without formal guidance documenting procedures for protecting the confidentiality of whistleblowers reporting potential internal DODIG employee misconduct, those employees lack assurance that DODIG can fully protect their identities. Similarly, without updated policies and procedures, the Air Force, Naval, and Marine Corps IGs may not be able to fully ensure whistleblower confidentiality in their organizations. The integrity of a whistleblower program also extends to ensuring that sensitive information in IT systems remains secure and inaccessible by employees without a need to know. The IGs have existing controls for safeguarding whistleblower information, but additional efforts are warranted. Specifically, without further steps—such as considering interim actions to mitigate the lack of cross-directorate access controls, developing a plan, along with the military service IGs for achieving least privilege in the future enterprise case management system, and enhancing the process for periodically validating user privileges—DODIG may not be able to ensure that access controls in its existing and future case management systems align with business needs on an ongoing basis. Similarly, without considering actions to further restrict IG employee access in existing IT, the Air Force, Army, and Naval IGs may be unable to mitigate ongoing risks to whistleblower confidentiality. Finally, without a plan for ensuring that access restrictions in its redesigned case management system function properly, the Marine Corps IG may be unable to fully ensure whistleblower confidentiality. We are making a total of 12 recommendations to DOD. Specifically: The DOD Inspector General should coordinate with the IGs of the military services to take additional actions to improve performance against unmet timeliness goals. This includes steps to improve performance of senior official misconduct investigations and military service reprisal intakes, and to resolve disagreement on notifications. (Recommendation 1) The DOD Inspector General should issue formal guidance documenting procedures for protecting the confidentiality of whistleblowers throughout its internal misconduct investigation process. (Recommendation 2) The Air Force Inspector General should establish procedures to fully reflect and implement DOD policy on the protection of whistleblower confidentiality. (Recommendation 3) The Marine Corps Inspector General should establish procedures to fully reflect and implement DOD policy on the protection of whistleblower confidentiality. (Recommendation 4) The Naval Inspector General should establish procedures to fully reflect and implement DOD policy on the protection of whistleblower confidentiality. (Recommendation 5) The DOD Inspector General should consider interim actions as the whistleblower enterprise case management system is being developed to help ensure that access to sensitive whistleblower information in the current case management system and associated document repository is limited to information that is necessary to accomplish assigned tasks. (Recommendation 6) The DOD Inspector General should coordinate with the IGs of the military services to develop a plan to fully restrict case access in the future whistleblower enterprise case management system so that user access is limited to information necessary to accomplish assigned tasks in accordance with organizational missions and business functions. (Recommendation 7) The DOD Inspector General should enhance its process for periodically reviewing whistleblower case management system and document repository user privileges by including steps to ensure that such privileges remain valid after system updates, as appropriate. (Recommendation 8) The Air Force Inspector General should consider interim actions as the whistleblower enterprise case management system is being developed to help ensure that access for users of existing applications is limited to information that is necessary to accomplish assigned tasks in accordance with organizational missions and business functions. (Recommendation 9) The Army Inspector General should consider interim actions as the whistleblower enterprise case management system is being developed to help ensure that access for users of existing applications is limited to information that is necessary to accomplish assigned tasks in accordance with organizational missions and business functions. (Recommendation 10) The Marine Corps Inspector General should develop a plan to ensure that its redesigned whistleblower case management application restricts user access to information based on what is needed to accomplish assigned tasks in accordance with organizational missions and business functions. (Recommendation 11) The Naval Inspector General should consider interim actions as the whistleblower enterprise case management system is being developed to help ensure that access for users of existing applications is limited to information that is necessary to accomplish assigned tasks in accordance with organizational missions and business functions. (Recommendation 12) We provided a draft of this report to DODIG and the military service IGs for review and comment. In written comments, DODIG and the military service IGs concurred with each of our 12 recommendations. Comments from DODIG and the Air Force, Army, and Marine Corps IGs are reproduced in appendix V; the Naval IG concurred in an email. These IGs also provided technical comments, which we have incorporated as appropriate. In its comments, DODIG stated that it will seek to implement the recommendations. In addition to highlighting recent and planned improvements, DODIG provided additional comments on some of the report’s findings and statements. In particular, DODIG noted that the report understated its improvements in timeliness, such as by stating that DODIG did not meet timeliness goals related to average days of senior official and military reprisal intakes, and average days for reprisal oversight reviews. Citing figure 2, DODIG further stated that it met its timeliness goals in more than 60 percent of all senior official and reprisal intake cases, including 87 percent of senior official oversight review cases, and that it met its 15-day goal in more than 70 percent of senior official intakes. We agree that DODIG achieved these percentages and present the associated data in figure 2. However, as described in the report, and shown in figure 2, DODIG did not meet its goals for the average days of senior official misconduct and military reprisal intakes, and the average days for reprisal oversight reviews. Nonetheless, it is encouraging that DODIG has taken