United States General Accounting Office GAO Testimony Before the Special Committee on the Year 2000 Technology Problem, U.S. Senate For Release on Delivery Expected at YEAR 2000 COMPUTING CHALLENGE 9:30 a.m. Thursday, April 29, 1999 Status of Emergency and State and Local Law Enforcement Systems Is Still Unknown Statement of Jack L. Brock, Jr. Director, Governmentwide and Defense Information Systems Accounting and Information Management Division GAO/T-AIMD-99-163 Mr. Chairman and Members of the Committee: Thank you for inviting me to discuss the impact of the Year 2000 computing challenge on the nations emergency and state and local law enforcement systems and our review of the Department of Justices and the Presidents Council on Year 2000 Conversions efforts to facilitate remediation and contingency planning and to gauge the Year 2000 readiness of these two important sectors. Briefly, we found the following. Limited information is available about the Year 2000 status of 9-1-1 call answering sites throughout the nation, known as Public Safety Answering Points (PSAP). The Federal Emergency Management Agency (FEMA) in conjunction with the National Emergency Number 1 Association has surveyed 4,300 primary PSAPs on their Year 2000 readiness; however, as of April 1999, only 18 percent responded. Of those that did respond, only 16 percent reported that their systems were compliant. However, the majority of the rest of the respondents reported that they will be compliant by 2000. Little is known about the status of state and local law enforcement agencies. No assessment surveys have been conducted. Last week, the Chairman of the working group focusing on law enforcement for the Presidents Council on Year 2000 Conversion informed us that such an assessment would soon be initiated in cooperation with a follow-on FEMA assessment of emergency services. Outreach efforts by FEMA, the Federal Communications Commission (FCC), the National Emergency Number Association, and other organizations have been fairly extensive, ranging from the development of contingency planning guidance to the hosting of forums for the 9-1-1 community on meeting the Year 2000 challenge. Outreach efforts by Justice generally have been targeted at raising awareness and, with the exception of those at the Bureau of Prisons, largely ad hoc in nature. To prepare for this testimony, we reviewed the FCCs March 1999 report on Year 2000 readiness in the communications sector, transcripts of the FCCs emergency services forum held in November 1998, and the April 1999 1 This is a trade association seeking to foster the technological advancement, availability, and implementation of a common emergency telephone number system. Page 1 GAO/T-AIMD-99-163 2 Network Reliability and Interoperability Council (NRIC) report on Public Safety Answering Positions. We reviewed test documentation prepared by Bellcore and the Telco Year 2000 Forum to assess the scope of Year 2000 interoperability testing conducted on both the local public network in general, and on the continued ability of this network to successfully process 9-1-1 calls for emergency services. Further, we reviewed information published on the Internet by manufacturers of computer systems supporting 9-1-1 sites as well as by FCC, NRIC, FEMA, the Presidents Council on Year 2000 Conversion, the National Emergency Number Association, the International Association of Emergency Managers, the National Emergency Management Association, the National Association of Counties, the National Public Safety Telecommunications Council, the State of Minnesota, and the State of Texas. We also toured 9-1-1 sites located in Arlington County and Fairfax County, Virginia, and we interviewed members of the Telco Year 2000 Forum and staff at both FEMAs U.S. Fire Administration and the National Emergency Number Association. We also reviewed available outreach strategies and plans for the Department of Justice and its component bureaus and documentation on actual outreach activities that they have conducted. We discussed with department and bureau officials their respective approaches to managing outreach activities, including outreach goals. Additionally, we attended meetings of the Police/Law Enforcement/Criminal Justice working group, reviewed documents prepared by the working group, and conducted interviews with the Chairman of the group. We performed our work in March and April 1999 in accordance with generally accepted government auditing standards. Federal Efforts to For the most part, responsibility for ensuring continuity of service for 9-1-1 Assess Continuity of calls and law enforcement resides with thousands of state and local jurisdictions. Nevertheless, the success of these efforts is of great interest 9-1-1 and State/Local at the national level as these services are critical to the safety and well- Law Enforcement being of individuals across the country. Thus, the lack of status Services information has increased concern about which, if any, critical emergency communications and law enforcement systems may not be compliant in time. 2 NRIC is a federal advisory committee that provides guidance to FCC on promoting the reliability of the public switched network. Page 2 GAO/T-AIMD-99-163 The Presidents Council on Year 2000 Conversion was established in part to help provide leadership and work with state and local governments to address the Year 2000 computing challenge. Last April, we recommended that the Chairman of the Council develop a comprehensive picture of the nations Year 2000 readiness, which would include identifying and assessing the Year 2000 risks within the nations key economic sectors, including 3 those posed by the failure of critical infrastructure components. By gathering basic information on Year 2000 status and impact on public well- being, the Council would