[House Hearing, 106 Congress]
[From the U.S. Government Publishing Office]
YEAR 2000 COMPUTER PROBLEM: DID THE WORLD OVERREACT, AND WHAT DID WE
LEARN?
=======================================================================
JOINT HEARING
before the
SUBCOMMITTEE ON GOVERNMENT MANAGEMENT,
INFORMATION, AND TECHNOLOGY
of the
COMMITTEE ON GOVERNMENT REFORM
and the
SUBCOMMITTEE ON TECHNOLOGY
of the
COMMITTEE ON SCIENCE
HOUSE OF REPRESENTATIVES
ONE HUNDRED SIXTH CONGRESS
SECOND SESSION
__________
JANUARY 27, 2000
__________
Committee on Government Reform
Serial No. 106-149
Committee on Science
Serial No. 106-84
__________
Printed for the use of the Committee on Government Reform and the
Committee on Science
Available via the World Wide Web: http://www.gpo.gov/congress/house
http://www.house.gov/reform
__________
U.S. GOVERNMENT PRINTING OFFICE
66-711 WASHINGTON : 2000
______
COMMITTEE ON GOVERNMENT REFORM
DAN BURTON, Indiana, Chairman
BENJAMIN A. GILMAN, New York HENRY A. WAXMAN, California
CONSTANCE A. MORELLA, Maryland TOM LANTOS, California
CHRISTOPHER SHAYS, Connecticut ROBERT E. WISE, Jr., West Virginia
ILEANA ROS-LEHTINEN, Florida MAJOR R. OWENS, New York
JOHN M. McHUGH, New York EDOLPHUS TOWNS, New York
STEPHEN HORN, California PAUL E. KANJORSKI, Pennsylvania
JOHN L. MICA, Florida PATSY T. MINK, Hawaii
THOMAS M. DAVIS, Virginia CAROLYN B. MALONEY, New York
DAVID M. McINTOSH, Indiana ELEANOR HOLMES NORTON, Washington,
MARK E. SOUDER, Indiana DC
JOE SCARBOROUGH, Florida CHAKA FATTAH, Pennsylvania
STEVEN C. LaTOURETTE, Ohio ELIJAH E. CUMMINGS, Maryland
MARSHALL ``MARK'' SANFORD, South DENNIS J. KUCINICH, Ohio
Carolina ROD R. BLAGOJEVICH, Illinois
BOB BARR, Georgia DANNY K. DAVIS, Illinois
DAN MILLER, Florida JOHN F. TIERNEY, Massachusetts
ASA HUTCHINSON, Arkansas JIM TURNER, Texas
LEE TERRY, Nebraska THOMAS H. ALLEN, Maine
JUDY BIGGERT, Illinois HAROLD E. FORD, Jr., Tennessee
GREG WALDEN, Oregon JANICE D. SCHAKOWSKY, Illinois
DOUG OSE, California ------
PAUL RYAN, Wisconsin BERNARD SANDERS, Vermont
HELEN CHENOWETH-HAGE, Idaho (Independent)
DAVID VITTER, Louisiana
Kevin Binger, Staff Director
Daniel R. Moll, Deputy Staff Director
David A. Kass, Deputy Counsel and Parliamentarian
Lisa Smith Arafune, Chief Clerk
Phil Schiliro, Minority Staff Director
------
Subcommittee on Government Management, Information, and Technology
STEPHEN HORN, California, Chairman
JUDY BIGGERT, Illinois JIM TURNER, Texas
THOMAS M. DAVIS, Virginia PAUL E. KANJORSKI, Pennsylvania
GREG WALDEN, Oregon MAJOR R. OWENS, New York
DOUG OSE, California PATSY T. MINK, Hawaii
PAUL RYAN, Wisconsin CAROLYN B. MALONEY, New York
Ex Officio
DAN BURTON, Indiana HENRY A. WAXMAN, California
J. Russell George, Staff Director and Chief Counsel
Bonnie Heald, Director of Communications/Professional Staff Member
Chip Ahlswede, Clerk
Michelle Ash, Minority Counsel
Trey Henderson, Minority Counsel
COMMITTEE ON SCIENCE
F. JAMES SENSENBRENNER, Jr., (R-Wisconsin), Chairman
SHERWOOD L. BOEHLERT, New York RALPH M. HALL, Texas, RMM **
LAMAR SMITH, Texas BART GORDON, Tennessee
CONSTANCE A. MORELLA, Maryland JERRY F. COSTELLO, Illinois
CURT WELDON, Pennsylvania JAMES A. BARCIA, Michigan
DANA ROHRABACHER, California EDDIE BERNICE JOHNSON, Texas
JOE BARTON, Texas LYNN C. WOOLSEY, California
KEN CALVERT, California LYNN N. RIVERS, Michigan
NICK SMITH, Michigan ZOE LOFGREN, California
ROSCOE G. BARTLETT, Maryland MICHAEL F. DOYLE, Pennsylvania
VERNON J. EHLERS, Michigan * SHEILA JACKSON LEE, Texas
DAVE WELDON, Florida DEBBIE STABENOW, Michigan
GIL GUTKNECHT, Minnesota BOB ETHERIDGE, North Carolina
THOMAS W. EWING, Illinois NICK LAMPSON, Texas
CHRIS CANNON, Utah JOHN B. LARSON, Connecticut
KEVIN BRADY, Texas MARK UDALL, Colorado
MERRILL COOK, Utah DAVID WU, Oregon
GEORGE R. NETHERCUTT, Jr., ANTHONY D. WEINER, New York
Washington MICHAEL E. CAPUANO, Massachusetts
FRANK D. LUCAS, Oklahoma BRIAN BAIRD, Washington
MARK GREEN, Wisconsin JOSEPH M. HOEFFEL, Pennsylvania
STEVEN T. KUYKENDALL, California DENNIS MOORE, Kansas
GARY G. MILLER, California JOE BACA, California
JUDY BIGGERT, Illinois
MARSHALL ``MARK'' SANFORD, South
Carolina
JACK METCALF, Washington
C O N T E N T S
----------
Page
Hearing held on January 27, 2000................................. 1
Statement of:
Koskinen, John, Assistant to the President, chairman,
President's Council on Year 2000 Conversion; Joel C.
Willemssen, Director, Civil Agencies Information Systems,
U.S. General Accounting Office; Charles Rossotti,
Commissioner, Internal Revenue Service; and Fernando
Burbano, Chief Information Officer, Department of State.... 13
Miller, Harris, president, Information Technology Association
of America; Cathy Hotka, vice president for information
technology, National Retail Federation; and Gary Beach,
publisher, CIO Communications, Inc......................... 99
Letters, statements, et cetera, submitted for the record by:
Barcia, Hon. James A., a Representative in Congress from the
State of Michigan, prepared statement of................... 129
Beach, Gary, publisher, CIO Communications, Inc., prepared
statement of............................................... 113
Biggert, Hon. Judy, a Representative in Congress from the
State of Illinois, prepared statement of................... 11
Burbano, Fernando, Chief Information Officer, Department of
State, prepared statement of............................... 75
Horn, Hon. Stephen, a Representative in Congress from the
State of California, prepared statement of................. 4
Koskinen, John, Assistant to the President, chairman,
President's Council on Year 2000 Conversion, prepared
statement of............................................... 17
Miller, Harris, president, Information Technology Association
of America, prepared statement of.......................... 102
Rossotti, Charles, Commissioner, Internal Revenue Service,
prepared statement of...................................... 63
Willemssen, Joel C., Director, Civil Agencies Information
Systems, U.S. General Accounting Office, prepared statement
of......................................................... 26
YEAR 2000 COMPUTER PROBLEM: DID THE WORLD OVERREACT, AND WHAT DID WE
LEARN?
----------
THURSDAY, JANUARY 27, 2000
House of Representatives, Subcommittee on
Government Management, Information, and
Technology, Committee on Government Reform,
joint with the Subcommittee on Technology,
Committee on Science,
Washington, DC.
The subcommittees met, pursuant to notice, at 10 a.m., in
room 2154, Rayburn House Office Building, Hon. Stephen Horn
(chairman of the Subcommittee on Government Management,
Information, and Technology) presiding.
Present for the Subcommittee on Government Management,
Information, and Technology: Representatives Horn, Biggert,
Walden, and Turner.
Staff present for the Subcommittee on Government
Management, Information, and Technology: J. Russell George,
staff director and chief counsel; Mathew Ryan, senior policy
director; Bonnie Heald, director of communications and
professional staff member; Chip Ahlswede, clerk; Deborah
Oppenheim, intern; Michelle Ash and Trey Henderson, minority
counsels; and Jean Gosa, minority clerk.
Present for the Subcommittee on Technology: Representatives
Morella, Green, Barcia, Wu, and Baird.
Staff present for the Subcommittee on Technology: Jeff
Grove, staff director; Ben Wu, counsel; Michael Quear, minority
professional staff member; and Marty Ralston, minority staff
assistant.
Mr. Horn. This joint hearing of the House Subcommittee on
Government Management, Information, and Technology, and the
House Subcommittee on Technology will come to order.
It is now 27 days into the new millennium. The lights are
still on, telephones keep ringing, and the airplanes are still
flying. So far, the biggest challenge, at least here on the
east coast, is shoveling through the mountainous snowdrifts
dumped by the first major storm of the year 2000. Thanks to the
hard work of thousands of dedicated people at a cost in the
billions of dollars, we have the luxury of meeting today to
discuss the benefits that have been derived from the year 2000
computer challenge.
Over the past 4 years, these subcommittees have spent
countless hours examining the Federal Government's computer
preparations for the year 2000, or Y2K. When we began this
process in April 1996, two Cabinet Secretaries had never heard
of Y2K, much less begun preparing for it. That ultimately
changed, but not without congressional prodding through 43
hearings and 10 report cards, grading agencies on their
progress. In addition to fixing all of the government's 6,400
mission-critical computer systems, the subcommittees expected
agencies to develop viable contingency plans in case those
computer fixes did not work. We prodded, we questioned, and we
hoped for the best, and the best happened. The Federal
Government experienced a successful transition into the new
millennium.
Some glitches did occur, however, giving cause to wonder
what might have happened if the work had not been completed. I
am inserting in the hearing record a statement stressing that
without the work of many in the executive and legislative
branches, it would not have been as successful.
Without objection, that will be in the record at this
point.
The Defense Department had problems with its surveillance
satellites. Some retailers were unable to process customer
credit card purchases. A Chicago area bank was unable to
process Medicare payments. As far as we know, those isolated
problems were quickly repaired. Some still question whether
other incidents might have occurred, but were unexpected due to
a fix first, report later mentality.
Successfully meeting the year 2000 challenge has provided
many lessons that must not be ignored or forgotten. The
unextendable deadline forced government leaders to focus on
information technology issues. Program and technology personnel
worked intensely and closely to get the job done. In addition,
government agencies and private sector organizations were
forced to develop detailed inventories of their technology
resources and computer systems, in many cases for the first
time. Unnecessary and obsolete systems have hopefully been
discarded.
Finally, government agencies and their partners have tested
and retested data flows at unprecedented levels. Strong
teamwork and rugged determination solved the year 2000 problem.
Some critics now question whether the high cost of this
massive effort was necessary. The best estimates currently
indicate that the executive branch will spend more than $8
billion on year 2000 fixes. The Secretary of Commerce has
reported that the United States will have spent about $100
billion on the effort as a whole.
Was that money well spent? Of course it was.
The executive branch of the Federal Government has not
always been known as a careful steward of the citizens' money,
regardless of what party is in power. Large corporations have
waste also, and those that are publicly traded could not afford
to squander hundreds of millions of dollars on unnecessary
computer problems and contingency plans. Boards of directors
and stockholders would not permit it. Whether large or small,
successful businesses rarely fritter away money. This was a
massive problem that required a massive solution.
We are grateful to everyone who contributed the many ideas,
solutions, and hard work that led to the success of this
effort, from government personnel to grassroots organizations
and the private sector. Thank you all for a job well done.
Today we welcome some of those dedicated leaders. The
Honorable John Koskinen, Assistant to the President and Chair
of the President's Council on Year 2000 Conversion; Mr. Joel
Willemssen, Director of Civil Agencies Information Systems for
the General Accounting Office; the Honorable Charles Rossotti,
Commissioner of Internal Revenue; Mr. Fernando Burbano, Chief
Information Officer of the Department of State and cochairman
of the Security Privacy and Infrastructure Committee of the
Chief Information Officer Council; Mr. Harris Miller, president
of Information Technology Association of America; Ms. Kathy
Hotka, vice president for Information Technology of the
National Retail Federation; and, last, Mr. Gary Beach,
publisher of the CIO Communications, Inc. I might say that is a
very distinguished magazine, and I read it regularly. We
welcome each of you, and look forward to your testimony.
It is a pleasure to first introduce Mr. John Koskinen,
special assistant to the President, Chairman, President's
Council on Year 2000 Conversion.
[The prepared statement of Hon. Stephen Horn follows:]
[GRAPHIC] [TIFF OMITTED] T6711.001
[GRAPHIC] [TIFF OMITTED] T6711.002
Mr. Horn. I now yield for opening statement from the
cochairman of the task force, Mrs. Morella, the gentlewoman
from Maryland.
Mrs. Morella. Thank you very much, Mr. Chairman. We will
hear from Mr. Koskinen and the very prominent panel very
shortly.
I appreciate having this hearing. I think it is important
that we look back at what has happened, and in particular, look
ahead to the future. If I had told everyone in this room a
month ago that in January 2000 the Federal Government would
shut down for 2 days and virtually the entire southeast and
northeast would be crippled, most likely everyone would have
immediately blamed Y2K millennium bug and not mother nature.
Yet it took a blizzard of snow and ice to accomplish what many
doomsayers had predicted long ago for the millennium bug. So
how is it that a winter storm caused more damage and
inconveniences than the Y2K problem?
In the ensuing weeks since the passage of January 1, 2000,
similar questions have been posted. Was the Y2K problem real or
was it overhyped? Was the $100 billion spent in the United
States, roughly $365 for every American citizen overall? Did
all of our efforts stave off an impending disaster, or was Y2K
simply a nonevent waiting to happen?
In my mind, there is no doubt the problem was real. From
the very first hearing that my technology subcommittee
conducted in the spring of 1996, to right up to the final month
of December 1999, we witnessed systems failing Y2K tests and
crashing completely. Our concern for the Y2K issue was
initially so great and disturbing that we have held almost 100
hearings in both the House and the Senate on the issue, which I
understand makes Y2K the single most thoroughly investigated
issue ever in the history of congressional oversight.
