Government Procurement: Effect of Restriction on DHS's Purchasing of Foreign Textiles Is Limited

The U.S. textile industry sustained significant losses when textile production fell from $71 billion in 2006 to $46 billion in 2009, according to the U.S. Bureau of Economic Analysis. As a part of the American Recovery and Reinvestment Act of 2009, Congress passed the Kissell Amendment, which placed a restriction on DHS's procurement of certain textiles from foreign sources. DHS has applied this restriction to uniforms and body armor. The amendment was intended to increase opportunities for American textile and apparel manufacturers, according to the Senate Committee on Appropriations.

The Senate report that accompanied Senate Bill 1619, a bill related to the Consolidated Appropriations Act, 2016, includes a provision for GAO to review DHS's implementation of the Kissell Amendment and its effectiveness. This report addresses the extent to which (1) DHS has incorporated the Kissell Amendment into its procurement policies and procedures and (2) the Kissell Amendment affects DHS's procurement of textiles. To perform this work, GAO analyzed DHS policies and procedures, procurement obligations data, textile contract files, and vendor ordering data from DHS's current uniforms contract. GAO also interviewed DHS and U.S. Trade Representative officials and private sector representatives, including the vendor for the current DHS uniforms contract. GAO received technical comments from DHS, which GAO incorporated as appropriate.

The U.S. Department of Homeland Security (DHS) has updated its policies and procedures to incorporate a restriction on its procurement of certain textiles as specified in the “Kissell Amendment.” In August 2009, DHS amended its procurement policies to reflect the Kissell Amendment restriction and describe the limitations on DHS's procurement of specified textiles from sources outside the United States. All 11 contracts GAO reviewed for uniforms and body armor entered into by a DHS component since August 2009 included language regarding the Kissell Amendment restriction. In addition, according to officials, DHS has several procedures to ensure that contracting officers adhere to the requirements of the Kissell Amendment. These include a required acquisition review process; a requirement for all DHS components to use department-wide contracts; verification procedures; and training for contracting personnel on the Kissell Amendment restriction.

In practice, the Kissell Amendment restriction affects a limited number of procurements due to multiple factors and has not fully restricted DHS from purchasing textiles from foreign sources. The restriction applies only to certain textile purchases directly related to U.S. national security interests above the simplified acquisition threshold of $150,000, and must be applied consistent with U.S. obligations under international agreements. For most of DHS, this restriction limits only procurements that fall between $150,000 and $191,000, the World Trade Organization Government Procurement Agreement threshold. However, because procurements by the Transportation Security Administration (TSA) of textiles are excluded from most international agreements, the Kissell Amendment prevents TSA's purchasing of certain textiles above $150,000 from all but three foreign countries. In September 2014, DHS signed a uniforms contract, the largest procurement covered by the Kissell Amendment. Under this contract, DHS has ordered 58 percent of the $164.6 million in uniform items from foreign sources through June 2017 (see figure).

Historically, the U.S. textile and apparel industries have faced intense  foreign competition in the U.S. marketplace from countries with low labor  costs. According to the U.S. Bureau of Labor Statistics, the apparel,  textile, and leather manufacturing industries lost 228,000 jobs from 2005  to 2016, representing a 26 percent decrease in employment in those  fields. In particular, the U.S. textile industry sustained significant losses  during the recession of 2007 to 2009. According to the U.S. Department  of Commerce’s Bureau of Economic Analysis, textile production fell from  $71 billion in 2006, the year prior to the start of the U.S. recession, to $46  billion in 2009, a 35 percent decrease.

The American Recovery and Reinvestment Act of 2009 was enacted, in  part, to preserve and create jobs and promote economic recovery. As part  of this act, Congress passed the “Kissell Amendment,” which, according  to the Senate Committee on Appropriations, was intended to increase  opportunities for American textile and apparel manufacturers. The Kissell  Amendment generally restricts the Department of Homeland Security  (DHS) from using its funds to procure certain fibers, textiles, and clothing  that are not grown, reprocessed, reused, or produced in the United  States.

Various administrations and congressional bills have supported similar  efforts to increase opportunities for American manufacturers and  producers. The current administration has also placed an emphasis on  the procurement of domestically produced goods, products, and materials  by the federal government in an effort to stimulate growth and create jobs  in the United States. In April 2017, the President of the United States  issued the Presidential Executive Order on Buy American and Hire  American stating, in part, that it shall be a policy of the executive branch  to maximize the use of domestic goods.

A Senate Report accompanying Senate Bill 1619, a bill related to the  Consolidated Appropriations Act, 2016, includes a provision for us to  review DHS implementation of and compliance with the Kissell  Amendment, as well as the policy’s effectiveness. This report examines  the extent to which (1) DHS has incorporated the Kissell Amendment into  its procurement policies and procedures and (2) the Kissell Amendment  affects DHS’s procurement of textiles.

To address these objectives, we reviewed U.S. laws, regulations, and  international trade agreements, and interviewed officials from DHS and  the Office of the U.S. Trade Representative (USTR) to understand the  legal context for the Kissell Amendment. To determine the extent to which  DHS incorporated the Kissell Amendment into its procurement policies  and procedures, we reviewed relevant DHS documents and procurement  files and interviewed DHS officials. We also reviewed 11 uniforms and  body armor contracts that DHS components entered into after August  2009.

To determine the extent to which the Kissell Amendment affects DHS’s  procurement of textiles from U.S. and foreign sources, we reviewed  obligations data from the Federal Procurement Data System – Next  Generation (FPDS-NG), and analyzed uniform cost estimate data from  DHS and uniform ordering data from the vendor for the current DHS  uniforms contract. We tested the reliability of both FPDS-NG data and  DHS ordering data from the vendor and determined the data to be  sufficiently reliable for the purposes of this report. See appendix I for  more information on our scope and methodology.

We conducted this performance audit from January 2017 to November  2017 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.

The Kissell Amendment applies to contracts entered into by DHS as of  August 16, 2009, and, according to the Congressional Record, would  require DHS to purchase uniforms made in the United States. According  to the Congressional Record, the amendment was intended to extend  some of the provisions found in the Berry Amendment to DHS. The Berry  Amendment generally restricts the Department of Defense’s (DOD)  procurement of textiles, among other items, to those produced within the  United States. Pursuant to the Kissell Amendment, subject to  exceptions, funds appropriated, or otherwise available to DHS, may not  be used to procure certain textile items directly related to the national  security interests of the United States if the item is not grown,  reprocessed, reused, or produced in the United States. The Kissell  Amendment specifies categories and types of textiles including items  such as clothing, tents, tarpaulins, covers, and protective equipment, as  well as the fibers used for fabrics such as cotton and other natural and  synthetic fabrics. We refer to these textile items that are directly related  to the national security interests of the United States as “Kissell-covered  items.”

The Kissell Amendment also has multiple exceptions to the procurement  restriction, including:

Small Purchases Exception – procurements under the simplified  acquisition threshold (currently set at $150,000).