be better prepared to advise any necessary action to mitigate risks. In October 1998, the Council tasked each of its working groups to complete sector assessments. These assessments were to be based on an assessment guide developed with input from GAO and were to be conducted in conjunction with related umbrella groups and trade associations. The Councils Emergency Services working group, which is chaired by FEMA, was responsible for conducting the assessment of emergency services, including 9-1-1 services. Because of the reliance of 9-1-1 services on the public switched network, this particular assessment was also dependent on results of the assessment conducted by the Telecommunications working group, chaired by FCC. The Councils Police/Public Safety/Law Enforcement/Criminal Justice working group, chaired by the Department of Justice, was responsible for conducting the assessment of state and local law enforcement agencies. The first report summarizing the results of the Councils assessments was issued on January 7, 1999. The Councils second assessment report was 4 issued on April 21, 1999. After the first report was issued, we testified that while the study was a good step toward obtaining a picture of the nations Year 2000 readiness, the picture remained substantially incomplete because assessments were not available in many key areas, including 9-1-1 and fire services. Also, some surveys did not have a high response rate, calling into question whether they accurately portrayed the readiness of the sector. We stated that the Council needed to remain vigilant and closely monitor and update the information in the sectors where information is available and obtain information for those where it was not. 3 Year 2000 Computing Crisis: Potential for Widespread Disruption Calls for Strong Leadership and Partnerships (GAO/AIMD-98-85, April 30, 1998). 4 Year 2000 Computing Crisis: Readiness Improving, But Much Work Remains to Avoid Major Disruptions (GAO/T-AIMD-99-50, January 20, 1999). Page 3 GAO/T-AIMD-99-163 9-1-1 Services 9-1-1 is the standard telephone number most Americans dial to quickly Year 2000 Readiness obtain assistance from police, fire, or emergency medical service providers. When dialing 9-1-1, callers depend on the countrys telecommunications infrastructure, a high degree of automation, and emergency dispatchers to ensure that emergency personnel can be reached when needed. If Year 2000 issues are not adequately addressed, the response to an emergency could be degraded. Fortunately, a number of positive outreach efforts have been undertaken to assist local governments as well as telecommunications providers in preparing for the Year 2000. Unfortunately, with less than 9 months remaining before the millennium, the status of thousands of 9-1-1 answering sites is still largely unknown. 9-1-1 and the Year 2000 According to the FCC, about 90 percent of the population has access to Problem 9-1-1 service and uses it to place most of the nearly 110 million emergency calls made in the United States each year. The remainder of the population, without access to 9-1-1 service, dials an ordinary seven-digit telephone number to contact emergency service providers. The National Emergency Number Association estimates that there are approximately 4,400 primary PSAPs operating nationwide. These PSAPs, in turn, may have one or more associated secondary PSAPs. For example, the city of Falls Church, Virginia, operates a PSAP that is secondary to Arlington Countys primary PSAP. 9-1-1 calls originating in Falls Church would be delivered to the primary PSAP in Arlington County. Following initial processing, that call would be forwarded for dispatch to the secondary PSAP operated by Falls Church. The 9-1-1 system is a multistep process that can vary from one PSAP to the next. However, 9-1-1 calls are initiated over the public switched network and most calls are made using enhanced 9-1-1 service--that is, service that uses automation to provide dispatchers with the address and telephone number associated with the caller. The following figure depicts a typical 9-1-1 call. Page 4 GAO/T-AIMD-99-163 Figure 1: Enhanced 9-1-1 Calling Process E911 Tandem Switch at telephone office Public Safety Answering Points PSAP Common Equipment PBX Voice System Call Phone Phone Number Number Controller Display Telephone Company Call Taker Location Database Address Address Controller Display Source: Network Reliability and Interoperability Council. As the figure illustrates, the telecommunications component of the 9-1-1 system includes the public switched network, the local telephone office, and one or more PSAPs. A computer system at the local telephone office-- called the E911 tandem switch--automatically routes incoming calls to the proper PSAP. At the PSAP, the call is recorded and information, such as the caller's location and directions on how to get there, is retrieved from a Page 5 GAO/T-AIMD-99-163 database normally provided by a local telephone company called the automatic location identification (ALI) database. Other equipment common to PSAPs are telephones, answering equipment, and personal computers. The systems used by PSAPs and supporting telecommunications networks have processes such as day/time logging, call recording, computer aided dispatch, and records management systems that could be disabled by a Year 2000 failure. Should Year 2000 disruptions impair either these date- sensitive components of PSAP call-handling or other communications and database services provided by the public network, the following could occur. If the automatic number identification (ANI) database computers fail, 9-1-1 calls would not be selectively routed to a PSAP for processing, unless a default was established to route any call without ANI data to a specific PSAP. Depending on the service area, the loss