Our objectives were to determine (1) the overall status of Defense’s effort to identify and correct its date sensitive systems and (2) the appropriateness of Defense’s strategy and actions to correct these systems. In conducting our review, we used our Year 2000 Assessment Guide to assess Defense’s Year 2000 efforts. This guide addresses common issues affecting most federal agencies and presents a structured approach and a checklist to aid in planning, managing, and evaluating Year 2000 programs. The guidance, which is consistent with Defense’s Year 2000 Management Plan describes five phases—supported by program and project management activities—with each phase representing a major Year 2000 program activity or segment. The phases and a description of each follows. Awareness - Define the Year 2000 problem and gain executive-level support and sponsorship for a Year 2000 program. Establish a Year 2000 program team and develop an overall strategy. Ensure that everyone in the organization is fully aware of the issue. Assessment - Assess the Year 2000 impact on the enterprise. Identify core business areas and processes, inventory and analyze systems supporting the core business areas, and prioritize their conversion or replacement. Develop contingency plans to handle data exchange issues, lack of data, and bad data. Identify and secure the necessary resources. Renovation - Convert, replace, or eliminate selected platforms, applications, databases, and utilities. Modify interfaces. Validation - Test, verify, and validate converted or replaced platforms, applications, databases, and utilities. Test the performance, functionality, and integration of converted or replaced platforms, applications, databases, utilities, and interfaces in an environment that faithfully represents the operational environment. Implementation - Implement converted or replaced platforms, applications, databases, utilities, and interfaces. Implement data exchange contingency plans, if necessary. During our review, we concentrated on Defense’s department-level Year 2000 Program, managed by the Assistant Secretary of Defense, Command, Control, Communications and Intelligence (ASD C3I), who is also the Defense Chief Information Officer. To determine how Defense components and their organizations were implementing Defense policy and managing their Year 2000 program efforts, we also reviewed Year 2000 efforts being carried out by Army, Navy, and Air Force headquarters, three Defense agencies, and three central design activities. We also visited a number of other organizations including the Joint Chiefs of Staff, the Global Command Control System (GCCS) Program Office, and the National Security Agency. The scope and methodology of these individual reviews are detailed in the following GAO reports: Defense Computers: Air Force Needs to Strengthen Year 2000 Oversight (GAO/AIMD-98-35, January 16, 1998). Defense Computers: Technical Support Is Key to Naval Supply Year 2000 Success (GAO/AIMD-98-7R, October 21, 1997). Defense Computers: LSSC Needs to Confront Significant Year 2000 Issues (GAO/AIMD-97-149, September 26, 1997). Defense Computers: SSG Needs to Sustain Year 2000 Progress (GAO/AIMD-97-120R, August 19, 1997). Defense Computers: Issues Confronting DLA in Addressing Year 2000 Problems (GAO/AIMD-97-106, August 12, 1997). Defense Computers: DFAS Faces Challenges in Solving the Year 2000 Problem (GAO/AIMD-97-117, August 11, 1997). Reports on the Army and Navy Year 2000 programs are being developed. We also reviewed efforts by the department to improve the Defense Integration Support Tools database (DIST), which serves as the Defense inventory of automated information systems and is intended to be used as a tool to help Defense components in correcting Year 2000 date problems. The scope and methodology of this work is further detailed in our report, Defense Computers: Improvements to DOD Systems Inventory Needed for Year 2000 Effort (GAO/AIMD-97-112, August 13, 1997). In conducting the individual component reviews and assessing oversight efforts from Defense headquarters, we reviewed and analyzed official memoranda and other documents discussing Defense and component Year 2000 policy and procedures; the June 1996 and February 1997 Defense and component responses to Year 2000 questions from the House Government Operations Committee, Subcommittee on Oversight; the January 1997 Action Plan for Year 2000 Information Technology Compliance; Defense’s May 1997, August 1997, November 1997, and February 1998 component quarterly reports on Year 2000 program status to ASD C3I, and Defense’s subsequent department-level reports to the Office of Management and Budget; Year 2000 status briefings to the Deputy Secretary of Defense by the Military Services, the Joint Chiefs of Staff, DISA, DFAS, and DLA; early drafts and the final April 1997 versions of the Defense Year 2000 Management Plan; and Year 2000 inventory data compiled by ASD C3I, Defense components, and their subcomponents. We also reviewed and monitored Year 2000 Internet homepages maintained by various contractors, government agencies, ASD C3I, DISA, the Army, the Navy, the Air Force, the Marine Corps, and subcomponents; and minutes of federal, Defense, and Air Force Year 2000 Working Groups. In addition, we