Data Protection: Actions Taken by Equifax and Federal Agencies in Response to the 2017 Breach

CRAs such as Equifax assemble information about consumers to produce credit reports and may provide other services, such as identity verification to federal agencies and other organizations. Data breaches at Equifax and other large organizations have highlighted the need to better protect sensitive personal information.

GAO was asked to report on the major breach that occurred at Equifax in 2017. This report (1) summarizes the events regarding the breach and the steps taken by Equifax to assess, respond to, and recover from the incident and (2) describes actions by federal agencies to respond to the breach. To do so, GAO reviewed documents from Equifax and its cybersecurity consultant related to the breach and visited the Equifax data center in Alpharetta, Georgia, to interview officials and observe physical security measures. GAO also reviewed relevant public statements filed by Equifax. Further, GAO analyzed documents from the IRS, SSA, and USPS, which are Equifax's largest federal customers for identity-proofing services, and interviewed federal officials related to their oversight activities and response to the breach.

In July 2017, Equifax system administrators discovered that attackers had gained unauthorized access via the Internet to the online dispute portal that maintained documents used to resolve consumer disputes (see fig.). The Equifax breach resulted in the attackers accessing personal information of at least 145.5 million individuals. Equifax's investigation of the breach identified four major factors including identification, detection, segmenting of access to databases, and data governance that allowed the attacker to successfully gain access to its network and extract information from databases containing personally identifiable information. Equifax reported that it took steps to mitigate these factors and attempted to identify and notify individuals whose information was accessed. The company's public filings since the breach occurred reiterate that the company took steps to improve security and notify affected individuals.

The Internal Revenue Service (IRS), Social Security Administration (SSA), and U.S. Postal Service (USPS)—three of the major federal customer agencies that use Equifax's identity verification services—conducted assessments of the company's security controls, which identified a number of lower-level technical concerns that Equifax was directed to address. The agencies also made adjustments to their contracts with Equifax, such as modifying notification requirements for future data breaches. In the case of IRS, one of its contracts with Equifax was terminated. The Department of Homeland Security offered assistance in responding to the breach; however, Equifax reportedly declined the assistance because it had already retained professional services from an external cybersecurity consultant. In addition, the Bureau of Consumer Financial Protection and the Federal Trade Commission, which have regulatory and enforcement authority over consumer reporting agencies (CRAs) such as Equifax, initiated an investigation into the breach and Equifax's response in September 2017. The investigation is ongoing.

GAO is not making recommendations in this report. GAO plans to issue separate reports on federal oversight of CRAs and consumer rights regarding the protection of personally identifiable information collected by such entities. A number of federal agencies and Equifax provided technical comments which we incorporated as appropriate.

Recent data breaches at federal agencies, retailers, hospitals, insurance  companies, consumer reporting agencies (CRA), and other large  organizations have resulted in the potential compromise of millions of  Americans’ personally identifiable information (PII), which could lead to  identity theft and other serious consequences. Such incidents highlight  the importance of ensuring the security and privacy of PII collected and  maintained by those entities.

As one example, the breach of an Equifax online dispute portal from May  to July 2017 resulted in the compromise of records containing the PII of at  least 145.5 million consumers in the U.S. and nearly 1 million consumers  outside of the U.S. Among others, the customers of Equifax’s services  include federal agencies, such as the Internal Revenue Service (IRS);  Social Security Administration (SSA); and U.S. Postal Service (USPS). In  addition, the Bureau of Consumer Financial Protection (BCFP) and  Federal Trade Commission (FTC) have roles in providing oversight of  Equifax and other CRAs.

You requested that we review aspects of the 2017 Equifax breach and  the federal response. Our specific objectives were to (1) summarize the  events regarding the 2017 Equifax breach and the steps taken by the  company to assess, respond to, and recover from the incident and (2)  describe the actions that federal customers and oversight agencies took  in response to the breach.

To address the first objective, we analyzed documentation generated by  Equifax and its cybersecurity consultant in response to the breach, such  as the report summarizing the results of the consultant’s forensic analysis  of Equifax systems. In addition, we conducted a site visit at the Equifax  data center in Alpharetta, Georgia, where we interviewed relevant  company officials and observed the organization’s physical security  measures. We did not independently verify or assess Equifax’s security  controls or the steps the company took to address factors related to the  breach. We also reviewed Equifax’s relevant public filings it provided to  the public and shareholders, which included information about the data  breach and the company’s efforts for remediation.

For the second objective, we analyzed documentation that described key  actions taken by federal customers and oversight agencies following the  breach. This included documentation that discussed the responses to the  breach by IRS, SSA, and USPS, as key federal customers of Equifax. In  addition, we analyzed documentation related to the oversight of Equifax  (and other CRAs) by BCFP and FTC. We also conducted interviews with  officials of these selected customer and oversight agencies to further  understand the actions they took. Appendix I discusses our objectives,  scope, and methodology in greater detail.

We conducted this performance audit from November 2017 to August  2018 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.

A consumer reporting agency is a person or entity that assembles or  evaluates consumer credit information or other consumer information for  the purpose of furnishing consumer reports to others. This includes  companies that compile and store electronic files of consumer  information, which they then sell to other businesses and organizations  that use the information to assess or evaluate creditworthiness.

Furnishing of information by creditors and others to CRAs is voluntary, as  federal law generally does not require such reporting, and information  compiled on individual consumers can vary among the CRAs. A lender  uses the information provided to determine whether to offer credit to an  individual, the rate of interest to be assigned to the loan, and other terms  of the contract. In addition, a growing number of entities use information  provided by CRAs to help make decisions about individuals’ credit  worthiness when determining eligibility for insurance, housing, or  employment, among other things. Information from CRAs can also be  used for other purposes, such as to identify potential customers with  specific characteristics for new credit card accounts.

CRAs may provide a variety of verification services to government and  private sector organizations. For example, Equifax provides income and  employment verification services using information collected from  employers.

Equifax, TransUnion, and Experian—the three major CRAs—also  leverage information they collect from organizations, such as financial  institutions, utilities, cell phone service providers, public records, and  government sources, to offer identity verification services. Other entities,  including federal agencies, use identity verification when they enroll new  applicants for benefits and services. In addition, the IRS uses identity  verification to ensure that individuals who want to access prior year tax  returns are the legitimate filers of those returns.

With regard to identity verification, CRAs typically use information they  collect to generate questions that federal agencies and other entities can  use to test applicants’ knowledge of information in their credit file. These  questions and answers are typically the basis for identity proofing—the  process of comparing evidence from an individual with a trusted source of  data to verify that the individual is who they claim to be. The evidence  generally consists of information or documentation that only the legitimate  individual should know or have access to. For example, a driver’s license,  passport, knowledge of recent financial transactions, and biometric  information are all considered relatively strong evidence that the  individual is who they say they are.

Although there is no commonly agreed-upon definition, the term “data  breach” generally refers to an unauthorized or unintentional exposure,  disclosure, or loss of an organization’s sensitive information. This  information can include PII, such as Social Security numbers, or financial  information, such as credit card numbers.

A data breach can occur under many circumstances and for many  reasons. It can be inadvertent, such as from the loss of an electronic  device, or deliberate, such as from the theft of a device. A breach can  also occur as a result of a cyber-based attack by a malicious individual or  group, agency insiders, foreign nation, terrorist, or other adversary. Data  breaches have occurred at all types of organizations, including private,  nonprofit, and federal and state entities.

The loss or unauthorized disclosure of information in a data breach can  lead to serious consequences and can result in substantial harm to  individuals, private sector organizations, and the federal government.  Examples of harmful results include:  loss or theft of resources, including money and intellectual property,  and identity theft;  inappropriate access to and disclosure, modification, or destruction of  sensitive information; harm to national security; use of computer services for unauthorized purposes or to launch an  attack on other computer systems; damage to networks and equipment;  loss of privacy, emotional distress, or reputational harm;  loss of public confidence; and high costs to remediate the effects of the breach.

Attackers Use a Variety of Tools and Techniques

Cyber criminals seeking access to sensitive information, such as PII,  typically use a variety of readily available software tools to carry out  attacks. These tools can be used to intercept and capture data as they  are transmitted, exploit known vulnerabilities in commercially available  software, and facilitate e-mail phishing techniques for gaining  unauthorized access to systems and information.

Attackers often use similar techniques and tools, making it difficult to  distinguish one attacker from another. When custom-built tools are used,  an attacker may rely on unique methods or display other telltale signs that  can be used for identification; such tools are usually used when a target’s  defenses justify them. Off-the-shelf tools are usually enough to conduct a  successful attack that allows an attacker to steal data, bring systems  down, or gain further access to systems and resources.