Ultimately, I believe two factors tipped the balance from
the grave uncertainty many of us harbored in the beginning. The
first was that we all knew the Y2K problem would strike on a
certain date, January 1, 2000, thereby allowing us to
collectively plan, coordinate and collaborate toward that
deadline.
The other and more significant factor was that after over a
year and a half of persistent cajoling by Congress, after we
realized this, our Nation required executive action to
effectively combat the Y2K problem, the President finally
exercised his authority in the spring of 1998. Y2K was suddenly
catapulted to become a top administration management priority,
and John Koskinen was appointed to oversee our Federal
Government's efforts and to partner with our Nation's private
sector and with other countries internationally.
John certainly deserves a great deal of accolades for his
stewardship. The well-deserved cheers I wanted to point out to
for our victory in vanquishing the millennium bug should also
go to those who ably served in the front lines of this epic
battle, all the dedicated Federal employees, public servants
and professionals who were the technicians, and those who gave
countless hours on their holidays to provide assurance to the
American people that our Nation would be prepared for Y2K.
I think the fact that nothing of disastrous proportions
happened does not mean that nothing would have happened. For
example, the American Banking Association reported that, but
for the $10 billion in Y2K fixes, mortgage calculations would
have been incorrect, direct deposit of pay and government
benefits would have been problematic, and credit cards could
not be read due to problems with expiration dates.
Similarly, the telecommunications industry reported that
the $3.6 billion that they spent over the past 3 to 4 years
prevented the potential gradual deterioration of public switch
telephone network performance, including slow response times
for dial tone access as well as interruptions of service.
The result of our Y2K experience is a testament to the fact
that we prepared well and we invested properly.
I believe, however, the investments were not just about
Y2K, but also about improving our Nation's information
technology systems and gaining knowledge about those systems.
That is the focus of our hearing today. This hearing is not
designed to simply pat each other on the back or to allow our
panelists to take a figurative victory lap around the witness
table, but to ascertain the lessons that we learned from our
Y2K experience.
Will Y2K inspire a conscious effort for greater long-term
planning and more reliable and secure technology, or will it
just prolong the shortsighted thinking that made Y2K so costly?
While many systems have relays replaced, some programs were
fixed by applying a Y2K patch that will require another round
of fixes within the next two decades. I look forward to
addressing these and many other issues with our distinguished
panel of witnesses, most of whom have appeared before us on
many occasions. It is only appropriate that since this is the
absolutely positively final last and ultimate hearing of the
House Y2K Task Force, we close with those who have been
involved with this issue since the very beginning.
Perhaps this hearing can provide the foundation for
initiatives as we address the 5-digit computer date problem,
Y10K as it may come to be known. If so at that time, maybe
Steve Horn and I can chair that task force, along with Strom
Thurmond in the Senate.
I would like to extend my deep appreciation to all the
members of my technology subcommittee and Congressman Horn's
government management subcommittee and his leadership for the 4
years of vigilant and cooperative bipartisan initiatives, and I
especially want to acknowledge the hard work of my ranking
member, Jim Barcia, and certainly Chairman Horn, the
distinguished cochair of the task force, and Jim Turner of the
government management subcommittee, ranking member, and the
members of both subcommittees who have been very dedicated, and
I yield back. Thank you.
Mr. Horn. We thank you so much for your nice words for all
the Members, and all of our witnesses. We agree with you, and I
am delighted to now yield to the gentleman who has been here
right from the beginning of his duties as the ranking member on
the side of the subcommittee on government management, Mr.
Turner from Texas. We are delighted you could make it out of
the snow, if you have any down there, and into Washington for
this meeting. So thank you very much for all you have done to
help us in the field hearings and everywhere else.
Mr. Turner. Thank you, Mr. Chairman. When I left Texas the
other day, it was 80 degrees.
I want to commend you, Mr. Chairman, and Chairwoman
Morella, for the good work you have done. This task force and
these two committees were about a 3\1/2\-year project. As I
recall, my staff advised me we had 24 different hearings of
this subcommittee alone on this subject. Many observers say
that the Y2K problem was the greatest management challenge the
Federal Government has faced, and perhaps that is true. I think
most of us had a high degree of confidence after the many
hearings that we had that we would make it through January 1st
without great problems, but nobody really knew for sure. The
fact we did make it I am sure is due, in large part, to the
hard work you, Mr. Chairman, and Chairwoman Morella, have made
in an effort to make sure the Federal Government is ready.
I also want to commend the ranking member of the science
subcommittee, Mr. Barcia, and I want to thank Mr. Williamson.
He worked very diligently, met with this committee time and
time again, and I think, in large part, usual efforts helped us
get to where we needed to go.
Of course, Mr. Koskinen and the President's Y2K council, I
think, did an outstanding job. I really felt sorry for you when
I was watching you on television on New Year's Day and you kept
holding these press conferences with nothing to say. That is
the worst nightmare of any politician, that somehow we would
have a press conference and there is nothing to say. But you
seemed to have survived it well, and you and your council did
an outstanding job working not only with the public sector and
Federal agencies, but reaching out to the private sector to
ensure that we got to where we needed to go.
That is not to say there weren't significant potential
problems. As I recall from many of our hearings, we tried to
ask witnesses that came before us to tell us what they fixed,
what would happen if they had not been diligent about
remediation of their Y2K problems, and some of the stories we
heard clearly convinced me that all of the effort and all of
the work that took place was needed, did accomplish the desired
result, and the fact that we had no great crisis on January 1
was to the credit of all of those many thousands of people who
spent countless hours and millions of dollars to remediate the
problem.
We are here today not to congratulate ourselves, but to
look back and to review the results of our efforts, to see what
lessons we have learned. I feel confident we are better
prepared as a Nation to meet a future national emergency than
we have ever been in terms of keeping our computer systems
working, which, of course, every facet of our life now depends
upon our computers working well.
So I think we are going to have a good hearing today, and I
appreciate all the witnesses being here. Again, I would like to
thank Chairman Horn and Chairwoman Morella for the good work
that you did.
Mr. Horn. Well, thank you very much. You have sure been
with us since the ground floor, and we have another person who
has been with us ever since she has been elected to Congress,
and the gentlewoman from Illinois, Mrs. Biggert, we have held
hearings in her area, which is a wonderful suburb outside of
Chicago, and we appreciate your regular attendance at these
meetings and the contributions you have made in staff meetings
and Member meetings. So thank you very much for coming to this
hearing. The gentlewoman from Illinois, Mrs. Biggert.
Mrs. Biggert. Thank you, Chairman Horn and Chairwoman
Morella. Let me thank you for calling this hearing on the
impact of the Y2K date change. Contrary to what some people
felt might happen, the planes didn't fall from the sky when the
clock struck midnight, telephones retained their dial tones,
water still ran from the faucets and America's New Year's
celebrations were not left in the dark. So I think we had a
good new year.
But remarkably, and a little bit surprisingly, substantial
Y2K problems were not experienced out of this country either,
despite the lack of preparation on the part of some of the
nations' computers and other essential services across the
globe. We really saw no major disruptions.
But as this committee heard numerous times during its
hearings, Y2K-related glitches could have had a substantial and
extremely negative impact on the variety of services, the
smooth turnover from 1999 into 2000 is directly related, I
think, to the billions of dollars and hundreds of man-hours
directed toward preventing and correcting potential Y2K
problems. I think it goes without saying that from what we have
seen, or seen thus far relating to Y2K disruptions, that these
efforts paid off handsomely. Y2K preparations paid off in other
ways as well as a result of the Y2K concerns; there are now
thousands more American families that own the equipment, such
as generators needed to prepare for other types of emergencies,
namely snowstorms, floods and hurricanes.
All of my family, even my 7-month-old grandson, now have
new flashlights and fresh new batteries. Government leaders on
every level now have a better understanding of technology,
management issues and are aware of the importance of
cooperation between local, State and Federal officials. What is
more, the millennium bug provided a reason to upgrade
government technology systems and to inventory resources.
So just being able to say some 3 weeks after the year 2000
rollover, it turned out to be a positive experience, that is a
testament to the hard work of the House Y2K task force and to
the leadership of Chairman Horn and Chairman Morella, and it is
also a testament to the efforts of today's witnesses,
particularly Mr. Koskinen and Mr. Willemssen and the others at
the General Accounting Office. Your work over the last--at
least 3 years in raising awareness and highlighting the
potential problems related to the Y2K date change is to be
recognized and commended.
I don't want to leave you with the impression that Y2K
glitches didn't occur. In fact, at least one bank in my home
State of Illinois did experience some Y2K problems when it was
temporarily unable to make some Medicare transactions. The
Federal Government, I don't think, was immune either. Three of
the Federal Housing Administration mission-critical systems
experienced problems shortly after January 1st.
So we are here today really, I think, to see if there are
any outstanding Y2K issues and to sort out what went right and
what went wrong, and to help the American people understand
what transpired on January 1, 2000, and let them know about the
significant long-term benefits this situation provided to our
government and to private industry.
So, again, I commend the men for calling the hearing today
and for all the work you have both done on this important issue
and look forward to hearing from the witnesses. Thank you.
[The prepared statement of Hon. Judy Biggert follows:]
[GRAPHIC] [TIFF OMITTED] T6711.003
[GRAPHIC] [TIFF OMITTED] T6711.004
Mr. Horn. Well, thank you very much. I now yield to the
gentleman from Oregon, Mr. Walden, who has been with us in
field hearings and a faithful worker in the very active work of
these subcommittees. Mr. Walden, the gentleman from Oregon.
Mr. Walden. Thank you very much, Mr. Chairman. I want to
extend my appreciation to the work you have done and others on
this committee certainly for bird-dogging this issue throughout
the last year or more. I think in large measure, the report
cards that you issued were a very positive step in not only
notifying our own agencies, but the world, where we stood and
proved to be a very effective technique for spurring on the
changes that needed to be made to cope with the Y2K issue.
In my other life, I was a small business owner, and I can
tell you Y2K was not a cheap thing to go through. Our own
little company spent well over $40,000 in upgrading software. I
know that I am not alone in the small business community in
that respect. So there was an enormous amount of capital spent
to deal with this issue, and hopefully the programmers who will
deal with the 10K issue, I won't have to help pay for them down
the road.
But I think it was an excellent exercise. I think it forced
both of us in both the government and private industry to do an
incredible amount of improvement to our software and to our
hardware. That should help us down the road in a competitive
status as well.
So, Mr. Chairman, I again want to thank you for your
tireless efforts to make that the country was ready, and I look
forward to hearing from our panelists as well. Thank you.
Mr. Horn. I thank the gentleman for your kindness.
The next gentleman has also been very active since he has
come here in the last election, Mr. Green of Wisconsin, Mark
Green. He has been faithfully working on some of these problems
and has a whole series of other things he wants us to consider
too, and we will.
Mr. Green. Thank you, Mr. Chairman. I have no comments at
this time, but will look forward to the testimony.
Mr. Horn. Thank you very much.
Now it is a great pleasure to present the person that put
the executive branch together, where it was no question it
wasn't going anywhere until the President picked Mr. Koskinen
out of retirement, who delayed his trip to France to have time
for retirement after his position as Deputy Director for
Management of the Office of Management and Budget. You did a
great job, John, and we are delighted to have you here with
your thoughts as to what happened and what did we learn from
it, and what can we use from it.
STATEMENTS OF JOHN KOSKINEN, ASSISTANT TO THE PRESIDENT,
CHAIRMAN, PRESIDENT'S COUNCIL ON YEAR 2000 CONVERSION; JOEL C.
WILLEMSSEN, DIRECTOR, CIVIL AGENCIES INFORMATION SYSTEMS, U.S.
GENERAL ACCOUNTING OFFICE; CHARLES ROSSOTTI, COMMISSIONER,
INTERNAL REVENUE SERVICE; AND FERNANDO BURBANO, CHIEF
INFORMATION OFFICER, DEPARTMENT OF STATE
Mr. Koskinen. Thank you, Mr. Chairman. Good morning. I am
pleased to appear once again before this joint session of the
subcommittees to discuss the activities of the President's
Council on Year 2000 Conversion and the Nation's successful
transition to the year 2000. With your permission, I will
submit my full statement to the record and summarize it here. I
appreciate everyone's kind comments and would like to
acknowledge as well the work of your subcommittees in helping
to prepare the Federal Government and the country for the
century date change.
I appreciate your work and I think it deserves recognition
as we look back on what has been truly a remarkable effort.
I continued to believe that Y2K was the greatest management
challenge the world has faced in the last 50 years. Given the
size of the task, it is easy to understand why just 2 or 3
years ago many serious people who had looked at the situation
maintained there was no way the work could be finished in time.
When I returned to the government in March 1998 to work on Y2K,
things were fairly grim. The consensus was the government
wouldn't make it. In the private sector, information
bottlenecks were widespread and companies weren't saying much
about their own readiness for Y2K.
On top of all that, the World Bank released a study showing
that three-quarters of the world's countries had no Y2K plans
at all. In short, Y2K looked too mammoth, too complicated and
too interconnected to be solvable. Now, almost 2 years later,
the United States and much of the world have made the
transition into the year 2000 with few problems that have had a
noticeable impact on the general public.
How did it hatch? It wasn't by accident. There was a
tremendous mobilization of people and resources to make sure
that systems would operate effectively into the year 2000.
Domestically, participants in key infrastructure sectors, such
as electric power, telecommunications finance and
transportation devoted great attention and resources to the
problem, and as we moved to the ends of the year, operators of
systems in those areas stated they were basically done with
their Y2K work.
We reported this information in our last quarterly
assessment, and, as we expected, there were no major
infrastructure failures, nationally or regionally in the United
States. The Federal Government was also ready for the year
2000. Two weeks before the new year, 99.9 percent of the
government's more than 6,000 mission-critical systems were Y2K
ready.
The result was that while it has been noted there have been
some glitches, thus far Y2K issues have not affected the major
government services and benefits provided to the American
people.
Internationally, after a slow start, countries made a
concerted effort to ensure that critical issues would be ready
for the date change and, as a general matter, major
infrastructure systems abroad functioned smoothly during the
rollover.
There is general agreement that the Y2K transition went
more smoothly than any of us would have imagined. In fact, as
noted in the week since the rollover, some people have
suggested that Y2K was an insignificant problem, hyped by the
media, computer consultants and those with other reasons for
hoping the world as we know it was about to end.
The short answer is that I don't know of a single person
working on Y2K who thinks that they did not confront and avoid
a major risk of systemic failure. Indeed, some of the
noteworthy problems we have seen from difficulties at State
motor vehicle offices to credit card processing problems to its
Defense Department satellite system failure, proved that Y2K
was a very real threat indeed.
