Input:
	Background

In the international sector, the routes that airlines can fly, the frequency of their flights, and the fares they can charge are governed by 72 bilateral agreements between the United States and other countries. Many of these agreements, including the accord with the United Kingdom, are very restrictive. Since the late 1970s, U.S. policy has been to negotiate agreements that substantially reduce or eliminate bilateral restrictions. DOT’s Office of the Assistant Secretary for Aviation and International Affairs, with assistance from the State Department, is responsible for negotiating these agreements and awarding U.S. airlines the right to offer the services provided for in those agreements.
In January 1993, DOT granted antitrust immunity to the Northwest/KLM alliance in conjunction with the U.S.-Netherlands open skies accord. In April 1995, DOT issued the U.S. International Aviation Policy Statement in which it reiterated its desire for open skies agreements and endorsed the growing trend toward alliances between U.S. and foreign airlines. Since issuing that statement, DOT has negotiated a number of more liberal agreements, including open skies accords with Germany and numerous smaller European countries. In 1996, the agency granted antitrust immunity to the alliances between United and Lufthansa, which is Germany’s largest airline, and between Delta and several smaller European carriers. In announcing their proposed alliance, American Airlines and British Airways emphasized that they are at a competitive disadvantage with these alliances because the airlines in those alliances can, among other things, better coordinate service and jointly set fares.
Despite success in negotiating open skies agreements throughout much of Europe, DOT has had very little success with the United Kingdom, our largest aviation trading partner overseas. The current U.S.-U.K. accord, commonly known as “Bermuda II,” was signed in 1977 after the British renounced the prior agreement. Bermuda II restricts the number of U.S. airlines that can serve Heathrow to two carriers—currently American Airlines and United Airlines. DOT has expressed increasing dissatisfaction with Bermuda II and attempted to negotiate increased access for U.S. airlines to Heathrow. Negotiations with the British take on particular importance because of the size of the U.S.-U.K. markets. In 1996, 12 million passengers traveled on scheduled service between the United States and the United Kingdom, which is more than twice that for the U.S.-Germany markets and three times that for the U.S.-France markets.
Competition is restricted in the U.S.-U.K. markets because Bermuda II, among other things, sets limits on the amount of service airlines can provide and prevents all U.S. airlines, except American and United, from flying to and from Heathrow. These restrictions on competition result in fewer service options for U.S. and British consumers. In addition, they also likely result in higher airfares. However, the extent to which airfares are higher is uncertain. DOT does not have data on the fares paid by passengers flown by BA or Virgin Atlantic if those passengers’ itineraries did not involve a connection with a U.S. carrier, because it has generally not required foreign airlines to report data from a sample of their tickets, as it requires U.S. airlines to do.
Bermuda II’s limits on competition also disproportionately affect U.S. airlines. In contrast to the continuing restrictions placed on U.S. airlines, the United Kingdom was successful in negotiating increased access for British carriers to the U.S. markets in the early 1990s. Partly as a result, between 1992 and 1996, the British carriers’ share of the U.S.-U.K. markets rose from 49 percent to 59 percent. As figure 1 shows, this gain by British Airways and Virgin Atlantic has come primarily at the expense of the U.S. airlines that are not allowed to serve Heathrow.

	European Reviews Considering a Range of Competitive Issues; U.S. Reviews Pending

The proposed AA/BA alliance is subject to review by the European Commission, several agencies within the U.K. government, and DOT. The European Commission, the U.K. Department of Trade and Industry, and DOT have decision-making authority over the proposed alliance. The U.K. Office of Fair Trading and the U.S. Department of Justice’s Antitrust Division (Justice) have advisory roles and provide analysis and comments to their respective decisionmakers. According to officials, the process for reviewing the AA/BA alliance is complicated by the fact that it is new and untested and some European laws have not previously been applied to airline alliances. The European regulatory agencies have nearly completed their reviews, and the formal U.S. review has yet to get under way.
Both the European and the U.S. reviewers have access to extensive information—including confidential proprietary data—to evaluate the competition issues arising from the AA/BA and other alliances. This information includes data on airline capacity, market shares on specific routes, and passenger travel statistics.

		European Commission’s Review Forthcoming

In July 1996, because of concerns about the anticompetitive effects of the alliances, the European Commission’s Directorate General for Competition initiated a review of the proposed AA/BA alliance and three other ongoing alliances: United/Lufthansa/SAS; Delta/Swissair/Sabena/Austrian Airlines; and Northwest/KLM. This review is examining a broad range of competition issues on AA/BA, including access to slots and facilities at Heathrow Airport; the frequency of service offered by AA and BA, which would dominate the market at Heathrow; and AA/BA’s sales and marketing practices, such as frequent flier programs, travel agent commission overrides, corporate incentive agreements, and computer reservation system practices.
The European Commission’s Directorate General for Competition expects to issue its draft remedies for addressing the anticompetitive effects of AA/BA within the coming weeks. Officials added that their reports on other alliances should be done soon afterwards. Various parties then have the opportunity to provide comments and possibly participate in oral hearings on the draft remedies. After it obtains comments from the interested parties, the Directorate General for Competition prepares a document outlining its recommendations on whether to approve the alliance with conditions or to withhold approval, and submits the document to the European Commission’s Member States Advisory Committee for review. After the Advisory Committee’s review, the Directorate General for Competition incorporates appropriate comments and prepares its draft final ruling, which either lays out the conditions that must be met in order for the alliance to be approved or disapproves the alliance. It becomes the ruling of the Commission when it is adopted by the European Commission’s College of Commissioners. Thus, the European Commission’s final decisions are not expected for several more months.

		United Kingdom Awaiting European Commission’s Draft Remedies

The U.K. Department of Trade and Industry is conducting its own review of the proposed AA/BA alliance. It has asked the U.K. Office of Fair Trading to investigate and provide advice on the proposed alliance. The Office of Fair Trading investigation, which began in June 1996, examined a broad range of issues raised by the proposed alliance, including competitive impacts of the alliance on routes, hubs, and networks within the U.S.-European markets; the frequency of service in the U.S.-U.K. markets; the pooling of frequent flier programs; and access to slots at Heathrow. The Office of Fair Trading issued a draft report in December 1996 that called for AA/BA to, among other things, make available to other airlines up to 168 slots per week at Heathrow for use only on U.S.-U.K. transatlantic services and allow third-party access to their joint frequent flier program in those cases in which that party does not have access to an equivalent program. The report took into account the views of third parties on conditions that should be placed on the alliance to remedy competition concerns. Before they provide their final advice on the proposed AA/BA alliance, the U.K. Office of Fair Trading is awaiting the European Commission’s publication of its draft remedies. The Secretary of State for Trade and Industry will decide on the case after receiving final advice from the Office of Fair Trading.
The U.K. agencies reviewing the proposed AA/BA alliance are in contact with the European Commission and have a duty to cooperate with it. If the United Kingdom’s decision on the proposed AA/BA alliance differs from the European Commission’s, the differences will have to be reconciled. According to European Commission officials, this could require a judgement by the European Court of Justice in Luxembourg, which ultimately judges the sound application of the European Union’s treaties by the institutions of the Union or the member states.