Availability Exception – satisfactory quality and sufficient quantity of  any Kissell-covered item cannot be procured when needed at U.S.  market prices.

Procurements Outside the United States – procurements by vessels  in foreign waters or emergency procurements outside the United  States.

De Minimis Exception – DHS may accept delivery of a Kissell-covered  item if it contains non-compliant (i.e., foreign) fibers as long as the  total value of those fibers does not exceed 10 percent of the total  purchase price of the item.

In addition to the exceptions noted above, the Kissell Amendment also  states that the Amendment shall be applied in a manner consistent with  U.S. obligations under international agreements. As a result, purchases  of Kissell-covered items, including uniforms and body armor, by DHS and  its components must be procured consistent with U.S. obligations under  relevant U.S. trade agreements. These agreements include the World  Trade Organization (WTO) Government Procurement Agreement (GPA)  and 14 bilateral or regional free trade agreements (FTAs) with 20  countries. These agreements generally require each party’s goods and  services to be given treatment comparable to what is given to domestic  goods and services in certain government procurements. The United  States implements these obligations through the Trade Agreements Act  of 1979 (TAA) and subpart 25.4 of the Federal Acquisition Regulation  (FAR). According to DHS and its components, officials apply the Kissell  Amendment by following the TAA as implemented in FAR subpart 25.4.  As a result, when an international trade agreement applies to a DHS  procurement of a Kissell-covered item, the Kissell Amendment does not  restrict DHS’s purchasing of textile items from that foreign source,  regardless of the item’s relationship to the national security interests of  the United States.

The Buy American Act (BAA) can also apply to DHS procurements. The  BAA restricts the U.S. government from purchasing nondomestic end  products, unless an exception applies. Examples of exceptions include:

Where the cost of the domestic end product would be unreasonable.

Where sufficient commercial quantities of domestic end products of a  satisfactory quality are not reasonably available.

In acquisitions covered by the WTO GPA or FTAs, USTR has waived the  Buy American statute and other discriminatory provisions for eligible  products. The BAA could apply to procurements of certain textile items  valued below the $150,000 simplified acquisition threshold, to which the  Kissell Amendment does not apply. The applicability of the act to a  particular procurement depends on a number of factors such as the  existence of a waiver or whether an exception applies.

DHS Obligations for Textile Procurements

DHS and its components procure textiles and fabrics for numerous  purposes, including clothing and equipping its officers and employees.  From October 2009 through June 2017, of DHS’s more than $105 billion  in obligations for procurements, $774 million, or less than one percent,  was for textile products, according to FPDS-NG. The majority of textiles  and fabrics procured by DHS components are for uniforms and body  armor. In particular, of the $774 million, DHS obligated $516 million (or 67  percent) to procure uniforms and body armor for DHS personnel (see fig.  1).

DHS Updated Policies and Procedures to Incorporate the Kissell Amendment Restriction

DHS Procurement Policies Contain the Kissell Amendment Restriction

In August 2009, DHS updated its procurement regulations, the HSAR, to  incorporate the Kissell Amendment restriction on the procurement of  textiles from foreign sources; since then DHS inserted language  incorporating the restriction into the 11 uniform and body armor contracts  we reviewed. The HSAR establishes standardized DHS policies for all  procurement activities within the department; according to DHS officials,  all DHS components are to follow these policies. Pursuant to the Kissell  Amendment, the restriction on the procurement of textiles became  effective for DHS on August 16, 2009. One day later, DHS published an  interim rule with a request for comments from the public that amended  relevant HSAR sections to reflect the statutory change limiting the  procurement of products containing textiles from sources outside the  United States (i.e., the Kissell Amendment). On June 9, 2010, after  receiving comments from the public, DHS adopted the amendments  issued under the interim rule as final and without change. The amended  sections detail the restriction on procurements of foreign textiles. They  also provide a list of the types of textile items included in the restriction  (i.e., yarn, wool, cotton), the exceptions noted in the Kissell Amendment,  and provide detail on the specific application of trade agreements. Under  the regulations, unless an exception applies, a specific clause shall be  inserted in solicitations and contract actions detailing the requirement to  use domestic goods for any procurement of a Kissell-covered item.

Some components within DHS issued additional, supplemental guidance  to the HSAR, while other components determined that additional  guidance would be duplicative, according to officials. For example,  Transportation Security Administration’s (TSA) Internal Guidance and  Procedure Memorandum, updated in June 2016, provides additional  guidance to contracting officers at TSA on the procurement of textiles.  This guidance specifically states that for certain textile products, TSA’s  contracting officers can only evaluate and/or accept offers from specified  countries. Other components determined that additional guidance was not  needed because the HSAR adequately covers the requirements of the  Kissell Amendment for their purposes. For example, U.S. Secret Service  officials stated that, for any procurement of textiles, they insert the  required language from the HSAR into the request for proposals in case  an item could be considered directly related to U.S. national security  interests and thereby subject to the Kissell Amendment restriction.

DHS officials stated that contracts for the procurement of uniforms and  body armor are their only contracts for textile-related products that are  directly related to national security interests. See figure 2 for examples of  DHS uniforms and body armor.

According to DHS officials, other textile or apparel procurements, such as  curtains for DHS offices, would likely not be subject to the foreign  procurement restriction under the Kissell Amendment because they are  not directly related to national security interests. DHS components can  also procure textiles through the Federal Supply Schedules (FSS)  program. When ordering from these contracts, DHS contracting officers  would make the determination of whether or not the purchase is directly  related to national security interests and therefore subject to the Kissell  Amendment restriction, according to DHS officials. DHS officials also  explained that if the purchase under the FSS program contract is subject  to the Kissell Amendment, the contracting officer would be responsible for  inserting the required language from the HSAR into the delivery order.

All 11 of the contracts we reviewed for uniforms and body armor entered  into by a DHS component since August 2009 included language  regarding the restriction of the Kissell Amendment. Many of DHS’s  components that buy uniforms, including TSA and U.S. Customs and  Border Protection (CBP), were already under contract with a vendor to  supply uniforms when the Kissell Amendment took effect in August 2009.  The Kissell Amendment specified that it applied to contracts entered into  by DHS 180 days after the enactment of the American Recovery and  Reinvestment Act of 2009. Therefore, DHS and its components did not  apply the Kissell restriction to contracts signed before August 16, 2009.  Several components separately signed contracts with uniform vendors  after prior contracts expired and the Kissell restriction was in effect. For  example, in February 2010, TSA signed a contract for uniforms with a  vendor that included language restricting the foreign procurement of  those uniforms per the Kissell Amendment.

In 2012, DHS decided to enter into a single, department-wide contract for  the procurement of uniforms for all of its components. While that  contract was being developed, several components signed additional  contracts for uniforms with vendors to ensure a continuous supply of  uniform items for their officers. This included a “bridge” contract between  TSA and a vendor in February 2013, which also included language  referencing the Kissell Amendment and language restricting the foreign  procurement of those uniforms. In September 2014, DHS entered into its  current 5-year, department-wide uniforms contract that provides eight  DHS components with uniform clothing items. One vendor holds this  uniforms contract.