While I do not think that the significance of the Y2K
problems was exaggerated, there were those who disagreed with
our reports indicating that the problem was being successfully
addressed. This form of hype can be traced to the skepticism
and disbelief in some quarters that companies or governments
reporting on their own progress could be telling the truth. In
the United States, I kept reminding my doomsayer friends that
it made no sense to discount these reports, since everyone who
was in a position of responsibility would be easily found after
January 1. Many continued to assume the worst would
materialize, some now discounting the significance of the Y2K
threat point to the relative lack of major disruptions abroad.
How did countries that appeared to have spent so little and
were thought to be relatively unprepared emerge unscathed?
Here, I think, there were a number of factors at work. Chief
among them was the difficulty of getting accurate status
reports, especially internationally on a fast-moving issue such
as Y2K. Information 3 months old was out-of-date. But in the
absence of additional details, people often relied on that
older information, and then were surprised when it turned out
to have been overtaken by subsequent progress.
Additionally, once you get beyond the world's largest users
of information technology, countries like the United States,
Canada, Japan and the United Kingdom, the reliance upon
information technology drops off quickly. Furthermore, the
technology being used in other countries is more likely to be
off the shelf and not customized applications that are more
difficult to fix.
Finally, countries starting later had the benefits of the
lessons learned by those working on Y2K for several years. We
spent a lot of time in the last 12 months encouraging the
sharing of technical information about problems, products,
fixes and testing techniques, and I think it is obvious that
worked paid off.
So what lessons can we draw from the Y2K experience? First,
Y2K has taught us that top management needs to be more involved
in information technology on an ongoing basis, since
information technology cuts to the very heart of how
organizations conduct their business. In many companies, it was
only when the board of directors or the chief executive officer
took ownership of the problem that we could see the first signs
of any real progress.
Y2K has also shown us that we need to do a better job of
configuration management, in other words, keeping track of the
technology we use and the functions it performs. Y2K provided
many large firms a reason to conduct, for the first time ever,
a comprehensive inventory of their information technology
infrastructure and processes.
Not surprisingly, organizations found that some systems
could be discarded without any loss in productivity. Other
systems were replaced by newer, more efficient models. Third,
Y2K has demonstrated the value of forming partnerships across
traditional boundaries to achieve a common goal. In addition to
showing us the increasing interconnectedness of organizations
through technology, Y2K highlighted the fact that private
industry and government can work together to address major
national issues.
I think that spirit of partnership obviously extended to
the political arena as well. Most people realized early on
there was not a Democratic or Republican solution to this
problem, and we really have worked well together, particularly
in the partnership that led to the passage of the Year 2000
Information Readiness and Disclosure Act in 1998.
Finally, I think that Y2K has demonstrated that we need to
include the American public in the discussions about any future
large-scale challenges. Given the facts, whatever they are,
people generally responded appropriately. Even when industry
and government information provided to the public revealed that
there was still substantial work left to do, people were
reassured rather than alarmed. They seemed comforted to know
their organizations were treating the problem seriously, were
working together to solve it, and would keep them informed with
the status of the situation.
The President's Council will soon cease its operations.
Before we post the going-out-of-business sign, we will focus on
monitoring activities during the leap year rollover. We do not
expect any major national problems and we anticipate the
Council will shut down for good by the end of March.
In closing, I would like to echo the comments made that the
Federal Government and the country's successful resolution of
the Y2K problem attributes to the skill, dedication and hard
work of thousands of professionals that have focused on this
issue. It has been my pleasure to assist them as part of this
vital national effort, and I look forward to answering any
questions you may have at the conclusion of the other
statements.
Mr. Horn. Thank you very much.
[The prepared statement of Mr. Koskinen follows:]
[GRAPHIC] [TIFF OMITTED] T6711.005
[GRAPHIC] [TIFF OMITTED] T6711.006
[GRAPHIC] [TIFF OMITTED] T6711.007
[GRAPHIC] [TIFF OMITTED] T6711.008
[GRAPHIC] [TIFF OMITTED] T6711.009
[GRAPHIC] [TIFF OMITTED] T6711.010
[GRAPHIC] [TIFF OMITTED] T6711.011
Mr. Horn. We will go down, as you know, with this panel and
then open it up to questions, because I think some of the
information will jibe and some won't.
The gentleman from the General Accounting Office, Mr. Joel
Willemssen, the Director of Civil Agencies Information Systems,
Accounting and Information Management Division. Mr. Willemssen
has gone all over the United States with the subcommittee on
government management and has been an active participant in the
various panels we have had of government officials, private
sector and so on. So it is a pleasure to have you here.
I know you were working right up to midnight there, as I
saw you in John's command center. So we appreciate all you have
done and your team at the General Accounting Office.
Mr. Willemssen. Thank you, Mr. Chairman, Chairwoman
Morella, Ranking Member Turner, members of the subcommittees,
thank you for inviting us to testify today. As requested, I
will summarize our statement.
Overall, during the rollover period, our country had
relatively few Y2K-related errors that affected the delivery of
key services. While the Y2K challenge is not yet over, because
some key business processes have not yet been fully executed
and some risky dates remain, the Nation's success thus far is a
very positive indicator that these hurdles will also be
overcome. The leadership exhibited by the legislative and the
executive branches and the partnerships formed by numerous
organizations were pivotal factors behind the success.
The Y2K-related errors that were experienced during the
rollover generally did not affect the delivery of key services
because they were either corrected quickly or contingency plans
were implemented. A key reason that Y2K errors had little
effect on the delivery of services is that Federal agencies and
other organizations used the rollover weekend to identify and
correct errors before the problems resulted in operational
consequences.
In the Federal Government, the few Y2K disruptions that
were significant were mitigated by quick action. For example,
the Department of Defense, Health Care Financing Administration
and Federal Aviation Administration each experienced
significant Y2K events that they were able to address quickly.
For high impact State-administered problems such as
Medicaid, food stamps and unemployment insurance, actions by
States and the Federal Departments of Agriculture, Health and
Human Services and Labor have paid off. Errors reported were
often cosmetic printing or display problems with few failures
resulting in disruptions to service.
The threat posed by Y2K was a much needed wake-up call for
organizations to improve their management of information
technology. Y2K has laid a foundation for longer term
improvements in the way that Federal Government manages
information technology. I would like to quickly summarize some
of the key lessons that we have learned out of the Y2K
experience.
First, as mentioned, one of the most important factors
underpinning the success of Y2K was leadership at the highest
levels of government. In particular, congressional oversight
played a central role in pushing agencies forward on Y2K. Mr.
Koskinen and the President's Y2K Council provided strong
effective leadership.
Second, Y2K served as a notice to many on how much we rely
on information technology to deliver key services.
Third, there was standard guidance that was put together
that was universally accepted, adopted and implemented, which
facilitated Y2K efforts and oversight. Such guidance provided
consistency, imposed structure and discipline and enhanced the
rigor of testing and assessment efforts.
Fourth, as Mr. Koskinen mentioned, the establishment of
partnerships among various organizations was especially
important. In particular, the partnerships formed by Mr.
Koskinen, Federal agencies and private sector organizations
were instrumental to the Nation's Y2K efforts.
Fifth, we found that using standard techniques and metrics
to monitor performance was especially helpful in measuring
progress and remaining challenges.
Finally, Y2K saw many agencies take charge of their
information technology resources in much more active ways. In
many instances, it forced agencies to inventory their systems
and to link those systems to agencies' core business processes.
Also the development and testing of contingency plans should
have benefits way beyond Y2K.
Further, Y2K prompted agencies to establish needed policies
in areas such as configuration management, risk management and
software testing.
In summary, the Y2K rollover was clearly a success for our
Nation. A key challenge now for the Federal Government is
ensuring that the lessons learned in addressing Y2K can be
effectively used to improve overall information technology
management.
That concludes the summary of my statement. Thank you very
much.
Mr. Horn. I thank you very much. We have a lot to pursue in
your very fine document here as to what did go wrong.
[The prepared statement of Mr. Willemssen follows:]
[GRAPHIC] [TIFF OMITTED] T6711.012
[GRAPHIC] [TIFF OMITTED] T6711.013
[GRAPHIC] [TIFF OMITTED] T6711.014
[GRAPHIC] [TIFF OMITTED] T6711.015
[GRAPHIC] [TIFF OMITTED] T6711.016
[GRAPHIC] [TIFF OMITTED] T6711.017
[GRAPHIC] [TIFF OMITTED] T6711.018
[GRAPHIC] [TIFF OMITTED] T6711.019
[GRAPHIC] [TIFF OMITTED] T6711.020
[GRAPHIC] [TIFF OMITTED] T6711.021
[GRAPHIC] [TIFF OMITTED] T6711.022
[GRAPHIC] [TIFF OMITTED] T6711.023
[GRAPHIC] [TIFF OMITTED] T6711.024
[GRAPHIC] [TIFF OMITTED] T6711.025
[GRAPHIC] [TIFF OMITTED] T6711.026
[GRAPHIC] [TIFF OMITTED] T6711.027
[GRAPHIC] [TIFF OMITTED] T6711.028
[GRAPHIC] [TIFF OMITTED] T6711.029
[GRAPHIC] [TIFF OMITTED] T6711.030
[GRAPHIC] [TIFF OMITTED] T6711.031
[GRAPHIC] [TIFF OMITTED] T6711.032
[GRAPHIC] [TIFF OMITTED] T6711.033
[GRAPHIC] [TIFF OMITTED] T6711.034
[GRAPHIC] [TIFF OMITTED] T6711.035
[GRAPHIC] [TIFF OMITTED] T6711.036
[GRAPHIC] [TIFF OMITTED] T6711.037
[GRAPHIC] [TIFF OMITTED] T6711.038
[GRAPHIC] [TIFF OMITTED] T6711.039
[GRAPHIC] [TIFF OMITTED] T6711.040
[GRAPHIC] [TIFF OMITTED] T6711.041
[GRAPHIC] [TIFF OMITTED] T6711.042
[GRAPHIC] [TIFF OMITTED] T6711.043
[GRAPHIC] [TIFF OMITTED] T6711.044
[GRAPHIC] [TIFF OMITTED] T6711.045
Mr. Horn. It is always a pleasure to have the Commissioner
of Internal Revenue here. We will see you again on April 15th.
We would love to hear your statement, because you had a lot of
burdens counting on it, people that wanted refunds and all the
rest of it. So thank you, Commissioner, for being here.
Mr. Rossotti. Thank you, Mr. Chairman. It is good to be
here. Madam Chairman and distinguished Members, I am very
pleased to report that the IRS experienced a smooth Y2K
rollover starting on December 29th and continuing up to the
present with fewer problems this January than we normally
experience in a normal January. To date, we have had good
success. It was hard work and our success can be attributed to
the comprehensive planning and preparations we have conducted
over the last 3\1/2\ years. We also are very grateful for the
guidance and assistance you provided, your committee, as well
as Mr. Koskinen and GAO.
I do want to note we cannot yet declare total victory on
Y2K at the IRS. Some risks do remain, and in particular, we
have to be very vigilant about Y2K problems that could still
crop up during our high volume tax filing season, which really
starts in February and continues through April.
As I discussed in previous hearings, the scope of the Y2K
problem at the IRS was enormous and required a significant
investment, about $1.3 billion, to plan and prepare.
But fortunately, that investment was made. Had we not
adequately prepared for Y2K, I think it is fair to say the tax
system of the United States would simply have ground to a halt.
In my written testimony, I described several scenarios for
today, I picked out a few of the events that would have
occurred.
For example, our 14-year-old system for entering data from
paper tax returns would have stopped working if we had simply
allowed it to roll over without modification. This particular
combination of hardware, software and third-party products
could not be renovated, and therefore, was totally redesigned
and replaced during 1998 and 1999. Without this system, about
90 million individual income tax returns that come in on paper
would have just been piling up right now.
Second, interest and penalty calculations would have been
incorrect and would have generated wrong notices to taxpayers.
For example, if we had not replaced the system, we would have
sent about 67 million wrong notices to taxpayers telling them
that they owe money to the IRS. Those numbers would have been
wrong.
Third, our data transfers with important external
organizations such as the financial management service and the
Federal Reserve Bank would have failed because of incompatible
dates. This would have impaired or eliminated the ability to
issue about 80 million refunds.
Just a final example, I think this is particularly
interesting, and certainly not unexpected, but after years of
fixing and testing these systems, we did one final end-to-end
test that was completed about the middle of December. This
particular final end-to-end test identified 175 problems. Some
of those would have been very serious had we not fixed them at
the end. For example, a system that generates new balance
notices to taxpayers for certain tax periods was displaying the
date as 2099 instead of 1999 for some of those notices.
So if this problem had not been fixed, we would have been
sending out hundreds of thousands of notices to taxpayers with
incorrect tax periods and wrong payment dates that would have
generated mass confusion among those taxpayers, and this was
just only one example. There are many more scenarios in my
written testimony. Of course, none of these things actually did
happen, and that was simply because we acted in time to solve
the problems.
Now, the question is sometimes asked in the form of was Y2K
a blessing in disguise? I would have to say that I would not
consider it to have been a blessing, whether it was disguised
or not disguised, but there are some important residual
benefits in the IRS that we will realize from the investment. I
will mention the four most important.
The first is we did replace a lot of obsolete hardware and
system software products. As a result of the Y2K program, most
of our hardware in the IRS has been replaced, since most of it
was really obsolete, and software releases have been brought
up-to-date. This bringing up-to-date of this infrastructure is
essential for supporting what we are now embarked on, our
technology modernization program, and, of course, it is
imperative that we have adequate annual replacements of
hardware and regular routine upgrades of software releases in
order to keep this vast installed base up-to-date.
Second, we did implement some very important improvements
in our program management practices. Our Y2K program was
successful largely because effective program management
practices were implemented over the last 3 years. These
practices will be extremely valuable as we now move forward
with our technology modernization program.
I do want to note as challenging as Y2K was, our
modernization program imposes even more and different
challenges because it involves major business changes as well
as technology.
Third, we were able to standardize many products. The IRS-
installed base of hardware and software was not only obsolete,
it was heterogeneous in the extreme. The Y2K program has
allowed us to set up and largely implement standard products.
Because of our reorganization under the leadership of our CIO,
Paul Cosgrave, we now have the management structure and
delegated authority in place to make design and procurement
decisions to maintain standardization of technology.
Finally, we implemented improved inventory management. GAO
has justly criticized the IRS for years for the poor condition
of our IT inventory. Because of Y2K, we were forced to examine
our inventory and bring it up-to-date as never before. So the
condition of our inventory records is greatly improved,
although I have to note it is still not fully where it needs to
be, and there is much that needs to be done in the future on
that problem.
In conclusion, Mr. Chairman, we are gratified with our
results. I stress there are still some risks that remain.
