oversight

Problems Persist in Justice's ADP Management and Organizations

Published by the Government Accountability Office on 1990-12-05.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

                      United States General Accounting     Office
                      Testimony
GAO


For Release           Problems  Persist    In Justice's
on Delivery           ADP Manaqement    and Organizations
Expected    at
9:30 a.m.     EDT
December    5, 1990




                      Statement     of
                      Milton    J. Socolar
                      Special     Assistant   to   the   Comptroller     General

                      Before     the Committee    on the     Judiciary
                      House    of Representatives




GAO/T-IMTEC-91-z                                                         GAO Form 160 (12/87)
Mr.     Chairman            and Members of                  the        Judiciary               Committee:

We are       pleased            to be here               today         to discuss               the       results          of our
recent       review,            undertaken               at your          request,             of     the      Department              of
Justice's           ADP (automated                   data        processing)                  management             and
operations.               You asked            if        Justice          has adequately                     responded               to our
previous           recommendations                   on ADP management                         and case management.
You also           asked        (1)    whether             the     Justice            information               resources
management            (IRM)       office            is     structured               in accordance                   with      the
Paperwork           Reduction            Act        of     1980;        (2)        whether          the      IRM office               has
sufficient           authority             and resources                      to    fulfill           its      responsibilities
under       both      the       Brooks       Act         and the          Paperwork              Reduction             Act;         and (3)
whether       Justice            has sufficient                    resources              to     properly            conduct           large-
scale     ADP and telecommunications                                    acquisitions.


Our review           disclosed             that          some longstanding                       problems            still          exist.
It    is difficult               to    understand                the      department's                  lack        of progress              in
responding           to our           1983 recommendation                           to develop               accurate           and
complete           information             on its           litigative                cases:          an effort              that
affects       only        the     department's                   case management                      systems.               However,
of    broader         concern          are     the         more fundamental                      problems            with
Justice's           overall           management              of    its        information                  resources           --
problems           that     can affect               all      of the           department's                  systems.
In this        regard,         Justice          has not                yet        implemented              our     1986

recommendation               to develop               an information                    resources                management
plan.         Organization             problems              also        weaken management                         of     information
resources.            Although           its         central            IRM office             is     structured                in
accordance           with      the     Paperwork               Reduction               Act     of     1980,         the        senior        IRM
official         does not          have clear                authority               to direct              the     component
agencies         to accomplish                 Justice-wide                       ADP goals          and     objectives.                     In
addition,         Justice          does        not      believe              it     has sufficient                  staff           with
adequate         technical           and managerial                      capabilities,                 at         both        the
department           and component                   levels,            to conduct             large-scale                 ADP
acquisitions             and required                 oversight.


These kinds           of     problems           raise          doubts              as to      Justice's             ability           to

effectively           manage its               information                   technology              resources,
especially           since      Justice              plans        to     spend over                 $2.7     billion            for
information           technology               and services                       in fiscal          years         1991        through
1995.         In this        regard,           two      of the           biggest           spenders              of this            money--
the     INS (Immigration                 and Naturalization                            Service),             and the            FBI
(Federal         Bureau       of     Investigation)                     --account             for     over         55 percent              of
this       amount,       and seem         to         have the            bigqest           problems.                For example,
our     recent       reports         on the           department's                   ADP security                  program'            and
INS'       information          management2                  showed that                the         department                risks

lJustice  Automation:  Tighter                               Computer               Security          Needed             (GAO/IMTEC-
90-69, Jul. 30, 1990).
21nformation Management:  Immigration                                              and Naturalization                      Service
Lacks Ready Access to Essential    Data                                            (GAO/IMTEC-90-75,                      Sept. 27,
1990).

                                                                    2
disclosing           sensitive              computer            data      because          of poor      security           while
INS risks          admitting               illegal         aliens         and granting           benefits           to
ineligible           aliens,          and has millions                      of dollars          in     uncollected               debts
because      of      unreliable                 ADP systems.               Also,      a recent          report          by the
department's               Office          of    the      Inspector            General3       pointed        out        that         the
FBI had "major                 internal            control            weaknesses"          involving         almost            all

aspects      of      its       ADP operations,                       including       findings        that     the        FBI's
IRM program            is      fragmented              and ineffective.