DHS Has Procedures to Ensure That the Kissell Amendment Restriction Is Properly Applied

DHS employs multiple procedures, according to officials, in an effort to  ensure that the restriction on the procurement of foreign textiles from the  Kissell Amendment was and is properly applied, including (1) a  standardized procurement contract review process; (2) a requirement for  all DHS components to use established department-wide contracts; (3)  verification procedures to ensure the stated country of origin is correct;  and (4) trainings on foreign procurement restrictions.

First, the DHS official review process for all procurements helps ensure  that the Kissell restriction is applied, if appropriate, to contracts for textiles  and apparel, according to officials. Specifically, each procurement goes  through a standardized review process that includes several levels of  acquisition supervisors and DHS legal counsel, depending on the  estimated dollar amount of the procurement. The DHS Acquisition Manual  requires this review and approval process, which is designed to ensure  compliance with all relevant federal acquisition laws, regulations, policies,  and procedures. Through this process, officials evaluate the proposed  contract for a number of restrictions, such as the appropriate use of a  small business set-aside or a sole-source contract, which must also be  reviewed by supervisors and legal departments before contract approval.

According to DHS officials, while the applicability of the Kissell  Amendment is part of the standard review process, there is no separate  review for whether the foreign procurement restriction should be applied  to the procurement. Officials also stated that the small number of  contracting officers handling these textile procurements are aware of the  requirements.

Second, DHS now uses department-wide contracts for uniforms and body  armor rather than each component entering into its own contracts for  those items. Establishing and using these department-wide contracts  increases efficiencies and reduces duplication in the department’s  procurement processes, according to DHS documentation. According to  agency officials, the establishment of a department-wide uniforms  contract for use by all DHS components reduces opportunities for  mistakes, including the possibility of a contracting officer issuing a  contract that does not include the required restriction for a Kissell-covered  item.

Third, the department relies on the vendor to verify that the item is in  compliance with all applicable restrictions. It is not the responsibility of the  agency or department to verify the country of origin of an item procured  through a contract. According to the FAR, the contracting officer may rely  on the vendor’s certification of the country of origin for an end product  when evaluating a foreign offer. DHS officials told us that, for each  contract, the vendor is responsible for certifying the country of origin and  notifying DHS if a uniform item from a previously approved country is no  longer available and a replacement must be located. According to  representatives from the current uniforms vendor, both its manufacturing  facilities and its subcontractors have measures and internal controls in  place to ensure that all items under the current uniforms contract are  sourced from designated countries. Furthermore, if an item is being  misrepresented, or not from the reported country of origin, other vendors  in the industry could report such suspected violations to DHS and the  department would investigate possible false claims. According to DHS  officials, no reports have been made against the vendor for the current  uniforms contract.

In addition, CBP’s Textiles and Trade Agreements Division is responsible  for the Textile Production Verification Team Program. Under this program,  CBP deploys teams of personnel drawn from many DHS components to  FTA partner countries to visit manufacturers of textiles imported into the  United States. These teams review textile production and verify  compliance with the terms of the FTA. CBP provided information that  showed it had made numerous verification visits to factories used by  DHS’s uniform vendor since October 2011. However, CBP officials said  they did not know the degree to which the vendor’s imports from these  factories were used to fulfill the DHS uniform contract.

Fourth, DHS provided training in 2009 and in 2017 to contracting  personnel who conduct textile and apparel procurements subject to the  Kissell Amendment and other Buy American-like provisions to ensure that  the requirements are applied appropriately. The Kissell Amendment  required that the Secretary of DHS ensure that each member of DHS’s  acquisition workforce “who participates personally and substantially in the  acquisition of textiles on a regular basis receives training during fiscal  year 2009 on the requirements” of the Kissell Amendment and the  regulations implementing the amendment. The amendment further  states that any training program developed after August 2009 include  comprehensive information on the Kissell Amendment restriction.  According to officials, appropriate DHS contracting personnel were  trained on the requirements of the Kissell Amendment through a  presentation to DHS’s Acquisition Policy Board in July 2009. DHS  officials, however, were unable to identify the number of personnel  present during this meeting or the materials associated with this training.

According to DHS officials, no further training on Kissell requirements was  conducted until June and July 2017, when DHS officials conducted two  webinars that included approximately 570 DHS acquisition professionals  on the requirements of the Kissell Amendment and its implications under  the President’s Buy American and Hire American Executive Order from  April 2017. Our review on the implementation of the Kissell Amendment,  as well as the President’s new actions to increase opportunities for  government agencies to buy American and hire American, precipitated  the trainings, stated DHS officials. We observed the July 2017 training, at  the invitation of DHS, and confirmed that the materials and topics covered  included Kissell Amendment requirements.

The Kissell Amendment Restriction Has a Limited Effect on DHS Textile Procurements

In practice, the Kissell Amendment affects DHS textile purchases in a  limited manner due to multiple factors. For most DHS components, these  factors limit the effect of the Kissell Amendment restriction to certain  foreign textile procurements directly related to U.S. national security  interests that fall between $150,000 and $191,000. Specifically, from  October 2009 to June 2017, only 14 DHS-awarded textile contracts,  excluding TSA, fell within this range, according to FPDS-NG data. TSA  textile procurements, unlike most DHS components, are excluded from  the coverage of most U.S. international agreements. Therefore, the  Kissell Amendment restricts TSA’s procurement of certain foreign textiles  above $150,000 from all but three foreign countries. According to DHS  officials, the current contracts to which the Kissell Amendment applies are  department-wide contracts for uniforms and body armor. As of June 2017,  under the current uniforms contract, 58 percent of the value of ordered  uniform items by DHS came from foreign sources. In addition, DHS  officials stated that the current body armor contracts source all textile  items from the United States.

The Kissell Amendment Restriction Affects a Limited Number of DHS Textile Procurements Due to Multiple Factors

The number of DHS’s textile procurements that could be affected by the  Kissell Amendment restriction is limited by multiple factors. The Kissell  Amendment restriction applies only to those textile items that are directly  related to national security interests for procurements above the $150,000  simplified acquisition threshold, and must be applied in a manner  consistent with U.S. obligations under international agreements. In  practice, this limits the number of procurements that could be affected by  the amendment’s restriction to those of Kissell-covered items between the  current simplified acquisition threshold and the current WTO GPA  threshold of $191,000, a $41,000 range, for most DHS components.  Furthermore, statutory and regulatory provisions generally require that  government agencies acquire U.S.-made or designated country end  products and services for procurements covered by the WTO GPA. For  most of DHS, the procurement of certain textiles is covered by the WTO  GPA. Therefore, due to these regulations, most DHS components are  limited in their textile procurements at or above $191,000 to the United  States or designated countries, regardless of the Kissell Amendment.  However, the number of TSA contracts that could be affected by the  Kissell Amendment restriction is potentially greater since procurement of  textiles by TSA is not subject to statutory and regulatory provisions that  affect the rest of DHS’s procurement of textiles.

