kport, to the Cl&man, Sutxomrnittc~ct . GAO on ‘I‘ctlecorn~unic;Itions and Finance, Conmittee on Energy and Commerce, House of’ Representatives .-.-- J II I y I !)!)O ENERGY MANAGEMENT DOE Controls Over Contractors’ Use of FTS Are Inadequate 142021 P i United States wGAO General Accounting Office Washington, D.C. 20548 Resources, Community, and Economic Development Division B-2366 11 July 17, 1990 The Honorable Edward J. Markey Chairman, Subcommittee on Telecommunications and Finance Committee on Energy and Commerce House of Representatives Dear Mr. Chairman: This report responds to your March 1, 1989, request that we examine the Department of Energy’s (DOE) controls over contractors’ use of the Federal Telecommunications System (FTS).Over 90 percent of the FTS lines at facilities in DOE’S operations offices are used by contractor employees, and these offices spent about $16 million on FTS long dis- tance calls in fiscal year 1989. You asked us to examine (1) the ade- quacy of DOE’S FTSpolicies and procedures, (2) the effectiveness of DOE’S management and oversight of FTSusage by contractors, and (3) the ade- quacy of DOE’S efforts to investigate allegations of misuse or abuse by contractors. DOE’sbasic policies on FI’Susage place the responsibility on supervisors Results in Brief for preventing misuse of FTSlines assigned to their units. However, DOE’S procedures for supervisors are not specific enough to ensure that con- tractors’ use of FTSis limited to official purposes. Furthermore, DOE, in most instances, does not provide supervisors with any information on FTScalls made by employees. According to DOE telecommunications officials, DOE cannot provide spe- cific information to supervisors about FTScalls or develop procedures to determine if FTScalls are for official purposes until it has established a Privacy Act (5 USC. 562a) system of records designed to prevent the misuse of information collected about individuals.1 Records of telephone calls used to control costs and to determine accountability are subject to the Privacy Act because such call-information must be linked to the indi- vidual responsible for the call to determine whether the call was made for official purposes. DOE proposed a system of records in 1987. On May ‘A system of records is any group of records under the control of an agency from which information is retrieved by a person’s name or by any number, symbol, or other identifier assigned to that indi- vidual. Such a system is designed to safeguard an individual’s privacy by preventing the misuse of federal records and by allowing individuals to review their records. Page 1 GAO/RCED-!WlM Energy Management B-286511 9,1990, DOE'S Office of General Counsel approved the system of records for public notice and comment in the Federal Register. DOE'S oversight is not adequate to determine whether FTS is misused by contractors. Although DOE'S procedures provide for periodic appraisals of the telecommunications programs at the operations offices by head- quarters staff, in the past these appraisals have not included an evalua- tion and review of the uses of FTS.Furthermore, reviews carried out by WE operations office officials have not assessed whether contractors’ use of FTSis restricted to official purposes. Finally, since DOE was gener- ally unable to provide examples of alleged or actual misuse of FTS,we could not evaluate the adequacy of DOE'S efforts to investigate possible contractors’ abuse. DOE owns an extensive network of facilities and laboratories, which are Background operated by firms and universities (operating contractors) under fully reimbursable, cost-type contracts (i.e., contractors receive full reim- bursement from DOE for all costs incurred). As permitted by the General Services Administration (GSA) rules, DOE has authorized these operating contractors to use ITS, the primary long-distance telephone service for the government, to carry out the government functions specified in their contracts. GSA is in the process of replacing the existing FTS with FT3 2000, which will provide video, enhanced data, and electronic mail ser- vices not now available under FTS. Although the services and informa- tion provided to DOE under FTS 2000 will be different, DOE'S responsibility for establishing policies and procedures to control its use will not change. DoE'S FTS long-distance cost in fiscal year 1989 was about $24 million. About $16 million (or 66 percent) was incurred by facilities at WE'S eight operations offices where most-or about 96 percent-of the FTS lines are assigned to contractor employees. While GSA provides overall direction and management of ITS and bills federal agencies for its use, individual federal agencies, such as DOE, are responsible for establishing administrative controls to ensure that the FTSis used for official purposes.” ‘According to GSA regulations (41 CFR 201-38.007), official purposes include emergency calls and personal calls that an agency determines are necessary in the interest of the government, for example, a call of a personal nature that could not have reasonably been made at another time. Page 2 GAO/RCED-90-184 Energy Management R-296611 The Privacy Act (5 USC. 562a) and the Freedom of Information Act (5 U.S.C. 652) are applicable to the treatment of information concerning telephone calls. The Privacy Act requires agencies to institute specific control procedures to protect government records about individuals from unauthorized access and unintentional disclosure. The Freedom of Information