and planned actions to improve timeliness as its caseload has increased, including by increasing its staff by about 29 percent since fiscal year 2016, during which time it reported that its caseload similarly increased by about 26 percent. DODIG also noted that the report presented some information in a manner that could create an incomplete impression of the agency’s commitment to protecting whistleblower confidentiality. Specifically, DOD stated that the report’s presentation of survey data related to DODIG employee concerns about internal DODIG processes may give a misleading impression because of the focus on the small number of respondents who had a negative impression. In particular, DODIG noted that more than 80 percent of respondents either believed that DODIG’s internal process for reporting misconduct protected confidentiality somewhat or very well, or did not know if it did so. However, a positive perspective cannot be inferred from the respondents that reported not knowing whether or not DODIG’s internal process protects confidentiality (42 percent). Also, it should be recognized that the respondents that held negative views on DODIG’s process for reporting internal misconduct (16 percent) accounted for a substantial proportion of respondents (28 percent) that held either positive or negative views on this issue. Importantly, these and other survey information presented in the report also provide valuable information on the degree to which DODIG employees have confidence in the integrity of these important internal processes, and, as mentioned, align with other information obtained during our review. As such, this information may help to inform DODIG’s efforts in addressing our recommendation to issue formal guidance documenting procedures for protecting the confidentiality of whistleblowers throughout its internal misconduct process, along with any future efforts to instill employee confidence in internal misconduct reporting mechanisms. DODIG also noted that portions of the report addressing restrictions on DODIG employee access to sensitive whistleblower records need further context, stating specifically that no DODIG employees outside of the Administrative Investigations directorate, Office of Professional Responsibility, and Office of General Counsel had access to any of the records, and that there was no evidence that any person without a need to know accessed any such records. However, information provided to us by DODIG does not show that accessibility was limited in all instances to employees within one of those DODIG offices. Also, the ability of any employee to access records that were specifically restricted to protect complainant identities or internal records belonging to the Office of Professional Responsibility is problematic given the increased sensitivity of such records. Further, while DODIG did not identify instances in which anyone without a need to know accessed the records, DODIG did not provide evidence that all cases of improper access were thoroughly investigated, as we state in our report, and the instances included in the report are examples and not inclusive of all instances of improper access identified by the DODIG. Nevertheless, it is positive that DODIG has reported taking corrective action to address instances of improper accessibility. It is also encouraging that DODIG plans to implement our recommendations, as the potential for unauthorized access will persist until it establishes cross-directorate controls in the case management system and enhances its processes for periodically reviewing user privileges for its whistleblower case management system and document repository. All of the military service IGs concurred with the recommendations directed to them. The Air Force and the Army IGs also provided comments on some of the report findings. In particular, the Air Force IG noted in relation to our third recommendation that language in Air Force Instruction 90-301, updated in December 2018, is essentially the same as 5 U.S.C. Appendix § 7, and that this language precludes Air Force officials at any level from waiving the requirement to inform complainants and employees of the requirement to not disclose their identities without their consent, unless the Inspector General determines such disclosure to be unavoidable. However, as stated in our report, Air Force guidance did not include requirements outlined in DOD Instruction 7050.01 related to the specific conditions under which information disclosures may be made without complainant consent. These include circumstances wherein a complainant has made it known outside IG channels that he or she submitted the complaint, there is an emergency situation or health or safety issue, or the allegation is being transferred outside of DOD to another IG. As a result, we continue to believe that without updated policies and procedures that fully implement confidentiality standards, the Air Force IG may not be able to ensure the consistent implementation of confidentiality protections. Separately, in relation to IG employee access of information, the Army IG stated that the processes it has in place provide judicious access and control of whistleblower information to achieve an appropriate balance between efficient operations and minimized risk. As stated in our report, DODIG’s 2018 quality assurance review of the Army IG found that the Army IG’s application did not restrict personnel without a need to know from accessing allegations involving Army IG personnel, contrasting with NIST guidelines, which predicate user access on the need to accomplish assigned tasks. Army IG officials acknowledged this issue, but stated that the Army IG had elected to not use existing resources to further develop its case management application in light of the enterprise system being developed by DODIG. As a result, we continue to believe that by considering actions prior to the advent of the enterprise system—which is not expected to be released to the Army IG until fiscal year 2021—the Army IG could mitigate risks to whistleblower confidentiality by reducing the potential for unauthorized IG employee access of whistleblower records. We are sending copies of this report to congressional committees; the Acting Secretary of Defense; the Department of Defense Principal Deputy Inspector General performing the duties of the Inspector General; the Inspectors General of the Air Force, the Army, the Navy, and the Marine Corps; the Office of Special Counsel; and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-3604 or farrellb@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix VI. To determine the extent to which