U.S. obligations under international agreements, as implemented by the  TAA and FAR, require that offers of eligible products receive equal  consideration with domestic offers. The FAR additionally specifies that  agencies, “in acquisitions covered by the WTO GPA, acquire only U.S.- made or designated country end products unless offers for such end  products are either not received or are insufficient to fulfill the  requirements.” To be a U.S. procurement covered by the WTO GPA,  the procurement must (1) be performed by a covered government entity;  (2) be for a covered item; and (3) be at or above the WTO GPA threshold,  which is currently $191,000. Other international trade agreements have  their own thresholds currently ranging from $25,000 to $191,000. Figure  3 outlines the various key procurement thresholds that may affect the  designated and non-designated countries from which DHS could source  textiles with respect to the Kissell Amendment. Most of these dollar  thresholds are subject to revision approximately every 2 years.

Due to the multiple factors that affect DHS’s textile procurements, most of  DHS’s components may source eligible textiles from up to 128 designated  countries outside the United States in procurements at or above $191,000  (see fig. 4). This is because most DHS components’ textile procurements  are considered covered items under the WTO GPA. Therefore, most DHS  components’ foreign textile procurements that either meet or exceed the  current $191,000 threshold are restricted to designated countries  regardless of the Kissell Amendment, due to the FAR. These  designated countries include WTO GPA countries, Free Trade Agreement  countries, least developed countries, and Caribbean Basin countries.

As noted above, multiple factors influence DHS’s procurement of textiles  and the number of contracts that could be affected by the Kissell  Amendment restriction. Based on our analysis of contract data from  FPDS-NG, from October 2009 to June 2017, DHS awarded 111 textile  contracts above the simplified acquisition threshold. Of the 111  contracts, only 14 DHS textile contracts, excluding TSA, were valued  between the simplified acquisition threshold and $191,000, the current  threshold for coverage under the WTO GPA. In part, because FPDS-NG  does not designate whether or not a contract is directly related to the  national security interests of the United States, we could not determine  whether these contracts were subject to the provisions of the Kissell  Amendment. According to DHS officials, the only current contracts  considered directly related to U.S. national security and therefore subject  to the Kissell Amendment are for uniforms and body armor.

The Kissell Amendment includes additional language regarding the use of  any availability exception and states that any availability exception issued  by DHS shall be publically posted on a government procurement internet  site within 7 days of the contract. However, according to agency  officials, since the passage of the Kissell Amendment, DHS has not  issued any waivers for availability exceptions and has therefore been  limited to procuring certain textile items from the United States and  designated countries identified in the FAR.

TSA Procurement Is Excluded from Coverage of Most U.S. International Trade Agreements

The Kissell Amendment restriction affects TSA textile procurements  differently than other DHS components. As implemented, the Kissell  Amendment restricts TSA’s procurement of certain textiles above  $150,000 to the United States, Canada, Mexico, and Chile. TSA’s  procurement of textiles is different because it is not included in the U.S.  coverage schedules of the WTO GPA and all U.S. free trade agreements,  with the exception of the North American Free Trade Agreement and the  U.S.-Chile Free Trade Agreement. According to USTR officials, some of  TSA’s security functions were originally held by the Federal Aviation  Administration (FAA), which is not subject to the FAR. Furthermore, TSA  was also not subject to the FAR prior to 2008, until Congress passed  legislation removing the requirement that TSA procurements be subject to  the acquisition management system established by the administrator of  the FAA. Those circumstances resulted in TSA’s exclusion from the  WTO GPA for textiles and most other international trade agreements,  according to USTR officials. Figure 5 illustrates when the Kissell  Amendment could affect TSA procurements and the applicability of  international trade agreements. Based on our analysis of FPDS-NG data,  from October 2009 to June 2017, TSA entered into 13 textile contracts  above the simplified acquisition threshold.

DHS Procured Over Half of the Value of Textile Items for the Current Uniforms Contract from Foreign Sources

From October 2014 to June 2017, 58 percent of the value of uniform  items ordered by DHS came from outside the United States. In  September 2014, DHS entered into its current department-wide uniforms  contract, the largest value textile contract since the passage of the Kissell  Amendment in 2009. In the request for proposals, DHS included a clause  detailing the Kissell restriction on the purchase of foreign items in the  uniforms contract documentation. As implemented, when combined with  the purchasing restriction in the TAA, the clause in the Kissell  Amendment that states the act shall be applied consistent with U.S.  obligations under international agreements allows the uniforms contract  vendor to source items from up to 128 designated countries. In the  request for proposal for the current uniforms contract, DHS components  included a list of over 900 uniform items including shirts, pants, shoes,  and insignias. The vendor that was awarded the contract then reported  the cost and expected country of origin for each item, which DHS  approved. Table 1 shows the estimated cost and quantity of items  estimated to be procured under the contract for components that primarily  have a national security function.

After the uniform contract was entered into by DHS in September 2014,  DHS components began ordering uniform items under the contract. In  addition to more than 900 types of uniform items that were agreed upon  at the initiation of the contract, DHS components issued contract  modifications to add or remove uniform items from the approved list.  Common types of items expected to be ordered included uniform shirts,  pants, socks, and shoes that met DHS component specifications.

From October 2014 to June 2017, $164.6 million in uniform items was  ordered by DHS components that primarily have a national security  function. Of that amount, 58 percent, or $96 million, in uniform items  ordered by DHS came from a reported 12 countries outside the United  States. The remaining 42 percent, or $69 million, in uniform items was  reported as originating in the United States. By value, Mexico, the largest  source of uniform items from outside of the United States, accounted for  30 percent of the ordered uniform items. In addition, 8 percent of the  value of uniform items was sourced from least developed countries,  including Cambodia (5 percent) and Bangladesh (2 percent). Figure 6  illustrates the percentage value of DHS procurement of uniform items by  reported country of origin for the current contract by components that  primarily have a national security function.

Based on our analysis of the vendor’s ordering data, the majority of the  value of uniform items ordered by all five components were sourced from  outside the United States. In addition, a larger value of the uniform  items ordered by three of the five components were sourced from Mexico  than from any other country, including the United States. Table 2 shows  the total value of the uniform ordering data for the five DHS components  that primarily have a national security function under the current uniforms  contract.

From October 2014 through June 2017, CBP ordered approximately  $101.1 million in uniform items under the contract, and TSA ordered  approximately $53.5 million. CBP and TSA accounted for the majority of  the dollar value of uniform orders from October 2014 through June 2017,  representing 94 percent of the value of uniform items ordered by DHS  components that primarily have a national security function under the  contract. Specifically, 32 percent of the value of TSA ordered uniform  items were from the United States, with the other 68 percent sourced  from Mexico. As mentioned above, the Kissell Amendment, as  implemented, restricts TSA’s foreign procurement of certain textiles  above $150,000 to Canada, Mexico, and Chile.