Act provides the basic authority and the procedures through which the public may obtain records in the government’s possession. In a previous report we recognized that an inherent conflict exists between the disclosure and protection of personal information that leads to a certain tension in the application of existing law to telephone records.” Specifically, a record may be subject to the Privacy Act and yet disclosed under the Freedom of Information Act. The report recom- mended that the Director, Office of Management and Budget (OMB), the agency with oversight responsibility for the Privacy Act, review the extent to which telephone records should be protected from disclosure and the circumstances under which they should be released. The report also recommended that the Director, with the assistance of GSA and the Department of Justice, explore various alternatives and, if appropriate, propose legislation or issue clarifying guidance for the treatment of tele- phone records. According to an OMB official, no action has been taken or is planned on the recommendations. DOE policies make supervisors (including the supervisors employed by DOE Lacks Effective its contractors) responsible for preventing misuse of the ~“rslines Controls Over assigned to their units. DOE has not developed procedures, however, to Contractors’ Use of guide the supervisors in carrying out this function or provided informa- tion about the calls made over their FTSlines that could be used to eval- FTS uate whether the calls were appropriate. DOE has continued to rely on supervisors to control FTSuse even though a 1985 DOE Office of the Inspector General (OIG) report found widespread abuse of m by DOE and contractor employees4 According to DOE telecommunications officials, DOE cannot develop more effective controls over FTSuse until it estab- lishes a Privacy Act system of records for its detailed information on FTS calls. “Telecommunications Privacy: GSA’s Planned FI’S 2000 Telephone Record Controls Appear Reason- -able (GAO/Mm896_ - ,Dec.23,1988). 4Review of Abuse of Long Distance Telephone Service (FTS) in the Department of Enera (DOE/IG- 0217, Mar. 22, 1986). Page 3 GAO/RCED-9@184 Energy Management E-226611 Since 1986 DOE has not examined controls over FTSuse and could not tell us whether there is abuse of FTS. DOE Policies and Two DOE orders assign responsibility to supervisors for ensuring that FE Procedures Do Not Provide calls are for official purposes. One order specifies the authorized use of government telephone services while the other is concerned with tele- Guidance for Controlling communication policies in general. the Use of FTS The order on the authorized use of telephone services states that DOE'S overall policy is that FTSis to be used to conduct official business, and that FI%represents resources and should be managed as any other resource. The order lists the types of calls DOE has authorized as official use of government-provided telephone services. For example, DOE employees traveling for more than 1 night on government business can use FTSto make brief calls home. The second order requires the heads of DOE units to provide efficient and effective management of telecommunications services and facilities and to ensure that contractors manage telecommunications services in accor- dance with DOE policies and procedures. It also specifies that DOE head- quarters telecommunications officials appraise field locations’ telecommunications programs every three years and prepare a report on the findings. The appraisals are to ensure that adequate internal con- trols are in place and to promote measures for the avoidance of waste, fraud, and abuse. Neither order specifies the procedures that supervisors should follow to carry out their responsibilities for ensuring that the m lines assigned to their units are not misused. Since in most offices the supervisors are not given any information about their units’ FTScalls, their only option is to observe the employees. Prior OIG Audit Revealed DOE'S OIG reported on the use of FE long distance service by DOE and Widespread Misuse of FTS contractor employees in 1986. At that time DOE was also relying on supervisors to control the use of FTK The OIG report concluded that (1) Due to the Lack of DOE about 30 percent of DOE’s FTSlong-distance calls nationwide were for Procedures unofficial purposes, (2) annually, $8 million was spent on unofficial FTS calls, and (3) a cost of about $6 million was incurred annually by DOE for w work time spent on unauthorized long-distance FI%calls. The OIG recom- mended that DOE consider, among other things, additional recording and Page 4 GAO/RCED-B@l&I Energy Management accounting procedures to (1) track FTScalls, (2) examine the manage- ment of FTSlines, and (3) develop methods to curtail abuse. DOEagreed to take corrective actions that included reemphasizing its policy on the use of FTSfor official business by sending memoranda to all employees and by distributing detailed information on FTScalls to the operations offices. However, DOE did not (1) implement any procedures to identify and analyze FTscalls for possible unofficial uses, (2) expand its policy that makes supervisors responsible for controlling the use of FTS,or (3) distribute call-detail reports to the operations offices about ~7%calls. DOE headquarters telecommunications officials pointed out that although the call-detail reports were not routinely sent to the operations offices, they informed the operations offices that they