the Department of Defense Office of Inspector General (DODIG) and the military service offices of inspector general (IG) met and took steps to achieve key fiscal year 2018 timeliness and quality goals related to the handling of whistleblower complaints, we reviewed performance documentation and interviewed officials on DODIG and military service IG timeliness and quality goals, performance measures, and associated performance data for fiscal year 2018, along with ongoing and planned efforts to improve performance. We also reviewed fiscal year 2017 performance data for comparison purposes. We selected data from this period because they constituted the most complete and recent performance data available. Using the data, we assessed the extent to which DODIG and the military service IGs met timeliness and quality goals defined by statute and internal IG policy. Specifically, we assessed the timeliness of DOD Hotline referrals and completion reports against its internal goals, along with DODIG senior official misconduct and whistleblower reprisal intakes, investigations, and oversight reviews against internal and statutory goals. We also assessed the timeliness of military service IG senior official and reprisal notifications, intakes, and investigations against DOD and statutory goals, and reviewed the results of DODIG quality assessments for DOD Hotline referrals, military service investigations, and DODIG senior official and whistleblower reprisal investigations. We assessed the reliability of DODIG and military service IG data by administering questionnaires, interviewing cognizant officials, and reviewing case management system documentation and quality assurance procedures. We also compared select electronic data to fiscal years 2013 through 2017 case file documentation associated with our review of case files to determine whether dates had been properly recorded in the system. We determined that these data were sufficiently reliable for our purposes. To identify factors affecting timeliness and quality, we interviewed IG officials and reviewed relevant documentation including strategic plans, briefing materials, and semiannual reports to Congress. We also compared DODIG and military service IG completed and planned efforts to improve timeliness and quality against Council of the Inspectors General on Integrity and Efficiency (CIGIE) standards for federal IGs related to establishing performance plans with goals and performance measures, and Standards for Internal Control in the Federal Government related to assessing performance and improving performance. To determine the extent to which DODIG and the military service IGs have established processes to protect the confidentiality of whistleblowers, we assessed DOD and military service IG policies and procedures for handling whistleblower allegations against DOD policy, CIGIE standards for federal IGs, and statutory protections related to safeguarding whistleblower confidentiality. We also reviewed the results of DODIG’s quality assurance reviews of the Air Force (2017), Army (2018), and Naval (2016) IGs. We performed a web-based survey of the entire population of 108 DODIG Administrative Investigations directorate employees directly involved with the handling of whistleblower cases to ascertain whether, in their view, confidentiality processes are being implemented in accordance with guidance and standards, identify potential confidentiality violations, and to gather perceptions on the integrity of the internal process for reporting misconduct, among other things. We removed four employees from our initial population of 112 employees because two employees left DODIG prior to the initiation of our survey and two employees were new to the organization and therefore likely not familiar with the issues covered by the survey. To conduct the survey, we developed 27 questions covering (1) access to and protection of sensitive and classified whistleblower information; (2) confidentiality guidance, safeguards and identity disclosures; (3) resolving internal conflict through DODIG’s Office of the Ombuds; and (4) reporting misconduct through the internal DODIG process for DODIG employees to report misconduct. A survey specialist helped to develop these questions, and another survey specialist provided independent feedback on the questions to ensure that content necessary to understand the questions was included and that the questions could be answered accurately and completely. To minimize errors that might occur from respondents interpreting our questions differently than we intended, we pretested our survey with seven DODIG employees to ensure the clarity and reasonableness of the questions. During the pretests, conducted in person and by phone, DODIG employees read the instructions and each question out loud and told us whether (1) the instructions and questions were clear and unambiguous, (2) the terms we used were accurate, and (3) they could offer a potential solution to any problems identified. We also asked them for a mock answer to ensure that the questions were understood as intended. We noted any potential problems identified by the reviewers and through the pretests and modified the questionnaire based on the feedback received. A full listing of survey questions is provided in appendix IV. We conducted the survey between June 14, 2018, and July 6, 2018. To maximize our response rate, we sent reminder emails and contacted non- respondents by telephone to encourage them to complete the survey. In total, we received responses from 86 DODIG employees, achieving a response rate of 80 percent. Although not required, we assessed the potential for non-response bias by analyzing differences in the percent of DODIG employees per directorate and job position (e.g., investigator) that responded to our survey and the percent of potential DODIG respondents in each directorate and position. We found no meaningful differences between respondents and our population of potential respondents, indicating no evidence for non-response bias. Also, we took steps in the development of the survey, data collection, and data analysis to minimize nonsampling errors and help ensure the accuracy of the answers that were obtained. For example, a social-science survey specialist helped to design the questionnaire, in collaboration with analysts having subject- matter expertise. Then, as noted earlier, the draft questionnaire was pretested to ensure that questions were relevant, clearly stated, and easy to comprehend, and it was also reviewed by another specialist with expertise in survey development. We calculated the frequency of responses to our closed-ended