Clearly, we gained some residual benefits which will be of
great value as we proceed to our even more challenging business
system modernization programs. These benefits will only be
realized if we actively continue the practices established
during Y2K, including regular replacement and upgrades of
hardware and software. We will keep the subcommittees apprised
of any remaining problems and our actions to correct them.
I thank you for the opportunity to discuss our efforts, and
certainly thank you for your interest and support over the last
3 years.
Mr. Horn. Well, we thank you very much.
[The prepared statement of Mr. Rossotti follows:]
[GRAPHIC] [TIFF OMITTED] T6711.046
[GRAPHIC] [TIFF OMITTED] T6711.047
[GRAPHIC] [TIFF OMITTED] T6711.048
[GRAPHIC] [TIFF OMITTED] T6711.049
[GRAPHIC] [TIFF OMITTED] T6711.050
[GRAPHIC] [TIFF OMITTED] T6711.051
[GRAPHIC] [TIFF OMITTED] T6711.052
[GRAPHIC] [TIFF OMITTED] T6711.053
[GRAPHIC] [TIFF OMITTED] T6711.054
Mr. Horn. As Mr. Koskinen leaves the scene, there is no
question in my mind the toughest job in the executive branch is
the Commissioner of Internal Revenue. If anybody is going to
turn that agency around, you are.
So, thank you.
The last witness on this panel is Mr. Fernando Burbano, the
Chief Information Officer of the Department of State. We are
glad to have you here.
Mr. Burbano. Thank you, Mr. Chairman, Madam Chairwoman and
distinguished members of both committees. Since my oral
testimony is limited to 5 minutes, my written testimony
includes more detail.
As chairman of the CIO Council Subcommittee on Critical
Infrastructure Protection, I am pleased to have this
opportunity to discuss how lessons learned, products and
processes developed in support of Y2K, can be leveraged into
our ongoing critical infrastructure security efforts and
challenges facing Federal agencies in implementing security
pleasures.
As well, in my role as CIO of the State Department, I would
like to thank you for providing me this opportunity to talk
about the results and continuing impacts of the Department's
successful Y2K preparation efforts. The Department of State,
along with rest of the Federal Government, showed just how
powerful and effective we can be when we are singularly focused
and committed to solving a problem and are provided the
necessary resources to get the job done.
First, let me quickly address the cost of preparing for
Y2K. The question is, did we spend too much? The answer is very
simple: Absolutely not. We should be careful not to confuse the
lack of catastrophic disruptions with unnecessary preparations
by the Federal Government.
Now, moving on to the actual results of the Y2K rollover
and its impacts to the global community. In general, there are
few and only minor Y2K failures reported internationally, and
none that impacted the safety of American citizens worldwide. I
believe this global success is a direct result of the U.S.
Government's international outreach and awareness campaign led
by the Department of State, the Department of Defense and the
President's Council on the Y2K Conversion, in coordination with
the United Nations and World Bank.
Embassies representing the U.S. presence in over 160
countries around the world played a key role in monitoring and
reporting events in their host countries and post facilities
through a Y2K task force convened in State's operations center.
Additionally, internal State Department systems fared
exceptionally well throughout the rollover, experiencing no
significant failures among our mission critical, critical and
routine systems.
As you are well aware, many of the products and processes
developed to address Y2K problems can be applied to future
challenges and serve as the foundation for managing issues with
cross-agency and public-private boundaries, including critical
infrastructure protection. In fact, much of the work already
done is a prerequisite for PDD 63, critical infrastructure
protection, Clinger-Cohen, and other government performance
results act initiatives.
Specifically, Y2K preparation forced government agencies to
take a close look at its IT applications and produce a complete
prioritized inventory. This is a critical first step to
identifying and refining the mission essential infrastructure
as required by PDD 63.
The Y2K effort produced program management methodologies
which were applied across all government agencies and included
executive and congressional oversight, Assistant Secretary
level management and repeatable standardized measures and
processes. This management structure can also be applied to
critical infrastructure protection.
All elements of the Federal Government reviewed and
developed contingency plans for critical business processes.
The development of these contingency plans resulted in a
greater understanding by senior policy managers of the
dependency of business processes on IT systems. Additionally,
these plans are durable beyond Y2K established a foundation for
all future contingency operations planning.
For the Y2K rollover period, the government developed a
robust global reporting structural which can be leveraged into
a mechanism for monitoring threats against critical
infrastructure elements. For example, within the Department of
State, we have developed a web-based geographic information
system to collect cyber-threat information from all overseas
posts. This tool can serve as a pilot system for other agencies
to collect and analyze cyber-threat data.
Finally, Y2K preparation efforts increased the level of
interagency cooperation and coordination between the public and
private sectors. The same working level teamwork will be
required to effectively implement critical infrastructure
protection plans.
There are two areas which I believe allow the Federal
Government to successfully overcome widespread Y2K problems in
the face of an unmovable tight deadline.
First, continued participation by key congressional
oversight organizations provided Federal Y2K programs the
authority needed to push agency resources to their limits.
Second, the ability of Federal Y2K programs to rapidly
obtain and more importantly retain adequate separate
supplemental funding, specifically designated for Y2K, allowed
each agency to acquire the resources necessary to achieve the
time sensitive objectives.
This ability of Federal agencies to have access to a
congressionally managed yet continuous separate supplemental
funding stream designated specifically for the Y2K effort
allowed Federal CIOs and Y2K program managers the ability to
acquire and retain qualified resources in the needed quantity.
Critical infrastructure protection requires the same
approach. Involvement by Congress and other oversight
organizations to raise the level of awareness and visibility
throughout the Federal community and overseas CIP
implementation in support of national security goals is vital,
and this activity is already underway.
But just as important to me and my colleagues through our
government is access to funding which allows each of us to
begin developing and implementing our plans in accordance with
PDD 63 and other critical infrastructure protection guidance
and statutes.
One of the key obstacles preventing agencies from
immediately pursuing CIP initiatives is the lack of current
funding for these projects. Due to the Federal Government's
budget cycle, forecasting the future work is done 2 years prior
to the budget year. Therefore, as new requirements are levied,
current agency budgets do not reflect changing priorities and
requirements, such as the need for critical infrastructure
protection implementation initiative. In light of this, there
are numerous events that have prevented agencies from
adequately addressing current CIP implementation requirements
in their fiscal year 2000 and fiscal year 2001 budgets.
First, the unprecedented and unpredictable growth of
Internet use and technologies over the last 2 years; second,
the corresponding collateral growth of the cyber underworld
during this same period; third, the extent to which our daily
business relies on Internet-based systems and the fundamental
shift of business tools to be used in a web-based environment;
finally, expanding CIP requirements on Federal agencies,
including the recent critical infrastructure plan released and
its 10 programs, some of which require immediate
implementation.
These are just some of the reasons why Federal agencies are
poorly positioned to successfully implement critical
infrastructure to address the challenge posed by the ever-
growing cyber underworld, not to mention to be in compliance
with executive guidance. Although we of the CIO council fully
understand fiscal constraints, reallocation of such a fraction
of the current surplus would be a solid investment for the
protection of the Federal Government's critical infrastructure.
In closing, it is my belief and the belief of members of my
subcommittee and CIO's across the Federal Government that in
order for the national CIP initiatives to be fully successful,
continued congressional support as well as the ability to get
access to specific CIP and security-related funding is vital. I
cannot emphasize that without congressional-backed support,
including adequate funding, we on the subcommittee of the
critical infrastructure committee believe that the government
will significantly fall short of national critical
infrastructure protection goals. Thank you.
Mr. Horn. We thank you very much for that statement.
[The prepared statement of Mr. Burbano follows:]
[GRAPHIC] [TIFF OMITTED] T6711.055
[GRAPHIC] [TIFF OMITTED] T6711.056
[GRAPHIC] [TIFF OMITTED] T6711.057
[GRAPHIC] [TIFF OMITTED] T6711.058
[GRAPHIC] [TIFF OMITTED] T6711.059
[GRAPHIC] [TIFF OMITTED] T6711.060
[GRAPHIC] [TIFF OMITTED] T6711.061
[GRAPHIC] [TIFF OMITTED] T6711.062
[GRAPHIC] [TIFF OMITTED] T6711.063
Mr. Horn. We are sure there will be questions for every
witness. I am going to start with the cochairman of the task
force, the gentlewoman from Maryland, to begin the questioning.
It will be limited to 5 minutes by each Member, and it will
alternate between those who have not had a chance, starting
with Mr. Turner after the gentlewoman from Maryland.
Mrs. Morella. Thank you, Mr. Chairman.
You know, I hear from all of you some of the same results
assessments. First of all, you became more familiar in your
various agencies, departments, groups with whom you work, with
information technology and its role in the future. Second,
there was an assessment of the systems that you have, so you
are ready to move ahead with information technology.
Also, I think, rising to the forefront is the concept of
the partnerships, partnerships within the Federal Government,
the executive branch, legislative branch, but also partnerships
with the private sector, partnerships with local governments. I
think that is something that we could all learn from and hope
to continue to preserve.
We also--I think you all said you felt this was very
important and that it did prevent some big problems.
My two questions I am going to meld into one because of the
time constraints. First of all, I am surprised myself that
there weren't some problems with the Pakistans of this world,
Russia. They didn't seem to have any major problems. These are
places with older computer systems. I just wondered if you all
were surprised at the lack of the problems we have heard about
emanating from those countries and other countries that would
be in the same category?
Second part, as we look to leap year, February 29th, do you
foresee any major or minor problems? Is there something we
should be doing about that?
I guess I could start then with Chairman Koskinen.
Mr. Koskinen. Well, as I noted in my testimony, I think
things did go better abroad than anyone had expected.
Partially, though, I think that is because we fell prey to what
I thought people did here, which is we didn't believe other
countries when they gave us their progress reports.
In the last 2 months of the year, country after country
issued reports that didn't say there wasn't a problem, but
basically said they identified the places where they needed to
apply resources; they had done that effectively and they were
prepared. We all sort of said it was late in the day, are they
really prepared? It turned out they were, for a number of
reasons that I discussed.
One is, a lot of them had much less reliance on information
technology, certainly in their infrastructure, than we do here.
In fact, I think there are a relatively small number of
countries in the world that have complicated computerized
control systems for their infrastructure that put them at risk.
So a lot of countries discovered that the embedded-chips did
not create a problem for their infrastructure.
In fact, in the last quarter of last year, we noted, based
on testimony and information from industry experts, that it was
unlikely that the lights would go out anywhere or that a dial
tone would stop anywhere, that the risk in infrastructure
systems with embedded systems was gradual degradation of
service over a period of time.
So in the countries that we knew were in the middle--the
truly developing countries have very little IT and were at risk
primarily in financial systems, it was the Pakistans,
Indonesias, Russias, Chinas of the world--that had a reasonable
reliance on information technology, where people were concerned
about how much they had done.
I think it is a combination of the fact that they started
late, but they spent a lot of time in the last 6 to 9 months
working hard on it. They got the benefit of learning from
everybody else. There was a tremendous amount of information
exchanged as we moved through it, and third, a lot of their
systems are still analog, they are not digital. They did not
depend upon new digitalized equipment, and therefore, they were
able to prioritize their resources in a much more focused way.
But I would emphasize that the image of those countries, as
if they didn't do anything, they were unconcerned and just
waited around, was wrong. We met with 173 country delegates in
June at the United Nations, and every one of those countries
understood this was a problem that, in some degree, affected
them. Every one of those countries was then focused on Y2K,
every country met at least twice in every region of the world
cooperating, or most of the countries did, cooperating, sharing
information.
So I think what happened was in that last 6 months far more
work was done in a very focused, effective way than any of us
were able to get a window on.
With regard to February 29th, it has turned out in testing,
certainly in the Federal systems and in the private sector,
that there have been more mistakes than one would have thought.
You would have thought people would have gotten the right
result for the wrong reason, which is, they didn't understand
the rule of centuries, they just divided by 4 and figured out
the year 2000 was a leap year.
It turned out there were a reasonable number of programmers
that had just enough information to be dangerous, which is,
they knew centuries generally aren't leap years, they just
didn't know the rule of the exception divisible by 400.
So this is primarily a software problem, although there
were some potential embedded chip and system operations
problems. Our judgment is we will see no more glitches than we
saw on January 1, which were relatively minor and modest.
We are going to monitor it for two reasons. One is we think
it is important for those who are operating systems to
understand it is a real problem and there is still time for
them to test their systems. Most major companies have already
done that.
Second, it will be important to monitor the 3 days: the
28th, 29th and 1st of March, so the glitches that occur, and I
think inevitably there will be some, are put in the appropriate
context. If we had not been able to identify the limited nature
of the glitches as they occurred over that first 2 or 3 days on
the rollover, we would have had a very different media
response. When reports came in of legitimate glitches, the
fact, we were able to confirm their accuracy, but expand by
saying that is the only country in which it happened, or the
only area that happened. It allowed us to put the glitch in the
right context. Absent that, you would have had a greater
likelihood of unnecessary overreaction by either the media or
the public. We don't expect there will be many glitches, but we
think it is important for the public to know where they are and
what their significance is.
Mrs. Morella. I would like to give you opportunity to
respond, Mr. Burbano. Incidentally, I love that acronym for the
critical infrastructure, CIAO. It is easy to remember.
Mr. Burbano. Thank you. Working at the State Department, I
had a great opportunity to actually go overseas to many of the
countries and meet the John Koskinens of those countries and
their sector leaders. I found two things quite interesting, and
that is why I personally wasn't too surprised.
One is in talking to them, I found out they were not as
automated as some of the people thought they were. But more
importantly, the culture in a lot of these countries is not to
report the status of government systems, whether it is good or
bad, believe it or not. But they will reveal more orally, which
obviously when you try to track status, is the only thing that
are looked at is written, and if you don't have information to
provide, you assume the worst, and that is why they don't get
reported as well. Those were the two reasons I found.
Mrs. Morella. Like people say about the President,
underestimate so that the results will be attributed to you,
however it comes out.
Mr. Horn. I thank the gentlewoman.
I now yield to the gentleman from Texas, Mr. Turner, the
ranking member, 5 minutes for questioning.
Mr. Turner. Thank you, Mr. Chairman.
Mr. Koskinen, I don't know if you have this information or
are set up to collect it, but earlier we had a lot of dire
predictions about lawsuits being filed all over the place
regarding Y2K problems, and I would be curious as to whether or
not any of that has occurred and the degree to which that was a
significance problem?
Mr. Koskinen. Well, some of us maintained last year that
you couldn't have massive lawsuits without having massive
failures, and therefore, at least the President Council's
position was there was not likely to be this flood of
litigation, because there was not likely to be a flood of
failures.
