DOD increasingly relies on advanced technology in its weapons for effectiveness on the battlefield and actively seeks to include foreign partners in weapon system development and acquisition. DOD’s policy also encourages the sale of certain weapons to foreign governments through the Foreign Military Sales Program and direct commercial sales made by companies. While these efforts have the potential to enhance coalition operations and reduce weapons’ unit costs, DOD has acknowledged that the efforts also risk making U.S. technologies potentially vulnerable to exploitation. DOD reported that an increasing number of countries have reverse engineering capability and actively seek to obtain U.S. technology through various means. As a method to protect critical technologies, the Under Secretary of Defense for Acquisition, Technology, and Logistics directed the military services in 1999 to implement anti-tamper techniques. While the techniques will not prevent exploitation, they are intended to delay or discourage attempts to reverse engineer critical technologies in a weapon system or develop countermeasures to a system or subsystem. In 2001, the Under Secretary of Defense for Acquisition, Technology, and Logistics designated the Air Force as the Executive Agent responsible for implementing DOD’s anti-tamper policy. The Executive Agent oversees an annual budget of about $8 million per year to implement policy and manage anti-tamper technology projects through the Air Force Research Laboratory. DOD, in conjunction with the Air Force Research Laboratory and the Department of Energy’s Sandia National Laboratories, also holds periodic information sessions to educate the acquisition community about anti-tamper policy, guidance, and technology developments. In addition, military services and defense agencies, such as the Missile Defense Agency, have an anti-tamper focal point to coordinate activities. Program managers are responsible for considering anti-tamper measures on any weapon system with critical technologies. Since it is not feasible to protect every technology, program managers are to conduct an assessment to determine if anti-tamper protection is needed. The first step of the decision process is to determine if the system has critical technologies. If program managers determine the system has no critical technologies, they are to document that decision according to draft guidance. Program managers of systems that contain critical technologies complete the remaining steps of the process. Based on draft guidance, program managers are to conceptually address how they will implement anti- tamper measures at system development, otherwise known as milestone B. DOD’s anti-tamper decision process is illustrated in figure 1. Program managers can obtain assistance on their assessments from government laboratories, contractors, and the intelligence community. They are required to document the decision to use or not to use anti- tamper techniques in a classified annex of the program protection plan, which is subject to approval from the program’s milestone decision authority. Anti-tamper techniques vary depending on the type of protection the system requires. An example of an anti-tamper technique is software encryption, which scrambles software instructions to make them unintelligible without first being reprocessed through a deciphering technique. Another example is a thin opaque coating placed on microelectronic components, which makes it difficult to extract or dissect the components without great damage. Programs can apply multiple anti- tamper techniques to a critical technology. For example, a program could encrypt critical data on a microelectronic chip that is also covered with a protective coating. Each layer of protection could act as an obstacle to reverse engineering. Implementation of the anti-tamper policy has been hampered by several factors. First, identification of critical technology is subject to interpretation and program managers and DOD officials can and have arrived at different conclusions about what needs to be protected. Second, applying anti-tamper protection can take time and money, which may compete with a program manager’s cost and schedule objectives. Finally, some programs found it difficult to apply anti-tamper techniques when the techniques were not fully developed, and others were unsure which techniques were available to them. In general, the later anti-tamper techniques are applied, the more difficult and costly it can be to implement. Thus far, support to help program managers address some of these factors has been limited. DOD officials acknowledged that the identification of critical technologies—a basis for determining if anti-tamper protection is needed—is subjective, which can result in different conclusions regarding what needs protection. DOD’s Program Managers Anti-Tamper Handbook defines technology as critical if compromise results in degrading combat effectiveness, shortening the expected combat life of the system, or significantly altering program direction. While a broad definition allows for flexibility to determine what is critical on individual systems, it may increase the risk that the same technology is protected on some systems but not on others or that different conclusions can be reached on whether programs have critical technologies. For example: An official from an intelligence agency described a case where two services used the same critical technology, but only one identified the technology as critical and provided protection. The intelligence agency official speculated that if exploited, knowledge gained from the unprotected system could have