survey questions and performed content analysis on the open-ended questions to identify common themes from across the responses and to determine their frequencies. The quantitative analysis was performed by one analyst and independently reviewed by another analyst. For the qualitative analysis, a standard coding scheme was developed to identify common themes and determine their frequencies. We also used professional judgment to identify other themes that were determined to be important based on our review of case files, discussions with DODIG management, and review of guidance and relevant standards. To determine the extent to which DODIG and the military service IGs are able to access and safeguard classified and sensitive information necessary to handle whistleblower complaints, we reviewed documentation and interviewed officials on the extent to which DODIG and the military service IGs have developed, implemented, and assessed key information technology (IT) security controls, and authorized the systems and applications used to process, store, and transmit sensitive whistleblower information per requirements and standards prescribed by DOD, the Office of Management and Budget, and the National Institute of Standards and Technology. Collectively, these documents delineate an array of documentary and procedural requirements related to the assessment of IT security controls and the authorization to operate IT systems and applications. We also reviewed plans and interviewed cognizant officials on the development and implementation of the Defense Case Activity Tracking System enterprise (D-CATSe)—DOD’s future system for managing whistleblower information across DODIG and the military service IGs, and reviewed DODIG’s quality assurance reviews of the Air Force (2017), Army (2018), and Naval IGs (2016). Separately, we reviewed data and information on the number and percentage of DODIG and military service IG classified cases closed in fiscal year 2017, the number and allocation of DODIG and military service IG staff possessing security clearances, and the processes and procedures for storing and accessing classified information within DODIG and the military service IGs against DOD policy related to establishing controls to ensure access to classified information is limited to authorized persons. We assessed the reliability of classified case data by administering questionnaires to cognizant officials, and determined the data were sufficiently reliable for the purpose of reporting the number of classified cases closed in fiscal year 2017. To determine the extent of substantiated and potential confidentiality violations and retaliatory investigations involving DODIG employees, we obtained and analyzed available fiscal year 2013 through 2018 data on known or perceived violations of confidentiality standards and retaliatory investigations from DODIG and the military service IGs. We selected data covering this period of time because they constituted the most recent and reliable data available, and because DODIG officials told us that data prior to fiscal year 2013 were unreliable. We also reviewed fiscal year 2013–2018 complaint data from the Office of Special Counsel and the CIGIE Integrity Committee in order to identify possible violations of confidentiality standards or retaliatory investigations. We assessed the reliability of DODIG and service IG data by administering questionnaires, interviewing cognizant officials, and reviewing the methods used to query IG case management systems for this information. We determined the data to be sufficiently reliable for the limited purpose of identifying potential confidentiality violations and retaliatory investigations. To evaluate the extent to which select misconduct and reprisal cases involving civilian DOD Presidential appointee with Senate confirmation (PAS) officials met key documentation and reporting requirements, we reviewed all 125 administrative misconduct and reprisal cases involving Senate-confirmed civilian official subjects that were dismissed by DODIG in fiscal years 2013 through 2017. We chose to review cases from this period because they constituted the most recent and complete data in DODIG’s case management system and would therefore most accurately reflect the extent to which the majority of DODIG’s cases included required documentation. Also, DODIG officials informed us that information on cases prior to the implementation of the current case management system in fiscal year 2013 were both incomplete and unreliable. During the course of our review, we removed five out-of-scope cases from the original population of 130 cases, reducing the number of cases in our population from 130 to 125. Four cases were removed because the related allegations were investigated, and one case was removed because it was a record used to track an investigation occurring at a military service IG. Table 8 shows the distribution per fiscal year of closed misconduct and reprisal cases involving civilian DOD PAS subjects by the result of the case. To conduct the case-file review, we developed and used a data collection instrument to guide our review regarding general case characteristics and the presence of information and documentation required by DOD policies and CIGIE best practices. Core elements of this instrument were shared with DODIG officials to ensure the instrument aligned with the policies and practices in place when the cases were dismissed. These core elements represented individual documents and data elements. We incorporated DODIG’s feedback into our instrument before commencing the file review. Examples of elements in our review that represent key data in DODIG’s database or constitute documentation of key steps of the case-handling process include the following: case open date, case close date, disposition of the matter at intake, dismissal rationale. To validate the data collection instrument and ensure consistency in its application, we developed and followed standard procedures to review a test sample of 11 case files that were selected from each stratum of cases (e.g., misconduct) to ensure that each case type was tested at least once. In reviewing the sample, we adjusted the relevant case file elements for each case based on its type and circumstances and captured responses in our data collection instrument accordingly. To help ensure the accuracy of the information we collected, one analyst reviewed each casefile and coded for the presence of required information using the data collection instrument, and another analyst reviewed the first analyst’s work. In the event that disagreement between the two analysts occurred, the