		U.S. Reviews Not Proceeding Until AA and BA Complete the Application Process

In the United States, DOT has the authority not only for approving airline alliances, but also for granting those alliances immunity from the antitrust laws. In determining whether to grant approval and antitrust immunity for an airline alliance, DOT must find that the alliance is not adverse to the public interest. DOT cannot approve an agreement that substantially reduces or eliminates competition unless the agreement is necessary to meet a serious transportation need or to achieve important public benefits that cannot be met or that cannot be achieved by reasonably available alternatives that are materially less anticompetitive. Public benefits include considerations of foreign policy concerns. In general, DOT has found code-sharing arrangements to be procompetitive and therefore consistent with the public interest because they create new services, improve existing services, lower costs, and increase efficiency for the benefit of the traveling and shipping public. As with the other international code-sharing alliances that the United States has approved, DOT officials explained that they will not approve AA’s and BA’s proposed code-sharing alliance with antitrust immunity unless the United States has reached an open skies agreement with the United Kingdom.
According to U.S. law, DOT is to give the Attorney General and Secretary of State “an opportunity to submit written comments about” the application. In practice, DOT and Justice officials told us that they stay in contact throughout the application process regarding their respective analyses of airline alliances.
Justice’s role is advisory and is performed pursuant to the Sherman Antitrust Act and the Clayton Act, which set forth antitrust prohibitions against restraints of trade. To determine if a proposed alliance is likely to create or enhance market power and allow firms to maintain prices above competitive levels for a significant period of time, Justice applies its Horizontal Merger Guidelines, which describe the analytic framework and the specific standards to be used in analyzing mergers and alliances. A key concern is whether entry into the market would deter or counteract a proposed merger’s potential for harm.
DOT officials told us that in reviewing other code-sharing alliances, the Department did not apply any written set of guidelines in its analysis. Rather, DOT has discretion in deciding the factors it will analyze and in past applications for international code-sharing alliances has considered issues raised in petitions by interested parties. Those issues generally involved market power between particular hub airports, except in one instance. In response to United’s application for antitrust immunity in its code sharing with Lufthansa, TWA contended that Lufthansa’s control over travel agents, both through dominance of the computer reservation system and through commissions and override payments, was a serious impediment to new airlines’ entry into the U.S.-Germany marketplace. In making its final decision, DOT addressed the concern about the computer reservation system, but wrote that other forums were more appropriate for addressing the other concerns.
DOT has considered, but not always completely agreed with, Justice’s comments on the extent to which particular code-sharing alliances pose threats to competition in individual markets. In the case of United/Lufthansa, for example, Justice was concerned that competition could be reduced in two nonstop markets—Chicago-Frankfurt and Washington D.C. (Dulles)-Frankfurt. DOT agreed, and “carved out” (i.e., withheld antitrust immunity from) specific airline operations in those two markets. In considering Delta’s proposed alliance, Justice identified seven nonstop markets that raised concerns of reduced competition. DOT agreed with Justice on three markets (Atlanta-Brussels, Atlanta-Zurich, and Cincinnati-Zurich) and withheld antitrust immunity for specific operations there; DOT generally disagreed with Justice and imposed different conditions on the other four city-pairs, each of which involved travel from New York.
In the case of the proposed AA/BA alliance, U.S. reviews are essentially on hold. DOT cannot move forward with its review of the alliance until AA and BA file the necessary documents to make their application complete. DOT officials do not believe that AA and BA will complete their application until after the European Commission issues its draft remedies on the alliance, and BA officials confirmed that to us. Once DOT determines that the application is complete, interested parties—including Justice—will have 30 business days to comment on the alliance. Interested parties and AA/BA will then have another opportunity for rebuttal comments.
According to its regulations, DOT may order a full evidentiary hearing at the end of the comment period. Requests for DOT to hold an oral evidentiary hearing must specify the material issues of fact that cannot be resolved without such a hearing. However, DOT has the discretion by statute whether to hold a hearing, even if requested to do so by the Attorney General or Secretary of State.
Although the AA/BA application is not complete, DOT has already proposed holding an oral hearing before a departmental “decisionmaker” so that interested parties can express in person their particular opinions and views on the issues concerning the AA/BA alliance. AA and BA have characterized any type of hearing as merely a delaying tactic. Six airlines opposing the proposed AA/BA alliance, on the other hand, have argued that the kind of hearing DOT has proposed is not sufficient; they contend that questions of fact could only be adequately explored and resolved with an oral evidentiary hearing before an administrative law judge. For example, AA and BA have contended that slots are easily obtainable at Heathrow and that Gatwick is an available and competitive alternative. Other airlines have testified that it is impossible to obtain slots at Heathrow that are timely and competitive, that Gatwick is full, and, in any event, that Gatwick is not a reasonable alternative to Heathrow, especially for business travelers. DOT has told us that it may reconsider its proposed schedule for reviewing the AA/BA alliance, along with the type of hearing it would hold.
We are not in a position to assess whether material issues of fact remain to be resolved in the proposed AA/BA alliance, but we believe it is critical that DOT avail itself of all empirical data in making its determination. Although DOT considers code-sharing agreements to be procompetitive, it has not collected sufficient data to fully analyze the long-term effects of such alliances. In our 1995 report on alliances, we found that DOT’s ability to monitor the impact of alliances was limited because foreign airlines are not required to report data from a sample of their tickets involving travel to or from the United States. In addition, U.S. carriers were not required to report traffic flying on a code-share flight. Since that report, DOT has required foreign airlines in alliances that have been granted antitrust immunity to report data on traffic to and from the United States. Even so, alliances have not been sufficiently studied to determine their long-term consequences or to allay fears that such alliances may hinder competition in the long term.

	AA/BA Alliance Would Dominate, and Competition Would Decline Unless Substantial New Entry Occurred

The proposed AA/BA alliance has network benefits and could increase competition in markets between the United States and the European continent, the Middle East, and Africa because the number of alliances competing in these markets would increase from three to four. However, it raises serious competition issues in U.S.-U.K. markets. Competition issues arise because, under the alliance, rather than competing with each other, the two largest airlines in U.S.-U.K. markets would in essence be operating as if they were one airline. For the month of March 1998, an analysis of Official Airline Guide data indicates that AA and BA account for nearly 58 percent of the seats available on scheduled passenger flights between the United States and London. Moreover, as of March 1998, the two airlines account for 37 of the 55 total daily roundtrips (67 percent) between the United States and Heathrow offered by scheduled U.S. and British airlines.
AA and BA currently compete with one another from six U.S. airports to Heathrow and from Dallas to London’s Gatwick airport. New York’s importance—Kennedy and Newark—is underscored by the fact that the market between these airports and Heathrow accounts for nearly one-fifth of all U.S.-London service and is more than three times the size of the Los Angeles-Heathrow market. At five of the seven airports where AA and BA compete—Kennedy, Chicago, Boston, Miami, and Dallas—these two airlines account for over 70 percent of the service, and at Los Angeles, they account for almost 50 percent. In addition, in Boston, AA and BA currently are the only carriers that serve Heathrow, and in the Dallas market, they are the only nonstop competitors. Figure 2 shows the location of seven cities where AA and BA currently compete with each other.
Our review of current competitive conditions in the New York-Heathrow (Kennedy and Newark) market indicates that substantial new entry would need to occur to provide competition because of the (1) size of the market, (2) large share of that market currently held by AA and BA, (3) frequency of service in that market—15 flights a day—provided by the two airlines (compared with 3 daily flights by United and 3 daily flights by Virgin Atlantic), and (4) substantial portion of the market accounted for by time-sensitive business travelers. New entry could come from Delta and TWA, which have hubs at Kennedy, and from Continental from its hub at nearby Newark. In the Boston and Chicago markets, new nonstop service may offset the effect on competition caused by joining the two largest competitors in those markets.
In the event of the alliance, time-sensitive business travelers in the Dallas-London and Miami-London markets will have fewer nonstop options and thus will likely pay higher fares for nonstop service. In the Dallas-London market, AA and BA are currently the only competitors providing nonstop service. In the Miami-London market, the number of nonstop competitors would fall from three to two. Several carriers told us that it is unlikely that a new U.S. competitor would attempt nonstop London service from either Miami or Dallas, since no carrier besides American maintains a large enough network from either of those airports to provide critical “feed” traffic. As a result, DOT will need to carefully examine the unique circumstances associated with these markets.
At another eight U.S. cities, either BA or AA has a monopoly on nonstop service to either Heathrow (two cities) or Gatwick (six cities). In our October 1996 report on domestic competition, we found that competition was most limited and airfares highest in markets dominated by one airline. Figure 3 shows the location of eight cities where either AA or BA has a monopoly.
If slots at Heathrow were made available, several U.S. carriers might serve London from their primary or secondary hubs. These slots would provide new competition to AA and BA on several routes that they currently monopolize. In particular, U.S. carriers could provide new nonstop service in the Philadelphia, Charlotte, and Pittsburgh markets. They could also provide new nonstop service from cities that are currently unserved with nonstop flights, such as Cleveland.
In addition to increased nonstop competition, carriers could provide consumers with new one-stop options to compete with the alliance’s nonstop services in markets that include their primary or secondary hubs. For example, if Northwest Airlines, which is one of the largest carriers in Seattle, could serve Heathrow from its hub in Minneapolis, consumers in Seattle would have more and better connecting opportunities to Heathrow, and hence competition would be greater than it is today with BA’s being the only nonstop carrier. However, for time-sensitive travelers, these one-stop options may not be very competitive. Consumers in cities such as Des Moines or Fargo with no nonstop service to London, would experience an increase in the number of one-stop options offered by competing airlines to Heathrow.