Sourcing Only from the United States Could Be More Costly for DHS

According to DHS officials and representatives of the current uniforms  vendor, both the price of the uniform items and the time it would take to  find appropriate U.S. sources could potentially increase if current  statutory and trade agreements requirements changed and DHS was  required to source all of its uniform items from the United States.  According to the FAR, it is the responsibility of agencies to obtain the best  value for the U.S. government. According to DHS officials, the best value  may be sourced from foreign countries, especially when the country is a  party to an international trade agreement with the United States. DHS  officials and representatives of the vendor stated that it would be possible  to source most of the items in the current uniforms contract from the  United States. However, representatives of the vendor speculated that  sourcing only from the United States could result in a 50 to 150 percent  price increase for items that are currently sourced from foreign countries.  Therefore, DHS costs could increase for over half of the uniform items  currently procured from foreign sources. Additionally, DHS officials stated  that the domestic availability of some items, such as footwear, is limited  and that it could take approximately 2 years to find U.S. suppliers for all  items currently procured from foreign sources.

DHS Reported Procuring All Body Armor from U.S. Sources

The second largest current textile contract is the department-wide  contract for body armor. Effective November 1, 2016, the department- wide contract for body armor is not to exceed $93.8 million. As of June  2017, DHS had obligated $6.8 million under these body armor  contracts. DHS did not provide GAO documentary evidence that the  body armor is produced in the United States. However, according to DHS  officials, textile items under the current body armor contracts are  produced in the United States. According to DHS officials, to verify that  materials are produced in the United States, DHS visited the site where  these materials are produced and assembled in the United States. In  addition, the contract contains specific language restricting the vendor  from procuring items that are not in compliance with the Kissell  Amendment.

We provided a draft of this report for review and comment to DHS and  USTR. DHS did not provide written comments on the draft report but  provided a number of technical comments that we incorporated as  appropriate. USTR did not provide written or technical comments to the  draft report.

We are sending copies of this report to the appropriate congressional  committees, to the Secretary of Homeland Security, the U.S. Trade  Representative, and other interested parties. In addition, the report is  available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-8612 or gianopoulosk@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix II.

Appendix I: Objectives, Scope, and Methodology

A Senate Report accompanying Senate Bill 1619, a bill related to the  Consolidated Appropriations Act, 2016, includes a provision for us to  review the Department of Homeland Security’s (DHS) implementation and  compliance with the Kissell Amendment, as well as the effectiveness of  the policy. This report examines the extent to which (1) DHS has  incorporated the Kissell Amendment into its procurement policies and  procedures and (2) the Kissell Amendment affects DHS’s procurement of  textiles.

To address these objectives, we reviewed relevant laws and policies,  such as Section 604 of the American Recovery and Reinvestment Act of  2009 (the “Kissell Amendment”), the Trade Agreements Act of 1979  (TAA) as amended, the Federal Acquisition Regulations (FAR),  Homeland Security Acquisition Regulations (HSAR), and the DHS  Acquisition Manual, as well as select U.S. free trade agreements. We  interviewed officials from DHS and the office of the U.S. Trade  Representative (USTR). We also interviewed officials from the U.S. textile  and apparel industry, including the National Council of Textile  Organizations and the American Apparel and Footwear Association.  Finally, we spoke with officials from the vendor for DHS’s current  department-wide uniforms contract, VF Imagewear.

To determine the extent to which DHS incorporated the Kissell  Amendment into its procurement policies and procedures, we reviewed  relevant DHS documents and policies, including the HSAR, interim and  final rules on the implementation of the Kissell Amendment, and  component-level procurement guidance. We also interviewed officials  from DHS’s Office of the Chief Procurement Officer and from the  components in DHS that have their own contracting authority, including  U.S. Customs and Border Protection (CBP), Federal Emergency  Management Agency (FEMA), U.S. Immigration and Customs  Enforcement (ICE), Transportation Security Administration (TSA), U.S.  Coast Guard, and U.S. Secret Service.

To analyze whether or not language indicating the restriction on the  procurement of foreign textiles from the Kissell Amendment was included  in DHS and component level contracts, we reviewed contract files for 11  available uniforms and body armor contracts entered into since August  16, 2009, the date the Kissell Amendment became effective. We  reviewed contract files from DHS uniform and body armor contracts  because these are the only DHS textile contracts that are directly related  to U.S. national security and therefore subject to the Kissell Amendment,  according to DHS officials. We identified these uniforms and body armor  contracts through reviews of Federal Procurement Data System–Next  Generation (FPDS-NG) data for DHS and components contracts in  groups 83 and 84 since August 16, 2009, and through discussions with  CBP, DHS, and TSA officials. We were not, however, able to review  every uniforms contract all DHS components have entered into since  August 16, 2009, because, for example, some of the contract files were  no longer available, consistent with federal document retention policies,  according to DHS officials. The results of our reviews of selected  contracts are not generalizable to all DHS textile contracts entered into  since August 16, 2009.

To determine the extent to which the Kissell Amendment affects DHS’s  procurement of textiles, we reviewed relevant government regulations  and laws, U.S. international agreements, DHS contract files, and ordering  data for the largest textile contract since the effective date of the Kissell  Amendment. We reviewed the FAR to evaluate which international  agreements are applicable to DHS textile procurements, the thresholds  for each international trade agreement, and the countries from which DHS  may procure certain textiles. We reviewed the U.S. central government  coverage schedule of the World Trade Organization (WTO) Government  Procurement Agreement (GPA) to determine which procurements by  DHS component are covered by the WTO GPA and therefore subject to  the purchasing restriction in the TAA, as implemented in the FAR.

To identify the dollar range for textile contracts that could be affected by  the Kissell Amendment, we reviewed the Kissell Amendment and the  relevant provisions of the FAR. We also interviewed USTR officials and  DHS officials from the Office of the Chief Procurement Officer, CBP, and  TSA to understand how international trade agreements affect DHS’s  textile procurement under the Kissell Amendment. We reviewed award  and obligation data from the FPDS-NG to identify the number of textile  contracts awarded by DHS components and delivery orders through the  General Services Administration’s Federal Supply Schedules program  above the simplified acquisition threshold and those that could be  affected by the Kissell Amendment. To assess the reliability of  procurement data from FPDS-NG, we reviewed relevant documentation  and performed verification through electronic testing. We determined the  data to be sufficiently reliable for the purposes of this report.

To evaluate DHS’s procurement of uniform items from the United States  versus foreign sources, we reviewed the ordering estimates, which were  provided as an attachment to DHS’s request for proposals for the current  uniforms contract, and ordering data provided by the vendor for the  current uniforms contract. The current uniform and body armor contracts  are the only two active contracts to which the Kissell Amendment applies,  according to DHS officials. For the purposes of ordering data and  estimates, we did not review previous contracts. In addition, since all  body armor items are sourced from the United States, we focused our  ordering analysis on the current uniforms contract. Because we did not  evaluate ordering data for previous DHS uniforms contracts, these values  cannot be extrapolated to all DHS uniforms contracts.

