To protect its critical assets, DOD has established several protection measures for weapon systems. These measures include information assurance to protect information and information systems, software protection to prevent the unauthorized distribution and exploitation of critical software, and anti-tamper techniques to help delay exploitation of technologies through means such as reverse engineering when U.S. weapons are exported or lost on the battlefield. Examples of anti-tamper techniques include software encryption, which scrambles software instructions to make them unintelligible without first being reprocessed through a deciphering technique, and hardware protective coatings designed to make it difficult to extract or dissect components without damaging them. In 1999, the Under Secretary of Defense for Acquisition, Technology, and Logistics (AT&L) issued a policy memorandum for implementing anti- tamper protection in acquisition programs. In the following year, AT&L issued a policy memorandum stating that technologies should be routinely assessed during the acquisition process to determine if they are critical and if anti-tamper techniques are needed to protect these technologies. In 2001, an AT&L policy memorandum designated the Air Force as the Anti- Tamper Executive Agent. The executive agent’s office, which currently has four staff, is responsible for implementing DOD’s anti-tamper policy and managing anti-tamper technology development through the Air Force Research Laboratory. The executive agent also holds periodic information sessions to educate the acquisition community about anti-tamper policy, initiatives, and technology developments. To coordinate activities, military services and defense agencies, such as the Missile Defense Agency, have an anti-tamper point of contact. Program managers are responsible for ensuring anti-tamper protection is incorporated on any weapon system with critical technologies that need protection. Since it is not feasible to protect every technology, program managers are to conduct an assessment to determine if anti-tamper protection is needed. When assessing if anti-tamper protection is needed, program managers make several key decisions regarding the identification of critical technologies, assessment of threats and vulnerabilities, and determination of anti-tamper techniques or solutions. The process begins with determining whether or not their system’s critical program information includes any critical technologies. If it is determined that the system has no critical technologies, program managers are to document the decision and request concurrence from either the office within their component that is designated with anti-tamper responsibilities or the Anti-Tamper Executive Agent. For systems that are determined to have critical technologies, the next key steps are to identify potential threats and vulnerabilities and select anti-tamper techniques to protect those technologies. Techniques are ultimately verified and validated by a team composed of representatives from the DOD components. The program manager documents decisions in an annex of the program protection plan. In 2004, we reported that program managers had difficulty in carrying out DOD’s anti-tamper policy on individual weapons, such as identifying critical technologies and experiencing cost increases or schedule delays when applying anti-tamper techniques—particularly when the techniques are not fully developed or when the systems are already in design or production. We made several recommendations, including increasing oversight over the identification of critical technologies across programs, improving tools and resources for program managers in identifying critical technologies, ensuring early identification of anti-tamper costs and solutions, monitoring the development of generic anti-tamper solutions and evaluating their effectiveness, and developing a business case to determine whether the current organizational structure and resources are adequate. DOD concurred or partially concurred with these recommendations. DOD has taken some steps to implement our recommendations including identifying available anti-tamper technical resources and developing a searchable spreadsheet of critical technologies, incorporating information in the Defense Acquisition Guidebook on the need for early identification of anti-tamper solutions in a weapon system, and sponsoring a study on anti-tamper techniques and their general effectiveness. While DOD has taken these steps to address parts of the recommendations, all remain open. DOD has recently taken several actions aimed at raising awareness about its anti-tamper policy and assisting program managers in implementing anti-tamper protection on a weapon system. Despite these actions, DOD still lacks departmentwide direction to implement its anti-tamper policy. Without such direction, DOD components are left to develop their own initiatives to assist program managers in implementing anti-tamper protection. While individual efforts are important, such as a database to track critical program information DOD-wide, their effectiveness may be limited because they have yet to be accepted and adopted across all DOD components. Since our 2004 report, DOD, through the Anti-Tamper Executive Agent, has developed some resources aimed at assisting program managers as they go through the anti-tamper decision process. DOD’s resources range from providing general information about the anti-tamper policy to research on