		Air Carriers Vary on the Effort Needed to Overcome Combined AA/BA Strength

When we testified last June on the proposed alliance, representatives from six major U.S. airlines told us that they would need a total of 38 daily roundtrip slots (or 532 weekly slots) at Heathrow, along with gates and facilities, to compete with the AA/BA alliance. For this testimony, we discussed the issue of access to Heathrow with officials from each major U.S. carrier, as well as with Virgin Atlantic. This time, some were not as clear on the number of slots they would need to be competitive. The officials emphasized that gaining a sufficient number of commercially viable slots, gates, and facilities at Heathrow was critically important for them to be able to compete effectively against the alliance, and several expressed doubt that the proposed alliance could be sufficiently restructured to prevent it from being inherently anticompetitive.
The carriers’ representatives expressed a range of views on the actions needed to compete effectively against the proposed alliance. For example, officials from Continental discussed the importance of flight frequency, which they argued is vital for business travelers, who represent the most valued passenger because of the revenue generated by business travel. For Continental to be able to compete in the New York-London market, where, they said, AA/BA would operate what amounts to a virtual shuttle, they argued that an additional three flights between Newark and London on top of their current schedule would not be sufficient. They believed they would need an additional six flights per day.
Officials from United Airlines, which already participates in a global alliance, suggested that their alliance would compete effectively with AA/BA for many points beyond Heathrow. However, because of the importance of Heathrow, they would like to create a greater presence for their entire alliance. Thus, United officials did not indicate a desired number of slots and gates needed at Heathrow but spoke about the importance of having its STAR alliance partners (Air Canada, Thai, Varig, SAS, and Lufthansa) operate out of a single terminal at Heathrow.
On the other hand, officials from Delta, which also participates in a global alliance, found the proposed AA/BA alliance to be highly anticompetitive and argued that the best way to protect the traveling and shipping public would be to disapprove the proposed alliance. Failing that, Delta officials have testified that the respective governments should guarantee that competing carriers will have unrestrained opportunities to provide service between the United States and London and receive a significant number of commercially viable slots and airport infrastructure to support those services. They suggested a minimum of 800 weekly peak-period slots would be required to provide sufficient competition at Heathrow.
Virgin Atlantic officials concluded that determining the number of slots needed for a carrier to compete successfully in the U.S.-U.K. markets is difficult, but that BA would need to divest itself of a “very large” number of slots to make successful competition by another airline (besides American) a realistic possibility.
As we testified last year, as a practical matter, because of a limited number of slots available at Heathrow, AA and BA would likely need to have slots transferred from them and made available to competing airlines. If the proposed alliance is approved and the regulatory agencies decide how many slots and gates should be made available, it is uncertain how long it would take the British Airports Authority, which owns and operates seven U.K. airports, including London’s Heathrow and Gatwick airports, to actually make them available to new airlines. For example, according to the British Airports Authority, it probably will not have the facilities to allow the STAR alliance to locate all of its members within the same terminal until Heathrow opens the new Terminal 5, which is not scheduled to open before the fall of 2004.
If approved, the AA/BA alliance would bring a history of competitive service to London. Many other airlines that do not have a history of service to London, on the other hand, would have no such advantage. DOT will have to address this issue because it will be critical for new carriers to obtain access to commercially viable slots, as well as needed gates and facilities, at the same time as the proposed alliance begins joint operations. Some have suggested that AA and BA “phase in” their alliance over time, in part to give other carriers the time needed to establish themselves. If this happened, new airlines’ operations should be phased in to coincide with the alliance.

	Airline Sales and Marketing Practices May Further Enhance Market Dominance Over Smaller, Nonaligned, and New Entrant Carriers