exposed the technology on both systems to compromise. While both systems were ultimately protected, the intelligence agency official stated that the situation could occur again. Officials from the Executive Committee told us that two program managers stated that their systems had no critical technologies and therefore were not subject to the anti-tamper policy. Both managers were directed by the Executive Committee to reconsider their determination and apply anti-tamper protection. As a result, one program is in the process of determining which technologies are critical, and the other program is applying anti-tamper protection as a condition to export the system. While different conclusions can be reached regarding what is critical, various organizations can serve as a check on a program manager’s assessment. However, no organization has complete information or visibility of all programs across the services and agencies. For example, the anti-tamper Executive Agent and the military service focal points do not have full knowledge about which program offices have or have not identified critical technologies or applied anti-tamper protection. In 2001, DOD attempted to collect such information, but not all programs provided data and DOD did not corroborate what was provided to ensure that program officials were consistently assessing critical technologies. The Executive Agent stated that there are no plans to update this data. Conducting oversight over program managers’ assessments may be difficult because of limited resources. Specifically, the Executive Agent has two full-time staff and the military service focal points perform duties other than anti-tamper management. Furthermore, according to a military official, program offices that determine they have no critical technologies are not required to obtain the focal points’ concurrence. While other organizations can review a program manager’s critical technology assessment as part of various acquisition and export processes, they may not have a full perspective of the assessments made by all programs across the services and the agencies. For example, different milestone decision authorities only review an individual program manager’s critical technology decisions for programs coming under their responsibility. Also, the Executive Committee may weigh in on the determinations, but it only reviews exports involving stealth technology. While it was apparent that the systems had critical technologies, some program managers needed assistance to determine which specific technologies were critical. For example, a program office tasked the contractor to identify critical technologies, and it has worked for months with the contractor to agree upon and finalize a list of critical technologies on the system. Also, an intelligence official, who is available to assist program managers in assessing their systems’ criticality, found that some program managers identified too many technologies as critical and that others did not identify all of the systems’ critical elements. In one instance, a program manager indicated that a system had 400 critical technologies, but an intelligence agency narrowed down the list to about 50 that it considered critical. In another case, a program manager concluded that an entire system was one critical technology, but the intelligence agency recommended that the system’s technologies be broken down and identified approximately 15 as critical. Although there are various resources to help program managers identify critical technologies, they may have limited utility, or may not be known, and therefore not requested. For example, the Militarily Critical Technologies List—cited in guidance as a primary reference for program managers—may not be up to date and may not include all technologies, according to some DOD officials. Another resource—the Program Managers Anti-Tamper Handbook—contains information regarding critical technology determinations, but program managers are not always aware that the handbook exists, in part because it is not widely distributed. In addition, the Defense Intelligence Agency can conduct an independent assessment of a system’s critical elements and technologies, if requested by the program manager. However, many officials we interviewed were unaware that the agency provides this assistance. According to a military official, the focal points are available to review a program manager’s assessment if requested. In some instances, program managers may have differing perceptions of what constitutes a critical technology. According to DOD’s guidance, critical technologies can be either classified or unclassified. However, an anti-tamper focal point stated that there is a perception that the anti- tamper policy only applies to classified programs. We found in one instance that the manager for a weapon program stated that the program did not require anti-tamper protection because it had no critical technologies that were classified. Applying anti-tamper protection takes money and time, which can affect a program manager’s cost and schedule objectives. Generally, anti-tamper implementation is treated as an added requirement that is not separately funded for most programs. Program officials acknowledged that anti- tamper costs can be difficult to estimate and isolate because they are intertwined with other costs, such as research and development or production costs. As we have found in prior work, the later a requirement is identified, the more costly it is to achieve. Most programs we visited experienced or estimated cost increases, and some encountered schedule delays as they attempted to apply anti-tamper techniques.