anti-tamper solutions. Specifically, DOD has developed a guidebook that includes a checklist to assist program managers in identifying security, management, and technical responsibilities when incorporating anti-tamper protection on a weapons system; developed a searchable spreadsheet to assist program managers in developed a Web site for program managers to provide general anti- tamper information, policy resources, conference briefings, implementation resources, and current events; coordinated with Defense Acquisition University to design and launch an online learning module on anti-tamper protection; funded Sandia National Laboratories to study anti-tamper techniques and their general effectiveness; and sponsored research to develop generic anti-tamper techniques through Small Business Innovation Research, a research program that funds early-stage research and development projects at small technology companies. DOD has also updated two acquisition documents with general anti- tamper information. The first document—DOD Instruction 5000.2, Operation of a Defense Acquisition System—currently states that one of the purposes of the System Development and Demonstration phase of a weapon system is to ensure affordability and protection of critical program information by implementing appropriate solutions such as anti- tamper protection. The second document—the Defense Acquisition Guidebook—has been updated to include some basic information on the importance of implementing anti-tamper protection early in the development of a weapon system and describes program managers’ overall responsibilities for implementing the anti-tamper policy. While DOD has issued broad policy memorandums that reflect the department’s desire for routinely assessing weapon systems to determine if anti-tamper protection is needed, the department has not fully incorporated the anti-tamper policy into its formal acquisition guidance. Specifically, DOD Instruction 5000.2 mentions anti-tamper protection, but the department has not provided direction for implementation of anti- tamper in a formal directive or instruction. Currently, the department is coordinating comments on a draft instruction (DOD Instruction 5200.39) on protection of critical program information that includes anti-tamper implementation. However, in commenting on the draft instruction, several DOD components have raised concerns about when and how to define critical program information that warrants protection, which have contributed to long delays in finalizing the instruction. In addition, the department has not provided specific guidance for program managers on how to implement anti-tamper protection in a DOD manual because DOD officials said this process cannot begin until the instruction is finalized. The date for finalizing the instruction has not yet been determined. Officials from the executive agent’s office stated that departmentwide direction would give credence to the anti-tamper policy in practice. Anti- tamper points of contact told us that the policy memorandums are not sufficient to ensure that program managers are implementing anti-tamper protection on weapon systems when necessary. One service anti-tamper point of contact stated that program managers might disregard the policy memorandums because they are high-level and broad. Another service anti-tamper point of contact said that implementation is ultimately left up to the individual program manager. While a program manager’s decision should be approved by the milestone decision authority and documented in the program protection plan, some service and program officials said that programs are not always asked about anti-tamper protection during the review. Lacking departmentwide direction for the anti-tamper policy, DOD components have been left to develop their own initiatives to assist program managers in anti-tamper implementation. However, the usefulness of these initiatives depends on the extent to which other components participate in these efforts. For example, the Missile Defense Agency developed a risk assessment model to help program managers identify how much anti-tamper is needed to protect critical technologies. Specifically, the model helps program managers assess the criticality of the technology relative to the risk of exploitation. However, when the Missile Defense Agency sought comments on the initiative, the executive agent and services indicated that it was too lengthy and complex to use. The executive agent, in coordination with anti-tamper points of contact from the Missile Defense Agency and services, has taken over this effort, and it is still in development. The Navy is also implementing an initiative: a database intended to capture the information that programs across DOD components have identified as critical. Many officials we spoke with pointed to this database as a potential tool to improve identification of critical program information across DOD components. To date, the Navy and the Army are submitting information for the database, but the Missile Defense Agency and Air Force are not. The Missile Defense Agency anti-tamper point of contact stated that its information is classified at a level above what the database can support and its program managers will not submit information for the database unless DOD requires submissions by all DOD components. However, the Missile Defense Agency does have access to the database and uses it as a cross-check to determine if it is identifying similar critical program information.