According to airline officials, aviation experts, and consumer groups we interviewed, restrictions on access to slots and gates at Heathrow Airport are the most significant barriers to competition in U.S.-U.K. markets, but sales and marketing practices—which include frequent flier programs, travel agent commission overrides, multiple listings on computer reservation systems, and corporate incentive programs—may also reduce competition. They do so by reinforcing market dominance at hubs and impeding successful entry by new carriers and existing carriers into new markets, which can lead to higher fares. However, measuring the impact of these practices on fares is difficult, and limiting them would involve a trade-off between their anticompetitive effect and the consumer benefits that some of them bring.
In October 1996, we reported that sales and marketing strategies, when used by incumbent airlines in U.S. domestic markets, make it difficult for nonincumbents to enter markets dominated by an established airline. The strength of these programs depends largely on an airline’s route networks, alliance memberships, and hubs. If an airline is already dominant in a given airport, these programs will serve to reinforce this dominance. In particular:
Travel agent commission overrides encourage travel agencies to book travelers on one airline over another on the basis of factors other than price.
Frequent flier programs encourage travelers to chose one airline over another on the basis of factors other than price.
Corporate fare agreements make it more difficult for point-to-point carriers to compete for corporate business.
Bias in the computer reservation systems, in which multiple listings of a single flight offered by an alliance partner crowd the first few screens in U.S. systems, makes the booking of an alliance flight more likely.
In our October report, we noted that travel agent commission overrides and frequent flier programs are targeted at business fliers and encourage them to use the dominant carrier in each market. Because business travelers represent the most profitable segment of the industry, airlines in many cases have chosen not to enter, or quickly exit, domestic markets where they did not believe they could overcome the combined effect of these strategies and attract a sufficient amount of business traffic.
AA, which is credited with having first created frequent flier programs in 1981, is reputed to have the largest frequent flier program in the world, with more than 30 million members. Continental has more than 15 million members. European airlines, on the other hand, tend to have much smaller frequent flier memberships. BA’s program, for example, has approximately 1 million members. The difference in memberships compared with U.S. carriers is due to their relative newness among European carriers and U.S. programs’ tending to allow members to accumulate miles for activities other than flying (e.g., through car rentals or stays at hotels), while European carriers’ programs are more restrictive in scope.
Some airline officials we interviewed expressed concern that the scope of AA’s and BA’s combined route network and flight frequency, in combination with sales and marketing practices, would effectively preclude competition by other carriers in the U.S.-U.K. markets, especially at BA-dominated Heathrow. These carriers argued that the alliance would be able to exercise such market power, especially in relation to travel agents and corporate fare products, that other carriers would not be able to attract key business traffic. Officials from Continental Airlines told us that the problem with the sales and marketing practices of the combined AA/BA alliance would be their effect on enhancing AA/BA’s dominance of market share. They said that rather than restrict AA/BA in combining their frequent flier programs, travel agent commission overrides, corporate incentive agreements, and computer reservation system practices, DOT should not grant antitrust immunity to AA/BA. TWA officials also said that these sales and marketing practices are anticompetitive and their use by the proposed alliance should be restricted. Officials from Virgin Atlantic, noting the strength and market dominance of AA and BA, questioned whether any mitigating conditions would be sufficient to limit the competitive advantage the two airlines would have if joined in a code-sharing partnership.
However, United, Delta, and Northwest—each of which participates in its own global code-sharing alliance—generally disagreed that any of these sales and marketing practices represented significant barriers to their ability to compete. United told us that its alliance would compete with any other both in terms of their networks and their various sales and marketing practices. US Airways also indicated that it was not concerned with sales and marketing practices, as long as it had access to sufficient Heathrow slots and gates.
Outside experts on airline competition had varying opinions on the degree to which sales and marketing practices stifle competition. While none had done research specifically on how these practices affect international air transport markets, some said frequent flier programs do not raise entry barriers for large worldwide carriers because they all have relatively strong frequent flier programs and extensive route networks. However, point-to-point carriers may be at an additional disadvantage when competing against carriers with both large route networks and strong frequent flier programs. For example, while AA and BA are perceived to have considerable advantages in their frequent flier programs compared with other nonallied or point-to-point airlines, the differences are relatively minor when compared with other U.S.-European alliances. Even so, these experts said it is almost impossible to measure the degree to which sales and marketing practices impede competition.
We were unable to obtain any data on these sales and marketing practices. The airlines are not required by law to report this information to DOT, and GAO has no right of access to commercially owned data. However, we know of at least two lawsuits alleging that BA has engaged in certain sales and marketing practices that are anticompetitive in nature. However, because these actions have not yet entered the trial phase, we have been unable to obtain detailed information on the alleged economic damage stemming from BA’s practices, or BA’s evidence to the contrary.
In past alliances, DOT has not restricted partner airlines in their use of frequent flier programs, travel agent commission overrides, or corporate fare packages. It has, in some of the alliances, withheld antitrust immunity from the airlines’ coordination of the management of their financial interests in computer reservation system companies. While restrictions on other sales and marketing practices would be unprecedented, the European Commission, as noted earlier, is considering whether to address sales and marketing practices with all alliances. DOT and some U.S. carriers are concerned that the European Commission would so broadly regulate the industry’s practices.
The outside experts we interviewed concurred that restrictions on sales and marketing practices in alliances should not be imposed. They believed that any restrictions on the pooling of frequent flier programs, for example, would reduce the benefits that accrue to travelers while doing nothing to address the underlying issue of market dominance. Moreover, they said it would be difficult to limit alliance members’ use of these marketing practices without eliminating them altogether; banning them involves a trade-off between their anticompetitive effect and the consumer benefits that some of them bring.
In summary, Mr. Chairman, as a result of the challenges in addressing the barriers to entry at Heathrow, significant intergovernmental agreement will be needed well beyond the scope of prior open skies agreements. If the U.S. government is successful in obtaining an open skies agreement with the United Kingdom, and that agreement provides for sufficient access to Heathrow, significant new entry in the U.S.-U.K. markets would likely provide substantial benefits for consumers in both countries in terms of lower fares and better service. However, because these markets have been heavily regulated for 2 decades, the incumbent airlines enjoy a competitive advantage over new carriers in the U.S.-London markets. Because of AA’s and BA’s dominance at certain airports and extensive networks, that advantage may be further strengthened by sales and marketing practices. Thus, it will be important that new competitors are able to initiate their service no later than the time at which the AA/BA alliance becomes operational.
How much access would be needed for other airlines to effectively compete, and what other conditions should be imposed on the alliance can only be determined after careful analysis of the facts to ensure that over the long run, consumers benefit. While we recognize that ultimately, decisions on all conditions must inevitably reflect numerous policy judgments, public policy should be based on significant quantitative analysis of the factors at issue, rather than anecdotal evidence. At least four governmental bodies—DOT, Justice, the European Commission, and the U.K. Department of Trade and Industry—have the ability to get the data needed for such analyses. Only then can the public be assured that such important international policy is grounded on a sound basis and that consumers benefit, both in the short and long term.
Mr. Chairman, this concludes my prepared statement. Our work was conducted in accordance with generally accepted government auditing standards. We would be pleased to respond to any questions that you or any Member of the Subcommittee may have.

Related GAO Products

International Aviation: Competition Issues in the U.S.-U.K. Market (GAO/T-RCED-97-103, June 4, 1997).
International Aviation: DOT’s Efforts to Promote U.S. Air Cargo Interests (GAO/RCED-97-13, Oct. 18, 1996).
Airline Deregulation: Barriers to Entry Continue to Limit Competition in Several Key Domestic Markets (GAO/RCED-97-4, Oct. 18, 1996).
International Aviation: DOT’s Efforts to Increase U.S. Airlines’ Access to International Markets (GAO/T-RCED-96-32, Mar. 14, 1996).
International Aviation: Better Data on Code-Sharing Needed by DOT for Monitoring and Decisionmaking (GAO/T-RCED-95-170, May 24, 1995).
International Aviation: Airline Alliances Produce Benefits, but Effect on Competition Is Uncertain (GAO/RCED-95-99, Apr. 6, 1995).
International Aviation: DOT Needs More Information to Address U.S. Airlines’ Problems in Doing Business Abroad (GAO/RCED-95-24, Nov. 29, 1994).
International Aviation: New Competitive Conditions Require Changes in DOT Strategy (GAO/T-RCED-94-194, May 5, 1994).
International Aviation: Measures by European Community Could Limit U.S. Airlines’ Ability to Compete Abroad (GAO/RCED-93-64, Apr. 26, 1993).
Airline Competition: Impact of Changing Foreign Investment and Control Limits on U.S. Airlines (GAO/RCED-93-7, Dec. 9, 1992).
Airline Competition: Effects of Airline Market Concentration and Barriers to Entry on Airfares (GAO/RCED-91-101, Apr. 26, 1991).
The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent.
U.S. General Accounting Office P.O. Box 37050 Washington, DC  20013 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000  or by using fax number (202) 512-6061, or TDD (202) 512-2537.
Each day, GAO issues a list of newly available reports and testimony.  To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touchtone phone.  A recorded menu will provide information on how to obtain these lists.

Output:
Why GAO Did This Study

Pursuant to a congressional request, GAO discussed the United States' aviation relations with the United Kingdom, focusing on the: (1) status of the various reviews of the proposed American Airlines/British Airways (AA/BA) alliance being undertaken by the European regulatory agencies and the Departments of Transportation and Justice; (2) competitive impact of the proposed alliance; and (3) extent to which sales and marketing practices of American Airlines and British Airways should be considered in reviewing the alliance.

What GAO Found

GAO noted that: (1) European regulatory agencies have nearly completed their reviews of the proposed AA/BA alliance; (2) they are considering a range of issues that would have to be addressed as a condition of approving the alliance, including the number of slots and gates that other airlines would need at London's Heathrow Airport to compete, as well as American Airlines' and British Airways' marketing practices; (3) the United Kingdom, which is also reviewing the proposed alliance, is waiting for the European Commission to announce its draft remedies; (4) in contrast, the Department of Transportation (DOT) has not yet begun its formal review of the proposed alliance because neither airline has filed all the documentation requested; (5) DOT has reiterated that it will not approve the alliance until the United States successfully negotiates an open skies agreement with the United Kingdom; (6) the proposed AA/BA alliance raises significant competition issues; (7) currently, the two airlines account for nearly 58 percent of the available seats on scheduled U.S. and British airlines between the U.S. and London; (8) in addition, they provide over 70 percent--and in some cases all-of the available seats on scheduled U.S. and British airlines between Heathrow Airport and several key U.S. airports, including Chicago, Boston, and Miami; (9) as a result of this level of market concentration, DOT's approval of the alliance would further reduce competition unless, as a condition of approval, other U.S. airlines were able to obtain adequate access to Heathrow; (10) although slots, gates, and facilities are most important, most experts and some airline officials with whom GAO spoke also recognize that American Airlines' and British Airways' sales and marketing practices may make competitive entry more difficult for other airlines; (11) practices such as frequent flier programs and travel agent commission overrides encourage travelers to choose one airline over another on the basis of factors other than obtaining the best fare; (12) such practices may be most important if an airline is already dominant in a given market or markets; (13) ultimately, this may lead to higher fares than would exist in the absence of these marketing practices; (14) even so, the experts agreed that measuring the effect of these practices is nearly impossible; and (15) mitigating their effect without banning them is difficult, and banning them involves a trade-off between their anticompetitive effect and the consumer benefits that some of them bring.


