FAA’s ATC network is an enormous, complex collection of interrelated systems, including navigation, surveillance, weather, and automated information processing and display systems that reside at, or are associated with, hundreds of ATC facilities. These systems and facilities are interconnected by complex communications networks that separately transmit both voice and digital data. As stated in our 1997 report on high-risk issues, while the use of interconnected systems promises significant benefits in improved government operations, it also increases vulnerability to anonymous intruders who may manipulate data to commit fraud, obtain sensitive information, or severely disrupt operations. Since this interconnectivity is expected to grow as systems are modernized to meet the projected increases in air traffic and to replace aging equipment, the ATC network will become even more vulnerable to such network-related threats. The threat to information systems is also growing because of the increasing availability of strategies and tools for launching planned attacks. For example, in May 1996 we reported that tests at the Department of Defense showed that Defense systems may have experienced as many as 250,000 attacks during 1995, about 65 percent of these succeeded in gaining access, and only about 4 percent were detected. Since intruders can use a variety of techniques to attack computer systems, it is essential that FAA’s approach to computer security be comprehensive and include (1) physical security of the facilities that house ATC systems (e.g., locks, guards, fences, and surveillance equipment), (2) information security of the ATC systems (e.g., safeguards incorporated into computer hardware and software), and (3) telecommunications security of the networks linking ATC systems and facilities (e.g., secure gateways, firewalls, and communication port protection devices). For years, the need for federal agencies to protect sensitive and critical, but unclassified, federal data has been recognized in various laws, including the Privacy Act of 1974, the Computer Security Act of 1987, and the Paperwork Reduction Act of 1995, and was recently reemphasized in the Clinger-Cohen Act of 1996. The adequacy of controls over computerized data is also addressed indirectly by the Federal Managers’ Financial Integrity Act (FMFIA) of 1982 and the Chief Financial Officers Act of 1990. For example, FMFIA requires agency managers to evaluate their internal control systems annually and report to the President and the Congress any material weaknesses that could lead to fraud, waste, and abuse in government operations. In addition, a considerable body of federal guidance on information security has been developed by both the Office of Management and Budget (OMB) and the National Institute of Standards and Technology (NIST). The objectives of our review were to determine (1) whether FAA is effectively managing physical security at ATC facilities and systems security for its current operational systems, (2) whether FAA is effectively managing systems security for future ATC modernization systems, and (3) the effectiveness of FAA’s management structure and implementation of policy for computer security. To determine whether FAA is effectively managing physical security at ATC facilities, we reviewed FAA Order 1600.6C, Physical Security Management Program, to determine ATC facility security inspection and accreditation requirements; reviewed data from FAA’s Facility Inspection Reporting System (FIRs) to determine the accreditation status of category I and II towers, terminal radar approach control (TRACON) facilities, and air route traffic control towers (en route centers) and their last inspection date; verified the accuracy of the FIRs accreditation data with each of the nine regional FIRs program managers by requesting accreditation reports for each facility that FIRs reported as being accredited; for those facilities that were not accredited, requested dates of their initial comprehensive physical security inspection and follow-up inspections from each of the nine regional FIRs program managers to determine why ATC facilities were not accredited; verified the initial and follow-up inspection dates by requesting and reviewing documentation for each inspection conducted from April 16, 1993, to July 31, 1997, and then provided our analyses to Office of Civil Aviation Security Operations officials, who in turn verified it with each region; reviewed the Department of Justice’s June 28, 1995, report, Vulnerability Assessment of Federal Facilities, to identify new physical security requirements for federal facilities; reviewed physical security assessments for three locations to determine FAA’s ATC compliance with Department of Justice blast standards and to identify additional physical security weaknesses at key ATC facilities; reviewed the Facility Security Risk Management Mission Need Statement for Staffed Facilities, Number 316, June 23, 1997, to determine physical security deficiencies and FAA’s plans to improve physical security; and interviewed officials from the Offices of Civil Aviation Security, Operations and Policy and Planning, and Airways Facility Services to determine physical security requirements, to determine whether FAA is in compliance with 1600.6C, to identify reasons for noncompliance, and to identify who develops, implements, and enforces ATC physical security policy. To determine whether FAA is effectively managing systems security for its current operational systems, we reviewed federal computer security requirements specified