Attackers often begin with network-scanning programs, which are used to  map the layout of a targeted network and determine the location of data  repositories that may contain information of interest. Some scanners are  designed to scan only a single networked computer, extracting as much  data about that system as possible. Others can scan Internet addresses  across the web to identify potential targets by determining whether they  are using a version of software that is vulnerable to an attack.

Once a target has been identified, the attacker will generally attempt to  gain access to the system or network without leaving any indication of  who they are or from where they launched their attack. This is commonly  accomplished using tools that mask the attacker’s origin by using the  Internet address of another computer from another location. While an  investigator can sometimes use forensic tools to trace the original Internet  address, often this leads to misleading information.

Attackers use additional tools and techniques to gain unauthorized  access to systems and data on the target network and to transfer stolen  data back to the attacker’s own computer system. One such technique is  to leverage the access rights gained on the originally compromised  system to get further access into other servers on the network. To do this,  an attacker can use standard, off-the-shelf tools for navigating systems  and managing information that blend in with normal network activity. For  example, encryption can be used to hide the transfer of sensitive  information from one server to another or out of the network entirely. This  enables the attacker to continue probing for more repositories of  information and stealing copies of that information without being detected  by the targeted network’s system administrators.

Federal Agencies Oversee CRA Activities, Including Protection of Personally Identifiable Information

CRAs have been subject to federal regulation since the passage of the  Fair Credit Reporting Act in 1970. Currently, FTC and BCFP are the two  federal agencies with primary oversight responsibilities for CRAs. FTC  was given responsibility for administratively enforcing CRAs’ compliance  with the Fair Credit Reporting Act at the time of enactment. As part of the  Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd- Frank Act), BCFP was given authority to enforce a number of federal  consumer financial laws, including the Fair Credit Reporting Act. BCFP  also has begun exercising supervisory authority over certain larger  participants in the credit reporting market.

FTC has authority, subject to certain exceptions, to investigate any  organization that maintains consumer data and to bring enforcement  actions for violations of laws that concern the protection of consumer  information. FTC also exercises enforcement authority over CRAs  through the Gramm-Leach-Bliley Act and the related “Safeguards” and  “Privacy Rules.”

The Fair Credit Reporting Act promotes the accuracy, fairness, and  privacy of information collected or used to help make decisions about  individuals’ eligibility for credit, insurance, employment, housing, or  other benefits. CRAs that compile credit histories and other personal  information into consumer reports must adhere to the act’s provisions  for ensuring the accuracy and permissible uses of such information.

The Gramm-Leach-Bliley Act requires that federal financial regulators  and FTC establish standards and protections to ensure the security  and confidentiality of customer information. These standards and  protections must be implemented by companies of all sizes that are  engaged in financial activities, including Equifax and all other CRAs.  Further, the act requires financial institutions to protect the security of  customers’ personal information.

As part of its implementation of the Gramm-Leach-Bliley Act, FTC  issued the “Safeguards Rule”, which requires financial institutions  develop, implement, and maintain a comprehensive information  security program to keep information about a customer of a financial  institution secure and confidential. In addition to developing their own  safeguards, companies covered by the rule are responsible for  requiring their affiliates and service providers to implement and  maintain safeguards to protect customer information in their care.

In determining whether it should take enforcement action against a  company for a violation of data security provisions, FTC considers a  number of factors, including whether a company’s data security measures  are commensurate with the company’s size. FTC does not have  supervisory authority to examine CRAs for compliance with the Federal  Trade Commission Act; therefore, the agency typically must rely on its  enforcement authority after an incident has occurred.

Finally, FTC enforces Section 5 of the Federal Trade Commission Act,  which prohibits “unfair or deceptive acts or practices in or affecting  commerce.” FTC officials told us that failing to properly protect  consumer data can be considered an unfair or deceptive act or practice.

BCFP Has Enforcement and Supervisory Authorities over CRAs

In 2010, the Dodd-Frank Act gave BCFP enforcement authority over all  CRAs and certain other persons for violations of most provisions of the  Fair Credit Reporting Act; certain provisions of the Gramm-Leach-Bliley  Act; and for unfair, deceptive, or abusive acts or practices under sections  1031 and 1036 of the Dodd-Frank Act. BCFP has taken enforcement  actions against CRAs for violations of the Fair Credit Reporting Act and  for deceptive practices.

In 2012, BCFP also extended its supervisory authority to include larger  CRAs—that is, those with more than $7 million in annual receipts from  consumer reporting activities. BCFP staff review certain of these larger  CRAs on an ongoing basis, and BCFP staff said that their recent  examinations of CRAs have focused on compliance with Fair Credit  Reporting Act requirements related to accuracy and resolving consumer  disputes. BCFP has also examined CRAs subject to the BCFP’s  supervisory authority for compliance with other Fair Credit Reporting Act  requirements, including those related to ensuring the accuracy of  information in consumer reports, furnishing information only to those with  a permissible purpose, and compliance with the consumer dispute  process.

BCFP also has supervisory authority over some aspects of the Gramm- Leach-Bliley Act. For example, BCFP examines larger CRAs for whether  they restrict the sharing and disclosure of nonpublic personal information  to third parties. BCFP does not have supervisory or enforcement authority  over the “Safeguards Rule” enacted by FTC as part of the agency’s  implementation of the Gramm-Leach-Bliley Act.

Finally, BCFP has authority to examine larger CRAs for any unfair,  deceptive, or abusive acts or practices and to bring enforcement actions  against CRAs of all sizes for such acts or practices. According to BCFP  staff, in some cases, a CRA could commit an unfair, deceptive, or abusive  act or practice or violation of other applicable law in connection with its  data security practices.

GAO Has Previously Reported on Data Protection Issues

We have previously made recommendations to agencies regarding the  protection of PII, and proposed Matters for Congressional Consideration  in areas where laws could be enhanced. For example, in our recent report  on data oversight at the Centers for Medicare and Medicaid Services  (CMS), we recommended that the agency ensure that all third parties  that receive CMS data have clear requirements for the protection of that  data, that CMS properly oversee the implementation of those  requirements, and that the agency ensure identified issues are  remediated. Additionally, our recent report on the oversight of students’  PII at the Department of Education included seven recommendations for  better protection of student PII and for improving department policies to  meet federal privacy guidelines. All of these recommendations currently  remain open while the agencies take actions to address them.

In addition to recommendations for agencies, we have proposed two  Matters for Congressional Consideration related to data protection. In  2008, we reported that the Privacy Act and E-Government Act of 2002 may not adequately ensure that consumers are notified in the event of a  breach by federal agencies and that existing laws could better ensure that  consumers are aware of what PII federal agencies collect and how they  use it. Based on this finding, we suggested that Congress consider  amending applicable laws to ensure that all PII collected by federal  agencies is protected and that its use is limited to the stated purpose of  the collection.

With regard to data collected by private entities, in 2013, we reported that  existing federal laws provide consumers with only limited protection for  data that is collected and used for marketing purposes. Consequently,  we asked Congress to consider strengthening the current consumer  privacy framework to reflect the effects of changes in technology and the  marketplace while also ensuring that any limitations on data collection  and sharing do not unduly inhibit the economic and other benefits to  industry and consumers that data sharing can accord.

Attackers Exploited Vulnerabilities That Equifax Subsequently Reported Taking Actions to Address

In March 2017, unidentified individuals discovered the presence of a  known vulnerability in software running on Equifax’s online dispute portal  that could be used to obtain access to the system. In May of that year,  attackers exploited the vulnerability and began to extract data containing  PII from Equifax’s information systems. According to Equifax, the  attackers used a number of techniques to disguise their exploit of the  Equifax systems and the database queries they conducted. On July 29,  2017, Equifax discovered the breach and reported that it took actions to  address the factors that allowed the attackers to successfully gain access  to its network. Further, the company reported that it took steps to identify,  notify, and provide support to individuals who were potentially impacted  by the breach.

Attackers Identified and Exploited Vulnerabilities to Steal Data

Equifax has stated that, on March 10, 2017, unidentified individuals  scanned the company’s systems to determine if the systems were  susceptible to a specific vulnerability that the United States Computer  Emergency Readiness Team had publicly identified just 2 days earlier.  The vulnerability involved the Apache Struts Web Framework and would  allow an attacker to execute commands on affected systems.