Input:
	Background

Dramatic increases in computer interconnectivity, especially in the use of the Internet, are revolutionizing the way our government, our nation, and much of the world communicate and conduct business. The benefits have been enormous. Vast amounts of information are now literally at our fingertips, facilitating research on virtually every topic imaginable; financial and other business transactions can be executed almost instantaneously, often on a 24-hour-a-day basis; and electronic mail, Internet web sites, and computer bulletin boards allow us to communicate quickly and easily with a virtually unlimited number of individuals and groups.
In addition to such benefits, however, this widespread interconnectivity poses significant risks to our computer systems and, more important, to the critical operations and infrastructures they support.  For example, telecommunications, power distribution, water supply, public health services, and national defense—including the military’s warfighting capability---law enforcement, government services, and emergency services all depend on the security of their computer operations. The speed and accessibility that create the enormous benefits of the computer age likewise, if not properly controlled, allow individuals and organizations to inexpensively eavesdrop on or interfere with these operations from remote locations for mischievous or malicious purposes, including fraud or sabotage.
Reports of attacks and disruptions abound.  The March 2001 report of the “Computer Crime and Security Survey,” conducted by the Computer Security Institute and the Federal Bureau of Investigation’s San Francisco Computer Intrusion Squad, showed that 85 percent of respondents (primarily large corporations and government agencies) had detected computer security breaches within the last 12 months.  Disruptions caused by virus attacks, such as the ILOVEYOU virus in May 2000 and 1999’s Melissa virus, have illustrated the potential for damage that such attacks hold. A sampling of reports summarized in Daily Reports by the FBI’s National Infrastructure Protection Center during two recent weeks in March illustrates the problem further:   A hacker group by the name of  “PoizonB0x” defaced numerous Government officials are increasingly concerned about attacks from individuals and groups with malicious intent, such as crime, terrorism, foreign intelligence gathering, and acts of war. According to the FBI, terrorists, transnational criminals, and intelligence services are quickly becoming aware of and using information exploitation tools such as computer viruses, Trojan horses, worms, logic bombs, and eavesdropping sniffers that can destroy, intercept, or degrade the integrity of and deny access to data. As greater amounts of money are transferred through computer systems, as more sensitive economic and commercial information is exchanged electronically, and as the nation’s defense and intelligence communities increasingly rely on commercially available information technology, the likelihood that information attacks will threaten vital national interests increases.  In addition, the disgruntled organization insider is a significant threat, since such individuals often have knowledge that allows them to gain unrestricted access and inflict damage or steal assets without a great deal of knowledge about computer intrusions.
Since 1996, our analyses of information security at major federal agencies have shown that federal systems were not being adequately protected from these threats, even though these systems process, store, and transmit enormous amounts of sensitive data and are indispensable to many federal agency operations. In September 1996, we reported that serious weaknesses had been found at 10 of the 15 largest federal agencies, and we concluded that poor information security was a widespread federal problem with potentially devastating consequences.  In 1998 and in 2000, we analyzed audit results for 24 of the largest federal agencies: both analyses found that all 24 agencies had significant information security weaknesses.   As a result of these analyses, we have identified information security as a high-risk issue in reports to the Congress since 1997—most recently in January 2001.

	Weaknesses Remain Pervasive

Evaluations published since July 1999 show that federal computer systems are riddled with weaknesses that continue to put critical operations and assets at risk.  Significant weaknesses have been identified in each of the 24 agencies covered by our review.  These weaknesses covered all six major areas of general controls—the policies, procedures, and technical controls that apply to all or a large segment of an entity’s information systems and help ensure their proper operation.  These six areas are (1) security program management, which provides the framework for ensuring that risks are understood and that effective controls are selected and implemented, (2) access controls, which ensure that only authorized individuals can read, alter, or delete data, (3) software development and change controls, which ensure that only authorized software programs are implemented, (4) segregation of duties, which reduces the risk that one individual can independently perform inappropriate actions without detection, (5) operating systems controls, which protect sensitive programs that support multiple applications from tampering and misuse, and (6) service continuity, which ensures that computer-dependent operations experience no significant disruptions.
Weaknesses in these areas placed a broad range of critical operations and assets at risk for fraud, misuse, and disruption. In addition, they placed an enormous amount of highly sensitive data—much of it pertaining to individual taxpayers and beneficiaries—at risk of inappropriate disclosure.
The scope of audit work performed has continued to expand to more fully cover all six major areas of general controls at each agency. Not surprisingly, this has led to the identification of additional areas of weakness at some agencies. While these increases in reported weaknesses are disturbing, they do not necessarily mean that information security at federal agencies is getting worse. They more likely indicate that information security weaknesses are becoming more fully understood—an important step toward addressing the overall problem. Nevertheless, our analysis leaves no doubt that serious, pervasive weaknesses persist. As auditors increase their proficiency and the body of audit evidence expands, it is probable that additional significant deficiencies will be identified.
Most of the audits covered in our analysis were performed as part of financial statement audits. At some agencies with primarily financial missions, such as the Department of the Treasury and the Social Security Administration, these audits covered the bulk of mission-related operations. However, at agencies whose missions are primarily nonfinancial, such as the Departments of Defense and Justice, the audits may provide a less complete picture of the agency’s overall security posture because the audit objectives focused on the financial statements and did not include evaluations of systems supporting nonfinancial operations.
In response to congressional interest, during fiscal years 1999 and 2000, we expanded our audit focus to cover a wider range of nonfinancial operations.  We expect this trend to continue.