could get the reports if they requested them. DOE Needsa System of DOE telecommunications officials told us that they have not issued more Recordsto Implement specific guidance or information about how to control the use of FTS because they do not have a DOE-wide system of records for telephone More Effective FTS call data. The officials believe that they cannot use the telephone Controls records that contain information about FTScalls to determine individual accountability for unofficial telephone calls until they comply with the Privacy Act system-of-records provision. DOE’S Office of Computer Services and Telecommunications Management submitted a DOE-wide system-of-records proposal in July 1987 to DOE’S Office of General Counsel.” As part of DOE’S internal review process, the Office of General Counsel must review and approve the proposal before it can be published in the Federal Register for public comment. Publica- tion in the Federal Register is required to provide public notice of the type of information being accumulated about individuals and the ways such information will be used. In a May 9, 1990, memorandum to DOE’S Acting Associate Director for Administration, Information and Facilities Management, DOE’S General Counsel gave his approval for the system of records to be published in the Federal Register. He stated that he had no legal objections to the proposed telephone system of records and that DOE has a legitimate right to curb telephone abuse by employees. ‘In April 1990, the Office of Computer Services and Telecommunications Management was reorga- nized, and its functions are now handled by two newly created offices: the Office of Information Resources Management Policy, Plans, and Oversight, and the Office of Information Technology, Ser- vices, and Operations. Page 6 GAO/RCED-90-1&Q Energy Management According to DOE’SOffice of General Counsel officials, the reasons for the delay in the Office’s approval were concern over employees’ privacy and over the release of information about telephone usage under the Freedom of Information Act once the system of records is published. Because telephone records subject to the Privacy Act are not collectively protected from disclosure under the Freedom of Information Act, DOE could not refuse to release a record under the Freedom of Information Act unless it falls under one of the exemptions provided by the act. Examples of exempt records include those that would breach national defense or foreign policy, or whose disclosure would constitute a clearly unwarranted invasion of personal privacy. In the May 9,1990, memorandum, the General Counsel noted his con- cerns about protection of the privacy interests of individuals and sug- gested that the Acting Associate Director for Administration assure employees that their privacy will be protected to the greatest extent possible. He also emphasized keeping only an essential minimum of records as the most effective protection against incursions into personal privacy. DOEtelecommunications officials said that the system of records will be a tool to control use of telephone systems. They also said that as FTS 2000 is implemented, telephone call records will be provided directly to the field directors for administration who are responsible for the over- sight of telephone systems. However, they do not expect that DOEwill establish DOE-wide procedures on how telephone records should be used to control FTSuse. Instead, they said DOEwill probably leave it up to field offices to decide whether and how to use the records. DOE’s Oversight Activities As specified in the DOEtelecommunications order, DOEheadquarters offi- Do Not Address cials appraise field locations telecommunications programs every 3 years. None of the three WE headquarters appraisals of telecommunica- Appropriateness of FTS tions programs at its operations offices done between August 1986 and Use July 1989 analyzed the adequacy of controls over the contractors’ use of FTS.The appraisals generally concentrated on the adequacy of equip- ment acquisition and utilization and staffing. In addition, while telecom- munications services such as FTSare an element of the operations offices’ reviews of contractors, according to officials at six of the eight DOEoperations offices, no attempt is made to determine if FTScalls are restricted to official business. Page 6 GAO/RCED-90-184 Energy Management ? * ,,.I’ E236611 DOE headquarters telecommunications officials told us that the periodic appraisals do evaluate the controls over FTS use in that they examine cost control procedures that are in place, such as restricting or blocking long-distance access to horoscope and sports numbers. They admitted, however, that they do not examine the adequacy of field offices’ efforts to ensure that calls made using FIX were for official purposes. Furthermore, DOE telecommunications officials at seven of the eight operations offices told us that they did not have information on specific instances of ETSabuse and generally were not aware of any misuse of FIS. In addition, OIG officials in DOE headquarters could not identify any investigations that involved FIYJuse during the last 4 or 5 years. As they pointed out, the investigative staffs are small and concentrate on the bigger dollar programs, such as procurement. could devise a cost effective method for reviewing FTStelephone Cost Effective DOE calls and for following up on possible unofficial calls. Even though DOE Program Could Be has not established department-wide