analysts discussed and resolved the disagreement by identifying and reviewing supporting database information or documentation, and obtaining the input of a third analyst, if necessary, until a final resolution was made. We reviewed all cases dismissed during this period; for this reason, the results of this analysis do not have a sampling error. To identify other characteristics of DODIG cases involving civilian DOD PAS officials, we also analyzed fiscal years 2013-2017 case data to determine the number of cases closed by fiscal year, case types, case dispositions, source organizations, and the frequency and type of alleged misconduct. Separately, we also reviewed documentation from DODIG on civilian DOD PAS official allegations and investigation results reported to the Secretary of Defense and Congress since fiscal year 2013. In addressing our objectives, we met with officials from the organizations identified in table 9. We conducted this performance audit from October 2016 to March 2019 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. While this audit was initiated in October 2016, work was suspended from December 2016 until September 2017 due to other engagement work. This appendix provides additional examples of Department of Defense Office of Inspector General (DODIG) timeliness improvement initiatives. According to DODIG officials, recent steps to improve the timeliness of whistleblower reprisal and senior official misconduct intakes, investigations, and oversight reviews include: Transferring the intake of most military reprisal complaints to the DODIG oversight branch for increased consistency. Changing the intake metric from 30 to 45 days for non-military reprisal cases to allow for more robust intakes. Not requiring a clarification interview when a written reprisal complaint is clear. Requesting documents from the employer at the intake stage in contractor reprisal cases. Interviewing subjects early in the investigation, when appropriate. Conducting investigative travel only when doing so would save time or for other compelling reasons. Otherwise, most interviews are conducted by phone or video teleconference and information is requested in opening letters for investigations to facilitate early receipt of documentary evidence. Using summary reports of investigation to facilitate timelier report- writing and review. DODIG issued 24 summary reports in fiscal year 2018, starting in May, for simple, non-substantiated investigations. Eliminating the requirement to conduct peer reviews of the reprisal reports of investigation, except at supervisors’ discretion. Using standardized complaint notification and determination forms across DOD to formalize the processing of complaints received by component and service IGs. Implementing a more robust intake process for senior official misconduct investigations, which includes complaint clarifications and more investigative work. According to DODIG officials, most of the complaints reviewed during this new process would have otherwise been investigated by DODIG or the military service IGs, with a negative impact on the overall timeliness of investigations. Authorizing the military service IGs to close and simultaneously notify the DODIG reprisal investigations directorate of actions taken for complaints relating to uncooperative complainants, untimely complaints, and withdrawn complaints. This has increased notification rates and decreased processing time, according to DODIG officials. This appendix provides information on the characteristics of closed and dismissed misconduct and reprisal cases involving civilian DOD Presidential appointee with Senate confirmation (PAS) officials based on our analysis of fiscal year 2013 through fiscal year 2017 case data from the Department of Defense Office of Inspector General (DODIG) case- management system and our review of dismissed cases. DODIG closed 129 cases from October 1, 2012, through September 30, 2017, of which 125 were dismissed. Of the 125 dismissed cases, 117 were misconduct cases and eight were reprisal cases. DODIG dismissed 125 civilian DOD PAS official misconduct and reprisal cases. The largest number of cases—40 (32 percent)—were submitted by defense agency employees. Employees from the Navy submitted the next highest number of complaints, with 31 (25 percent), followed by the Army, which accounted for 26 (21 percent) of the complaints. Figure 9 shows the percentage of dismissed cases closed from fiscal years 2013 through 2017, by organizational source. Our review of the 125 dismissed civilian DOD PAS official cases closed by DODIG from fiscal years 2013 through 2017 showed that the majority of cases were closed in 30 days or less. Specifically, approximately 81 percent of the cases were closed in 30 days or less, and 58 percent of the cases were closed in 10 days or less. Table 10 groups the cases dismissed in each fiscal year from fiscal years 2013 through 2017 by the number of days to close. We reviewed data on the number and type of allegations made against civilian DOD PAS officials in the 117 closed misconduct cases from fiscal years 2013 through 2017. In total, there were 152 allegations across the 117 closed cases. Allegations are grouped into 13 broad categories and 38 sub-allegation categories. From fiscal years 2013 through 2017, we found that the greatest proportion of allegations, at 47 percent, were personal misconduct and ethical violations. Personnel matters—at 14 percent—and “other”—an indeterminate category at 12 percent—were the next two largest in proportion of allegations. Figure 10 provides the percentages of allegations in closed misconduct cases from fiscal years 2013 through 2017. GAO administered the survey questions shown in this appendix to learn more about DODIG processes related to the access and protection of whistleblower records, and the avenues available to DODIG employees to resolve conflict and report alleged misconduct themselves. The survey was divided into four sections: information access and protection, confidentiality, resolving internal conflict, and reporting misconduct. Survey questions without response options were open-ended. This appendix accurately shows the content of the web-based survey but the format of the questions and responses options have been changed for readability in this report. For more information about our methodology for designing and administering the survey, see appendix I. 1. How long have you worked in Administrative Investigations (AI)? Please consider your full tenure across all AI directorates (DOD Hotline, Investigations of Senior Officials, and Whistleblower Reprisal Investigations) if you have worked in more than one directorate. (Response options provided: radio buttons labeled “Less than 1 year,” “1 year or more but less than 5 years,” “5 years or more but less than 10 years,” and “10 years or more.”) SECTION I: Information Access and Protection 2. Formal training (in-person/w eb-based) Informal training (staff meetings/briefings) Please describe any other guidance you have received . ii. Do you believe the guidance identified above is sufficient or insufficient in specifying requirements for properly securing whistleblower records in your directorate? Select only one  Sufficient  SKIP to Question 4 Insufficient  Continue to 1 below  Not sure  SKIP to Question 4 1. Why do you believe the guidance is insufficient? SKIP to iii. Would guidance that specifies access restrictions and security controls for handling whistleblower records be helpful? (Response options provided: radio button labeled “yes” and “no.”) 1. Please explain why guidance would or would not be helpful. 