Equifax officials stated that, as a result of this scanning, the unidentified  individuals discovered a server housing Equifax’s online dispute portal  that was running a version of the software that contained the vulnerability.  Using software they obtained from an unknown source and that was  designed to exploit the vulnerability, the unidentified individuals  subsequently gained unauthorized access to the Equifax portal and  confirmed that they could run commands. No data was taken at this time.

According to Equifax officials, beginning on May 13, 2017, in a separate  incident following the initial unauthorized access, attackers gained access  to the online dispute portal and used a number of techniques to disguise  their activity. For example, the attackers leveraged existing encrypted  communication channels connected to the online dispute portal to send  queries and commands to other systems and to retrieve the PII residing  on the systems. The use of encryption allowed the attackers to blend in  their malicious actions with regular activity on the Equifax network and,  thus, secretly maintain a presence on that network as they launched  further attacks without being detected by Equifax’s scanning software.

Equifax officials added that, after gaining the ability to issue system-level  commands on the online dispute portal that was originally compromised,  the attackers issued queries to other databases to search for sensitive  data. This search led to a data repository containing PII, as well as  unencrypted usernames and passwords that could provide the attackers  access to several other Equifax databases. According to Equifax’s interim  Chief Security Officer, the attackers were able to leverage these  credentials to expand their access beyond the 3 databases associated  with the online dispute portal, to include an additional 48 unrelated  databases.

After reviewing system log files that recorded the attackers’ actions,  Equifax officials determined that the attackers then ran a series of queries  in an effort to try to extract PII from the databases they had located.  Altogether, the attackers ran approximately 9,000 queries, a portion of  which successfully returned data containing PII. As before, Equifax  officials stated that the attackers were able to disguise their presence by  blending in with regular activity on the network.

After successfully extracting PII from Equifax databases, the attackers  removed the data in small increments, using standard encrypted web  protocols to disguise the exchanges as normal network traffic. The attack  lasted for about 76 days before it was discovered. Figure 1 depicts an  analysis of how the attackers gained access into Equifax’s systems and  exploited vulnerabilities.

After Becoming Aware of the Attack, Equifax Took Steps to Block the Attackers

Equifax’s assessment of the data breach began with actions it took to  identify that it was being attacked as well as subsequent actions to block  the intrusion. Equifax officials stated that, on July 29, 2017— approximately 2.5 months after the attackers began extracting sensitive  information on May 13, 2017—security personnel conducting routine  checks of the operating status and configuration of IT systems detected  the intrusion on the online dispute portal.

As reported by Equifax, a network administrator conducting routine  checks of the operating status and configuration of IT systems discovered  that a misconfigured piece of equipment allowed attackers to  communicate with compromised servers and steal data without detection.  Specifically, while Equifax had installed a device to inspect network traffic  for evidence of malicious activity, a misconfiguration allowed encrypted  traffic to pass through the network without being inspected. According to  Equifax officials, the misconfiguration was due to an expired digital  certificate. The certificate had expired about 10 months before the  breach occurred, meaning that encrypted traffic was not being inspected  throughout that period. As a result, during that period, the attacker was  able to run commands and remove stolen data over an encrypted  connection without detection.

Equifax officials stated that, after the misconfiguration was corrected by  updating the expired digital certificate and the inspection of network traffic  had restarted, the administrator recognized signs of an intrusion, such as  system commands being executed in ways that were not part of normal  operations. Equifax then blocked several Internet addresses from which  the requests were being executed to try to stop the attack.

Equifax reported that, on July 30, 2017, after its information security  department observed additional suspicious activity continuing to occur,  the online dispute portal was taken offline. The next day, the Chief  Security Officer, in coordination with internal stakeholders, informed the  Chief Executive Officer of the attack on the portal.

Equifax Identified Several Factors That the Attacker Exploited During the Breach

To further assess the scope of the breach and identify its causes, Equifax  began an investigation to identify the vulnerabilities that had been  exploited to steal PII from its systems. Concurrent with this effort,  company officials stated that they also began examining the data  repositories that had been accessed to try to determine how much data  had been taken and how many individuals were potentially impacted.  According to Equifax officials, the investigation took place between  August 2 and October 2, 2017, with the help of an external cybersecurity  consultant.

Equifax officials stated that the company’s investigation was facilitated by  the use of electronic logs that had not been damaged or erased by the  attackers on the affected systems. These logs recorded commands that  were issued by the attackers throughout the attack, such as commands to  retrieve or display the contents of data repositories. By examining the  logs, Equifax worked to reconstruct the sequence of specific actions that  the attackers had taken and, consequently, determine what specific data  had been compromised. In addition to initiating its internal investigation,  on August 2, 2017, the company notified the Federal Bureau of  Investigation of the breach.

Based on its cybersecurity consultant’s analysis and recommendations  following the breach, Equifax determined that several major factors had  facilitated the attackers’ ability to successfully gain access to its network  and extract information from databases containing PII. Specifically,  Equifax officials told us that key factors that led to the breach were in the  areas of identification, detection, segmentation, and data governance:  Identification. According to Equifax officials, the Apache Struts  vulnerability was not properly identified as being present on the online  dispute portal when patches for the vulnerability were being installed  throughout the company. After receiving a notice of the vulnerability  from the United States Computer Emergency Readiness Team in  March 2017, Equifax officials stated that they circulated the notice  among their systems administrators. However, the recipient list for the  notice was out-of-date and, as a result, the notice was not received by  the individuals who would have been responsible for installing the  necessary patch. In addition, Equifax officials stated that although the  company scanned the network a week after the Apache Struts  vulnerability was identified, the scan did not detect the vulnerability on  the online dispute portal.

Detection. As reported by Equifax officials, an expired digital  certificate contributed to the attackers’ ability to communicate with  compromised servers and steal data without detection. Specifically,  while Equifax had installed a tool to inspect network traffic for  evidence of malicious activity, the expired certificate prevented that  tool from performing its intended function of detecting malicious traffic.

The certificate had expired before May 2017, meaning that traffic was  not being inspected throughout the breach.

Segmentation. Because individual databases were not isolated or  “segmented” from each other, the attackers were able to access  additional databases beyond the ones related to the online dispute  portal, according to Equifax officials. The lack of segmentation  allowed the attackers to gain access to additional databases  containing PII, and, in addition to an expired certificate, allowed the  attackers to successfully remove large amounts of PII without  triggering an alarm.

Data Governance. Data governance includes setting limits on access  to sensitive information, including credentials such as usernames and  passwords. According to Equifax officials, the attackers gained access  to a database that contained unencrypted credentials for accessing  additional databases, such as usernames and passwords. This  enabled the intruders to run queries on those additional databases.

In addition to these four broad categories, Equifax officials noted one  other factor that also facilitated the breach. Specifically, the lack of  restrictions on the frequency of database queries allowed the attackers to  execute approximately 9,000 such queries—many more than would be  needed for normal operations.

Equifax Reported Taking Steps to Strengthen its Cybersecurity Controls

According to Equifax’s public filings, including its annual 10-K filing  submitted to the Securities and Exchange Commission in March 2018  and its notice of 2018 annual meeting and proxy statement, following the  2017 incident, Equifax undertook a variety of remediation efforts to  address the factors identified in their investigation. Equifax officials  responsible for coordinating the response to the incident stated that, once  the company identified how the attackers were able to gain unauthorized  access to company systems and remove sensitive data, it took measures  to address the internal factors that led to the breach. The measures were  intended to better protect the company’s infrastructure from future  disruptions, compromises, or failures. We did not independently assess  Equifax’s efforts to address the identified factors.

Specifically, Equifax officials stated that system-level remediation  measures were implemented to address the factors that led to the breach.  For example, to work toward addressing concerns about identifying  vulnerable servers, Equifax reportedly is implementing a new  management process to identify and patch software vulnerabilities and  confirm that vulnerabilities have been addressed. Also, to help ensure  that detection of malicious activity is not hindered in the future, Equifax  officials said they have developed new policies to protect data and  applications and implemented new tools for continuous monitoring of  network traffic. Further, in an effort to improve segmentation between  devices that do not need to communicate, Equifax officials stated that  they have implemented additional controls to monitor communications at  the external boundary of the company’s networks and added restrictions  on traffic between internal servers. Finally, to help address data  governance issues, the officials said they were implementing a new  security controls framework and tighter controls for accessing specific  systems, applications, and networks.