procedures for reviewing and ana- Developed to Improve lyzing FTStelephone records, contractors in two of DOE’S operations offices use telephone records to determine if FTScalls are made for offi- DOE Oversight of F’TS cial purposes. Officials in these two offices reported that these proce- dures seem to be effective in controlling FTSuse and in reducing FTS costs, Most DOE facilities have the technical capability to collect the data needed to institute similar programs. While it may be costly and burdensome to require contractors to verify all FTScalls, sampling procedures could be used to develop a cost-effec- tive verification process. Criteria for selecting calls for follow-up based on frequency or length of the calls, for example, could be used to elimi- nate the shorter, lower-cost calls that make up the bulk of FTSusage. Follow-up effort could then be limited to a small number of longer calls having a greater financial impact. For example, our analysis of GSA’S sample of 310,867 FTScalls made from DOE’s field offices in October 1988 showed that over 70 percent of these calls lasted less than 5 minutes, while less than 1 percent lasted 60 minutes or longer.(; Contractors who operate telephone systems at two DOE operations offices are already using FI’Srecords to control FTSuse even though DOE “The sampling error associated with these estimates is negligible due to the large sample size-over 310,000 calls. Page 7 GAO/RCED-90-184 Energy Management has not developed department-wide procedures for using them. The con- tractors who operate the telephone systems at facilities in the Chicago and Nevada Operations Offices develop and distribute reports on FTS long-distance usage for managers to review. This approach implements some of the procedures described in GSA’S FTSguidance in a May 1987 bulletin encouraging agencies to review and analyze detailed telephone records of actual calls and to follow up on questionable calls. According to telecommunications officials in the Nevada Operations Office, a telecommunications contractor prepares monthly lists of FTS calls made to non-ms numbers and of calls lasting more than 60 minutes. The lists are distributed to managers who are responsible for verifying the appropriateness of the calls on the list for their unit. Similarly, con- tractors at facilities reporting to the Chicago Operations Office provide managers with information on calls lasting more than 30 minutes and of telephone numbers called more than 20 times during the month. Man- agers are to identify questionable calls for follow-up. Officials at these two operations offices told us that FTScosts have decreased since the contractors started providing this information to the unit managers. For example, according to a telecommunications official in the Chicago Operations Office, the annual cost of FTSat one small facility decreased from $135,000 to $12,000 after the review process was initiated. Similarly, a telecommunications official in the Nevada Operations Office told us that ms costs for facilities in that office decreased by $400,000. The official also said that the amount of the decrease due to the review of FTS usage cannot be determined because of a switch from use of some FTSlines in the office to cheaper wide-area telecommunications service lines, known as WATS lines. DOE officials at these operations offices said that they allowed the con- tractors to implement these systems because’ the call-detail reports do not identify individuals; thus, they do not believe the reports are cov- ered by the Privacy Act. DOE headquarters’ telecommunications officials were unaware of this activity, which conflicts with their interpretation of Privacy Act requirements. They said that they were not sure what, if any, action would be taken and pointed out that while headquarters issues policies and guidance, it does not directly control how the opera- tions offices carry out those policies. Most DOE locations already have the technical capability to gather data on FTStelephone calls, which could be used in similar analyses. A few DOE facilities-the Richland Operations Office and seven facilities Page 8 GAO/RCED-96184 Energy Management reporting to other operations offices- will not be able to collect such data until their telephone equipment is upgraded. During our review, we noted that Richland was in the process of acquiring a new telephone system that will collect information about the telephone calls made. DOErelies on supervisors to control FTSuse by contractors but has Conclusions neither established procedures and guidelines for supervisors’ control of FIB nor provided information on ITS calls. Also, DOEevaluations have not focused on controls over F?Suse. Therefore, DOElacks assurance that FK~ is used for official business only and that unnecessary costs are not incurred. In our view, a program based on an analysis of a sample of FTStelephone calls for follow-up could improve DOEcontrols over FTSuse. That such a method can succeed has been demonstrated by the contractor-estab- lished programs in two of DOE’Soperations offices that have resulted in a decrease in the volume of FTScalls and a reduction in costs. DOEdeserves credit for taking an initial step toward establishing such a program by approving for comment in the Federal Register a system of records to comply with Privacy Act requirements. However, DOEhas no plans to establish procedures on how the information that will be avail- able under the system of records should be used to review and