of a 9-1-1 tandem switch could affect more than one million access lines. Also, if the automatic location identification database computers fail, the 9-1-1 attendant would get a voice path but not receive location data from the ALI database. The operator would then have to get location data from the 9-1-1 caller (which is routinely done with calls originating on wireless telephones) who may be confused or anxious. If the automatic call distributor fails, incoming calls would not automatically be delivered to available call takers. If a computer telephony integrated system (where the telephone has been totally replaced by computer) fails, the 9-1-1 attendant would lose all functionality and no calls would be received. Another Year 2000-related problem is potential congestion in the public switched network arising from individuals making 9-1-1 calls to simply test the system. According to the Network Reliability and Interoperability Council, an increase in 9-1-1 traffic could result in callers getting circuit busy signals, put on hold for long periods, or disconnected. Limited Information Is Successfully completing a 9-1-1 call next January 1--and taking full Available Concerning the advantage of all the features of enhanced 9-1-1 service--is dependent on two Status of Year 2000 major factors. First, the ability of the public switched telecommunications Readiness for 9-1-1 network to transmit the call and, second, the ability of the PSAP to process the call. Page 6 GAO/T-AIMD-99-163 With respect to the public switched network, the Telco Year 2000 Forum on Intra-Network Interoperability Testing, which is made up of local exchange carriers representing 90 percent of all access lines in the nation, recently conducted tests to determine whether the public switched network could carry calls in a Year 2000 environment. The tests were performed on 54 different configurations of central office equipment that included a majority of the network components used in North America. Only six Year 2000 problems were identified by the Telco Year 2000 Forum in over 1,900 test cases on these configurations, which involved 80 products from 20 different vendors. Assuming these tests were carried out effectively, their results provide some confidence that, if remediated, the public switched network should continue to function into the new millenium with no major service interruptions caused by Year 2000 dates. However, these tests did not focus specifically on 9-1-1 services and, as such, they did not test numerous back end systems that a PSAP might use, such as computer- aided dispatch systems, call logging systems, call recorders, and radios. PSAP operators are responsible for ensuring that these systems operate and interoperate properly after the date change. The status of the ability of PSAP efforts to ensure that they can effectively process 9-1-1 calls is less clear. The Network Reliability and Interoperability Council (NRIC) reports that major local telephone companies have taken action to ensure that PSAP systems they provide to their customers have been remediated. However, as of April 16, 1999, only 18 percent of 4,300 PSAPs had responded to a readiness survey conducted by FEMA and the National Emergency Number Association. Of the 766 sites that did respond, only 16 percent reported that they were ready for the Year 2000. Another 70 percent of those responding reported that they will be Year 2000 compliant in time for the millennium. Because of the low response rate, FEMA is planning to conduct telephone interviews with those sites that did not respond to the initial survey. NRIC developed its own assessment of PSAP Year 2000 readiness. NRIC estimated that at present, fewer than 10 percent of the nations PSAPs have completed upgrades of the 9-1-1 call processing equipment. However, according to NRIC, many upgrades have been scheduled and should be completed within the second and third quarters of this year. NRICs evaluation did not address the Year 2000 readiness of any of the other equipment employed within the PSAPs that support call processing or personnel dispatch. The proper functioning of that equipment is the responsibility of PSAP managers. Page 7 GAO/T-AIMD-99-163 Positive Outreach Efforts to To help ensure that emergency services will be accessible after the century Ensure 9-1-1 Year 2000 date change, many organizations are engaged in outreach activities to state Readiness Are Underway and local governments and even the telecommunications providers that support networks critical to 9-1-1 calls. For example: In December 1998, FEMA included an informational Year 2000 brochure with a survey that was sent to primary answering points. It also developed Year 2000 contingency and consequence management planning guidance that specifically identifies 9-1-1 systems as being at risk because of the Year 2000 problem. This guidance was made available to state and local government emergency managers through a series of Year 2000 workshops held throughout the country. The guidance was also presented in a multistate teleconference of state Year 2000 coordinators. The National Emergency Number Association is working to modify its technical standards, which cover a number of issues related to 9-1-1, to include Year 2000 compliance statements. The association is also advising its approximately 6,000 members to check their mission-critical computers and equipment for Year 2000 readiness. The National Association of Counties has been working with the National League of Cities, the International City/County Management Association, and Public Technology, Inc., to address the Year 2000 challenge and its potential to affect services provided by local governments. Together, these organizations have developed and distributed over 20,000 copies of a Year 2000 information kit and have sponsored a