held discussions with various Defense Department, component and subcomponent officials concerning Year 2000 problems, corrective actions, and related operational and programmatic impacts of the program. We conducted structured interviews on program policies and practices with Defense Department and component-level Year 2000 program officials. We also reviewed the output of various Defense computer generated databases and management information systems related to Year 2000 activities, but did not verify the integrity of the data in these systems. Our audit work on this overview report was conducted from August 1997 through February 1998 in accordance with generally accepted government auditing standards. We requested written comments on a draft of this report from Defense. The Acting Principal Deputy of the Office of the Assistant Secretary of Defense for Command, Control, Communications and Intelligence provided written comments, which are discussed in the “Agency Comments and Our Evaluation” section and reprinted in appendix II. Most of Defense’s automated information systems and weapon systems computers are vulnerable to the Year 2000 problem, which is rooted in the way dates are recorded, computed, and transmitted in automated information systems. For the past several decades, systems have typically used two digits to represent the year, such as “97” representing 1997, in order to conserve electronic data storage and reduce operating costs. With this two-digit format, however, the year 2000 is indistinguishable from 1900, or 2001 from 1901, etc. As a result of this ambiguity, systems or application programs that use dates to perform calculations, comparisons, or sorting may generate incorrect results when working with years after 1999. For example, the Defense Logistics Agency’s Standard Automated Material Management System is used to manage Defense’s vast inventory of supplies. Because it uses dates to automatically target items for deletion, the system erroneously targeted more than 90,000 items for deletion before Defense discovered the problem in 1996. In addition, any electronic device that contains a microprocessor or is dependent on a timing sequence may be also vulnerable to Year 2000 problems. This includes computer hardware, telecommunications equipment, building and base security systems, street lights at military installations, elevators, and medical equipment. For example, Defense components reported to ASD C3I in February 1998 that more than half of the over 730,000 personal computers they had checked had a Year 2000 problem. For Defense, the Year 2000 effort is a significant management challenge because it relies heavily on computers to carry out aspects of all operations, and time for completing Year 2000 fixes is short. For example, the department is responsible for more than 1.5 million computers, 28,000 automated information systems, and 10,000 networks. Its information systems are linked by thousands of interfaces that exchange information within Defense and across organizational and international lines. Successful operation after January 1, 2000, requires that Defense’s systems and all of the systems that they interface with be Year 2000 compliant. Should Defense fail to successfully address the Year 2000 problem in time, its mission-critical operations could be severely degraded or disrupted. For example: In an August 1997 operational exercise, the Global Command Control System failed testing when the date was rolled over to the year 2000. GCCS is deployed at 700 sites worldwide and is used to generate a common operating picture of the battlefield for planning, executing, and managing military operations. The U.S. and its allies, many of whom also use GCCS, would be unable to orchestrate a Desert Storm-type engagement in the year 2000 if the problem is not corrected. The Global Positioning System (GPS) is widely used for aircraft and ship navigation (commercial and military) and for precision targeting and “smart” bombs. The ground control stations use dates to synchronize the signals from the satellites and maintain uplinks to the satellites. Failure to correct Year 2000 problems could cause these stations to lose track of satellites and send erroneous information to the millions of users who rely on GPS. The Defense Message System (DMS) is being developed to replace the aging Automated Digital Network (AUTODIN). These systems provide critical capabilities such as secure messaging for important operations such as intelligence gathering, diplomatic communications, and military command and control. Should Year 2000 problems render DMS or AUTODIN inoperable or unreliable, it would be difficult to monitor enemy operations or conduct military engagements. Aircraft and other military equipment could be grounded because the computer systems used to schedule maintenance and track supplies may not work. Defense could incur shortages of vital items needed to sustain military operations and readiness—such as food, fuel, medical supplies, clothing, and spare and repair parts to support its over 1,400 weapons systems. Billions of dollars in payments could be inaccurate because the computer systems used to manage thousands of defense contracts may not correctly process date-related information.