	Risks to Federal Operations, Assets, and Confidentiality Are Substantial

To fully understand the significance of the weaknesses we identified, it is necessary to link them to the risks they present to federal operations and assets. Virtually all federal operations are supported by automated systems and electronic data, and agencies would find it difficult, if not impossible, to carry out their missions and account for their resources without these information assets. Hence, the degree of risk caused by security weaknesses is extremely high.
The weaknesses identified place a broad array of federal operations and assets at risk of fraud, misuse, and disruption.  For example, weaknesses at the Department of the Treasury increase the risk of fraud associated with billions of dollars of federal payments and collections, and weaknesses at the Department of Defense increase the vulnerability of various military operations.  Further, information security weaknesses place enormous amounts of confidential data, ranging from personal and tax data to proprietary business information, at risk of inappropriate disclosure.  For example, in 1999, a Social Security Administration employee pled guilty to unauthorized access to the administration’s systems.  The related investigation determined that the employee had made many unauthorized queries, including obtaining earnings information for members of the local business community.
Such risks, if inadequately addressed, may limit government’s ability to take advantage of new technology and improve federal services through electronic means.  For example, this past February, we reported on serious control weaknesses in the Internal Revenue Service’s (IRS) electronic filing system, noting that failure to maintain adequate security could erode public confidence in electronic filing, jeopardize the Service’s ability to meet its goal of 80 percent of returns being filed electronically by 2007, and deprive it of financial and other anticipated benefits. Specifically, we found that, during the 2000 tax filing season, IRS did not adequately secure access to its electronic filing systems or to the electronically transmitted tax return data those systems contained.  We demonstrated that unauthorized individuals, both internal and external to IRS, could have gained access to these systems and viewed, copied, modified, or deleted taxpayer data.  In addition, the weaknesses we identified jeopardized the security of the sensitive business, financial, and taxpayer data on other critical IRS systems that were connected to the electonic filing systems.  The IRS Commissioner has stated that, in response to recommendations we made, IRS has completed corrective action for all of the critical access control vulnerabilities we identified and that, as a result, the electronic filing systems now satisfactorily meet critical federal security requirements to protect the taxpayer.  As part of our audit follow up activities, we plan to evaluate the effectiveness of IRS’s corrective actions.
I would now like to describe the risks associated with specific recent audit findings at agencies of particular interest to this subcommittee.
Information technology is essential to the Department of Energy’s (DOE) scientific research mission, which is supported by a large and diverse set of computing systems, including very powerful supercomputers located at DOE laboratories across the nation. In June 2000, we reported that computer systems at DOE laboratories supporting civilian research had become a popular target of the hacker community, with the result that the threat of attacks had grown dramatically in recent years. Further, because of security breaches, several laboratories had been forced to temporarily disconnect their networks from the Internet, disrupting the laboratories’ ability to do scientific research for up to a full week on at least two occasions.  In February 2001, the DOE’s Inspector General reported network vulnerabilities and access control weaknesses in unclassified systems that increased the risk that malicious destruction or alteration of data or the processing of unauthorized operations could occur.
In February, the Department of Health and Human Services’ Inspector General again reported serious control weaknesses affecting the integrity, confidentiality, and availability of data maintained by the department.Most significant were weaknesses associated with the department’s Health Care Financing Administration, which was responsible, during fiscal year 2000, for processing more than $200 billion in medicare expenditures. HCFA relies on extensive data processing operations at its central office to maintain administrative data, such as Medicare enrollment, eligibility, and paid claims data, and to process all payments for managed care.  HCFA also relies on Medicare contractors, who use multiple shared systems to collect and process personal health, financial, and medical data associated with Medicare claims.  Significant weaknesses were also reported for the Food and Drug Administration and the department’s Division of Financial Operations.
The Environmental Protection Agency (EPA) relies on its computer systems to collect and maintain a wealth of environmental data under various statutory and regulatory requirements. EPA makes much of its information available to the public through Internet access in order to encourage public awareness of and participation in managing human health and environmental risks and to meet statutory requirements. EPA also maintains confidential data from private businesses, data of varying sensitivity on human health and environmental risks, financial and contract data, and personal information on its employees. Consequently, EPA’s information security program must accommodate the often competing goals of making much of its environmental information widely accessible while maintaining data integrity, availability, and appropriate confidentiality. In July 2000, we reported serious and pervasive problems that essentially rendered EPA’s agencywide information security program ineffective. Our tests of computer-based controls concluded that the computer operating systems and agencywide computer network that support most of EPA’s mission-related and financial operations were riddled with security weaknesses.
In addition, EPA’s records showed that its vulnerabilities had been exploited by both external and internal sources, as illustrated by the following examples.
In June 1998, EPA was notified that one of its computers was used by a remote intruder as a means of gaining unauthorized access to a state university’s computers. The problem report stated that vendor- supplied software updates were available to correct the vulnerability, but EPA had not installed them.
In July 1999, a chat room was set up on a network server at one of EPA’s regional financial management centers for hackers to post notes and, in effect, conduct on-line electronic conversations.
In February 1999, a sophisticated penetration affected three of EPA’s computers. EPA was unaware of this penetration until notified by the FBI.
In June 1999, an intruder penetrated an Internet web server at EPA’s National Computer Center by exploiting a control weakness specifically identified by EPA about 3 years earlier during a previous penetration of a different system. The vulnerability continued to exist because EPA had not implemented vendor software updates (patches), some of which had been available since 1996. -  On two occasions during 1998, extraordinarily large volumes of network traffic—synonymous with a commonly used denial-of-service hacker technique—affected computers at one of EPA’s field offices.  In one case, an Internet user significantly slowed EPA’s network activity and interrupted network service for over 450 EPA computer users. In a second case, an intruder used EPA computers to successfully launch a denial-of-service attack against an Internet service provider.
In September 1999, an individual gained access to an EPA computer and altered the computer’s access controls, thereby blocking authorized EPA employees from accessing files.   This individual was no longer officially affiliated with EPA at the time of the intrusion, indicating a serious weakness in EPA’s process for applying changes in personnel status to computer accounts.
Of particular concern was that many of the most serious weaknesses we identified—those related to inadequate protection from intrusions through the Internet and poor security planning—had been previously reported to EPA management in 1997 by EPA’s inspector general.  The negative effects of such weaknesses are illustrated by EPA’s own records, which show several serious computer security incidents since early 1998 that have resulted in damage and disruption to agency operations. As a result of these weaknesses, EPA’s computer systems and the operations that rely on them were highly vulnerable to tampering, disruption, and misuse from both internal and external sources.
EPA management has developed and begun to implement a detailed action plan to address reported weaknesses.  However, the agency does not expect to complete these corrective actions until 2002 and continued to report a material weakness in this area in its fiscal year 2000 report on internal controls under the Federal Managers’ Financial Integrity Act of 1982.
The Department of Commerce is responsible for systems that the department has designated as critical for national security, national economic security, and public health and safety. Its member bureaus include the National Oceanic and Atmospheric Administration, the Patent and Trademark Office, the Bureau of the Census, and the International Trade Administration.  During December 2000 and January 2001, Commerce ‘s inspector general reported significant computer security weaknesses in several of the department’s bureaus and, last month, reported multiple material information security weaknesses affecting the department’s ability to produce accurate data for financial statements. These included a lack of formal, current security plans and weaknesses in controls over access to systems and over software development and changes.  At the request of the full committee, we are currently evaluating information security controls at selected other Commerce bureaus.

	While Nature of Risk Varies, Control Weaknesses Across Agencies Are Strikingly Similar

The nature of agency operations and their related risks vary. However, striking similarities remain in the specific types of general control weaknesses reported and in their serious negative impact on an agency’s ability to ensure the integrity, availability, and appropriate confidentiality of its computerized operations—and therefore on what corrective actions they must take. The sections that follow describe the six areas of general controls and the specific weaknesses that were most widespread at the agencies covered by our analysis.

		Security Program Management

Each organization needs a set of management procedures and an organizational framework for identifying and assessing risks, deciding what policies and controls are needed, periodically evaluating the effectiveness of these policies and controls, and acting to address any identified weaknesses. These are the fundamental activities that allow an organization to manage its information security risks cost effectively, rather than react to individual problems in an ad-hoc manner only after a violation has been detected or an audit finding reported.
Despite the importance of this aspect of an information security program, poor security program management continues to be a widespread problem. Virtually all of the agencies for which this aspect of security was reviewed had deficiencies. Specifically, many had not developed security plans for major systems based on risk, had not documented security policies, and had not implemented a program for testing and evaluating the effectiveness of the controls they relied on. As a result, agencies   were not fully aware of the information security risks to their operations, had accepted an unknown level of risk by default rather than consciously deciding what level of risk was tolerable, had a false sense of security because they were relying on controls that were not effective, and could not make informed judgments as to whether they were spending too little or too much of their resources on security.
With the October 2000 enactment of the government information security reform provisions of the fiscal year 2001 National Defense Authorization Act, agencies are now required by law to adopt the practices described above, including annual management evaluations of agency security.