nationwide Year 2000 satellite broadcast for local government officials and employees. On November 16, FCC hosted a forum--attended by federal, state, and county government officials, telecommunications providers, and equipment manufacturers--on maintaining emergency response communications and potential Year 2000 issues. Topics discussed included potential Year 2000 threats to the system, strategies for averting those threats, and the need to convey the importance of the Year 2000 challenge to other emergency response organizations. The Association of Public-Safety Communications Officials International Inc., is planning to hold a Year 2000 symposium on May 20 and May 21 aimed at agency and company preparedness planning. Speakers will include officials from FCC, the Presidents Council on Year 2000 Conversion, and other federal government agencies, major utility companies, public safety communications center directors, volunteer associations, and communications manufacturers and consultants. Page 8 GAO/T-AIMD-99-163 State and Local Law Over 17,000 state and local law enforcement entities provide services to Enforcement Year 2000 protect the American public. These entities vary greatly in terms of specific services provided, geographic coverage, and use of computer and Readiness communication tools. Management information systems, computer-aided dispatch systems, and radio communications are typically used throughout the law enforcement community. All need to be thoroughly checked to determine their Year 2000 vulnerability and then fixed, if necessary. Little Is Known About Year The working group for Police/Public Safety/Law Enforcement/Criminal 2000 Status for State and Justice has not done an assessment of state and local law enforcement Local Law Enforcement agencies. Rather, its focus has been on increasing awareness through Entities speeches, participation in conferences, and other similar activities. In the Presidents Conversion Councils first report this past January, the working group reported: Based on informal assessment information, there is a high level of awareness of the problem among non-Federal police/law enforcement entities. State police/law enforcement entities and departments in larger metropolitan areas are making good progress. However, most departments at the county and municipality level lack the sophistication to assess the Y2K readiness of their service providers. These departments do not have their own, dedicated IT resources--money and professional staffing--and are instead dependent on the IT departments of the county, city, or municipality of which they are a part. Dedicated radio communications and dispatch systems are a concern for all police/law enforcement organizations and the working group is encouraging departments to focus on contingency planning in this area. 5 The working group made no report in the second national assessment summary issued earlier this month. Late last week, following our inquiries, the working group decided to develop an assessment of state/local law enforcement entities in conjunction with FEMAs efforts to develop more information on emergency services. The working group plans to conduct the survey by telephone to increase the response rate and to complete the survey by the time of the next sector summary report, which is expected in July. 5 The Presidents Council on Year 2000 Conversion: First Quarterly Summary of Assessment Information (January 7, 1999). Page 9 GAO/T-AIMD-99-163 Justice Outreach Efforts Are According to the Justice Chief Information Officer (CIO), the three Limited department components with primary responsibility for outreach to state and local agencies are the Federal Bureau of Investigation (FBI), Drug Enforcement Administration (DEA), and Bureau of Prisons (BOP). With the exception of BOP, neither the department nor its component bureaus have formal outreach programs with stated goals and defined strategies for actively reaching out to counterparts in state and local and international governments. In lieu of formal programs, the department and its bureaus are conducting largely ad hoc activities aimed at increasing Year 2000 awareness. Bureau of Prisons In January, we recommended that the Bureau of Prisons proactively identify organizations needing assistance and share their experiences and 6 lessons learned in remediating and preparing for Year 2000 problems. The bureau agreed and has established a proactive outreach program. For example: BOP established a formal outreach program with stated goals and defined strategies for reaching out to its counterparts in the state and local correctional community. BOPs plan called for this work to be conducted through professional associations, with the aim of delivering relevant information to corrections officials and providing direct assistance where needed. In addition, BOP plans to evaluate the effectiveness of its outreach activities, for example, by monitoring access to the BOP and National Institute of Corrections (NIC) Internet sites to assess the effectiveness of this mechanism in reaching its targeted audience. On March 1, 1999, BOP sent a letter to all members of NIC informing corrections officials about possible Year 2000 problems beyond those related to computer software and hardware. It mentioned such matters as embedded microchips in equipment like metal detectors, X-ray machines, and elevators, and encouraged officials to look into the compliance of such equipment. The letter informed recipients about the BOP and NIC Internet sites and provided the addresses to reach them. It also provided phone numbers to call if the recipients needed further assistance. BOP plans two more follow-up mailings throughout the year 6 Year 2000 Computing Crisis: Status of Bureau of Prisons Year 2000 Efforts (GAO/AIMD-99-23, January 27, 1999). Page 