That turns out to have been correct. There have been a
relatively modest number, but significant lawsuits have been
filed where people are arguing about who is going to pay for
the fixes, and the question is whether insurance policies cover
the failures that companies avoided, particularly in major
companies in the United States.
But as a general matter, in the absence of any very
significant Y2K failures since the 1st of the year, obviously,
you can't have a lawsuit if you don't have somebody damaged in
some way. So at this juncture, the only lawsuits out there are
primarily focused on arguments between those who fixed the
systems and primarily their insurance companies about who ought
to pay for it. Even that is not anything like a flood of
litigation.
Mr. Turner. As I recall, of those issues that you mentioned
regarding who should pay for fixing, it was not the subject of
the litigation nor the success of the legislation that
attracted so much attention in the Congress, because all issues
were separate and aside from the issues that were dealt with in
the Y2K litigation.
Mr. Koskinen. That is right. The legislation that the
Congress passed primarily addressed the rights and
responsibilities of potential plaintiffs and defendants if
there were system failures, focused primarily on giving
potential defendants the opportunity and the right to fix any
of those failures within a defined period of time, and again,
since there have been relatively few of those problems that
amounted to much, there have been a lot of glitches along the
way, there hasn't been much need for the legislation. But I am
sure people would argue that since there were great risks, if
we didn't get the work done, that there would be failures,
there was some potential that the failures obviously would have
generated litigation. The fact that we haven't had the failures
has had the side effect that we are not going to much
litigation.
Mr. Turner. That is all I have, Mr. Chairman. Thank you.
Mr. Horn. Thank you very much.
We are in the question period. Does the gentlewoman from
Illinois have some questions? The gentlewoman is recognized for
5 minutes.
Mrs. Biggert. Thank you.
As far as what is going to happen in the future, will there
be a plan like continuation of your Council, or is there going
to be an office that will remain after probably the leap year?
Mr. Koskinen. Well, if there is, it won't have me in it.
No, the Council will, as I noted, fold up its tent and fade
away into the dusk, probably by the end of March. The issue
going forward that Mr. Burbano noted that people are focused on
is how will we deal with information technology security and
threats to the critical infrastructure, and there is a
Presidential decision directive, PDD 63, that sets out a
structure and an organizational framework for dealing with
those issues, coordinated by the National Security Council out
of the White House. So that operation, while we have been
coordinating very closely together over the last 2 years, will
continue, but it is already set up in the Critical
Infrastructure Assurance Organization [CIAO], as Chairwoman
Morella noted, and that will be separate from the President's
Council.
Mrs. Biggert. So there will no longer be a CIO czar?
Mr. Koskinen. That is right. I never saw myself as the CIO
czar. The CIOs actually have been very capable of taking care
of themselves.
Mrs. Biggert. Again to Mr. Koskinen, what was the biggest
surprise of the rollover?
Mr. Koskinen. Well, if you look back at our quarterly
assessments, we did four of those. In the last one we put out
in the fall, basically in the United States the rollover went
as we predicted. We said there were going to be no national
infrastructure failures, there would be no regional failures,
if there were any failures, there would be isolated problems at
the local level. That is what we basically have seen. So in the
United States we have been pleased that there haven't been more
visible problems for small businesses. A number of them have
had glitches, but they seem to have been able to deal with
those, because that was an area we were concerned about.
So, like others, I think the bigger area of uncertainty for
us was what was going to happen abroad. Again, we did not think
as we noted in our report and in a report by the Department of
Commerce that any glitches abroad would have any significant or
noticeable impact on the American economy.
We looked at the range of possibilities, where the
countries were that were at risk, and where our trade and
business partners were, and it was clear to us, no matter what
happened in the countries we thought were at risk, it was not
going to have an economic impact on us. That also turned out to
be true.
But as we discussed earlier, I think all of us were,
primarily for a lack of information, concerned about a number
of countries that rely on some information technology who
started late, where it was hard to know exactly how much work
they had gotten done in the last 6 to 9 months of 1999. It
turned out that in their basic infrastructure, I think
primarily because it was not as much at risk as we might have
suspected, there haven't been any infrastructure failures.
The other thing to bear in mind is in the areas where I
think they were at greatest risk, which is in financial
transactions and communications, those systems were being
tested and worked on for the last 2 years on an international
basis. So even in a country that didn't have an organized
process for infrastructure protection, its banking system had
to be testing and working with other banking systems, because
the central bankers around the world for the last 2 years
focused on that. That was, in many ways I think, the biggest
risk they had and the biggest success they had.
Mrs. Biggert. I guess just one last question, that so many
valuable lessons came out of the experience, and how are we
going to ensure that these lessons aren't lost if we don't
continue on after leap year day, February 29th, I guess it is?
Mr. Koskinen. We created in my prior incarnation, with the
help of this committee and others, the Clinger-Cohen Act and
the Chief Information Officers Council and CIOs in all of the
agencies, with the idea they would be as they have been the
focus for information technology issues across the government.
That council is chaired by my successor as the Deputy
Director for Management at OMB, and independent of the
information technology issues, the security issues that are
under the critical infrastructure assurance organization, but
focused on by the CIOs as well, there is an existing vehicle
that I think, over the last 3 years of its existence, has
turned out to be very effective for bringing together all of
the Federal agencies and their senior information technology
people to work together on isolating and identifying what are
the critical challenges the Federal Government faces, how
should we be organized to deal with those, and then
implementing those situation suggestions.
Mrs. Biggert. Thank you. Thank you, Mr. Chairman.
Mr. Horn. Thank you very much. Let me ask you, Mr.
Koskinen, you have had a lot of experience in the executive
branch, first in OMB and other consultant operations, and, of
course, this. You note in your formal statement here, and you
mentioned it also, I believe, in your oral summary, this is the
greatest management challenge the world has faced in the last
50 years. I think there is probably a lot of truth to that on
the world.
But when we look at major management challenges within the
executive branch over 50 to 60 years, we see the atomic bomb
and the hydrogen bomb, major challenges of how you put that
together; going to the moon is certainly another one, setting a
goal as President Kennedy there; Admiral Rickover and the
nuclear Navy, where you cut through a lot of bureaucracy and
got the job done.
I guess I would ask you, as you look here, how do
Presidents best get served in dealing with those management
problems and the one you just presided over? So give us a
little insight into that.
Mr. Koskinen. Well, as I say, I think the difference
between the Y2K problem and the other significant challenges
you floated, which I think were important for the country is,
this was a challenge that affected every system in the Federal
Government, every agency. So it was not a question of having
NASA or the Energy Department or someone else focusing on a
very major challenge.
This was a challenge of having every Federal agency, large
and small, challenged at the same time, not only within each
agency but across agency lines. The Treasury Department
services and provides financial services to a wide range of
Federal agencies, for example.
I think in all of those cases, what is needed is for people
to identify the problem and for it to have a high level of
commitment and attention from the Congress as well as from the
executive branch. Again, I think the structure set up of the
CIO council for information technology challenges going forward
is an effective structural vehicle for the government to be
able to surface what the issues are and deal with them
effectively.
So as we move forward, I think information technology is
not a series of episodic challenges for us. Information
technology is an ongoing issue, not just for the Federal
Government, but for the private sector and world as we become
more reliant on information technology for everything from
communication to financial transactions.
Mr. Horn. What do you see based on usual experience as to
the one or two management challenges after this is done? What
do you see? You have had a real eye-opener, I think, throughout
the last few years.
Mr. Koskinen. Clearly information technology is a
challenge. I think it has affected our ability to modernize
systems across the government, to have them implemented and
operate effectively, has been for some time and will continue
to be a challenge.
I think performance measurement. I was a great supporter of
the Government Performance and Results Act. I think it is
important, not only for effective management within the
government, but for an improved dialog with the public about
what our goals are and our objectives are and how we are doing
and achieving those.
So as we go forward, I think we have on our plate
significant challenges, and we probably don't have to reach out
and find new ones. If we could handle both of those
effectively, deliver services more effectively under GPRA and
provide improved updated modernized information technology
delivery systems across the government, I think we are headed
in the right direction in those areas, but I think they are
major challenges.
Mr. Horn. We are going to be holding hearings with the
Government Management Subcommittee on Clinger-Cohen that was
mentioned, which came out of this subcommittee and the full
committee, and also on the computer security issue, which came
up here, so we will be looking for you to testify on those
things. Those certainly cut across different agencies within
the executive branch. We have a whole other agenda also we can
get into with whoever is in place there with the CIOs, because
I think that is very important, what you did when you took the
job and came out of retirement. You went around and sat down
with the Deputy Secretaries who often operate the departments,
and I think that was very important.
Would you like anything else to have done that you didn't
have time to do?
Mr. Koskinen. No. Oddly enough, this was my feeling even
before we had the successful transition, if I had to do it over
again, I wouldn't do anything differently. We did all we needed
to do, I think, and all we could do. I got tremendous
cooperation from not only the leadership in all of the Federal
agencies, but as I noted, I think a stunning achievement by
career public servants in the Federal Government and State and
local government, demonstrating an ability to meet a real
challenge and meet it effectively.
Mr. Horn. What are you going to do with that $50 million
headquarters? Who moves in?
Mr. Koskinen. That includes the operational cost for a
year, so not all of it will be in place. But OMB is working
with the agencies and I have said that when we do our last
briefing on March 1st for the rollover, OMB at that time will
announce exactly what its plans are for the operational
capacity at the information coordination center.
Mr. Horn. Most Presidents early in the morning get a
national security briefing coming over from CIA. Do any
Presidents ever get a management briefing in the morning as to
what is going on in the executive branch and why not?
Mr. Koskinen. That is not in my jurisdiction at this point,
so I can't tell you whether that is done or not.
Mr. Horn. It was in part when you were Deputy Director for
management. The question is most Presidents don't know what is
going on in the executive branch unless there is some crisis
that hits the papers. Shouldn't Presidents also be looking at
the domestic situation, just as they look in the morning at the
foreign situation?
Mr. Koskinen. There is no doubt that our ability to manage
the vast organizations we have and the significant funds that
we have is an important part of our responsibility to the
public, and I think that not just in the executive branch and
the Congress as well, it is oftentimes more exciting to talk
about new policies or new programs or failures isolated.
It is much harder, as you know, in the leadership you have
had in your subcommittee, to get people to understand and focus
on day-in and day-out management. But when push comes to shove,
our ability to make changes and provide benefits to people
depends on our ability to manage programs effectively. Good
ideas poorly implemented are actually very ineffective.
Mr. Horn. I am going to yield now to Mr. Wu from Oregon for
5 minutes of questioning.
Mr. Wu. Thank you, Mr. Chairman. I am just going to use a
little bit of my time and really focus on this a little bit
more with the private sector panel coming up. I just want to
ask one question:
With the upgrades, the new equipment, the other preparation
work which was done in the Federal agencies, do you see, or are
you currently experiencing a dip in procurement as a result of
the bulge, if you will, prior to December 31st?
Mr. Koskinen. I think the agencies can probably answer that
question better.
Mr. Burbano. I would like to address that as the CIO for
the State Department. I would say not really, for this reason.
There was a lot of systems, and I know at the State Department
we put a moratorium on systems development and implementation
and so forth if it wasn't Y2K-related.
So all of that was put on the shelf, and now it is getting
off-the-shelf as soon as the leap year is over. So that is
going to offset.
Mr. Rossotti. With respect to the IRS what really happened
is that over a 2 to 3-year period, we made an investment to
bring up-to-date our hardware and operating system software.
But, for example, with PCs, personal computers, we really need
to be on about a 3-year replacement cycle there, so we are
replacing each year about one-third of the computers
representing what was installed 3 years ago. That is kind of
the way that we are planning it.
There will be some dropoff in a few areas where we had to
make some special investments, but, on the whole, what we
really want to do is get on a long-range planning basis where
we invest a certain amount every year so that we don't get
behind as badly as we were 3 years ago.
Mr. Wu. And with respect to personnel, the people you
brought aboard, whether on a long-term basis or on a contract
basis to help you with the Y2K problem, are they being
redeployed within your agencies, have they left? What is going
on with the people?
Mr. Rossotti. Speaking for myself and the IRS, what we have
done is we simply made a determined effort 2 years ago to
retain the people we had. Unfortunately, we were suffering
attrition. So we made some very successful efforts to retain
the people we had, the people who really know some of these old
software systems, and simply had to put many, many other things
on hold. We even had to go to the Congress when they passed the
Restructuring Reform Act, and ask that some of the effective
dates for the law be extended out to 2001, because there was no
way to implement some of the things while still working on the
2000 fixes. So what we did was we simply took our staff, tried
to retain it, and allocated it to fixing Y2K as the top
priority, putting other things on hold. What we are now doing
is trying to dig out from this huge backlog.
Furthermore, we are in an unusual position in that we are
now just embarking on an enormous technology modernization
program. What IRS has right now is we have relatively new
hardware in most cases, and relatively up-to-date operating
systems, such as your Windows-type operating systems and your
mainframe operating systems.
What we don't have is up-to-date application software. We
have, in fact, extremely obsolete applications software, and we
have a lot of it. So our role now over the next several years
is with the help of a prime contractor is to reengineer that
technology, and as I mentioned in my opening statement, that
involves business change as well as technology change. So you
could almost think of Y2K as just laying the groundwork for
what we really have to do over the next several years to
reengineer our applications.
Mr. Burbano. From my view at the State Department, with the
new Y2K initiative, if you want to call it the critical
infrastructure protection I have been talking about, there is
going to be a huge demand for new people with possibly
different skills for computer security, cyber terrorism and so
forth. So there will be a replacement. Some of the skills used
in Y2K can certainly be applied. Others, maybe not. So you have
to look at it on a case-by-case basis. Regardless, there is
going to be a huge demand for this new initiative that is
facing us that is very serious.
Mr. Wu. On net, do you think you are adding folks in the
hardware-software information systems area, or are you shedding
a few now in the State Department?
Mr. Burbano. I think it is a combination. Not with
employees, with contractors. It is a combination of shifting,
replacement of skills, keeping some. But don't forget, we are
still not out of the Y2K window until the rollover of the leap
year. So that is a little bit too early to say right now. But
we are starting to look at it in that view, that since we do
have this new huge initiative that is very important and will
go on for the unforeseeable future, there will be a replacement
of skills, and some of those will be applicable and some not.
Mr. Wu. I thank the witnesses. Thank you, Mr. Chairman. I
yield back the balance of my time.
Mr. Horn. The gentleman from Washington, Mr. Baird, 5
minutes.
Mr. Baird. No questions.
Mr. Horn. Mrs. Biggert, the gentlewoman from Illinois.