4. Are you aware of any controls in place to restrict access to D-CATS records to only DODIG employees (either within or outside your directorate) with a need to know? Select only one  Yes  Continue to i  No  SKIP to Question 5 I’m not sure  SKIP to Question 5 i. Please describe the control(s) in place to restrict access to D- CATS records. 5. During your tenure at DODIG, have you or other DODIG employees (either within or outside your directorate) been able to access records in D-CATS without a need to know? This applies to potential access to records, regardless of whether anyone actually accessed records or not.  Yes  Continue to i  No  SKIP to Question 6 I don’t know  SKIP to Question 6 i. Which DODIG directorate’s records have you or other DODIG employees been able to access without a need to know? (Response options provided: checkboxes labeled “DOD Hotline,” “Investigations of Senior Officials,” “Whistleblower Reprisal Investigations,” and “Office of Professional Responsibility.”) ii. Are you aware of any actions taken to address the ability of DODIG employees to access records without a need to know? Examples of actions taken include a policy or procedure change, additional guidance, or other actions taken.  Yes  Continue to 1 below  No  SKIP to 2 below 1. Please describe the action(s) taken. 2. What improvements, if any, could be made to address the ability of DODIG employees to access records without a need to know? 6. Do you believe protections are sufficient or insufficient to ensure only DODIG employees with a need to know can access records in D- CATS? Select only one  Sufficient  Continue to i  Not sure  SKIP to Question 7 i. Why do you believe the protections are sufficient or insufficient? 7. Are you able to access classified information when needed to perform the duties required of your position? Select only one  Yes  SKIP to Question 8  No  Continue to i I do not require access to classified information to perform the duties of my position  SKIP to Question 8 i. Formal training (in-person/w eb- based) Informal training (staff meetings/briefings) Please describe any other guidance you have received. Formal training (in-person/w eb- based) Informal training (staff meetings/briefings) Please describe any other guidance you have received. ii. Do you believe the guidance identified above is sufficient or insufficient in specifying how to determine whether disclosing the identity of a complainant or source (e.g., witness) is unavoidable?  Sufficient  SKIP to 2 below Insufficient  Continue to 1 below  Not sure  SKIP to 2 below 1. Why do you believe the guidance is insufficient? 2. What improvements, if any, do you think could be made to guidance specifying how to determine whether disclosing the identity of a complainant or source (e.g., witness) is unavoidable? (After answering, SKIP to Question 12) iii. Would guidance that specifies how to determine whether disclosing the identity of a complainant or source (e.g., witness) is unavoidable be helpful? (Response options provided: radio buttons labeled “yes” and “no.”) 1. Please explain why guidance would or would not be helpful. 12. To your knowledge, is there one or more official(s) who is responsible for determining whether disclosing the identity of a complainant or source (e.g., witness) is unavoidable?  Yes  Continue to i  No  SKIP to Question 13 I don’t know  SKIP to Question 13 i. Who is responsible for determining whether disclosing the identity of a complainant or source (e.g., witness) is unavoidable? 13. While working in AI, have you ever encountered a situation where disclosing the identity of a complainant or source (e.g., witness) was unavoidable?  Yes  Continue to i  No  SKIP to Question 14 i. Please describe the general circumstance(s) and the steps you took to verify that the circumstance(s) required disclosing the identity of a complainant or source (e.g., witness). Please do not provide individual names related to the actors involved. 14. Between June 1, 2017, and today, are you aware — either by experiencing firsthand or directly observing actions of another person – of an instance where the identity of a complainant or source (e.g., witness) was disclosed by a DODIG employee to an organization or individual without a need to know (i.e., an avoidable disclosure)? Please check only one below.  No, I am not aware of any avoidable disclosures  SKIP to  Yes, I am aware of one or more avoidable disclosure(s)  Continue to i i. How many avoidable disclosures are you aware of between June 1, 2017, and today? For example, if the identity of a complainant was revealed to one person who did not have a need to know, please consider that event as one instance. Similarly, if the identity of a source was revealed separately to two different people who did not have a need to know, please consider those events as two instances. ii. Please describe any actions taken in response to the avoidable disclosure(s) you are aware of between June 1, 2017, and today. Examples of actions taken include but may not be limited to retracting/recalling a referred complaint, a change to policy, procedure or guidance, and notifying the complainant or source, among other actions. 15. What improvements, if any, could be made to prevent avoidable disclosures from happening in the future? 16. Please describe any best practices that you follow to help prevent avoidable disclosures. SECTION III: Resolving Internal Conflict 17. Have you ever contacted the DODIG Office of the Ombuds or participated in a DODIG Office of the Ombuds activity in order to address conflict among DODIG employees? Examples of DODIG Office of the Ombuds activities include but are not limited to providing confidential advice for resolving conflict among peers and supervisors and participating in an Ombuds-led mediation among DODIG employees.  