In addition to these measures, Equifax stated that they implemented a  new endpoint security tool to detect misconfigurations, evaluate potential  indications of compromise, and automatically notify system administrators  of identified vulnerabilities. Further, Equifax officials reported that the  company has implemented a new governance structure to regularly  communicate risk awareness to Equifax’s board of directors and senior  management. The new structure requires the company’s Chief  Information Security Officer to report directly to the Chief Executive  Officer. Officials said this should allow for greater visibility of  cybersecurity risks at top management levels.

Equifax Reported Taking Steps to Identify Affected Individuals

Following the shutdown of its online dispute portal, Equifax took steps to  identify what data had been lost and the number of individuals affected so  that it could fulfill its responsibility to notify affected individuals. To  develop its estimate of the number of individuals affected by the data  breach, Equifax stated that it recreated the attackers’ database queries  on a separate system that could run the queries at high speed, allowing  Equifax to generate its estimate in a relatively short period of time.  Equifax staff then worked to reconstruct queries against the data tables to  identify which queries had successfully extracted data and which  individuals were associated with that data.

However, as is commonly experienced with large breaches, Equifax faced  challenges in determining exactly how many individuals were affected.  According to Equifax officials, much of the stolen data consisted of  incomplete records without full sets of identifying information. Some data  sets included information that could be matched to more than one known  individual. Subsequently, Equifax officials stated that they compared  these data sets with information in the company’s internal databases that  were not impacted by the data breach to make matches with known  identities.

For example, Equifax took partial records that did not include all fields  and ran an analysis to determine whether Social Security numbers and  names included in the records could be matched with those in Equifax’s  core credit reporting databases. In addition, Equifax performed analyses  to remove duplicates and to determine whether a person could be linked  to incomplete records based on Social Security numbers. After Equifax  completed its initial analysis of the datasets, it estimated that  approximately 143 million U.S. consumers had been affected by the  breach.

Moreover, Equifax’s initial analysis, reported on September 7, 2017,  indicated that multiple types of PII had been compromised, including  individuals’ names, Social Security numbers, birth dates, addresses, and  driver’s license numbers. Because many of the records were incomplete, not all of the types of PII had been compromised for all affected  individuals.

In addition, Equifax determined that credit card numbers for  approximately 209,000 consumers and certain dispute documents, which  had included PII for approximately 182,000 consumers, had been  accessed. These documents contained PII associated with specific items  from dispute cases that were submitted to Equifax as evidence supporting  disputes they filed about the accuracy of their credit reports, such as  utility bills.

Equifax made two revisions over time to its estimate of affected  individuals. First, in late September 2017, Equifax determined that it had  incorrectly concluded that one of the attackers’ queries had not returned  any data. After additional analysis, including a determination that the  query had, in fact, allowed the attackers to access PII from approximately  2.5 million additional U.S. consumers, Equifax revised the number of  affected individuals from 143 million to 145.5 million on October 2, 2017.

Second, on March 1, 2018, Equifax stated that it had identified  approximately 2.4 million U.S. consumers whose names and partial  driver’s license information were stolen. The newly identified individuals  were based on names and partial driver’s license information contained in  a data table that Equifax had not previously identified as including  individuals compromised in the breach. According to Equifax officials,  Equifax’s original investigation had not identified these individuals  because their names and partial driver’s license information were not  stolen together with their Social Security numbers.

To identify as many potentially affected individuals as possible, Equifax  contracted with a third-party data source that had access to a driver’s  license database and mapped the partial driver’s licenses to an Equifax  database containing Social Security numbers. According to Equifax  officials, some of the individuals within this group of 2.4 million were  already included in the previous total of 145.5 million affected individuals,  while others were not. As of August 2018, Equifax had not determined  exactly how many of the 2.4 million individuals were included in the  previous total of 145.5 million.

Equifax Notified Affected Individuals and Offered Monitoring Services

On September 7, 2017, after Equifax had determined the extent of the  breach and developed a remediation plan for potentially impacted  consumers, the company provided written notification to all U.S. state  attorneys general regarding the approximate number of potentially  affected residents in each state and its plans for consumer remediation.  The notification included steps individuals could take to determine if they  were affected by the breach and to help protect against misuse of their  personal information. The company also issued a press release to the  public providing information about the breach and the types of PII that  had been compromised.

Further, the press release issued on September 7, 2017, stated that the  company had set up a dedicated website to help individuals determine if  their information might have been stolen in the breach. In addition,  Equifax improved the search tool it had developed to help U.S.  consumers determine if they were impacted and expanded its call center  operations. However, the website experienced several technical issues,  including excessive downtime and inaccurate data. Equifax officials  acknowledged these shortcomings and said they took measures to  address them, including improving the stability of the website and  accuracy of the information it provided.

Additionally, Equifax reported that it would provide several services to all  U.S. consumers, regardless of whether their information had been  compromised, free of charge for one year. Those services included credit  monitoring, individual copies of Equifax credit reports, notification of  changes to credit reports, a credit “lock” allowing individuals to prevent  third-parties from accessing their Equifax credit report, identity theft  insurance covering certain expenses related to the process of recovering  from identity theft, and a Social Security number monitoring service that  would scan suspicious websites for an individual’s Social Security  number.

These services were offered to consumers from September 7, 2017, until  January 31, 2018, when Equifax announced a new service called “Lock &  Alert.” This new service allows consumers to use their smartphone or  computer to lock and unlock their Equifax credit report. Equifax  announced that it was making this service available to all consumers at  no cost.

Federal Agencies Took a Variety of Actions in Response to the Equifax Breach

After Equifax announced the data breach, federal customer agencies took  a variety of actions based on their responsibilities and how the breach  affected their operations. Specifically, the agencies that were customers  of the company’s services conducted independent assessments of the  company’s security controls, revised their own identity proofing  processes, and made changes to their contracts with Equifax, among  other activities. Equifax did not ask the Department of Homeland Security  (DHS), which is the central agency that responds to cyber incidents  across the federal government, to assist in responding to the breach.  Nevertheless, the department took the step of reminding federal agencies  of the importance of correcting the software vulnerability that led to the  breach. In addition, the oversight agencies, BCFP and FTC, began taking  actions to investigate the breach and inform the public.

Major Federal Customers of Equifax Took Steps to Ensure Their Activities Were Not Adversely Affected by the Breach

IRS, SSA, and USPS—large agencies that were major customers of  Equifax at the time of the breach—assessed the potential impact of the  breach to their own operations as well as to the operations of their  consumers. For example, these agencies assessed the technical impact  of the breach on their own systems that rely on Equifax services to  determine whether the breach could have compromised the integrity of  their identity proofing processes. While there was no breach of agency  systems or information, they also sought to determine which of their  customers were directly affected by the breach, recognizing that those  individuals could be at heightened risk of identity fraud. Information  security officials we spoke to at IRS, SSA, USPS, and DHS expressed  concern about how the breached data could be used to compromise  sensitive information or fraudulently procure government services, even  from agencies that are not direct customers of Equifax.

Representatives of IRS, SSA, and USPS noted that they responded to  the breach independently of other agencies, because they said it was  unclear whether any single federal agency had responsibility for  coordinating government actions in response to a breach of this type in  the private sector. According to the three agencies, their actions included  the following:  Identified affected individuals. Due to concerns about the potential  for fraud using the stolen data, IRS and SSA both obtained from  Equifax a list of the individuals affected by the Equifax breach. The  agencies then used these lists to identify which of their own  customers were affected and to look for potential instances of identity  fraud affecting those customers.

Performed independent assessments of Equifax security  controls. According to information security officials at IRS, SSA, and  USPS, the agencies independently conducted site visits at Equifax’s  data center in Alpharetta, Georgia, where they reviewed the  company’s security controls. According to SSA officials, their agency’s  review assessed compliance with the baseline set of controls required  by the National Institute of Standards and Technology for systems  determined to pose a moderate level of risk. SSA officials stated that  they shared the results of their assessment with IRS, the Office of  Management and Budget, House Ways and Means Social Security  Subcommittee, and the Senate Committee on Finance. USPS officials  said they reviewed both physical security and cybersecurity controls  at Equifax’s data centers in Alpharetta, Georgia and St. Louis,  Missouri locations. IRS officials said they also conducted a security  assessment at Equifax’s Alpharetta data center, as well as a separate  review of physical security and cybersecurity controls at the  company’s St. Louis, Missouri site. The officials of all three agencies  said that their reviews did not uncover any major new problems, but  did identify a number of lower-level technical concerns that they  required Equifax to address.