Mrs. Biggert. Thank you. In making the fixes on the
computers, organizations really used a lot of different
methods, and some, apparently, I think what we heard before
were like short-term fixes as far as the date change of
windowing, making the dates like 99 and 00 rather than 1999 or
2000.
Will there be any oversight or will organizations, do you
think, pursue a permanent change, or will these temporary
changes or fixes really last for the long time, or will there
have to be something done there? Is there any oversight, I
guess, is the question or do they need to--do you know of
organizations that will need to pursue the permanent fix? Maybe
Mr. Willemssen.
And one other thing, I think, like HCFA delayed putting in
a new system until this was over. Do you see that the Y2K will
have benefited how for them to pursue that, the new changes in
their systems?
Mr. Willemssen. First of all, you are correct, many
organizations had to use techniques such as windowing, because
in many instances they had no choice. There wasn't enough time
to go through a full date expansion of the software and data
bases. So many of them did use those kind of techniques.
They will not last forever. Many of those same
organizations plan to have new systems over the next few years,
so that the risk, if those new systems come in, is relatively
small. However, the caveat to that is when programmers put in 2
digits in the 1970's and 1980's, they thought their systems
also would be replaced, and many of them were not.
So there still has to be some oversight of that issue. I
would say it is very difficult, though, to generalize among
agencies because even within a specific agency business
function, some may have windowed, some may have gotten a new
system, while others may have fully expanded the date field. It
is therefore, an issue where you have to go in and do a full
examination and know what you are dealing with and be aware of
where your risk points are as time continues with these kind of
patched systems.
Mr. Burbano. I would like to say that at the State
Department, since the Y2K program office was run underneath the
CIO, which is remaining, we do track where we used windowing.
We used a combination of windowing repairs as well as
replacements. We do have a list of those. We are tracking them,
and most of those are 10 years or more out. But we do have a
list of those and we will track them so long as the CIO office
lasts.
Mrs. Biggert. Thank you. Thank you, Mr. Chairman.
Mr. Horn. Thank you. Now the cochairman of this task force,
Mrs. Morella, the gentlewoman from Maryland.
Mrs. Morella. Thank you, Mr. Chairman. A question for Mr.
Willemssen. GAO recently reported that some of the Y2K
remediation that was done at Federal agencies was contracted
out to private corporations, and in your report, you noted that
some of the private companies used non-U.S. citizens to work
out the remediation. I just wondered if you would comment for
the record on what you found and what you think implications
are, if any?
Mr. Willemssen. We did have a request from the full House
Science Committee to look at the use of foreign nationals at
the Federal Aviation Administration in both the remediation of
software and in the post-remediation review of software that
had been previously remediated, and we did find some oversights
on the part of FAA. To the FAA administrator's credit, she
aggressively took action on these oversights, and they are now
in the process of going out and making sure that all of the
individuals who worked on the code are indeed checked out. FAA
did not know for sure, for all of the systems that were
remediated and reviewed, that the individuals had an
appropriate background investigation, and therefore whether the
risk was manageable in terms of manipulating the code.
So there were some issues that we did find. Again, to FAA's
credit, they have been very aggressive in following up on these
issues. One of the issues I think you pointed out at one of the
prior hearings, was that there was a security risk involved to
the extent that it wasn't managed with all of this push to get
Y2K done. That it would be done quickly, losing sight of some
of the necessary controls, and that is in fact, what happened
here at FAA. All the controls were not in place to check out
all of the individuals working on the code.
Mrs. Morella. Do you feel comfortable that this has then
become a symbol for what could happen if you don't have proper
implementation of the regulations and that the agencies all
know this? Did we learn from it, besides the FAA immediately
saying we will correct the oversight?
Mr. Willemssen. I hesitate to generalize because FAA is the
only agency where we went into depth on this particular point,
so I hesitate to say that other agencies may have similar
issues, although I know the executive branch is looking into
that.
I know that, as I mentioned, FAA has been very aggressive
and actually we are expecting a more detailed report from FAA
within the next couple of days on all of their actions in
response to a recommendation to do the background checks on
individuals working on the code.
Mrs. Morella. I think you would like to comment on that.
Mr. Burbano. Yes. The State Department, we looked at this
issue very carefully at the beginning. First of all,
domestically, we did not use any foreigners, especially that is
where mission critical systems are. We do require, regardless,
we do require all of our contractors and employees to go
through secret clearances. In addition to that, some minor
systems overseas did have some FSNs, foreign service nationals,
working on their systems, but they were closely supervised by
the Americans at the Embassies, and we have had no problem at
all. Everybody goes through a clearance check anyway.
Mrs. Morella. Splendid. Thanks for that assurance.
I yield back, Mr. Chairman.
Mr. Horn. Thank you very much. Let me ask a few questions
here in closing with this panel. I would like the commissioner
and Mr. Koskinen to respond to this.
The question would be the extent to which windowing was
used to repair systems, and is that really a permanent
situation, or how do you feel about the windowing aspect where
you are trying to piece it altogether and fool it, shall we
say, in terms of the computers?
Mr. Koskinen. I don't think anybody has the capacity to
tell you how much of the work was done by windowing and how
much was date expansion. Windowing is a technique that is
effective as long as you don't care about when people were born
or transactions in those windows. In other words, if you really
are only worried about relative dates, you can window. But in
things like Social Security, you can't window very effectively,
because you care very much about whether or not somebody has
been born on one side of the window or another.
Second, I think the point Mr. Willemssen made is important,
and that is, when we talk about configuration management and
better control of IT systems, obviously monitoring the way we
fix systems for Y2K as we go forward is an important part of
that management, and I think it is exactly right to note that
25 years ago, 15 years ago, people working on systems that knew
they weren't going to be Y2K compliant were comfortable because
they thought those systems wouldn't be operating. So you have
to be a little worried about anybody saying today, well, my
windowing works until 2015 or 2023, so I don't have a problem,
because those dates will come before we know it.
So I think the answer to that is not was it done, it
clearly was done. It was a very effective technique, it was
cost effective, and particularly if you are going to replace or
upgrade those systems, it was probably the right way to go. It
will turn out to be a mistake if you lose track of it, continue
to run the systems through the window, and discover you have
got a major challenge down the road.
Mr. Rossotti. I am pleased to say in this case, one of the
few occasions I can answer very easily, we did not use
windowing at the IRS, we did everything with 4-date digit
expansion and required a special exception from the CIO to have
any exceptions, and, to my knowledge there were just maybe a
very tiny handful, maybe one system given an exception.
Interestingly, the reason for that decision was not primarily
because of worries that would, you know, become obsolete in 10
or 20 years, but because we had so many heterogeneous systems
that had to work together, we were not convinced that if we
used some windowing here and some data expansion here, that we
wouldn't run into incompatibilities among our own systems. So
we made a decision to keep it simple, and so everything was
made compliant by four-digit date expansion.
Mr. Horn. OK. Now it has been mentioned on the foreign
workers in some of the patching up of these systems, I would be
curious how you all think how vulnerable our computer systems
are as a result of the Y2K, and are you concerned that those
remediating systems could have engaged in acts contrary to the
best interests of the government? So I would just appreciate--
let's start with Mr. Burbano.
Mr. Burbano. Yes. In terms of the concern, you should
always be concerned, but because of the process I mentioned
that we took at State with requiring security clearances, all
domestic systems, where our mission critical/critical systems
are at, only used Americans. We don't have as much concern
there.
Overseas, again, I mentioned we did use FSNs who have to be
cleared and who only work the minor systems and who are closely
monitored by Americans when working on the systems. So we are
not as concerned. However, we did develop a project in concert
with my sister bureau, Diplomatic Security, on doing some spot
checks on some of the systems, just to make sure.
But, just to let you know, you know, even with commercially
off-the-shelf systems, you don't know where those systems are
developed. They could have foreigners working on those systems
also. So you do have to be vigilant about these systems.
Mr. Horn. Commissioner, in terms of computer security, I am
sure you have to deal with that every day in some way.
Mr. Rossotti. Well, we have, of course, major security
challenges in the IRS from a number of perspectives, including
from the old applications software. But I think on this
particular issue, that is to say, the contractor support we
used for the Y2K, I think we were in pretty good shape on that.
There was one particular component of one system that, for a
particular reason, was developed with some offshore people, but
that was then subsequently cross-checked by a different group
that was cleared. So as far as I know, I think we can be pretty
confident on this, we do not have much vulnerability for this
particular problem.
That is not the same thing as saying we don't have
vulnerabilities for other reasons.
Mr. Horn. Mr. Koskinen, why don't you give us your side of
it?
Mr. Koskinen. I think Mr. Burbano made the important point,
which is, security is an issue beyond Y2K, you ought to be very
careful about whoever works on your systems. As a general
matter, we were concerned about this issue from the start and
we worked with the intelligence agencies and the National
Security Council and others, both to warn private sector
companies as well as domestic companies to be alert to this
issue. Most of them in a large sense are.
Most of the off-shore work was done by the private sector
and not the government. Most government work was done by normal
contracting, or internal resources, so that there was much less
of that done here than in the private sector.
Monitoring what has gone on in the private sector, what has
gone on, we have seen very little, in fact, almost no evidence
that work done offshore included some kind of security threat.
Obviously, the absence of glitches over the rollover means at
least if somebody was targeting the time to create mischief,
that was not one of those times.
But I think the bottom line to that is, again, as we move
forward, information security has to be high on everybody's
list. I think, again, the point is well made. It is not just
people who have access to your system. It is when you buy
systems, whether it is off-the-shelf systems or otherwise, you
have to be worried about who worked on those systems, what is
in them and what potential impact could they have on your own
system. So I think if anything requires eternal vigilance, it
will be, in fact, information security and security about those
working on your systems.
Mr. Horn. I thank you. We will be holding a separate
hearing on the computer security anyhow, so we will postpone
the rest of those questions.
Mr. Willemssen, before we round out this panel, I would
like you to summarize the following under page 16 of your
formal statement, ``Reported Year 2000-related Errors in the
Federal Government.'' If you could just sort of bullet them to
me in one sentence, each one, just so we have it in the record,
I would appreciate it.
Mr. Willemssen. On page 16 is a summary of what we observed
during the rollover from both the perspective of the
information coordination center and specific agencies where we
were onsite. We tried to summarize what we thought seemed to be
significant issues that did come up, even though they were
addressed very quickly.
Briefly, those included the Department of Defense
intelligence satellite system, the Federal Aviation
Administration had some systems with some Y2K failures that
again, they were able to remediate and fix very quickly, and
the Health Care Financing Administration ran into some
difficulties with partners. In one case HCFA had a problem with
a bank on some electronic payments leading to some delays in
payments, although it is still within the required targets.
Also, HCFA will continue to work aggressively with their
providers in making sure that they put forward accurate dates
on their claims so that claims are not returned.
Mr. Horn. You say here there are 26,000 claims from
providers with these erroneous dates in the first week of the
new year.
Mr. Willemssen. That is why we thought it important to give
a sense of the magnitude, because they are not just little
things that we are talking about. They are little within the
scope of the entire Medicare program, but they do have some
impact. But, again, HCFA has done an outstanding job over the
last couple of years on getting on top of Y2K. They as much as
anyone faced a mission impossible on Y2K, and through the
leadership of their administrator, again, they continue to be
very aggressive in following up and making sure that the
disruptions are kept to a minimum.
Mr. Horn. And then the ones that concern most of us based
on our air travel regularly is the low level wind shear alert
system. Can you tell us anything about that?
Mr. Willemssen. Again, those systems were out at about
eight locations, but they were out for no more than 2 hours, I
think 2 hours 12 minutes at the outside. Fortunately, when they
were out, we saw no evidence of bad weather in those locations.
So we could be sure, based on the evidence we saw that there
were no safety implications from those systems being out.
Again, it speaks toward the advantage of all the agencies being
poised to respond during the rollover. FAA was ready to get
right on top of those systems and fix them immediately, and
that they did, to their credit.
Mr. Horn. Yes. I was spending part of that December 31st in
the L.A. Tower, and I got a good education from the technicians
there. They have a terrific job to do when they are getting
those radar sites into operation when something goes crazy with
them. I was very impressed by that group.
So are there any other major things that is a worry to the
General Accounting Office?
Mr. Willemssen. I again conclude by saying the rollover was
a great success, thanks to the leadership of Mr. Koskinen and
yours and Chairwoman Morella's leadership. However, I think it
is important that we continue to monitor events over the next
couple of months. I would strongly concur with Mr. Koskinen's
plan to bring up the ICC again during the leap year, because I
think there will be a few disruptions that again occur, and I
think there will also be a few disruptions that we start
hearing about as processing cycles complete themselves. So we
haven't heard the last of Y2K. But I think it will be much,
much less than what we had once feared.
Mr. Horn. I want to end on a happy note here and help the
Department of State a little, Mr. Burbano. In November 1999,
the Department of State submitted its regular quarterly report
for the year 2000 to the Office of Management and Budget, and
of course, that does come to our subcommittee. After a lot of
discussion with you and OMB, it became clear that the language
in that quarterly report didn't really accurately reflect the
actual level of effort for the Department's independent
verification and validation work. Just so we can give you an A
on this, please explain to me the independent verification
process that you actually went through but wasn't in the
report.
Mr. Burbano. Thank you very much. At the State Department,
one of the things that I did when I came on board in May 1998,
as you all know, I came on board, we had straight F's for about
a year, so I had to move quickly in order to especially meet
the deadlines of Congress. But I wanted to make sure that we
did it correctly and not get any surprises at the rollovers. So
I set up a very rigorous process where not only did we have the
separate bureaus test our systems, but underneath my office,
the Y2K office separate from their individual bureau Y2K
offices, I had independent contractors test the systems. That
was the first level of independent tests.
But in addition to that, I did a partnership with the
Inspector General where they would do a second test with their
own contractors to review the test and so forth, and certify
the systems, along with myself as the CIO. So we went through
two levels of independent verification tests, in addition to
the testing that the Bureau did themselves.
The misunderstanding that came in that, we were about 66
percent in November or somewhere around that nature, in terms
of certification, but when, in fact, it really equalled to
about 160 percent, because we had already finished our first
level. That is where the misunderstanding came. I think we
proved that right since we had really no significant--not only
in the mission criticals, but in the criticals as well as the
routines, this thoroughness that we did.
Mr. Horn. Well, thank you very much. On that, are there any
questions any Member has? If not, we appreciate what each of
you has had to contribute to this and the fine work you have
done that kept us going with very minor glitches. So thank you
all for coming.
We now go to panel two.
Mr. Horn. I would ask you to stand and raise your right
hands.
[Witnesses sworn.]
Mr. Horn. The reporter will note all three confirmed. Mrs.
Morella will preside.