Yes  Continue to i  No, but I know about the DODIG Office of the Ombuds  I do not know about the DODIG Office of the Ombuds  SKIP to the next section i. Do you believe the DODIG Office of the Ombuds provided or is providing sufficient or insufficient assistance to address the conflict(s) for which you contacted the Ombuds or participated in an Ombuds activity?  Sufficient  Continue to 1 Insufficient  Continue to 1  Too soon to tell  Continue to 1 1. Please describe, in general terms, your latest experience working with the DODIG Office of the Ombuds. Please do not provide the names of individuals involved with your experience. 18. Have you ever considered reaching out to the DODIG Office of the Ombuds, but ultimately chose not to?  Yes  Continue to i  No  SKIP to the next section i. How much, if at all, did each of the following contribute to your decision not to utilize DODIG Office of the Ombuds services? Select one in each row. Resolved the issue through another avenue Not sure how to initiate contact w ith the Ombuds Concern about length of process Concern about objectivity or conflict of interest w ithin the Office of the Ombuds Fear that confidentiality w ould be compromised Fear of retaliation or reprisal from w ithin DODIG Please describe any other factor(s) that contributed to your decision not to utilize DODIG Office of the Ombuds services. SECTION IV: Reporting Misconduct 19. As a DODIG employee, have you ever personally reported misconduct against another DODIG employee through DODIG’s internal process for investigating alleged misconduct? For the purposes of this survey, “misconduct” refers to (1) a violation of a provision of criminal law, (2) a violation of a recognized standard, such as a federal or DOD regulation, or (3) a matter of concern involving DOD leadership that could reasonably be expected to be of significance to DODIG.  Yes  Continue to i  No  SKIP to iii i. Did you report misconduct on or before September 30, 2016?  Yes  Continue to 1 below  No  SKIP to ii 1. Do you believe your report(s) of misconduct on or before September 30, 2016 were investigated in a fair and objective manner? (Response options provided: radio buttons labeled “yes” and “no.”) a. Please describe your general experience(s) in reporting misconduct against a DODIG employee on or before September 30, 2016, including why you do or do not believe your report(s) of misconduct were investigated in a fair and objective manner. Please do not provide the names of individuals related to the misconduct you reported. ii. Did you report misconduct on or after October 1, 2016?  Yes  Continue to 1 below  No  SKIP to Question 20 1. Do you believe your report(s) of misconduct on or after October 1, 2016 were investigated in a fair and objective manner? (Response options provided: radio buttons labeled “yes,” “no,” and “too early to have an opinion”) a. Please describe your general experience(s) in reporting misconduct against a DODIG employee on or after October 1, 2016, including why you do or do not believe your report(s) of misconduct were investigated in a fair and objective manner. Please do not provide the names of individuals related to the misconduct you reported. iii. Do you know how to report misconduct against another DODIG employee through DODIG’s internal process? (Response options provided: radio buttons labeled “yes” and “no.”) 20. Thinking about the time period on or before September 30, 2016, did you ever consider reporting misconduct against a DODIG employee through DODIG’s internal process, but ultimately choose not to?  Yes  Continue to i  No  SKIP to Question 21 i. How much, if at all, did each of the following contribute to your decision not to report incident(s) of misconduct on or before September 30, 2016? Select one in each row. Resolved the issue through another avenue Not sure how to report misconduct Concern about length of process Concern about objectivity or conflict of interest w ithin DODIG’s internal process to report misconduct Fear that confidentiality w ould be compromised Fear of retaliation or reprisal from w ithin DODIG Please describe any other factor(s) that contributed to your decision not to report incidents of misconduct on or before September 30, 2016. 21. Thinking about the time period on or after October 1, 2016, did you ever consider reporting misconduct against a DODIG employee through DODIG’s internal process, but ultimately choose not to?  Yes  Continue to i below  No  SKIP to Question 22 i. How much, if at all, did each of the following contribute to your decision not to report incident(s) of misconduct on or after October 1, 2016? Select one in each row. Resolved the issue through another avenue Not sure how to report misconduct Concern about length of process Concern about objectivity or conflict of interest w ithin DODIG’s internal process to report misconduct Fear that confidentiality w ould be compromised Fear of retaliation or reprisal from w ithin DODIG Please describe any other factor(s) that contributed to your decision not to report incidents of misconduct on or after October 1, 2016. 22. How well, if at all, do you believe DODIG’s internal process for reporting misconduct protects the confidentiality of DODIG employees? (Response options provided: radio buttons labeled “Not at all,” “Slightly,” “Somewhat,” “Very well,” and “I don’t know.”) 23. What improvements, if any, do you think could be made to DODIG’s internal process for reporting misconduct to protect the confidentiality of DODIG employees? 24. How well, if at all, do you believe DODIG’s internal process handles misconduct allegations against DODIG employees? This includes activities associated with both assessing incoming complaints and subsequently investigating them, as appropriate. (Response options provided: radio buttons labeled “Not at all,” “Slightly,” “Somewhat,” “Very well,” and “I don’t know.”) 25. What factors contribute to your opinion about DODIG’s internal process for handling misconduct allegations against DODIG employees? 26. What improvements, if any, do you think could be made to DODIG’s internal process to improve the handling of misconduct allegations? 