To calculate the ordering estimates for the current uniforms contract, we  analyzed data created by DHS and the uniform vendor during the  development phase of the contract. To focus on the DHS components  that primarily have a national security function under the current uniforms  contract, we analyzed ordering estimates to identify the number of  uniform items that DHS components reported as being directly related to  national security. Under the current uniforms contract estimates, CBP,  ICE, National Protection and Programs Directorate (NPPD), TSA, and  U.S. Secret Service are the five DHS components that reported the  majority of uniform items as being directly related to national security. As  a result, we included these five DHS components in our analysis of the  ordering estimates under the current uniforms contract. We did not  include FEMA or Federal Law Enforcement Training Center (FLETC) in  our analysis because FEMA did not list any uniform items as related to  national security and FLETC identified only one item out of 88 as related  to national security. We also did not include ordering estimates from the  Food and Drug Administration, which is a party to the contract but is not a  DHS component. In addition, the U.S. Coast Guard did not provide  ordering estimates since it was not included in the original proposal for  the current uniforms contract.

For each of the identified DHS components that reported the majority of  uniform items as directly related to national security, we analyzed the  estimated data based on description, the estimated quantity, the unit  price, and the country of origin. While we did not analyze the value of any  contract modifications that added or removed uniform items from the  contract, we did review select modifications and found that contract  modifications were generally consistent with the original contract  estimates for that non-generalizable sample. To obtain insights into the  countries of origin in the modifications, we reviewed a small, non- generalizable sample of 10 modifications. We concluded that the  breakdown between domestic and foreign sourced items for the items  added through the modifications was generally consistent with the  breakdown between domestic and foreign sourced items in the original  contracts’ estimates.

To determine the reasonableness of the processes by which DHS and its  vendors generated these estimates, we interviewed knowledgeable  officials, reviewed documents submitted by the vendor, and performed  data reliability testing. DHS officials told us that they had provided the  contractor with detailed lists of the textile items it required, and the vendor  reported that they determined the prices and countries of origin based on  prevailing market conditions. DHS officials then reviewed the estimates  provided by the vendor and approved the items, price, and country of  origin under the contract. DHS officials and the vendor informed us that  because these estimates reflected market conditions when the contract  was signed, actual purchases of items might be from countries other than  those listed in the contract, depending on changes in those conditions  and availability of the items. We determined these estimates were  sufficiently reliable to represent DHS’s intended purchases of textile  products by country of origin under this contract.

To analyze the orders of uniform items, we relied on ordering data  provided by the vendor for the current uniform contract. We reviewed  uniform ordering data for the five DHS components that reported the  majority of uniform items as being directly related to national security:  CBP, ICE, NPPD, TSA, and the U.S. Secret Service. The uniform  ordering data included items ordered by individual DHS employees  through an allowance system and by DHS components through bulk  orders. We did not include the U.S. Coast Guard in our analysis since it  primarily orders U.S.-made uniform items through the Department of  Defense’s Defense Logistics Agency, according to Coast Guard officials.  We analyzed the value of uniform items procured from the United States  and foreign sources based on the reported country of origin and  component from October 2014 to June 2017.

To assess the reliability of the ordering data provided by the vendor, we  reviewed the data for inconsistencies. We clarified with the vendor the  relevant data sets for our analysis and any discrepancies we identified in  the data. DHS relies on the vendor to provide the countries of origin, and  it was beyond the scope of this engagement for us to verify the vendor  provided country of origin. We determined that the ordering data were  sufficiently reliable for the purposes of comparing orders to estimates by  countries of origin for uniforms under the contract, and presenting details  about purchases from the United States versus other countries of origin.  The result of our analysis is limited to the current department-wide  uniforms contract with DHS and cannot be extrapolated to other DHS  textile contracts.

For the body armor contracts, we relied on FPDS-NG data for the  obligations under the current and previous contracts. We also interviewed  DHS officials who identified the country of origin of the items purchased  under the current body armor contracts; it was beyond the scope of this  engagement to verify the agency-provided country of origin. To assess  the reliability of the obligations data from FPDS-NG, we reviewed relevant  documentation performed verification through electronic testing. We  determined the data to be sufficiently reliable for the purposes of this  report.

Appendix II: GAO Contact and Staff Acknowledgments

In addition to the individual mentioned above, Adam Cowles (Assistant  Director), Christopher J. Mulkins (Analyst-in-Charge), Martin Wilson, Lynn  Cothern, Martin de Alteriis, Neil Doherty, Grace Lui, and Julia Kennon  made key contributions to this report.

Passed in 2009, the Kissell Amendment restricts the Department of Homeland Security to procuring uniforms and other textiles from U.S. manufacturers, with certain exceptions. DHS has incorporated the restriction into its procurement policies and practices.

But we found, due in part to the exceptions, that the restriction has limited effect. For example, procurements must be made in accordance with U.S. trade agreements, which means most DHS offices must treat certain textiles made in 128 countries the same as domestic products. As a result, 58 percent of funds spent to order uniforms under the current DHS contract are for imported items.


Identity Theft: Strengthening Taxpayer Authentication Efforts Could Help Protect IRS Against Fraudsters

This testimony summarizes the information contained in GAO's June 2018 report, entitled Identity Theft: IRS Needs to Strengthen Taxpayer Authentication Efforts ( GAO-18-418 ).

The Internal Revenue Service (IRS) has identified over 100 interactions requiring taxpayer authentication based on potential risks to IRS and individuals. IRS authenticates millions of taxpayers each year via telephone, online, in person, and correspondence to ensure that it is interacting with legitimate taxpayers. IRS's estimated costs to authenticate taxpayers vary by channel.

IRS has made progress on monitoring and improving authentication, including developing an authentication strategy with high-level strategic efforts. However, it has not prioritized the initiatives supporting its strategy nor identified the resources required to complete them, consistent with program management leading practices. Doing so would help IRS clarify relationships between its authentication efforts and articulate resource needs relative to expected benefits. Further, while IRS regularly assesses risks to and monitors its online authentication applications, it has not established equally rigorous internal controls for its telephone, in-person, and correspondence channels, including mechanisms to collect reliable, useful data to monitor authentication outcomes. As a result, IRS may not identify current or emerging threats to the tax system.

IRS can further strengthen authentication to stay ahead of fraudsters. While IRS has taken preliminary steps to implement National Institute of Standards and Technology's (NIST) new guidance for secure digital authentication, it does not have clear plans and timelines to fully implement it by June 2018, as required by the Office of Management and Budget. As a result, IRS may not be positioned to address its most vulnerable authentication areas in a timely manner. Further, IRS lacks a comprehensive process to evaluate potential new authentication technologies. Industry representatives, financial institutions, and government officials told GAO that the best authentication approach relies on multiple strategies and sources of information, while giving taxpayers options for actively protecting their identity. Evaluating alternatives for taxpayer authentication will help IRS avoid missing opportunities for improving authentication.