Mr.     Chairman,           I would             like      to    briefly          summarize       the     results           of our
work and have               our     full         report         placed         in the       record      of this
hearing.4


JUSTICE HAS NOT ADEQUATELY RESPONDED
TO PAST GAO RECOMMENDATIONS


Since      1979      we have          issued            a number          of     reports      addressing            Justice's
ADP management                 and operations.                        These      reports      made recommendations
to    improve        the       department's                ability          to provide          complete           and
reliable          litigative           caseload                information           and to develop                and
implement          an IRM plan.                    Justice            has not      fully      responded            to    these
recommendations.



3Audit Report:  The Federal                              Bureau of Investigation's                          Automatic                Data
Processing  General Controls,                               September, 1990.

41nformation           Resources:                      Problems Persist                 in Justice's   ADP
Management           and Operations                     (GAO/IMTEC-91-4,                  Nov. 6, 1990).

                                                                      3
Litigative       Caseload Information
Still     Unreliable    and Incomplete


After        a number of                false        starts      and over              a    decade           of effort,
Justice           still          does not           have a      system          that        can accurately                   provide
the      total        number of cases                   being      litigated                and the            total        number of
staff        in the             litigating           organizations                working              on them.5             Efforts
to develop                such a system               have been unsuccessful                             because            each
litigating                organization               was allowed               to develop               a separate             system
to satisfy                its      own management               needs and              because           data          submissions

from      the       litigating               organizations               that       fed      the        departmental                 system
were incomplete                     and unreliable.


Over      11      years          ago    we reported             that          the Conqress               and the            Office         of
Management                and Budget            (OMB) found              it     difficult               to     evaluate            Justice
requests            for         additional           resources           because            of     a    lack      of      information
on its           litigative             caseloads.6


In 1983 we reported                          that     the     case management                      system         with       its
incomplete                and inaccurate                information              did        not        meet the           needs       of
either           Justice           or the       Congress.7               At that            time        we     recommended             that

5Justice's                litigating       organizations       include     six divisions--
Antitrust,                Civil,     Civil    Rights,    Criminal,      Lands and Natural
Resources,                and Tax --and the Executive             Office     for U.S. Attorneys.
6Department                 of Justice              Making Efforts to Improve Litigative
Management                Information               Systems (GAO/GGD-79-80,  Sept. 4,                                       1979).


7Department  of Justice   Case Management Information  System Does Not
Meet Departmental    or Congressional Needs (GAO/GGD-83-50,  Mar. 25,                                                                           1983).

                                                                   4
the Attorney            General             develop         a rigorous                data-management                     program         to
achieve       uniform,            accurate,            complete                  case-management                 information.


Three       years      later,          in     1986,        we again               reported       that       despite             actions
to   improve         data       quality,           Justice               still      needed       to address
fundamental            data-integrity                  problems.8


At present,           although              Justice         has rectified                    some of        its         data
problems,           significant              problems              remain.           According            to      its     senior
IRM official,             no one within                    Justice               uses the       departmentwide                   case-
management           system        because            of    its         continuing             inaccuracy.                The main
problem       with      the      current          system            is      the     lack      of a uniform                case-
numbering           system       among the             litigating                  divisions        and U.S.              Attorney
offices       resulting            in multiple                counting              of cases        that          are     shared         or
transferred            among these               litigating                  organizations.                 It      is    not        clear
why the department                  would         find        it        extraordinarily                 difficult               to
correct       this      problem.


In August           1990 Justice               entered             into          an agreement           with        the        General
Services        Administration's                      Federal             Systems          Integration              and
Management           Center        to perform               a consolidated                     requirements               analysis,
and is      exploring            the        feasibility                 of a single             case-management
system.




8Justice        Department:                  Improved Management                           Processes  Would Enhance
Justice's        Operations                 (GAO/GGD-86-12, Mar.                           14, 1986).
                                                                    5
IRM Plan          Still            Lacking


In our       1986 report                       we also           recommended               that     the Attorney             General
develop      a plan                for         managing           the      department's                information
resources.             9     We reported                   that       Justice            needed        a plan      to assess
whether          its        component               ADP initiatives                      were supporting
departmentwide                     mission              goals       and objectives.                      In response,             Justice
developed              a strategic                  automated              information              systems        plan.
Although          the        plan             identifies            cross-cutting                  information            technology
issues,      the            plan         is     not      clear        on how Justice                   will     use information
resources              to    accomplish                  its      mission.               Justice        expects          to develop
an overall                 IRM plan             by July            1991.