control FTSuse, nor is it clear how DOEwill monitor the procedures established by field locations. To ensure that contractors are using FTSonly for official purposes, we Recommendations recommend that the Secretary of Energy direct the Assistant Secretary for Management and Administration to establish an FTScall-control pro- gram which includes appropriate DOE-wide procedures and management controls, for both users and supervisory personnel, on the use of FIS as well as the finan- cial and disciplinary consequences of abuse and specific procedures for monitoring and reporting to management on the effectiveness of the FTScall-control program. Page 9 GAO/RCED9@1f34 Energy Management R-236511 In performing this review, we examined applicable laws and regulations, Scopeand DOE'S telecommunications policies and procedures, prior reports on FIX, Methodology and information on FB long-distance usage. We also discussed DOE'S poli- cies, procedures, and oversight with officials at DOE headquarters and eight operations offices, and obtained information on FTS operations from GSA and OMB officials. (See appendix I.) Our review was conducted between April 1989 and March 1990 in accor- dance with generally accepted government auditing standards. We dis- cussed this report with DOE headquarters officials. They generally agreed with the facts, and their comments and suggested changes have been incorporated where appropriate. However, as requested, we did not obtain official agency comments on this report. As arranged with your office, unless you publicly announce its contents earlier, we plan no further distribution of this report until 30 days from the date of this letter. At that time, we will provide copies to the Secre- tary of Energy and other interested parties and make copies available to others upon request. This work was performed under the direction of Victor S. Rezendes, Director, Energy Issues, (202) 275-1441. Other major contributors to this report are listed in appendix II. Sincerely vours, J. Dexter Peach Assistant Comptroller General Page 10 GAO/RCED-30-134 Energy Management Page 11 GAO/RCED-90-184 Energy Management ‘. 0 Contents Letter Appendix I Scopeand Methodology Appendix II 15 Major Contributors to This Report Abbreviations DOE Department of Energy ITS Federal Telecommunications System GAO General Accounting Office GSA General Services Administration OIG Office of Inspector General OMB Office of Management and Budget Page 12 GAO/RCED-90-184 Energy Management Page 13 GAO/RCED-90-184 Energy Management Appendix I Scopeand Methodology We reviewed pertinent laws, GSA regulations, GSA and OMB guidance, and DOE’S telecommunications policies and procedures on FE. We also examined past GAO and DOE Inspector General reports on FTSand a report for the President’s Council on Integrity and Efficiency that addressed FTSuse, control, and oversight at federal agencies.’ We discussed DOE’S policies, procedures, and oversight methods with officials of the Office of Computer Services and Telecommunications Management, Office of General Counsel, and Office of Inspector General at DOE headquarters in Washington, DC. We also reviewed appraisals of DOE operations offices’ telecommunications programs and data on the volume, frequency, length, and cost of DOE'S FTSlong-distance calls. At DOE’S Richland operations office in Richland, Washington, we reviewed FTSpolicies, procedures, and records of both the operations office and the major contractors. We discussed this information with operations office officials such as the Telecommunications Manager and head of the Telecommunications Branch. Because the telephone records for the Richland office did not show the telephone numbers from which the calls were made, as agreed with your office, we did not attempt to follow up on Fm calls to determine if they were made for official purposes. To determine if FTScontrols were different in other locations, we con- tacted telecommunications officials at DOE’S other seven operations offices-Albuquerque, Chicago, Idaho, Nevada, Oak Ridge, San Fran- cisco, and Savannah River-and obtained information on their FTSpoli- cies and procedures and oversight activities. We obtained information on GSA’S FTSbilling and allocation process from officials of its Information Resources Management Service in Wash- ington, DC., and Vienna, Virginia. We also discussed FTSoversight problems and the new FTS2000 system with them and obtained an explanation of privacy concerns related to telephone-call records from an OMB official in Washington, DC. ‘Consolidated Report on Federal Telecommunications System (FTS) Utilization, Office of Inspector General, General Services Administration, (Washington, D.C.; Mar. 16,1987). Page 14 GAO/RCED-90-184 Energy Management ’ Appendix II Major Contributor&o This Report Judy A. England-Joseph, Associate Director Resources, Richard A. Hale, Assistant Director Community, and Carrie M. Stevens, Evaluator-in-Charge Nicholas W. Greifer, Evaluator Economic Development Division, Washington, D.C. Leonard L. Dowd, Regional Assignment Manager Seattle Regional Office John w Sisson , SiteSenior (303603) Page 16 GAO/RCED-90-184 Energy Management l‘t~lq,trollt~ 202-275-63241 ‘I’lwrt~ is a 26% ciiscowit. on orders for 100 or nior~~ copies riiailwl to 21 singltb addrws. -.-
Energy Management: DOE Controls Over Contractors' Use of FTS Are Inadequate
Published by the Government Accountability Office on 1990-07-17.
Below is a raw (and likely hideous) rendition of the original report. (PDF)