I am pleased to be here today to discuss the Internal Revenue Service’s  (IRS) efforts to monitor and improve taxpayer authentication. In fiscal year  2017, IRS issued approximately $383 billion in individual tax refunds,  including overpayment refunds and refundable tax credits, an increase of  about $16 billion from the previous fiscal year. In an environment with an  increasing risk of fraud, identity theft (IDT), and cyberattacks, IRS must  ensure that its preventative security controls provide the agency with  reasonable assurance that it is interacting with the legitimate taxpayer.  Authentication—the process by which IRS verifies taxpayers are who they  claim to be—is a critical step in both protecting sensitive taxpayer  information and preventing potentially billions of dollars of refunds from  being paid to fraudsters each year. According to IRS’s most recent data, it  estimates that in 2016, at least $12.2 billion in IDT tax refund fraud was  attempted; of this amount, at least $1.6 billion was paid out to fraudsters.

IRS’s ability to continuously monitor its current authentication methods  while also looking ahead to new identity verification technologies is critical  to keeping ahead of fraudsters, who constantly adapt their schemes to  thwart IRS’s defenses. The agency must also strike a balance in  designing its authentication programs. Authentication must be strong  enough to prevent fraudsters from gaining access to IRS services using  stolen personally identifiable information, without being overly  burdensome on legitimate taxpayers who also must authenticate.

My remarks today highlight selected findings of our June 2018 report on  IRS’s efforts monitor and improve taxpayer authentication. Specifically,  this testimony addresses (1) IRS’s efforts to address its authentication  challenges, (2) IRS’s progress in implementing its authentication strategy,  and (3) additional steps we identified that IRS could take to enhance its  authentication programs and stay ahead of fraudsters.

To conduct the work for our June report, we reviewed IRS documents and  information related to taxpayer authentication including authentication  policies, risk assessments, and performance metrics. We compared IRS’s  authentication efforts to applicable activities in the IRS Identity Assurance  Strategy and Roadmap (Roadmap), Standards for Internal Control in the  Federal Government, and relevant National Institute of Standards and  Technology (NIST) guidance, among others. We also interviewed IRS  officials knowledgeable about the agency’s taxpayer authentication  programs, as well as IRS, state, and industry co-leads from two Security  Summit workgroups to understand IRS’s collaborative efforts to improve  taxpayer authentication. To assess how IRS can improve its  authentication programs going forward, we met with knowledgeable  officials from NIST to discuss its guidelines for online identity-proofing and  authentication. We also compared IRS’s authentication programs and  plans for future improvements to its Roadmap, federal internal controls,  guidance from NIST and the Office of Management and Budget (OMB),  principles for project planning, and our prior work on information  technology investment management and cost estimating. We also  interviewed officials from three other federal agencies and a  nongeneralizable selection of representatives from state revenue offices,  industry, and financial institutions to understand the range of  authentication technologies other organizations are using. Our report  includes a detailed explanation of the methods used to conduct our work.  The work on which this testimony is based was performed in accordance  with generally accepted government auditing standards.

In brief, Madam Chairman, our work found that IRS has taken some steps  to improve taxpayer authentication, including working with external  partners to identify solutions for combating IDT refund fraud and  developing an authentication strategy to address its most pressing  authentication challenges. However, we also found that IRS has not  prioritized the initiatives supporting its authentication strategy nor  identified the resources required to complete them. Further, we found that  IRS does not have clear plans and timelines to fully implement NIST’s  new guidance for secure online authentication and also lacks a  comprehensive process to evaluate potential new authentication  technologies, which could provide taxpayers additional options to actively  protect their identity. We made 11 recommendations to address these  and other weaknesses identified in our report. IRS agreed with all 11  recommendations and stated that it is taking action to address them.

IRS Has Broad Efforts Underway to Address Authentication Challenges

Our report noted that IRS has established organizational structures  essential to supporting its taxpayer authentication efforts. Specifically,  IRS created an Identity Assurance Office (IAO) in 2015 to work with  stakeholders across IRS to review and assess the agency’s various  authentication programs and efforts. In 2016, IAO led an effort that  identified over 100 interactions between IRS and taxpayers that require  authentication and categorized these interactions based on potential risks  to the agency and taxpayers. Further, in December 2016, IAO released  its Roadmap for developing a modern and secure authentication  environment for all taxpayers regardless of how they interact with IRS— online, over the telephone, in person, or via correspondence.

We also found that IRS is working to address its authentication  challenges by collaborating with industry members and state partners via  the Security Summit. The Security Summit was established in 2015 as an  ongoing effort between industry experts from tax software companies,  paid preparers, financial institutions, and states to improve information  sharing and fraud detection and to address common IDT challenges. The  Security Summit’s authentication workgroup leads several initiatives  aimed at verifying the authenticity of the taxpayer and the tax return at the  time of filing. One initiative involves analyzing data elements—such as  trusted customer requirements and other characteristics of the return— that are collected during the tax return preparation and electronic filing  process. In addition, in 2016 the authentication workgroup recommended  improved account password standards to help protect taxpayers’  accounts from being taken over by criminals.

Overall, we found that officials—representing IRS, industry, and states— expressed positive views about the level of commitment and cooperation  guiding the group’s authentication efforts. Officials with whom we spoke  stated that they are dedicated to continuing to address authentication  issues collaboratively because they have a mutual interest in improving  authentication to reduce tax refund fraud.

IRS Has Begun to Implement Its Authentication Strategy, but Has Not Articulated Priorities and Resource Needs

In its Roadmap, IRS outlined six core authentication objectives, 10 high- level strategic efforts, and 14 foundational initiatives to help it address  authentication challenges and identify opportunities for future investment.  While we found that IRS has made progress on some efforts identified in  its Roadmap, it has not prioritized the initiatives supporting its strategy nor  identified the resources required to complete them, consistent with  program management leading practices.

For example, one of IRS’s foundational initiatives is to send event-driven  notifications to taxpayers, such as when they file a return or request a tax  transcript. Such notifications could help IRS and taxpayers detect  potentially fraudulent activity at the earliest stage and help improve  authentication of tax returns. The Roadmap identifies seven supporting  activities for this foundational initiative. One is to provide taxpayers with  greater control over their online accounts. Another supporting activity is to  determine methods for sending notifications to taxpayers about activity on  their account.

However, IRS has not identified the resources required to complete these  activities, and the Roadmap notes that six of the seven activities will take  between 6 months to 3 years to complete. In December 2017, IRS  officials stated that they had developed business requirements for the  foundational initiative to give taxpayers greater control over their online  accounts. However, IRS has not identified funding for the initiative’s other  supporting activities—such as developing requirements to send push  notifications to taxpayers—and implementation will depend on the  availability of future resources.