Modified contracts with Equifax. IRS and SSA made changes to  contracts they had with Equifax to require prompt notification of any  future breach, among other things. According to officials from both  agencies, Equifax did not directly notify major federal customers of the  2017 breach prior to its public announcement because its contracts  with these agencies required notification only of breaches directly  involving the systems that provided services to the federal  government. SSA officials stated that it was important to update the  agency’s contract to require Equifax to promptly notify SSA of any  data breach, regardless of which of the company’s systems it may  affect. IRS officials stated that a similar change was made to their  contract with Equifax for credit reporting services. The contract  change also required the company to notify IRS within one hour after  a breach is discovered, rather than within the previous time frame of  24 hours. In addition, according to the officials, cybersecurity  language in the IRS’s contract was modified to ensure better  implementation and oversight of technical security controls.

Communicated with the public and affected individuals. IRS  made public announcements about the impact of the breach, noting  that the agency did not expect the breach to have any impact on  taxpayers’ ability to securely file tax returns. SSA issued a public blog  post reminding consumers about steps they could take to protect their  Social Security numbers.

Made changes to agency identity-proofing procedures. Following  its assessment, IRS updated its internal cybersecurity contractor  requirements and controls related to incident handling. Further, upon  completing its assessment, USPS initiated discussions with the  National Institute of Standards and Technology to determine risks  associated with the knowledge-based verification questions it had  been using with Equifax’s identity-proofing service. USPS  subsequently changed its process, removing certain knowledge- based verification questions and adding a procedure whereby  customers receive a code in the mail that they can use to verify their  mailing addresses.

Canceled a short-term contract with Equifax. Before the Equifax  breach, Equifax was the incumbent contractor at IRS for taxpayer  identity and verification services. In June 2017, prior to the discovery  of the breach, IRS began a new acquisition for these services by  issuing a request for quotations to three CRA vendors (including  Equifax and Experian) holding contracts under the federal supply  schedule. IRS selected Experian as offering the lowest-priced,  technically acceptable quotation, for issuance of a fixed-price task  order and establishment of a blanket purchase agreement. Equifax  filed a bid protest on July 5, 2017 with GAO challenging the IRS’s  evaluation of Experian’s quotation. As described elsewhere in this  report, Equifax discovered the breach on July 29 and, after  investigating it, announced the breach on September 7. On  September 29, during GAO’s consideration of the protest, IRS  awarded Equifax a short-term, sole-source contract for $7.25 million  to cover its need for the identity and verification services during the  time frame needed to resolve the protest. IRS considered these  services “critical” that “cannot lapse.” However, following the  completion of its breach-related security assessments, IRS issued  Equifax a stop-work order to suspend its performance under the short- term, sole-source order. GAO denied Equifax’s protest on October 16,  2017 and IRS proceeded with the task order issued to Experian for  the taxpayer identity and verification services.

DHS Offered Breach Response Services to Equifax

In its role as the center for federal information security incident prevention  and response, DHS offers services to assist federal agencies in preparing  for potential cyber incidents, maintaining awareness of the current threat  environment, and dealing with ongoing breaches. Under a Presidential  directive, DHS is also responsible for assisting public- and private- sector critical infrastructure owners and operators in preparing for,  preventing, protecting against, mitigating, responding to, and recovering  from a cyber incident.

In September 2017, shortly after the Equifax breach was publicly  announced, DHS contacted the company to offer its professional services  related to forensic analysis and breach response. However, according to  officials at both organizations, Equifax notified DHS officials that the  company had already retained professional services from a private  cybersecurity consultant and, thus, declined assistance from DHS.

Oversight Agencies Opened Investigations and Provided Information and General Advice to Consumers

According to Equifax officials, the company informed regulators about the  data breach on September 7, 2017—when the general public was  notified. FTC announced that it was investigating the Equifax breach, and  Equifax stated in its annual report that several governmental agencies,  including FTC and BCFP, were continuing to investigate events related to  the breach.

BCFP staff told us that, immediately following notification of the breach,  they participated in conference calls with Equifax to learn more about the  breach. According to the officials, their calls with Equifax focused on  ensuring consumers were provided with accurate information about the  breach and what they could do to protect themselves. Equifax officials  told us that they also informed FTC, the Securities and Exchange  Commission, various states’ attorneys’ general, and the Financial  Services Information Sharing and Analysis Center, that it had suffered a  breach.

Shortly after Equifax’s public announcement of the breach, BCFP  released a blog post on the top 10 ways that consumers could protect  themselves in the wake of the breach. Suggestions included regularly  reviewing credit reports, checking credit card statements, and changing  passwords for all financial accounts. In addition, BCFP posted on its  website actions consumers could take to protect themselves against fraud  or identity theft, including freezing credit and placing fraud alerts.

BCFP staff told us that, while the agency posts information to its website,  it does not provide individual legal assistance to consumers.  Nevertheless, the staff said that consumers can file a complaint with  BCFP if they are experiencing issues related to a CRA. BCFP staff added  that they received a large volume of consumer complaints following the  Equifax breach. BCFP staff said they use such complaints as one factor  to prioritize future supervisory examinations, as well as investigations and  enforcement actions.

In October 2017, BCFP also began conducting targeted data security and  cybersecurity examinations. Specifically, in addition to assessing whether  the CRAs’ data security practices and policies constitute violations of  federal consumer financial law, BCFP began assessing risks to  consumers posed by potential cybersecurity lapses and to markets for  consumer financial products and services. BCFP staff said that whether  BCFP continues to conduct CRA cybersecurity examinations will depend  on whether they identify the issue as a priority through future examination  prioritization processes.

Similarly, FTC released a statement to consumers with information about  the breach, such as when it occurred and the types of data  compromised. The statement also included guidance on steps  consumers could take to help protect their information from being  misused. For example, FTC encouraged individuals to visit Equifax’s  website to find out whether their information may have been exposed,  provided links to obtain a free credit report, and offered other information  about credit freezes and fraud alerts.

On June 25, 2018, eight state banking regulators issued a consent order  requiring Equifax to address various data security issues. The order  included several areas of concern, including general information security,  internal audits, and board and management oversight. More specifically,  the order required Equifax, the board, or its audit committee to, among  other things: provide a written risk assessment that identifies foreseeable threats  and vulnerabilities to the confidentiality of PII; establish a formal and documented internal audit program that is  capable of effectively evaluating information technology controls;  improve the oversight of its information security program;  improve oversight and documentation of its critical vendors;  improve standards and controls for supporting the patch management  function; and enhance oversight of IT operations as it relates to disaster recovery  and business continuity functions.

Under the consent order, Equifax was required to submit a list of all  remediation projects planned, in process, or implemented to the state  regulatory agencies by July 31, 2018.

We provided a draft of this report to BCFP, DHS, FTC, IRS, SSA, USPS,  and Equifax for comment. SSA and USPS provided written responses  expressing appreciation for the opportunity to review the draft report. The  SSA and USPS responses are reprinted in appendices II and III,  respectively. In addition, BCFP, DHS, FTC, IRS, SSA, USPS, and  Equifax provided technical comments orally and via email, which we have  incorporated, as appropriate.

As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 29 days from the  report date. At that time, we will send copies to the appropriate  congressional committees, Equifax, and to the Acting Director of the  Bureau of Consumer Financial Protection; the Chairman of the Federal  Trade Commission; the Secretary of the Department of Homeland  Security; the Commissioners of the Internal Revenue Service and Social  Security Administration; and the Postmaster General of the United States.  In addition, the report will be available at no charge on the GAO website  at http://www.gao.gov.We are sending copies of this report to In addition,  the report is available at no charge on the GAO website at  http://www.gao.gov.

If you or your staff have any questions about this report, please contact  Nick Marinos at (202) 512-9342 or marinosn@gao.gov, or Michael  Clements at (202) 512-8678 or clementsm@gao.gov. Contact points for  our Offices of Congressional Relations and Public Affairs may be found  on the last page of this report. GAO staff who made major contributions to  this report are listed in appendix IV.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to (1) summarize the events regarding the 2017  Equifax breach and the steps taken by the company to assess, respond  to, and recover from the incident and (2) describe the actions that federal  customers and oversight agencies took in response to the breach.

To address the first objective, we obtained and assessed documentation  generated in response to the breach. Specifically, we analyzed the results  of security assessments conducted by Equifax and its cybersecurity  consultant following the breach, which included information about how the  attacker gained access to Equifax’s systems and the specific  vulnerabilities that were exploited. This documentation included the report  summarizing the results of the consultant’s forensic analysis of Equifax  systems and the consultant’s recommendations to Equifax to address the  factors that led to the breach. We also reviewed Equifax’s relevant public  filings to the Securities and Exchange Commission and statements it  provided to the public and shareholders, which included information about  the data breach and the company’s efforts for remediation.