SENIOR IRM OFFICIAL DOES
NOT HAVE CLEAR AUTHORITY


Under      the         Paperwork                Reduction            Act       of       1980,      federal        agencies         are
assigned          various                information                management              responsibilities,                 such as
implementing                 governmentwide                        and agency              policies,           principles,          and
standards.                  By departmental                       order,          the      information            management
requirements                 of the             act      have been assigned                        to the       Justice
Department's                 senior             IRM official,                  the       Assistant            Attorney       General
for    Administration.lO                                Department             requlations              also      give     this
official          broad            responsibilities                        that         include        IRM functions              such as

9GAO/GGD-86-12,                     Mar.          14,      1986.

loDepartment  of Justice     Order                                    2880.1,            "Information             Resources
Management Program,"     June 26,                                     1987.

                                                                           6
formulating              department                    policies,           standards,                  and procedures                for
information                systems.         11          Although           the         senior          IRM official                has these
broad        responsibilities,                           Justice's          departmental                      orders        and
regulations              do not         give            the       senior      official                 clear        authority            to
direct          component            organizations                    to    implement                 departmental                 IRM
decisions.               This        lack         of      clear       authority                may      have        impeded         the
senior          IRM official                from          fully       carrying                out      his     assigned
responsibilities.                       In our                judgement           clear             authority          is    important
because           of the        varying                degrees       of     independence                      of    Justice's
component            organizations.                          For example,                while          we are         not      certain
that       this      lack     of clear                  authority           prevented                 the      senior        IRM
official           from      developing                   and implementing                          a uniform          case        numbering
system,           we noted           that        the         manager        of this                 project         expressed            such
concern           and the        senior                official           recently             asked          the    Attorney            General
for      help      in gaining               the         cooperation               of     the         litigating             components              in
developing             such a         system.



JUSTICE BELIEVES ITS IRM RESOURCES
AND TECHNICAL AND MANAGEMENT
CAPABILITIES ARE LIMITED


Justice           believes           that         it      does not          have sufficient                         technical            and
managerial             capabilities                     to     administer               its         large      ADP budget
including            the     monitoring                   of      information                 technology             contracts,
conducting             large-scale                     ADP acquisitions,                       and providing                 the
necessary            management              oversight                of    its         information                 resources.                The

"28        C.F.R.            0.75.

                                                                       7
senior        IRM officials                 at both            Justice           and the      Immigration              and
Naturalization                  Service           have expressed                  this      concern.               And the
issue      has been raised                       in department                  reports.


The department's                      central        IRM office                 says that         limited          resources
have      prevented             it     from       fulfilling              its     oversight          responsibilities.
For example,               staff         shortages             have precluded                independent             oversight
and evaluation                  of IRM functions                    such as computer                   security
including              proper         training         of      staff.12             The result          has been the
proliferation               of many disturbing                          security           weaknesses             in the
department's               sensitive              computer          systems.


In summary,              Mr.         Chairman,         Justice            must take          decisive         action          to
solve      its         longstanding               information              management             problems.           This         need
is    made more urgent                    by department                   plans       to acquire            $2.7     billion         in
hardware,              software,          and computer                  services           in the      next        5 years.          Our
report        contains               recommendations                for         addressing         these      problems.              In
particular,              we recommend that                      the Attorney                General         (1)     require         that
the     department              develop          an IRM plan               and clean          up its         case-management
systems          to provide              uniform,           accurate,             and complete              information;             (2)
clarify          the     senior          IRM official's                   authority          in    implementing
departmental               IRM decisions;                   and (3)             augment,      where         needed,        central
IRM office              capabilities.




12GAO/IMTEC-90-69,                       July      30,      1990.
                                                                    8
Mr.   Chairman,    this     concludes   my prepared        statement.   I will   be
happy   to   respond      to any questions       at this    time.




                                             9