Mrs. Morella [presiding]. Thank you. I want to thank the
second panel for being so patient and waiting in going through
the first panel testimony and the questions that were asked. So
we will be concise. We know that you can offer a great deal to
supplement what we learned about Y2K. Proceeding again with the
5-minute rule, you can give us a synopsis of your testimony.
We will start with, first of all, Mr. Harris Miller. I want
to comment on the fact that from the very beginning Mr. Miller
has been very tuned into this issue, has appeared before this
committee probably as many times as any other person who has
testified. So we very much appreciate his coming back now at
the end as we do our summation and look ahead to the future. He
is president of the Information Technology Association of
America.
Ms. Kathy Hotka has not appeared before this committee
before, so you are the alpha and the omega, the beginning and
the end. Ms. Hotka is vice president for technology at the
National Retail Federation here in Washington, DC. We welcome
you. Thank you.
Mr. Gary Beach has appeared before this joint committee,
and he is the publisher of CIO Communications, Inc., from
Framingham, MA. Again, thank you for appearing here. Thank you
for waiting.
Let's start off with Mr. Miller.
STATEMENTS OF HARRIS MILLER, PRESIDENT, INFORMATION TECHNOLOGY
ASSOCIATION OF AMERICA; CATHY HOTKA, VICE PRESIDENT FOR
INFORMATION TECHNOLOGY, NATIONAL RETAIL FEDERATION; AND GARY
BEACH, PUBLISHER, CIO COMMUNICATIONS, INC.
Mr. Miller. Thank you, Madam Chairwoman. It is said that
politics makes strange bedfellows, but I found out that Y2K
makes strange bedfellows, for on the morning of January 1st,
instead of being snuggled warm in my bed with my wife, I was
instead with Chairman Horn at the C-SPAN studios doing a
broadcast on Y2K.
What is even more unusual is that at 8 a.m., constituents
of his from California were calling in, which means at 5
o'clock in the morning they were paying attention to what was
going on with Y2K. But I appreciated working with both of you
chairmen and the members of your subcommittee. I am going to
skip the victory lap you mentioned, Madam Chairwoman. It is my
written statement and will be in record. I obviously want to
commend the subcommittees, and particularly Mr. Koskinen, for
his leadership.
From the perspective of the private sector, we do believe
this is a real crisis that we did face, it was not something
that was hyped or made up. In fact, as I was walking down the
hall this morning with our Y2K program manager, Heidi Hooper is
with me, she noted there wasn't a line about the hallway
waiting to get into the subcommittee hearing. I said that is
good news, because if, in fact, the problems had occurred, I
suggest you wouldn't have Harris Miller and Kathy Hotka and
Gary Beach on this panel, you would have Alan Greenspan and
Secretary Summers discussing the global recession that had been
caused. So, in fact, the fact we didn't have a major crisis is
good news, and the fact we don't have hordes of people standing
around is, in fact, very good news.
In terms of the magnitude of the effort, I would certainly
agree with Mr. Koskinen's effort. In fact, I even go a little
more hyperbolic, I think it is the biggest success since the
building of the pyramids, because it was, in fact, a global
effort, government, private sector, hundreds of thousands of
individuals around the globe working together to achieve this
success.
To talk about the lessons learned, I would like to refer to
what I believe is a Y2K renaissance. What do I mean by a Y2K
renaissance? I think it really is two parts. First of all, the
rationalization of the existing computer technology. You heard
a lot about this from the first panel in the Federal sector,
but the same thing was true very much in the private sector.
The fact that time and again, because of the necessity of
dealing with this huge challenge, companies were able to get
rid of deadwood programs, they were able to bring into their
companies more modern and more efficient computer systems.
They also learned to do supply chain analysis and in a
systematic way that they had never done before. They were able
to collaborate in ways never experienced before, either within
companies or across companies. They were able to develop
contingency plans, many of which were not needed as it turned
out, at least are now in place should there be future problems,
and they learned to approach the entire IT system in a much
more strategic way.
That is going to mean that down the road these companies
and ultimately their customers can take much more benefit from
information technology. The productive gains which Mr.
Greenspan and others have noted have helped to contribute to
the continued growth of our economy and the high productivity
should be even stronger because the IT systems in companies as
well as within the government are now being treated much more
rationally and in a much more systematic way.
The second reason I call this a Y2K renaissance is the new
directions that companies are now taking. Because as they came
to understand through Y2K the strategic as opposed to tactical
importance of IT, they are now moving ahead implementing future
IT much more strategically. Obviously, the Internet changes
everything, and we are seeing throughout the private sector and
we hope the government sector will quickly catch up the use of
the Internet for improved, dramatically improved in many cases,
internal processes, whether you are talking about personnel
systems, whether you are talking about human resources or
financial services, whether you are talking about inventory
control, all of these basic day-to-day business operations are
being done much more effectively and efficiently on the
Internet. This is one of the new exciting aspects of Internet
technology.
Also, of course, dealing with customers, and customers
don't just mean business to consumer, the kind of stuff you
read about on the front page, about Amazon.Com and others. It
also means business to business, because businesses are also
customers, and the ability of businesses to deal much more
effectively.
So this is the kind of Y2K renaissance I see coming,
because as we come out of what Mr. Burbano and others described
in the Federal sector, which also occurred in the private
sector, namely, a temporary freeze in many cases on new
programs and spending, and now all these projects which have
been temporarily set aside are going to be brought out to the
fore, and again, I think you are going to see massive increases
in productivity, in major benefits to customers, and again,
customers I define broadly as businesses and individual
consumers.
Let me talk about some other lessons learned. One of the
lessons learned that was that while the government sector did
an excellent job, as the previous panel discussed, the private
sector also did a remarkable job.
Some names of individuals who you may not have come across,
or maybe you have come across, like Bill Mont and Tim Shepherd
Whalen from Global 2000, or Ron Balls from the ITU, people who
are able to take entire sectors and coordinate them, you are
going to hear from Ms. Hotka about the retail sector,
contributed mightily to the success. I think ongoing we have
learned lessons about the ability of these sectors to work both
nationally and globally.
I also use that as a point for future global cooperation.
The International Y2K Coordination Center, which both of you
were very involved with and which Mr. Bruce McConnell headed so
ably, has demonstrated the opportunity for global cooperation.
Coming out of that, I am hopeful we will see some continued
opportunities.
For example, the International Y2K Coordinating Center
steering committee is considering the creation of what is
called the Center for Digital Opportunity, which would be a
cooperative program to promote Internet growth in developing
countries to the same extent that it currently is in developed
countries. In fact, tomorrow the steering committee will have a
conference call and I am involved in that also, as is Mr.
Koskinen, to see about the possibility of building on the
linkages that have been established through Y2K in that area.
Similarly, the issue that Mr. Burbano talked about so
extensively and Chairman Horn said you will be having further
hearings on, the whole issue of information security.
While there are information security issues which are very
specific to the U.S. Government, there are many issues which
are global in nature. Again, the 170-plus countries that work
together through the international Y2K cooperation center
should be able to take those linkages which they established
and build on them for information security. I think that is
also another lesson learned.
The last lesson learned which I would like to refer to, and
I am a little bit over my time, is that the Y2K problem was
solved without government dictating what the private sector
needed to do, without legislation. As you remember, you two
chair people, at a hearing early on, there was actually
discussion about perhaps Congress having to mandate the private
sector to take specific actions. You came to the correct
conclusion that, in fact, there were better ways to do that,
rather than mandating specific activity. We did get through
this without mandating specific activity on the part of the
Congress to order the private sector to do activities because
the private sector was and to work collaboratively.
I think the lesson learned there is as we move ahead to
other challenges in information technology, whether it be the
information security area or regulation of the Internet, that
the claims that the private sector made to you then that we can
handle this in a collaborative manner, not working against
government, but cooperatively with government, did prove true
in the Y2K area, and I think when Congress approaches other
issues, such as information security or other issues of
regulating the Internet, they should take that lesson learned,
and perhaps it will also prove true that you do not need
legislation, that there are other ways to get things done in
this new economy and in this information revolution.
Thank you very much for giving me the opportunity to appear
before you, and I would be glad to answer any questions.
Mrs. Morella. Thank you. I also want to comment on the fact
that I did hear that early morning C-SPAN program, and it was
very informative. Thanks for your leadership.
[The prepared statement of Mr. Miller follows:]
[GRAPHIC] [TIFF OMITTED] T6711.064
[GRAPHIC] [TIFF OMITTED] T6711.065
[GRAPHIC] [TIFF OMITTED] T6711.066
[GRAPHIC] [TIFF OMITTED] T6711.067
[GRAPHIC] [TIFF OMITTED] T6711.068
[GRAPHIC] [TIFF OMITTED] T6711.069
[GRAPHIC] [TIFF OMITTED] T6711.070
Mrs. Morella. I am now pleased to recognize Ms. Hotka.
Ms. Hotka. Chairman Morella, Chairman Horn, members of the
committee, retailers appreciate your leadership on this issue,
and I appreciate the opportunity to appear here with you today.
As you may know, the National Retail Federation's Survival
2000 project worked for 3 years to coordinate a joint retail-
industry response to the year 2000 issue. We worked with
department stores, restaurants, specialty stores, liquor
stores, pharmacists, convenience stores and grocery stores to
make sure that you could shop this year. People are really
shopping as a result.
How did retailers fare? Better than we expected. But the
sector desk at the White House information coordination center
that seemed to have the most to talk about was ours, retail and
small business. As expected, bigger businesses experienced
annoyance grade glitches and some smaller ones found out that
that fix on failure policy they had was not such a great idea.
Anecdotally, we know of retailers still processing credit
cards manually because of the IC verify problem. One retailer's
store credit cards failed. Cash registers at one chocolate
store chain would not open. But the examples here are
relatively minor.
Now, it remains to be seen whether the global supply chain
would be unaffected, larger retailers have some doubt about
whether or not we have sailed through this internationally.
Was it worth the work and expense? We already know the
answer. While retailers spent multiple billions of dollars to
find and fix and replace software and hardware and to conduct
extensive testing, we also would not do it any differently. We
had conducted a survey in 1997 that showed that if retailers
didn't undertake this work, many key systems would simply be
dead in the water. We found out that 100 percent, all, private
label credit card systems would not have worked; 99 percent of
warehouse management systems would have failed. Most retail
processes are touched by technology, and our members were not
willing to bet the business they would be fine without
remediation. My members are astonished that some columnists
have questioned the value of the investment. Mr. Burbano
mentioned earlier that some countries found they were less
dependent on technology than they thought. We discovered we
were more dependent on technology than we had thought.
So what lessons did we learn? We learned four:
First, we learned that most organizations underestimated
their reliance on IT despite healthy investments in technology,
retailers found that some business critical processes were
being run by business units on 15-year-old software. You cannot
run a company on paradox 1.0 for DOS. It is not a good idea.
Some companies maintained software they didn't need. Some
key programs were being run by people with no IT background.
Companies did not have contingency plans. In fact, we found
only one company that had a contingency plan at all.
In the end, though, savvy companies realized Y2K was not an
IT issue but a business issue, and that IT needs the continuing
attention of the CEO. Those companies that did best had the CEO
in charge of this project. We who lead industries must bring a
better appreciation of IT as knowledge management, not just PCs
and printers.
Second, we learned that reliable information was hard to
come by on this, particularly in the early days. Should
retailers have believed technology companies product updates?
They seemed to change hourly.
Should retailers have believed government agencies' self-
reports? How about suppliers? How about the fear mongers?
Ultimately, no self-reported information was reliable, and
retailers simply conducted their own verification in the
absence of reliable test data or organizational benchmarks,
this was our only choice. It was expensive and time-consuming.
We know of a number of companies, for instance, that put people
on airplanes all during 1999 to check on international
readiness. These people simply traveled from country to
country.
Third, we learned that government may have a useful role in
helping companies use technology as a business tool. There is
no doubt, but that the white hot spotlight of your committee's
attention to this issue brought home to all of us the need to
work diligently. Your contributions to private industry
preparedness should not be underestimated. We paid a lot of
attention to those report cards. Our friends at GAO published
world-class, best-practices documents that gave private
industry some models to work from. John Koskinen and his
talented staff helped galvanize countries, governmental bodies,
private industry and the media. All were key to helping
retailers who rely on a global supply chain and public
confidence. We thank you all. Like Harris, we believe that this
should be a partnership and not a speaking from on high.
But, fourth, we learned that joint action was key. No one
retailer did it alone. Fierce competitors worked together to
keep the industry ready. Generous companies allowed staff to
speak at conferences to spread the word to others.
So going forward, we would like to continue what we have
been doing for the past several years, working to protect
America's business data. Congress should continue to show
interest in America's information infrastructure. The White
House ICC where public-private partnerships were so useful
might continue to be a valuable tool. Business still needs best
practices that can help smaller companies use technologies
responsibly, and reliable sources of information about threats
to data from hackers, viruses and industrial espionage are
needed. Let's continue to work together. Public private
partnerships got us through Y2K, but we have compelling reasons
to keep working in 2000 and beyond.
Thank you.
Mrs. Morella. Thank you very much for that testimony.
Now we will hear from Mr. Beach.
Mr. Beach. Madam Chairwoman, Mr. Chairman, I thank you for
the opportunity to appear before the committee again. Madam
Chairwoman, talking about the victory lap analogy, I live close
to Hopkinton, MA, which is the start of the Boston Marathon,
and I would say what we have learned with all the great work
here is that we are in the first mile of a marathon, a marathon
showing how pervasive technology is in all of our lives.
The subject of my testimony here is in the written side,
but I will orally summarize it, is lessons learned,
opportunities created, and I would encourage the committee to
look forward as to what are some of those exciting
opportunities.
Increasing the crescendo of hyperbole, we heard about John
Koskinen talking about it in the last 50 years, and Mr. Miller
talking about the work as is comparable to pyramids. I would
say that the year 2000 computer problem and the work that was
done on it by a myriad of groups is the most remarkable
peacetime example of human cooperation in the history of the
world, and I have an idea for you at the end of my oral
testimony.
We are entering, what I see, as the age of digital
enlightenment where technology is going to help nations govern
better, help businesses conduct better business, and make
everyone's digital life all the more meaningful.
The committee asked the panelists ``was Y2K hyped for
profit?'' Those of us on the front lines, the ITAA and Kathy
and her group and others, have no doubt that without proper
remediation and all the great work that this committee has
done, Y2K would have had a severe impact on computer systems
around the world.
It is interesting, isn't it, that those companies that may
have benefited from an increase in sales of computer hardware
or software over the last couple of years are now reporting in
the Wall Street Journal over the last couple of days saying
their earnings reports are down because of Y2K. So what goes
around comes around, and it is all going to even out in the
end.