Further, we conducted a site visit to the Equifax data center in Alpharetta,  Georgia, to interview knowledgeable officials, such as the interim Chief  Security Officer and other officials knowledgeable about how Equifax  stores and processes data, and observed physical security measures. In  addition, to clarify details of the breach and the steps that Equifax took,  we interviewed officials at Equifax who were responsible for coordinating  reviews conducted following the breach. Specifically, we interviewed the  interim Chief Security Officer and government relations employees, who  were responsible for coordinating Equifax’s interaction with federal  agencies in response to the incident.

We did not independently assess Equifax’s information security controls  or the steps the company took to address identified factors that  contributed to the ineffective implementation of those controls.  Specifically, the scope of our report was to report on actions taken by  Equifax and agencies in response to the breach. Consequently, the  information in this report is based on public filings and announcements as  well as information provided to us by the company. We did not reach  conclusions regarding the adequacy or efficacy of Equifax’s security  measures.

To address the second objective, we selected three major federal  agencies, Internal Revenue Service (IRS), Social Security Administration  (SSA), and United States Postal Service (USPS), which were Equifax’s  largest federal customers at the time of the breach. We initially identified  these customer agencies by reviewing public reports following the breach  that identified federal agencies that were major Equifax customers at the  time. We also interviewed Equifax officials responsible for managing  government accounts to confirm that these three agencies were the only  large-scale federal customer agencies that interacted with Equifax  following the breach. Other federal agencies also have contracts with  Equifax for a variety of services; we did not conduct audit work for this  engagement at any other agencies because we narrowed our selection  criteria to the largest federal agencies that used Equifax’s services to  conduct their identity-proofing processes.

Subsequently, we analyzed documentation from IRS, SSA, and USPS to  describe the relevant actions these agencies took in response to the  breach, as well as documentation regarding oversight by BCFP and FTC,  which are the federal agencies with primary oversight responsibilities over  CRAs. Specifically, we reviewed relevant laws and BCFP guidance on  data security examinations. In addition, we spoke with BCFP and FTC  officials about their actions in response to the data breach and reviewed  their websites for information provided to consumers.

We also selected and reviewed contracts between Equifax and each of  the three selected agencies—IRS, SSA, and USPS—to determine what  changes were made to services, such as identity-proofing solutions,  provided by Equifax to federal agencies as a result of the breach. The  contracts we reviewed were the ones identified by IRS, SSA, and USPS  as contracts with Equifax for credit reporting or identity-proofing services.

Further, we conducted interviews with agency officials at BCFP, FTC,  DHS, IRS, SSA, and USPS to determine what actions customer and  oversight agencies took in response to the breach. The officials we  interviewed were responsible for conducting their agencies’ security  assessment of Equifax at the time of the data breach. These included  officials at each agency that had a role in responding to the Equifax  breach, such as investigators at the oversight agencies and information  security officials at the federal customer agencies.

To address both objectives, and to identify how federal requirements  apply to credit reporting agencies, we analyzed relevant federal laws to  determine the responsibilities of agencies and their contractors.  Specifically, we reviewed the following laws:

Dodd-Frank Wall Street Reform and Consumer Protection Act;

We conducted this performance audit from November 2017 to August  2018 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.

Appendix II: Comments from the Social Security Administration

Appendix III: Comments from the United States Postal Service

Appendix IV: GAO Contacts and Staff Acknowledgments

In addition to the individuals named above, John de Ferrari and John  Forrester (assistant directors); Tina Torabi (analyst-in-charge); Bethany  Benitez, Chris Businsky, Kavita Daitnarayan, Nancy Glover, Andrea  Harvey, Thomas Johnson, David Plocher, Tovah Rom, Rachel Siegel,  and Winnie Tsen made key contributions to this report.

Hackers stole the personal data of nearly 150 million people from Equifax databases in 2017.

How did Equifax, a consumer reporting agency, respond to that event? Equifax said that it investigated factors that led to the breach and tried to identify and notify people whose personal information was compromised.

In addition, three federal agencies that use Equifax services made their own security assessments and modified contracts with Equifax. Moreover, other federal agencies that oversee consumer reporting agencies started investigating Equifax and gave further advice to consumers on how to protect themselves against security breaches.


Coast Guard Acquisitions: Lessons Learned to Inform Coast Guard and NOAA Shipbuilding Efforts

Both the Coast Guard—a component of the Department of Homeland Security (DHS)—and the Department of Commerce's National Oceanic and Atmospheric Administration (NOAA) are investing significant resources to recapitalize their aging fleets of ships. Ensuring that the Coast Guard and NOAA maintain their ships and address potential capability gaps is vital for protecting national security and scientific interests.

This statement summarizes lessons that GAO has identified from its prior reviews of Coast Guard and Navy acquisitions, which can be applied to the Coast Guard's and NOAA's shipbuilding efforts. Specifically, this testimony provides information on, among other things, (1) long-term strategic planning for acquisitions, (2) the need for a sound business case, and (3) the leveraging of the Navy's acquisition resources and shipbuilding expertise. In its prior work, GAO reviewed Coast Guard and Navy programs and interviewed officials. For this testimony, GAO obtained publicly available information on NOAA's ship acquisition efforts.

GAO has found that acquisition programs can benefit from long-term strategic planning that identifies how tradeoff decisions would affect the future of the acquisition portfolio. In July 2018, GAO found the Coast Guard continues to manage its acquisitions through its annual budget process and the 5-year Capital Investment Plan. As a result of this planning process, the Coast Guard has continued to defer planned acquisitions to future years and left a number of operational capability gaps unaddressed. Incorporating the use of a long-term strategic plan and additional tradeoff discussion into the Capital Investment Plan could lead to more informed choices before irreversible commitments are made.

GAO's prior work has also found that acquisition programs should start with solid business cases before setting program baselines and committing resources. At the heart of a business case is a knowledge-based approach—successful shipbuilding programs build on attaining critical levels of knowledge at key points in the shipbuilding process before significant investments are made (see figure).

In September 2018, GAO found the Coast Guard did not have this type of sound business case when it established the program baselines for its polar icebreaker program in March 2018 due to risks in technology, design, cost, and schedule. For example, the Coast Guard's planned delivery dates were not informed by a realistic assessment of shipbuilding activities, but rather were primarily driven by the potential gap in icebreaking capabilities once the Coast Guard's only operating heavy polar icebreaker reaches the end of its service life.

Agencies have partnered with the Navy to take advantage of its resources and shipbuilding expertise, including the Coast Guard when acquiring the polar icebreakers. For example, in September 2018, GAO found that the Coast Guard and the Navy had established an integrated program office and a ship design team. These teams provided input to Navy cost estimators, who developed the polar icebreaker program's cost estimate.

GAO has previously recommended that the Coast Guard develop a 20-year fleet modernization plan, reflect acquisition trade-off decisions in its annual Capital Investment Plans, and address risks to establish a sound business case for its polar icebreakers acquisition. DHS concurred with these recommendations and is taking steps to implement them.

I am pleased to be here today to discuss key lessons and insights we  have identified from our prior work in Coast Guard and Navy acquisitions  that may be useful in informing the Coast Guard’s and the National  Oceanic and Atmospheric Administration’s (NOAA) current efforts to  recapitalize their aging fleets of ships. The Coast Guard’s multi-billion  dollar ship acquisition portfolio includes the National Security Cutters,  Offshore Patrol Cutters, Fast Response Cutters, and heavy polar  icebreakers, which collectively perform critical missions such as search  and rescue, law enforcement, and icebreaking. NOAA’s research and  survey ships comprise the largest fleet of federal research ships in the  United States. Ensuring that the Coast Guard and NOAA maintain their  ship fleets and address potential capability gaps is vital for protecting  national security and scientific interests.

My statement today provides information on: (1) long-term strategic  planning for acquisitions (2) the need for a sound business case when  acquiring new ships (3) leveraging of the Navy’s acquisition expertise and  resources and (4) considerations when selecting contracting  mechanisms. This statement is based on our extensive body of work  examining the Coast Guard’s and Navy’s acquisition efforts, including our  September 2018 report on the Coast Guard’s polar icebreaker acquisition  and July 2018 report on Coast Guard recapitalization. For the reports  cited in this statement, among other methodologies, we analyzed Coast  Guard and Navy guidance, data, and documentation, and interviewed  Coast Guard and Navy officials. Detailed information on our scope and  methodology can be found in the reports cited in this statement. In  addition to our prior work, for this statement we obtained publicly  available information from NOAA regarding its ship acquisition and  recapitalization efforts; we did not assess its efforts.