		Access Controls

Access controls limit or detect inappropriate access to computer resources (data, equipment, and facilities), thereby protecting these resources against unauthorized modification, loss, and disclosure. Access controls include physical protections—such as gates and guards—as well as logical controls, which are controls built into software that require users to authenticate themselves through the use of secret passwords or other identifiers and limit the files and other resources that an authenticated user can access and the actions that he or she can execute. Without adequate access controls, unauthorized individuals, including outside intruders and terminated employees, can surreptitiously read and copy sensitive data and make undetected changes or deletions for malicious purposes or personal gain. Even authorized users can unintentionally modify or delete data or execute changes that are outside their span of authority.
For access controls to be effective, they must be properly implemented and maintained. First, an organization must analyze the responsibilities of individual computer users to determine what type of access (e.g., read, modify, delete) they need to fulfill their responsibilities. Then, specific control techniques, such as specialized access control software, must be implemented to restrict access to these authorized functions. Such software can be used to limit a user’s activities associated with specific systems or files and to keep records of individual users’ actions on the computer. Finally, access authorizations and related controls must be maintained and adjusted on an ongoing basis to accommodate new and terminated employees, and changes in users’ responsibilities and related access needs.
Significant access control weaknesses were reported for all of the agencies covered by our analysis, as evidenced by the following examples:   Accounts and passwords for individuals no longer associated with the agency were not deleted or disabled; neither were they adjusted for those whose responsibilities, and thus need to access certain files, changed. At one agency, as a result, former employees and contractors could and in many cases did still read, modify, copy, or delete data. At this same agency, even after 160 days of inactivity, 7,500 out of 30,000 users’ accounts had not been deactivated.
Users were not required to periodically change their passwords.
Managers did not precisely identify and document access needs for individual users or groups of users. Instead, they provided overly broad access privileges to very large groups of users. As a result, far more individuals than necessary had the ability to browse and, sometimes, modify or delete sensitive or critical information. At one agency, all 1,100 users were granted access to sensitive system directories and settings. At another agency, 20,000 users had been provided access to one system without written authorization.
Use of default, easily guessed, and unencrypted passwords significantly increased the risk of unauthorized access. During testing at one agency, we were able to guess many passwords based on our knowledge of commonly used passwords and were able to observe computer users’ keying in passwords and then use those passwords to obtain “high level” system administration privileges.
Software access controls were improperly implemented, resulting in unintended access or gaps in access-control coverage. At one agency data center, all users, including programmers and computer operators, had the capability to read sensitive production data, increasing the risk that such sensitive information could be disclosed to unauthorized individuals. Also at this agency, certain users had the unrestricted ability to transfer system files across the network, increasing the risk that unauthorized individuals could gain access to the sensitive data or programs.
To illustrate the risks associated with poor authentication and access controls, in recent years we have begun to incorporate network vulnerability testing into our audits of information security. Such tests involve attempting—with agency cooperation—to gain unauthorized access to sensitive files and data by searching for ways to circumvent existing controls, often from remote locations. Our auditors have been successful, in almost every test, in readily gaining unauthorized access that would allow intruders to read, modify, or delete data for whatever purpose they had in mind. Further, user activity was inadequately monitored. At one agency, much of the activity associated with our intrusion testing was not recognized and recorded, and the problem reports that were recorded did not recognize the magnitude of our activity or the severity of the security breaches we initiated.

		Application Software Development and Change Controls

Application software development and change controls prevent unauthorized software programs or modifications to programs from being implemented. Key aspects of such controls are ensuring that (1) software changes are properly authorized by the managers responsible for the agency program or operations that the application supports, (2) new and modified software programs are tested and approved prior to their implementation, and (3) approved software programs are maintained in carefully controlled libraries to protect them from unauthorized changes and to ensure that different versions are not misidentified.
Such controls can prevent both errors in software programming as well as malicious efforts to insert unauthorized computer program code. Without adequate controls, incompletely tested or unapproved software can result in erroneous data processing that, depending on the application, could lead to losses or faulty outcomes. In addition, individuals could surreptitiously modify software programs to include processing steps or features that could later be exploited for personal gain or sabotage.
Weaknesses in software program change controls were identified for almost all of the agencies where such controls were evaluated. Examples of weaknesses in this area included the following: Testing procedures were undisciplined and did not ensure that implemented software operated as intended. For example, at one agency, senior officials authorized some systems for processing without testing access controls to ensure that they had been implemented and were operating effectively. At another, documentation was not retained to demonstrate user testing and acceptance.
Implementation procedures did not ensure that only authorized software was used. In particular, procedures did not ensure that emergency changes were subsequently tested and formally approved for continued use and that implementation of “locally developed” (unauthorized) software programs was prevented or detected.
Agencies’ policies and procedures frequently did not address the maintenance and protection of program libraries.

		Segregation of Duties

Segregation of duties refers to the policies, procedures, and organizational structure that help ensure that one individual cannot independently control all key aspects of a process or computer-related operation and thereby conduct unauthorized actions or gain unauthorized access to assets or records without detection. For example, one computer programmer should not be allowed to independently write, test, and approve program changes.
Although segregation of duties alone will not ensure that only authorized activities occur, inadequate segregation of duties increases the risk that erroneous or fraudulent transactions could be processed, improper program changes implemented, and computer resources damaged or destroyed. For example, an individual who was independently responsible for authorizing, processing, and reviewing payroll transactions could inappropriately increase payments to selected individuals without detection; or a computer programmer responsible for authorizing, writing, testing, and distributing program modifications could either inadvertently or deliberately implement computer programs that did not process transactions in accordance with management’s policies or that included malicious code.
Controls to ensure appropriate segregation of duties consist mainly of documenting, communicating, and enforcing policies on group and individual responsibilities. Enforcement can be accomplished by a combination of physical and logical access controls and by effective supervisory review.
Segregation of duties weaknesses were identified at most of the agencies covered by our analysis. Common problems involved computer programmers and operators who were authorized to perform a variety of duties, thus providing them the ability to independently modify, circumvent, and disable system security features. For example, at one data center, a single individual could independently develop, test, review, and approve software changes for implementation.
Segregation of duties problems were also identified related to transaction processing. For example, at one agency, 11 staff members involved with procurement had system access privileges that allowed them to individually request, approve, and record the receipt of purchased items. In addition, 9 of the 11 had system access privileges that allowed them to edit the vendor file, which could result in fictitious vendors being added to the file for fraudulent purposes. For fiscal year 1999, we identified 60 purchases, totaling about $300,000, that were requested, approved, and receipt-recorded by the same individual.

		Operating System Controls

Operating system software controls limit and monitor access to the powerful programs and sensitive files associated with the computer systems operation. Generally, one set of system software is used to support and control a variety of applications that may run on the same computer hardware. System software helps control and coordinate the input, processing, output, and data storage associated with all of the applications that run on the system. Some system software can change data and program code on files without leaving an audit trail or can be used to modify or delete audit trails. Examples of system software include the operating system, system utilities, program library systems, file maintenance software, security software, data communications systems, and database management systems.
Controls over access to and modification of system software are essential in providing reasonable assurance that operating system-based security controls are not compromised and that the system will not be impaired. If controls in this area are inadequate, unauthorized individuals might use system software to circumvent security controls to read, modify, or delete critical or sensitive information and programs. Also, authorized users of the system may gain unauthorized privileges to conduct unauthorized actions or to circumvent edits and other controls built into application programs. Such weaknesses seriously diminish the reliability of information produced by all of the applications supported by the computer system and increase the risk of fraud, sabotage, and inappropriate disclosure. Further, system software programmers are often more technically proficient than other data processing personnel and, thus, have a greater ability to perform unauthorized actions if controls in this area are weak.
The control concerns for system software are similar to the access control issues and software program change control issues discussed earlier. However, because of the high level of risk associated with system software activities, most entities have a separate set of control procedures that apply to them.
Weaknesses were identified at each of the agencies for which operating system controls were reviewed. A common type of problem reported was insufficiently restricted access that made it possible for knowledgeable individuals to disable or circumvent controls in a variety of ways. For example, at one agency, system support personnel had the ability to change data in the system audit log. As a result, they could have engaged in a wide array of inappropriate and unauthorized activity and could have subsequently deleted related segments of the audit log, thus diminishing the likelihood that their actions would be detected.
Further, pervasive vulnerabilities in network configuration exposed agency systems to attack.  These vulnerabilities stemmed from agencies’ failure to (1) install and maintain effective perimeter security, such as firewalls and screening routers, (2) implement current software patches, and (3) protect against commonly known methods of attack.