in the Computer Security Act of 1987 (Public Law 100-235); Paperwork Reduction Act of 1995 (Public Law 104-13), as amended; OMB Circular A-130, appendix III, “Security of Federal Automated Information Resources;” the 1996 Clinger-Cohen Act; and An Introduction to Computer Security: The NIST Handbook to identify federal security requirements; reviewed FAA Order 1600.54B, FAA Automated Information Systems Security Handbook, and FAA Order 1600.66, Telecommunications and Information Systems Security Policy, to determine ATC system risk assessment, certification, and accreditation requirements; reviewed Volpe National Transportation Systems Center NAS AIS Security Review, October 1, 1996, to determine how many ATC operational systems were assessed, certified, and accredited as of October 1, 1996; requested and reviewed accreditation reports, security certification reports, risk assessments, contingency plans, and disaster recovery plans for six operational ATC systems; reviewed the White House Commission on Aviation Safety and Security’s final report to the President, February 12, 1997, to determine recommendations to improve ATC computer security; reviewed the Federal Aviation Administration Air to Ground Communications Vulnerabilities Assessment, June 1993, to determine ATC communication systems vulnerabilities; reviewed the Report to Congress, Air Traffic Control Data and Communications Vulnerabilities and Security, Report of the Federal Aviation Administration Pursuant to House-Senate Report Accompanying the Department of Transportation and Related Agencies Appropriations Act, 102-639, June 1, 1993, to determine what ATC security vulnerabilities FAA disclosed to the Congress in 1993; interviewed the telecommunications integrated product team to determine what operational communication systems have been assessed, certified, and accredited and reviewed the team’s 1994 and 1997 strategic plans to determine communication system risks and planned security improvement initiatives; interviewed the Director of Spectrum Policy and Management to determine the extent to which intruders are accessing ATC frequencies; interviewed FAA’s Designated Approving Authority (DAA) to determine FAA’s policy for accrediting ATC systems; and interviewed the Office of Civil Aviation Security Operations officials and Airways Facilities Services officials to determine who develops, implements, and enforces ATC operational systems security policy and to determine whether an incident reporting and handling capability exists. To determine whether FAA is effectively managing systems security for future ATC modernization systems, we requested and reviewed risk assessments and acquisition specifications for six ATC systems that are being developed to determine if security requirements based on detailed assessments existed;interviewed three integrated product teams (IPT) to determine what security policy/guidance each follows in developing ATC systems; reviewed the NAS Information Security Mission Need Statement, April 22, 1997, to determine information security deficiencies, future system vulnerabilities, and FAA’s plans to improve information security; interviewed the NAS Information Security (NIS) group to determine its plans to improve ATC information security and reviewed its NAS Information Security Action Plan; and reviewed the President’s Commission of Critical Infrastructure Protection’s (PCCIP) final report, Critical Foundations, Protecting America’s Infrastructures, October 1997, and its supplemental report, Vulnerability Assessment of the FAA National Airspace Systems (NAS) Architecture, October 1997, to determine future ATC systems security vulnerabilities. To determine the effectiveness of FAA’s management structure and implementation of policy for computer security, we reviewed FAA Order 1600.6C, Physical Security Management Program (dated April 1993), Order 1600.54B, FAA Automated Information Systems Security Handbook (dated February 1989), and Order 1600.66, Telecommunications and Information Systems Security Policy (dated July 1994), to determine what organizations are assigned responsibility for developing, implementing, and enforcing ATC computer security policyand interviewed officials from the Offices of Civil Aviation Security, Air Traffic Services, and Research and Acquisitions to determine what organizations are responsible for developing, implementing, and enforcing ATC computer security policy. In addition, we interviewed the Associate Administrators for Civil Aviation Security and for Research and Acquisitions and the Director of Airway Facilities under the Associate Administrator for Air Traffic Services to determine why ATC computer security policies have not been adequately implemented and enforced. We performed our work at FAA headquarters in Washington, D.C., from April 1997 through January 1998 in accordance with generally accepted government auditing standards. ATC systems used to control aircraft reside at, or are associated with, a variety of ATC facilities including towers, TRACONs, and en route centers. FAA policy, dated April 1993, required that these facilities be inspected by April 1995 and that annual or triennial follow-up inspections be conducted depending on the type of facility to determine the status of physical security at each facility. These inspections determine whether the facility meets the physical security standards established in FAA policy and are the basis for accrediting ATC facilities (i.e., concluding that they are secure). FAA is not effectively managing physical security at ATC facilities.