27. If you would like to comment on any of the topics covered by this survey, or anything else that you feel might be relevant to our review on the DOD whistleblower program, please do so below. In addition to the contact named above, Alissa Czyz (Assistant Director),Tracy Barnes, Amy Bush, Nicole Collier, Ryan D’Amore, Chad Hinsch, Linda Keefer, Kevin Keith, Amie Lesser, Serena Lo, Michael Silver, and Lillian Yob made key contributions to this report. Office of Special Counsel: Actions Needed to Improve Processing of Prohibited Personnel Practice and Whistleblower Disclosure Cases. GAO-18-400. Washington, D.C.: June 14, 2018. NASA Contractor Whistleblowers: Steps Taken to Implement Program but Improvements to Timeliness and Guidance Needed. GAO-18-262. Washington, D.C.: March 8, 2018. Whistleblower Protection: Opportunities Exist for DOD to Improve the Timeliness and Quality of Civilian and Contractor Reprisal Investigations. GAO-17-506. Washington, D.C.: September 29, 2017. Contractor Whistleblower Protections Pilot Program: Improvements Needed to Ensure Effective Implementation. GAO-17-227. Washington, D.C.: March 2, 2017. Whistleblower Protection: Additional Actions Would Improve Recording and Reporting of Appeals Data. GAO-17-110. Washington, D.C.: November 28, 2016. Whistleblower Protection: DOD Has Improved Oversight for Reprisal Investigations but Can Take Additional Actions to Standardize Process and Reporting. GAO-16-860T. Washington, D.C.: September 7, 2016. Department of Energy: Whistleblower Protections Need Strengthening. GAO-16-618. Washington, D.C.: July 11, 2016. Whistleblower Protection: DOD Needs to Enhance Oversight of Military Whistleblower Reprisal Investigations. GAO-15-477. Washington, D.C.: May 7, 2015. Whistleblower Protection: Additional Actions Needed to Improve DOJ’s Handling of FBI Retaliation Complaints. GAO-15-112. Washington, D.C.: January 23, 2015. Whistleblower Protection Program: Opportunities Exist for OSHA and DOT to Strengthen Collaborative Mechanisms. GAO-14-286. Washington, D.C.: March 19, 2014. Whistleblower Protection: Actions Needed to Improve DOD’s Military Whistleblower Reprisal Program. GAO-12-362. Washington, D.C.: February 22, 2012.

Summary: Safeguarding confidentiality to the maximum extent possible is essential for encouraging whistleblowers to report wrongdoing without fear of reprisal. In fiscal year 2018, DODIG received over 12,000 contacts from potential whistleblowers related to fraud, waste, abuse, employee misconduct, or other violations. The National Defense Authorization Act for Fiscal Year 2017 included a provision for GAO to review the integrity of DOD's whistleblower program. This report assesses the extent to which DODIG and the military service IGs (1) met and took steps to achieve key fiscal year 2018 timeliness and quality goals, (2) established processes to protect whistleblower confidentiality, and (3) are able to safeguard sensitive information necessary to handle whistleblower complaints. It also evaluates (4) the extent to which select cases involving certain senior DOD civilian officials met key requirements. GAO assessed fiscal year 2018 IG performance data, surveyed all 108 DODIG employees who directly handle whistleblower complaints, reviewed IT security controls, and analyzed all 125 cases involving civilian DOD Presidential appointees with Senate confirmation dismissed by DODIG in fiscal years 2013-2017. The Department of Defense Office of Inspector General (DODIG) and military service offices of inspector general (IG) met some but not all fiscal year 2018 timeliness and quality goals for handling whistleblower complaints. For example, DODIG met its goals related to referring complaints to the appropriate agency within a certain number of days. All IGs also generally met goals related to the quality of investigations. However, about 85 percent of DODIG reprisal and senior official misconduct investigations exceeded statutory and internal timeliness goals. Further, military service IGs did not meet most goals for handling cases within prescribed timeframes. For example, the service IGs averaged between 17 and 84 days to notify DODIG of their receipt of whistleblower reprisal allegations, exceeding the 10-day goal. The IGs have various initiatives underway to improve timeliness, such as a Naval IG program to reduce timeframes for initial credibility determinations. However, additional actions could provide a more targeted approach to improving performance against unmet timeliness goals—such as for senior official misconduct investigations—and better assure whistleblowers that their cases will be handled expeditiously. DODIG and the military service IGs have policies to protect whistleblower confidentiality, but some gaps exist. For example, DODIG guidance for protecting whistleblowers who report internal DODIG misconduct does not specify key steps investigators should take to protect confidentiality, such as not identifying complainants during interviews with case subjects. Also, Air Force, Naval, and Marine Corps IG guidance does not specify when whistleblower identities can be disclosed without consent. Without updated guidance, the IGs cannot ensure the consistent implementation of confidentiality protections. The IGs have taken steps to safeguard whistleblower information in their information technology (IT) systems and applications, such as by restricting access to case information through unique user permissions and by taking actions to follow DOD's IT risk management process. However, between 2016 and 2018, employees in all of the IGs have been able to access sensitive whistleblower information without a need to know. For example, DODIG determined that numerous restricted whistleblower records in its document repository were accessible to DODIG personnel without a need to know. Similarly, the Air Force IG's application did not restrict users from other DOD components from viewing Air Force IG case descriptions and complainant identities, while the Army IG's application and the Naval IG's system did not restrict personnel within those IGs from viewing allegations or investigations involving other personnel within those IGs. Additionally, employees in Marine Corps IG offices were able to see whistleblower cases assigned to other IG offices without a need to know. While some actions have been taken to address these issues, additional steps are needed to restrict access to case information in order to mitigate ongoing risks to whistleblower confidentiality. DODIG generally met key documentation requirements for the 125 cases it dismissed without investigation involving civilian DOD Presidential appointees with Senate confirmation. GAO is making 12 recommendations, including that the IGs take additional actions to improve timeliness, develop additional procedures to protect whistleblower confidentiality, and take steps to further limit IG employee access to sensitive whistleblower information. DOD concurred with all of the recommendations.