We conducted the work on which this statement is based in accordance  with generally accepted government auditing standards. Those standards  require that we plan and perform the audit to obtain sufficient, appropriate  evidence to provide a reasonable basis for our findings and conclusions  based on our audit objectives. We believe the evidence obtained provides  a reasonable basis for our findings and conclusions based on our audit  objectives.

Long-Term Strategic Planning in Acquisitions Enables Better Tradeoff Decisions

Key elements of strategic planning include establishing long-term goals  and strategies for how those goals are to be achieved. Specifically for  managing Coast Guard acquisitions, we have noted that a long-term plan  that includes acquisition implications would enable tradeoffs to be  addressed in advance, which leads to better informed choices and makes  debate possible before irreversible commitments are made to individual  programs. Without this type of plan, decision makers do not have the  information they need to better understand and address an agency’s  long-term outlook. Similarly, according to the Office of Management and  Budget’s capital planning guidance referenced by the Coast Guard’s  Major Systems Acquisition Manual, each agency is encouraged to have a  plan that justifies its long-term capital asset decisions. This plan should  include, among other things, (1) an analysis of the portfolio of assets  already owned by the agency and in procurement, (2) the performance  gap and capability necessary to bridge the old and new assets, and (3)  justification for new acquisitions proposed for funding.

In June 2014, we found that the Coast Guard—a component within the  Department of Homeland Security (DHS)—did not have a long-term fleet  modernization plan that identified all acquisitions needed to meet mission  needs over the next two decades within available resources. Without  such a plan, the Coast Guard repeatedly delayed and reduced its  capabilities through its annual budget process and did not know the  extent to which it could meet mission needs and achieve desired results.  We recommended that the Coast Guard develop a 20-year fleet  modernization plan that identifies all acquisitions needed to maintain the  current level of service and the fiscal resources necessary to build the  identified assets. DHS agreed with our recommendation but it has not yet  approved a 20-year plan.

Further, in July 2018, we found the Coast Guard continues to manage its  acquisitions through its annual budget process and the 5-year Capital  Investment Plan, which is congressionally mandated and submitted to  Congress annually. Coast Guard officials told us the Capital Investment  Plan reflects the highest priorities of the department and that trade-off  decisions are made as part of the annual budget process. However, the  effects of these trade-off decisions, such as which acquisitions would take  on more risk so others can be prioritized and adequately funded, are not  communicated in the Capital Investment Plan to key decision makers.  Over the years, this approach has left the Coast Guard with a bow wave  of near-term unfunded acquisitions, negatively affecting recapitalization  efforts, and limiting the effectiveness of long-term planning. As a result of  this planning process, the Coast Guard has continued to defer planned  acquisitions to future years and left a number of operational capability  gaps unaddressed that could affect future operations. We recommended  that the annual Capital Investment Plans reflect acquisition trade-off  decisions and their effects. DHS concurred with this recommendation and  plans to include additional information in future Capital Investment Plans  to address how trade-off decisions could affect other major acquisition  programs. According to Coast Guard officials, the Coast Guard plans to  implement this recommendation by March 2020.

Examples of other fleet modernization plans include the Navy’s annual  naval vessel construction plan (also known as the Navy’s long range  shipbuilding plan), which reflects the quantity and categories of assets  that the Navy needs to buy as well as the total number of assets in  operation for each year. While we found in March 2006 that the Navy faced challenges associated with its long range shipbuilding plan, we also  observed that such a plan is beneficial in that it lays out a strategic  approach for decision making. In October 2016, NOAA—which is within  the Department of Commerce—approved a fleet plan that is intended to  identify an integrated strategy for long-term recapitalization, including  acquisition of up to eight new ships. In March 2017, NOAA indicated that  long-term recapitalization of the NOAA fleet requires an annual, stable  funding profile on the order of its fiscal year 2016 appropriations—about  $80 million. NOAA noted that it will continue to proceed on schedule, as  laid out in its fleet plan, or make adjustments based on available funding.

Successful Acquisition Programs Begin with Sound Business Cases

Our prior work has repeatedly found that successful acquisition programs  start with solid, executable business cases before setting program  baselines and committing resources. A sound business case requires  balance between the concept selected to satisfy operator requirements  and the resources—design knowledge, technologies, funding, and time— needed to transform the concept into a product, such as a ship. At the  heart of a business case is a knowledge-based approach—we have  found that successful shipbuilding programs build on attaining critical  levels of knowledge at key points in the shipbuilding process before  significant investments are made (see figure 1).

We have previously found that key enablers of a good business case  include firm, feasible requirements; plans for a stable design; mature  technologies; reliable cost estimates; and realistic schedule targets.  Without a sound business case, acquisition programs are at risk of  experiencing cost growth, schedule delays, and reduced capabilities.

In September 2018, we found the Coast Guard did not have this type of  sound business case when it established the cost, schedule, and  performance baselines for its polar icebreaker program in March 2018.  This was primarily due to risks in four key areas:

Technology. The Coast Guard intends to use proven technologies for  the program, but did not conduct a technology readiness assessment  to determine the maturity of key technologies—which include the  integrated power plant and azimuthing propulsors— prior to setting  baselines. As a result, the Coast Guard does not have full insight  into whether these technologies, which we believe are critical  technologies and merit such an assessment, are mature. Without a  technology readiness assessment, the Coast Guard is potentially  underrepresenting technical risk and increasing design risk.

Cost. The cost estimate that informed the program’s $9.8 billion cost  baseline—which includes lifecycle costs for the acquisition,  operations, and maintenance of three polar icebreakers—substantially  met our best practices for being comprehensive, well-documented,  and accurate, but only partially met best practices for being credible.  The cost estimate did not quantify the range of possible costs over the  entire life of the program, such as the period of operations and  support. As a result, the cost estimate was not fully reliable and may  underestimate the total funding needed for the program.

Schedule. The Coast Guard’s planned delivery dates of 2023, 2025,  and 2026 for the three ships were not informed by a realistic  assessment of shipbuilding activities, but rather were primarily driven  by the potential gap in icebreaking capabilities once the Coast  Guard’s only operating heavy polar icebreaker—the Polar Star— reaches the end of its service life (see figure 2).

The Polar Star’s service life is estimated to end between fiscal years 2020  and 2023. This creates a potential heavy polar icebreaker capability gap  of about 3 years, if the Polar Star’s service life were to end in 2020 and  the lead polar icebreaker were to be delivered by the end of fiscal year  2023 as planned. If the lead ship is delivered later than planned in this  scenario, the potential gap could be more than 3 years. The Coast Guard  is planning to recapitalize the Polar Star’s key systems starting in 2020 to  extend the service life of the ship until the planned delivery of the second  polar icebreaker (see figure 3).

Further, our analysis of selected lead ships for other shipbuilding  programs found the icebreaker program’s estimated construction time  of 3 years is optimistic. An unrealistic schedule puts the Coast Guard  is at risk of not delivering the icebreakers when promised and the  potential gap in icebreaking capabilities could widen.

Design. The Coast Guard set program baselines before conducting a  preliminary design review—a systems engineering event that is  intended to verify that the contractor’s design meets the requirement  of the ship specifications and is producible—which puts the program  at risk of having an unstable design, thereby increasing the program’s  cost and schedule risks. Although the Coast Guard set the program  baselines prior to gaining knowledge on the feasibility of the selected  shipbuilder’s design, it has expressed a commitment to having a  stable design prior to the start of lead ship construction. This is  consistent with shipbuilding best practices we identified in 2009.

To address these four areas and other risks, we made six  recommendations to DHS, Coast Guard, and the Navy in our September  2018 report. DHS concurred with all six recommendations and identified  actions it planned to take to address them.

In its October 2016 fleet plan, NOAA indicated the need to construct up to  eight new ships by 2028 to maintain its capabilities for at-sea  requirements. Ensuring a sound business case for each acquisition will  be important as NOAA moves forward.

Leveraging Navy’s Shipbuilding Experience May Create Efficiencies

Given the Navy’s experience in shipbuilding, agencies have partnered  with the Navy to take advantage of its expertise. For example, in April and  September 2018, we found examples of how the Coast Guard had  leveraged the Navy’s resources and acquisition approaches when  acquiring the polar icebreakers, including:

Establishing an integrated program office and potentially using  funding from both organizations. In 2016, in response to a  congressional report, the Navy and the Coast Guard established an  integrated program office to acquire the icebreakers for Coast Guard  operations. This relationship was officially memorialized through three  memorandums in 2017.