10 GAO/T-AIMD-99-163 that will provide updated information, as appropriate, to state and local correction officials. Also, BOP plans to make a limited number of follow-up phone calls to recipients of the letter. The calls will be used to assess the usefulness of the initial mailing and, depending on the findings, to modify future mailings to better meet needs of the state and local facilities. Second, the calls will determine whether state and local facilities need assistance in their remediation. BOP officials admit that they have limited ability to provide direct assistance, but they believe they can share lessons learned during the course of their own remediation work. Other Justice Outreach Efforts The following are descriptions of other outreach efforts being carried out by the Department of Justice. On December 11, 1998, the CIO chaired a Year 2000 outreach session with the Government Advisory Group for the Global Criminal Justice Information Network. Members of the Advisory Group include the American Correctional Association, the International Association of Chiefs of Police, the National Sheriffs Association, and the National Association of Attorney Generals, among others. The FBI made three presentations at the outreach session concerning the compliance of its key systems and forensic laboratories. On January 25, 1999, the Attorney General sent a letter to the presidents of seven law enforcement/criminal justice associations intended for publication in association newsletters. The letter discussed potential Year 2000 problems associated with law enforcement and the formation of the Presidents Council on Year 2000 Conversion. It also provided the address of the Councils Internet site and encouraged state and local law enforcement agencies to take a hard look at their buildings, computers, and other devices that could be susceptible to the Year 2000 problem. The FBI has engaged in a number of activities to educate state and local law enforcement officials about the status of the FBIs mission-critical systems. FBI officials have spoken at law enforcement conferences about their Year 2000 program primarily to discuss the status of key systems, such as the National Crime Information Center system, and to provide assurance that these systems will be unaffected by Year 2000 problems. The FBI has also recently published an article in several law 7 enforcement publications discussing the experiences the FBI had with 7 Law Enforcement News , September 30, 1998; Law Enforcement Technology , August 1998; and The Police Chief , March 1999. Page 11 GAO/T-AIMD-99-163 its system remediation and encouraging state and local law enforcement groups to institute their own Year 2000 programs. The FBI is also using the Criminal Justice Information System Advisory Board, run by state representatives, to communicate Year 2000 information to state and local users of FBI systems. The Office of Justice Programs is working to build awareness through two forums. First, in July 1998, it distributed a notice to all grant recipients that all new equipment purchased with grant money is required to be Year 2000 compliant. The notice provided an Internet address and a phone number where recipients could obtain Year 2000 information. Second, at regional financial management training seminars held throughout the country, the office has been working to build Year 2000 awareness by discussing some basic information about the problem. DEA has stated that the focus of its outreach efforts is making sure that its system interfaces with state and local and other counterparts are fully compliant. DEA is also working with state and local law enforcement in field offices where DEA shares facilities with local or state counterparts. In conclusion, Mr. Chairman, not enough is known about the status of either the 9-1-1 system or of state and local law enforcement activities to conclude about eithers ability during the transition to the Year 2000 to meet the public safety and well-being needs of local communities across the nation. The Emergency Services and Telecommunications working groups have been active in this area and plan to follow up on their initial surveys. The Police/Public Safety/Law Enforcement/Criminal Justice working group has further to go to develop a more defined assessment but is moving forward. However, more needs to be done than simply determining the status of these two critical sectors. More specifically, these sectors, under the leadership of the Council, should use the information made available through the working group assessments to identify specific risks and develop appropriate strategies and contingency plans to respond to those risks. Mr. Chairman, that concludes my statement. I would be happy to respond to any questions you or the Committee members have. (511153) Leter Page 12 GAO/T-AIMD-99-163 Ordering Information The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary, VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. Orders by mail: U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 or visit: Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touchtone phone. A recorded menu will provide information on how to obtain these lists. For information on how to access GAO reports on the INTERNET, send an e-mail message with info in the body to: email@example.com or visit GAOs World Wide Web Home Page at: http://www.gao.gov United States Bulk Mail General Accounting Office Postage & Fees Paid Washington, D.C. 20548-0001 GAO Permit No. GI00 Official Business Penalty for Private Use $300 Address Correction Requested
Year 2000 Computing Challenge: Status of Emergency and State and Local Law Enforcement Systems Is Still Unknown
Published by the Government Accountability Office on 1999-04-29.
Below is a raw (and likely hideous) rendition of the original report. (PDF)