In December 2017, IRS officials stated that each of the strategic efforts  and foundational initiatives identified in the Roadmap are a high priority,  and they are working to address them concurrently while balancing the  availability of resources against the greatest threats to the tax  environment. As noted in our report, we recognize that a strategy is  necessarily high-level and that IRS must remain flexible and use available resources to respond to unexpected threats. Identifying resources and  prioritizing activities in its Roadmap will help IRS clarify tradeoffs between  costs, benefits, and risks and aid in decision making.

Further, such efforts may also help IRS establish clearer timelines and  better respond to unexpected events. As such, we recommended that  IRS estimate the resources (i.e., financial and human) required for the  foundational initiatives and supporting activities identified in its Roadmap  and prioritize its foundational initiatives. IRS agreed with our  recommendations and is currently working to finalize its overall  authentication approach.

Additional Actions Could Help IRS Enhance Security and Stay Ahead of Fraudsters

Given the widespread availability of personally identifiable information  that fraudsters can use to perpetrate tax fraud, it is essential for IRS to  further strengthen taxpayer authentication to stay ahead of fraudsters’  schemes. In our report, we identified two additional areas that IRS must  address to better position the agency and protect taxpayers against future  threats.

First, we found that IRS has taken preliminary steps to implement NIST’s  June 2017 guidance for secure online authentication, however it had not  yet established detailed plans, including timelines, milestone dates, and  resource needs to fully implement it. Among other things, NIST’s new  guidance directs agencies to assess the risk for each component of  identity assurance—identity proofing, authentication, and federation— rather than conducting a single risk assessment for the entire process.  According to NIST officials, this approach gives agencies flexibility in  choosing technical solutions; aligns with existing, standards-based market  offerings; is modular and cost-effective; and enhances individual privacy.  In short, following NIST’s new guidance will help provide IRS with better  risk-based assurance that the person trying to access IRS’s online  services is who they claim to be.

As noted in our report, IRS has taken preliminary steps to implement the  new NIST guidance. These efforts include forming a task force to guide  IRS’s implementation of NIST guidance and working with the Security  Summit to develop an implementation framework for state and industry  partners. IRS has also begun analyzing gaps between IRS’s current  authentication procedures and the new guidance. In addition, in  December 2017, IRS implemented a more secure online authentication  option consistent with the new guidance through its mobile application,  IRS2Go. After taxpayers link their IRS online account with the mobile app,  they can use it to generate a security code to log into their account. This  option provides taxpayers with an alternative to receiving the security  code via a text message, which NIST considers to be less secure.

We recommended that IRS develop a plan—including a timeline,  milestone dates, and resources needed—for implementing changes to its  online authentication programs consistent with new NIST guidance, and  also implement these improvements. IRS agreed with our  recommendations, but noted that its ability to complete these efforts will  depend on the availability of resources.

Second, we found that IRS lacks a comprehensive, repeatable process to  identify and evaluate potential new authentication technologies and  approaches. Our discussions with representatives from industry and  financial institutions and with government officials indicate that there is no  single, ideal online authentication solution that will solve IRS’s challenges  related to IDT refund fraud. These representatives advocate an approach  to authentication that relies on multiple strategies and sources of  information, while giving taxpayers options for further protecting their  information.

We identified several authentication options in our report that IRS could  consider, including the following:

Possession-based authentication. This type of authentication offers  users a convenient, added layer of security when used as a second  factor for accessing websites or systems that would otherwise rely on  a username and password for single-factor authentication. For  example, as noted in our report, according to an industry official,  authentication using a trusted device or “security key” based on  Universal Second Factor standards complies with NIST’s new  guidance for digital authentication. While IRS is not likely to provide  the devices to taxpayers, it could enable its systems to accept these  trusted devices as authenticators for taxpayers who elect to use them.

Working with trusted partners. IRS could partner with organizations  it trusts that are accessible to taxpayers and enable the partners to  identity-proof and authenticate taxpayers. Trusted partners could  include tax preparers, financial institutions, or other federal or state  agencies. In the course of our work, IRS officials stated that they had  been exploring such options with both the Social Security  Administration and the U.S. Postal Service; however, at the time of  our report, the agencies had not yet made decisions about next steps.

Expanding existing IRS services to further protect taxpayers. IRS  could expand the functionality of its online account to further protect  taxpayers from IDT refund fraud. For example, IRS could develop  additional functionality that allows the taxpayer to designate a bank  account or a preference for a paper check for receiving a tax refund. If  a fraudster filed a return with different information, the return would be  automatically rejected.

IRS officials told us the agency continually researches new identity  assurance processes and technologies and has talked with other  agencies, industry groups, and vendors to better understand how  particular technology solutions could apply to IRS’s environment.  However, during the course of our work, IRS could not provide us  evidence of a repeatable, comprehensive process to identify and evaluate  available authentication technologies and services. Such a process could  compare options for in-house authentication solutions with off-the-shelf  solutions based on estimates of cost, schedule, and benefits, as  applicable. To this end, we recommended that IRS develop a process to  identify and evaluate alternative options for improving taxpayer  authentication, including technologies in use by industry, states, or other  trusted partners; and based on this approach, include and prioritize these  options, as appropriate, in its Roadmap. IRS agreed with these  recommendations, but did not provide additional details on how it plans to  address them.

In conclusion, IRS’s authentication environment is one component of a  broad, complex information technology infrastructure, and we have  previously reported on the many challenges the agency faces as it  modernizes its tax systems. Taxpayer authentication has become more  difficult with the wide availability of personally identifiable information and  fraudsters’ ability to develop more complex and sophisticated methods to  commit fraud undetected. Addressing the issues we describe above could  better position IRS to identify and mitigate vulnerabilities in its  authentication efforts and better protect taxpayers and the Treasury.

Chairman Jenkins, Ranking Member Lewis, and members of the  Subcommittee, this concludes my prepared remarks. I look forward to  answering any questions that you may have at this time.

If you or your staff have any questions about this testimony, please  contact James R. McTigue, Jr. at (202) 512-9110 or mctiguej@gao.gov.  Contact points for our Offices of Congressional Relations and Public  Affairs may be found on the last page of this statement. Key contributors  to this testimony include Neil Pinney, Assistant Director; Heather A.  Collins, Analyst-in-Charge; Dawn Bidne; and Bryan Sakakeeny.

This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.

IRS estimated that criminals used stolen identities to try to claim $12.2 billion in refunds in 2016. IRS protected $10.5 billion but paid at least $1.6 billion. To help address this issue, which we added to our High Risk list in 2015, IRS checks whether millions of taxpayers are who they say they are.

We testified that IRS has improved its taxpayer authentication efforts, but should take additional actions to stay ahead of fraudsters.

In our related report, we made 11 recommendations, including that IRS prioritize its authentication initiatives and develop a process to evaluate potential authentication technologies.