Given potential plans to fund the polar icebreaker program with both  Navy and Coast Guard appropriations, the Navy and the Coast Guard  had a memorandum of agreement with a budgeting and financial  management appendix. In September 2018, however, we found that  the Coast Guard and the Navy interpreted the meaning of “cost  overruns” differently in the context of their agreement. We also  found that the agreement itself did not address how the Coast Guard  and the Navy plan to handle any cost growth stemming from changes  to the scope, terms, and conditions of the detail design and  construction contract. We recommended that the Coast Guard, in  collaboration with the Navy, revise the agreement to clarify and  document how cost growth in the polar icebreaker program, including  changes in scope, will be addressed between the two organizations.  The Coast Guard concurred with this recommendation and plans to  update the agreement by March 2019.

Establishing an integrated ship design team. The ship design team  includes Coast Guard and Navy technical experts who develop ship  specifications based on the polar icebreaker program’s operational  requirements document. The ship design team is under the  supervision of a Coast Guard ship design manager, who provides all  technical oversight for development of the polar icebreaker’s design.

Leveraging Navy cost estimating and contracting functions. With  input from the integrated program office and ship design team, Navy  cost estimators developed the polar icebreaker program’s cost  estimate, which informed the program’s cost baselines and  affordability constraints. In addition, the Navy plans to award the polar  icebreaker’s detail design and construction contract under the Navy’s  contracting authority and use a tailored DHS acquisition process.

Supplementing the DHS acquisition process with the Navy’s gate  review process. Coast Guard and Navy agreed to manage the polar  icebreaker program using a tailored acquisition approach that  supplements DHS acquisition decision event reviews with additional  “gate” reviews that were adopted from Navy’s acquisition processes.  The gate reviews allow both Coast Guard and Navy leadership to  review and approve key documents before proceeding to the  acquisition decision events. Each acquisition decision event is also  overseen by acquisition oversight board with members from both the  Coast Guard and the Navy (see figure 4).

By collaborating with the Navy, the Coast Guard is leveraging the Navy’s  experience in ship design, cost estimating, contracting, and other  shipbuilding processes. This partnership may allow the Coast Guard to  more efficiently manage the polar icebreaker program.

In March 2017, NOAA indicated that it had partnered with the Navy  through an interagency agreement to leverage the Navy’s acquisition  expertise for Auxiliary General Purpose Oceanographic Research  Vessels, which will be the basis for a new class of NOAA ships. In April  2018, the Navy released the request for proposal for the preliminary  contract design of this new class of ships.

Estimated Savings and Requirements Stability Should be Considered When Selecting Contracting Mechanisms

When acquiring multiple quantities of a product, agencies generally have  several options for contracting mechanisms. Annual contracting, which  can be considered the typical method, refers to awarding a contract for  one year’s worth of requirements. Annual contracting allows for the use of  options for subsequent requirements. Options give the agency the  unilateral right to purchase additional supplies or services called for by  the contract, or to extend the term of the contract. Besides annual  contracting with options, agencies may also be able to choose among  other contracting mechanisms—multiyear contracting and “block buy”  contracting, which are discussed in more detail below.

Multiyear Contracting Requirements and Considerations

Multiyear contracting allows agencies to acquire known requirements for  up to 5 years under a single contract award, even though the total funds  ultimately to be obligated may not be available at the time of contract  award. Before DOD and Coast Guard can enter into a multiyear contract,  certain criteria must be met. Table 1 provides some of the multiyear  contracting requirements for DOD and the Coast Guard.

Multiyear contracts are expected to achieve lower unit costs compared to  annual contracts through one or more of the following sources: (1)  purchase of parts and materials in economic order quantities, (2)  improved production processes and efficiencies, (3) better utilized  industrial facilities, (4) limited engineering changes due to design stability  during the multiyear period, and (5) cost avoidance by reducing the  burden of placing and administering annual contracts. Multiyear  procurement also offers opportunities to enhance the industrial base by  providing contractors a longer and more stable time horizon for planning  and investing in production and by attracting subcontractors, vendors,  and suppliers. However, multiyear procurement entails certain risks that  must be balanced against the potential benefits, such as the increased  costs to the government should the multiyear contract be changed or  canceled and decreased annual budget flexibility for the program and  across an agency’s portfolio of acquisitions.

In February 2008, we found that it is difficult to precisely determine the  impact of multiyear contracting on procurement costs. For example, for  three multiyear procurements (Air Force’s C-17A Globemaster transport,  the Navy’s F/A-18E/F Super Hornet fighter, and the Army’s Apache  Longbow helicopter), we identified unit cost growth ranging from 10 to 30  percent compared to original estimates, due to changes in labor and  material costs, requirements and funding, and other factors. In some  cases, actual costs for the multiyear procurement were higher than  original estimates for annual contracts. We noted that we could not  determine how cost growth affected the level of savings achieved, if any,  because we did not know how an alternative series of annual contracts  would have fared. Although programs using annual contracts also have  unit cost growth, it is arguably more problematic when using multiyear  contracting because of the up-front investments and the government’s  exposure to risk over multiple years.

Block buy contracting generally refers to special legislative authority that  agencies seek on an acquisition-by-acquisition basis to purchase more  than one year’s worth of requirements, such as purchasing supplies in  economic order quantities. Unlike multiyear contracting, block buy  contracting does not have permanent statutory criteria and, therefore, can  be used in different ways.

We have previously analyzed several cases where block buy contracts  were considered or used and have not found evidence of savings. For  example:  In September 2018, we found that for the polar icebreaker program,  the Navy gave offerors an opportunity to provide the estimated  savings that the government could achieve if it were to take a “block  buy” approach in purchasing the ships or purchasing supplies in  economic order quantities. The Navy told us that they did not  receive any formal responses from industry on potential savings from  block buys or economic order quantities.

In April 2017, we found that the Navy’s Littoral Combat Ship contracts’  block buy approach could affect Congress’s funding flexibility.  Specifically, the block buy contracts provided that a failure to fully fund  a purchase in a given year would make the contract subject to  renegotiation, which provides a disincentive to the Navy or Congress  to take any action that might disrupt the program because of the  potential for the government to have to pay more for ships.

In February 2005, we found that the Navy believed that a block-buy  contract contributed to increased material costs for the Virginia class  submarine. Under this block-buy contract, subcontracts for  submarine materials were for single ships spread over several years.  According to the Navy, this type of acquisition approach did not take  advantage of bulk-buy savings and incurred the risk that funding will  not be available in time to order the material when needed.

Based on our prior work, it is important for agencies to consider multiple  factors such as estimated savings, the stability of the requirements,  quantities required, and potential contract terms and conditions before  committing to a contracting mechanism approach.

In conclusion, as the Coast Guard and NOAA continue investing taxpayer  dollars to modernize their fleets, they could benefit from the lessons  learned from prior recapitalization and acquisition efforts. It is important  for agencies to develop strategic and comprehensive approaches for  managing their respective portfolios so that future requirements and  capability gaps can be addressed in a timely manner. For each  acquisition within their portfolios, agencies should ensure that they have  established a sound business case before committing significant  resources. Additionally, leveraging the Navy’s resources and expertise in  shipbuilding, such as by establishing integrated teams, could be  beneficial by helping agencies be more efficient. Finally, when it comes to  contracting mechanisms, factors such as estimated savings and program  risks should be assessed before committing to a particular approach.

Chairman Sullivan, Ranking Member Baldwin, and Members of the  Subcommittee, this concludes my prepared statement. I would be  pleased to respond to any questions.

If you or your staff have any questions about this statement, please  contact Marie A. Mak, (202) 512-4841 or makm@gao.gov. In addition,  contact points for our Offices of Congressional Relations and Public  Affairs may be found on the last page of this statement. Individuals who  made key contributions to this testimony include Rick Cederholm,  Assistant Director; Peter Anderson; Laurier Fish; Kurt Gurka; Claire Li;  and Roxanna Sun.

This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.

The Coast Guard and National Oceanic and Atmospheric Administration (NOAA) collectively spend billions of dollars to replace aging ships that conduct search and rescue, icebreaking, and research missions.

We testified on how lessons learned from our extensive work on ship acquisitions could be used to inform how the Coast Guard and NOAA buy ships. These include:

establishing a sound business case before committing resources

partnering with the Navy to use some of its shipbuilding resources and experience

estimating the costs and risks of different contracting approaches before committing to one