		Service Continuity

Finally, service continuity controls ensure that when unexpected events occur, critical operations will continue without undue interruption and that crucial, sensitive data are protected. For this reason, an agency should have (1) procedures in place to protect information resources and minimize the risk of unplanned interruptions and (2) a plan to recover critical operations, should interruptions occur. These plans should consider the activities performed at general support facilities, such as data processing centers, as well as the activities performed by users of specific applications. To determine whether recovery plans will work as intended, they should be tested periodically in disaster simulation exercises.
Losing the capability to process, retrieve, and protect information maintained electronically can significantly affect an agency’s ability to accomplish its mission. If controls are inadequate, even relatively minor interruptions can result in lost or incorrectly processed data, which can cause financial losses, expensive recovery efforts, and inaccurate or incomplete financial or management information. Controls to ensure service continuity should address the entire range of potential disruptions. These may include relatively minor interruptions, such as temporary power failures or accidental loss or erasure of files, as well as major disasters, such as fires or natural disasters that would require reestablishing operations at a remote location.
Service continuity controls include (1) taking steps, such as routinely making backup copies of files, to prevent and minimize potential damage and interruption, (2) developing and documenting a comprehensive contingency plan, and (3) periodically testing the contingency plan and adjusting it as appropriate.
Service continuity control weaknesses were reported for most of the agencies covered by our analysis. Examples of weaknesses included the following: Plans were incomplete because operations and supporting resources had not been fully analyzed to determine which were the most critical and would need to be resumed as soon as possible should a disruption occur.
Disaster recovery plans were not fully tested to identify their weaknesses.
At one agency, periodic walkthroughs or unannounced tests of the disaster recovery plan had not been performed. Conducting these types of tests provides a scenario more likely to be encountered in the event of an actual disaster.

	Improved Security Program Management Is Essential

The audit reports cited in this statement and in our prior information security reports include many recommendations to individual agencies that address specific weaknesses in the areas I have just described.  It is each individual agency’s responsibility to ensure that these recommendations are implemented.   Agencies have taken steps to address problems and many have good remedial efforts underway. However, these efforts will not be fully effective and lasting unless they are supported by a strong agencywide security management framework.
Establishing such a management framework requires that agencies take a comprehensive approach that involves both (1) senior agency program managers who understand which aspects of their missions are the most critical and sensitive and (2) technical experts who know the agencies’ systems and can suggest appropriate technical security control techniques. We studied the practices of organizations with superior security programs and summarized our findings in a May 1998 executive guide entitled Information Security Management: Learning From Leading Organizations (GAO/AIMD-98-68). Our study found that these organizations managed their information security risks through a cycle of risk management activities that included assessing risks and determining protection needs, selecting and implementing cost-effective policies and controls to meet these needs, promoting awareness of policies and controls and of the risks that prompted their adoption among those responsible for complying with them, and implementing a program of routine tests and examinations for evaluating the effectiveness of policies and related controls and reporting the resulting conclusions to those who can take appropriate corrective action.
In addition, a strong, centralized focal point can help ensure that the major elements of the risk management cycle are carried out and serve as a communications link among organizational units. Such coordination is especially important in today’s highly networked computing environments. This cycle of risk management activities is depicted below.
This cycle of activity, as described in our May 1998 executive guide, is consistent with guidance on information security program management provided to agencies by the Office of Management and Budget (OMB) and by NIST. In addition, the guide has been endorsed by the federal Chief Information Officers (CIO) Council as a useful resource for agency managers. We believe that implementing such a cycle of activity is the key to ensuring that information security risks are adequately considered and addressed on an ongoing basis.
While instituting this framework is essential, there are several steps that agencies can take immediately.   Specifically, they can (1) increase awareness, (2) ensure that existing controls are operating effectively, (3) ensure that software patches are up-to-date, (4) use automated scanning and testing tools to quickly identify problems, (5) propagate their best practices, and (6) ensure that their most common vulnerabilities are addressed. None of these actions alone will ensure good security. However, they take advantage of readily available information and tools and, thus, do not involve significant new resources. As a result, they are steps that can be made without delay.

	New Legal Requirements Provide Basis for Improved Management and Oversight

Due to concerns about the repeated reports of computer security weaknesses at federal agencies, in 2000, the Congress passed government information security reform provisions require agencies to implement the activities I have just described.  These provisions were enacted in late 2000 as part of the fiscal year 2001 NationalDefense Authorization Act.  In addition to requiring these management improvements, the new provisions require annual evaluations of agency information security programs by both management and agency inspectors general.  The results of these reviews, which are initially scheduled to become available in late 2001, will provide a more complete picture of the status of federal information security than currently exists, thereby providing the Congress and OMB an improved means of overseeing agency progress and identifying areas needing improvement.

	Improvement Efforts Are Underway, but Many Challenges Remain

During the last two years, a number of improvement efforts have been initiated.  Several agencies have taken significant steps to redesign and strengthen their information security programs; the Federal Chief Information Officers Council has issued a guide for measuring agency progress, which we assisted in developing; and the President issued a National Plan for Information Systems Protection and designated the related goals of computer security and critical infrastructure protection as a priority management objective in his fiscal year 2001 budget.  These actions are laudable. However, recent reports and events indicate that they are not keeping pace with the growing threats and that critical operations and assets continue to be highly vulnerable to computer-based attacks.
While OMB, the Chief Information Officers Council, and the various federal entities involved in critical infrastructure protection have expanded their efforts, it will be important to maintain the momentum. As we have noted in previous reports and testimonies, there are actions that can be taken on a governmentwide basis to enhance agencies’ abilities to implement effective information security.
First, it is important that the federal strategy delineate the roles and responsibilities of the numerous entities involved in federal information security and related aspects of critical infrastructure protection. Under current law, OMB is responsible for overseeing and coordinating federal agency security; and NIST, with assistance from the National Security Agency (NSA), is responsible for establishing related standards.  In addition, interagency bodies, such as the CIO Council and the entities created under Presidential Decision Directive 63 on critical infrastructure protection are attempting to coordinate agency initiatives.  While these organizations have developed fundamentally sound policies and guidance and have undertaken potentially useful initiatives, effective improvements are not taking place, and it is unclear how the activities of these many organizations interrelate, who should be held accountable for their success or failure, and whether they will effectively and efficiently support national goals.
Second, more specific guidance to agencies on the controls that they need to implement could help ensure adequate protection.  Currently agencies have wide discretion in deciding what computer security controls to implement and the level of rigor with which they enforce these controls. In theory, this is appropriate since, as OMB and NIST guidance states, the level of protection that agencies provide should be commensurate with the risk to agency operations and assets. In essence, one set of specific controls will not be appropriate for all types of systems and data.
However, our studies of best practices at leading organizations have shown that more specific guidance is important. In particular, specific mandatory standards for varying risk levels can clarify expectations for information protection, including audit criteria; provide a standard framework for assessing information security risk; and help ensure that shared data are appropriately protected. Implementing such standards for federal agencies would require developing a single set of information classification categories for use by all agencies to define the criticality and sensitivity of the various types of information they maintain.  It would also necessitate establishing minimum mandatory requirements for protecting information in each classification category.
Third, routine periodic audits, such as those required in the government information security reforms recently enacted, would allow for more meaningful performance measurement.   Ensuring effective implementation of agency information security and critical infrastructure protection plans will require monitoring to determine if milestones are being met and testing to determine if policies and controls are operating as intended.

Output:
Why GAO Did This Study

This testimony discusses GAO's analysis of security audits at federal agencies.

What GAO Found

The widespread interconnectivity of computers poses significant risks to federal computer systems and the operations and the infrastructures they support. GAO's evaluations show that federal computer systems are riddled with weaknesses that continue to put critical operations and assets at risk. GAO found weaknesses in following six areas: (1) security program management, (2) access controls, (3) software development and change controls, (4) segregation of duties, (5) operating systems controls, and (6) service continuity. Weaknesses in these areas place a broad range of critical operations and assets at risk for fraud, misuse, and disruption. Federal agencies have tried to address these problems, and many have good remedial efforts underway. However, these efforts will not be fully effective and lasting unless they are supported by a strong agencywide security management framework. Establishing such a management framework requires that agencies take a comprehensive approach that involves both (1) senior agency program managers who understand which aspects of their missions are the most critical and sensitive and (2) technical experts who know the agencies' systems and can suggest appropriate technical security control techniques.