So, the long-term legacy of this challenge is going to be
akin to the oil crisis that we saw in the mid-1970's, where we
had relatively short-term pain, and long-term we had more fuel-
efficient cars. The Y2K long-term legacy was simply mentioned
here many times today that it caused the world to update its
computing infrastructure in a relatively short period of time.
I was personally surprised at how well the rest of the
world made it through digitally unscathed on January 1st. I
would say this experience was a resounding clarion call to our
government and our industries that other nations, many of whom
predominantly use U.S. technology, are running neck and neck
with the United States. It seems to me that the digital playing
field appears to be leveling off. And, in this new 21st
century, where the economy is going to be very digital and
electronic, these other countries are prepared to provide
stronger global competition.
On the earlier panel we talked about foreign nationals. I
had an opportunity last year to travel to Bangalore, India,
where I saw thousands of workers producing Y2K remediation
projects, many for United States firms. These workers are now
going to be looking to produce products and services in their
own global environment.
The next big technological breakthrough is going to be e-
commerce. A CIO poll recently reported that 73 percent of
American businesses now have e-commerce initiatives started.
What is even more important to me is by 2001, these e-commerce
initiatives are going to be the core business models of these
businesses.
Shifting to opportunities for government, the Y2K
revolution has afforded the Federal Government and the State
and local governments opportunities to modernize its computing
infrastructure. We should leverage these revitalized systems to
better do the business of governing. Opportunities before this
House and this committee in light of legislation continue on
Internet taxation, how Americans will govern using technology,
closing the digital divide of the have's and have not's, and
possibly the aspect of a not too long-term strategy of having
the United States wean off its dependence on foreign workers.
I did some work last year in Massachusetts reviewing the
State's entire higher education system. While there are more
and more men and women entering computer science courses in
classes across the country, the challenge is that the faculties
at many of these institutions are not prepared to teach the new
technologies.
As I mentioned in the beginning of my testimony, I had an
idea. I would encourage Madam Chairman and Mr. Chairman to send
on behalf of the world's IT workers, a letter to the Nobel
Prize committee in Oslo recommending that a special award be
given in October to the world's IT workers, where possibly a
person from the informatics committee at the U.N. could go to
accept it, and on a site, some place on a U.N. URL, any worker
who worked on Y2K could download it and proudly frame it in his
or her office.
In closing, Y2K in context, was a massive tactical
challenge, but what it underscored on a more strategic level is
the importance of technology in governing and commerce, and
with the seemingly stable technology infrastructure in place,
now is the time to take advantage of these new opportunities.
Thank you.
Mrs. Morella. Thank you.
[The prepared statement of Mr. Beach follows:]
[GRAPHIC] [TIFF OMITTED] T6711.071
[GRAPHIC] [TIFF OMITTED] T6711.072
[GRAPHIC] [TIFF OMITTED] T6711.073
[GRAPHIC] [TIFF OMITTED] T6711.074
Mrs. Morella. I think that is a fitting way to end the
testimony of the panelists with this concept of the Nobel Prize
and the fact that it is a great example, as you said, a feat
greater than or as great as the pyramids. Ms. Hotka had some
very glowing things to say about what we learned also. Coming
from the private sector, it is particularly important.
We have a roll call vote right now, a quorum, but we will
be back for some questioning, so I would imagine 10 minutes or
so. So we will recess this hearing for about 10 minutes.
[Recess.]
Mrs. Morella. I am going to reconvene this hearing. I can
ask a few questions, and then if other Members come in in the
meantime, they can continue to ask questions.
Of course, our policy has been that if it is acceptable to
you, that we might also submit questions to you by Members who
may not be here. Thank you. I appreciate that.
You know, I think there have been many, many benefits to
the Y2K work that has been done, whether or not it is the
dimension of the pyramids or Nobel Peace Prize, but certainly
there has been a lot of cooperation that has been so
comprehendible. In going to the command station on December
31st, I saw many people from the private sector on their own
time, unpaid, who were there for 24 hours and spent their New
Years' Eve there, and then part of New Years' morning there
also.
I also saw a report that National Institutes of Standards
and Technology did a lot of work with small businesses in
remediation of the Y2K computer bug, and the small businesses
have said they thought this was a concept that they hoped would
continue, the idea of being able to get help and get assistance
from somebody, an agency or whatever, that cared about them.
So, again, it is another example of the private sector
benefiting from what the public sector had done.
Then just the other day at the District of Columbia
hearing, both Chairman Horn and I are on that authorizing
committee, I asked Mayor Williams about it, because, as you may
remember, the District of Columbia was so far behind, and he
was very excited about the results, the fact that they have now
been able to update their computer system, they know what they
have, and because technology will play such a big role,
particularly as we try to revitalize the District of Columbia,
that they feel they are going to benefit greatly by it. Also by
working with neighboring communities too.
So, again, the whole concept you all pointed out, and that
is, building on the various linkages and the partnerships.
Well, I am going to ask you a question that deals with
people. The vast Y2K repair corps is now being scattered to the
winds after apparently saving the world from the Y2K disaster.
So now what are these people trained to correct Y2K, probably
those people who knew could balance, what do they do now? Can
these displaced Y2K workers help to alleviate the H1B
situation? What do you see with regard to the whole personnel
issue? I will start with any one of you.
Ms. Hotka, why don't we start with you first.
Ms. Hotka. Just briefly, one of the things that struck us
about the people that worked on this was their ability to deal
with business units. IT does not live in a vacuum, and this was
never an IT problem.
These people went out and spent time in warehouse
facilities with people who run the trucks, with suppliers, with
the accounting offices and all through the business. What we
are seeing in our industry is that those people will continue
to work in these companies and that they will continue to work
with these business units to make sure that the IT tools that
are created are actually used and are used effectively. That is
a skill. These are generally older people, people over 30, and
they have got----
Mr. Miller. Speak for yourself.
Ms. Hotka. Well, I am saying that because there is a
tremendous emphasis, I think, in some parts of the IT world on
people who are very young, who have experience in new
technologies. But some of us who are not that young have some
experience that might be useful, and we are finding that it is
being priced in these retail companies. They don't want to lose
these people.
Mr. Miller. I think, Madam Chairman, what Mr. Burbano
discussed is, in the Federal Government, very similarly true in
the private sector. If you take the first group of people,
namely, people who are interimly the staff of an organization,
in most cases when the Y2K issue became a priority for the
organization internally, and the organization decided to use
internal resources, they simply took other projects, put them
off to the side and took those people and focused on Y2K; and
now that they have gotten through most of the Y2K era, leaving
aside having to get through the next 2 months to February 29th,
those projects, which have been temporarily frozen, are now
going to come back as high priorities, and those people are
going to go back and do those projects. That is one group to
think about.
The second group of people are the contractors who came in
from outside to do work for customers, whether those customers
were in government or the private sector. A lot of those
companies, which provided those outside services, were in a
situation where they anticipated very well the end of the Y2K,
they knew when their projects were going to end, and so they
had to do two things: No. 1, they had to find new clients so
they can continue to stay in business and continue to grow
their businesses; and No. 2, they had to take into account the
need to upgrade the skills of their employees to do more
current projects, most of which are going to be e-commerce
related or somehow on the Internet revolution as opposed to the
mainframe projects.
If you look at the major companies that do business and
look at the revenue in 1999 versus 1998, you will see their
revenue continue to go up even as the Y2K work began to drop
off. The reason is that because they were able to find new
customers and they were able to retrain the work force.
So not only do I think this is not going to solve the H1B
problem, if you use the logic that I use in my testimony that
this is going to be a Y2K renaissance, and a lot of projects
were temporarily frozen while companies were getting through
the Y2K problem, I think there is going to be even a bigger
explosion and even more demand for IT workers. The trick is
going to be, as you suggested in your question and as Ms. Hotka
commented in her comments, making sure the workers do have the
retraining. The computer language skills they have are not the
ones most current or most in demand, and that has to be
factored into the process.
Mrs. Morella. I do think many of them are older, but, on
the other hand, I know the University of Maryland had a special
course geared toward remediation of Y2K. Mr. Beach.
Mr. Beach. Madam Chairman, I just would like to once again
mention the aspect of what human beings like most is
recognition, I am dead serious in challenging you and Chairman
Horn to nominate these workers for noble awards.
The international Y2K cooperation center that we heard
about today, and you are familiar with, and that Bruce
McConnell did an incredibly good job running, had a subset
called YES Corps, which was the Y2K Experts Service Corps. I
was fortunate to be on that steering committee. This group
aimed to share information with 140 countries about Y2K, and
currently it is migrating to another role. We all felt this
network was created for tactically addressing Y2K, the network
was more valuable than the actual focus on Y2K. So there is
movement afoot to expound this effort.
I would like to say there is a vested interest in large
businesses in whatever they can do here in the States to help
small businesses, because we are all living in this giant
economic supply chain. Many large businesses are even more
dependent now on smaller businesses.
The H1B visa issue, I know there is a call now to bring the
limit up to 200,000. Long-term what we have to do, and I
addressed it briefly in my testimony, is more rather than fewer
students in America are entering computer science courses,
whether in California, Maryland or Massachusetts.
I chaired last summer for the Commonwealth of Massachusetts
a review of the entire higher education program, and the most
damning finding we found was that we were talking about older
people here, but the faculty, the faculty, No. 1, is older, is
not skilled in the new technologies of JAVA, XML, you name it.
There is a bottleneck there. If that bottleneck is not relieved
or addressed, then our country is going to continue to have to
rely on H1B visa issues.
Mr. Miller. Could I make one more point on personnel to
follow on the earlier discussion of information security? That
is an enormous problem, because we do not have information
security specialists trained. That is one area where you can't
do H1Bs, you can't send the work offshore to Ireland or Israel
or India. That work has to be done with U.S. citizens.
I know President Clinton mentioned this in his national
plan, and Attorney General Reno talked about it. So this is one
area where the government, working with academia and business,
is going to have to focus. You are going to have to convince
people to go beyond their traditional education, to get
additional education, plus get security clearances, because
obviously, the type of people that a Federal agency or a State
government wants to hire for security information, security
purposes is going to need a clearance. Even you are going to
find in the private sector many private-sector financial
institutions and others want to get people with very high
security clearances because they are being put in very
sensitive security positions.
Mrs. Morella. As a matter of fact, the Science Committee
passed, in the first session, actually the last Congress, a
computer security bill which does have the dimension of
fellowships for computer security. Even that is not enough.
Much more needs to be done. We have also been pushing teacher
training in technology, not so much looking at the higher
education, but more education from K through 12, to make sure
that even those teachers know something about how to use
technology because the youngsters do, so they can also inspire
them.
My legislation for women and minorities and disabled in
science, engineering and technology, the commission is meeting,
it will be coming up with its recommendations to get more of
those groups that have traditionally not been involved,
involved in those fields.
Well, I thank you. I am going to now----
Mr. Horn. If you might yield on that point----
Mrs. Morella. I am going to recognize you for your
questioning.
Mr. Horn. Your associations could do a lot of good in
bringing together the people from the Silicon Valleys of this
Nation, and the community college teachers in particular.
When you think that these programmers get about $60,000
when they are out of college or out of the community college,
and what we need, speaking now as a Californian where we
started the community college movement and we have about 107
campuses from San Diego to the Oregon border, and they should
be talking to the Silicon Valley types and vice versa. Because
the State will never have enough money to get the equipment
that is needed to educate people on to meet the people's needs
as they go into the industry. It just seems to me there ought
to be a summit meeting that perhaps your group, Mr. Miller, or
your group and friends in the publishing world, and getting all
these people in the room.
When you think of what Jamie Escalante, the great teacher
in L.A., that took young people that everybody had given up on
and they got right at the top of the college boards, and it can
be done. We need to do that and we need to get the Mexican
Americans, Hispanic Americans, African Americans, Americans,
whatever they are, into seeing a point in their lives where
they can make a substantial income. That is only going to
happen if we start, as the chairman here said, concerning the K
through 12. That is fine. But I think the K through 13 and 14
have to be considered, where their role, really, is to be
either an academic program or a vocational program. In this
case it is both. You need the academic background. You also
need the vocational background. And you need the opportunity to
work on equipment that makes sense.
I know from what I had to go through with a very--probably
the largest school of engineering west of Texas A&M, and we
were just swamped with problems on equipment in the 1970's and
the 1980's. Finally, our trustees stepped up to the plate and
said OK, so we will pay engineers more, we will pay people in
the business school more. Well, that doesn't solve all the
problems, because the equipment is the problem, and the
millions that takes. And that is where it is everybody's self
interest to do something along that line.
Now, I don't know if you want to add anything to that or if
you are willing to do that conference, but we ought to get them
in the same room with the American Electronics Association and
so forth.
Mr. Miller. We tried to do that the last couple of years,
Mr. Chairman. We are making progress. I think that the IT
community discovered the community college system very recently
in a sense. They didn't previously think of it as a resource,
except for some chip manufacturing companies, which didn't see
the need for a 4-year degree. So you had a couple of instances
in Arizona, particularly where Maracopa Community College was
training people to work in the cleaning rooms for some of the
major chip manufacturers. But I think the IT industry at large
didn't see the community college as a good resource.
We held our first national work force convocation at the
University of California at Berkeley in January 1998, and I
think that is the first time that the IT industry began to
understand that the community colleges were willing to be
flexible, and, frankly, they can change a lot more quickly than
formal 4-year universities, I am sure you know as a former
university president.
Mr. Horn. You are absolutely correct. You won't get your
supply from Berkeley. They are wonderful people. It is true.
They have research designs. Ph.Ds, there is a use for some of
those, face it, but you want the worker people, which does take
skill, which does take imagination, and some day they might be
running their own Silicon Valley firm. That is the way the
whole evolution of that Santa Clara Valley has happened.
Mrs. Morella. I used to teach, at a community college in
Montgomery County.
Mr. Horn. Absolutely.
Mr. Miller. It is happening. Yesterday the National
Commission on the 21st Century Workforce had its second field
hearing, it was actually held at De Anza in Silicon Valley, and
I know that that is a focus of attention.
I spoke at a major event that the Houston Partnership held
3 months ago, and virtually every attendee was there from a
community college. So I think the communication is starting. We
are having our third convocation in Chicago in April of this
year, and have invited many of the colleges to participate. The
key to the community college is obviously getting support of
the State legislatures to get the funding to be able to offer
the courses. In most cases State legislatures do seem willing
to do that.
Mr. Horn. They see it helps their economy.
Mr. Miller. It is an economic development issue, not an
education issue. That is what employers want to know, if I move
my business there, where am I going to get my IT workers.
Mr. Horn. You might have covered this while I was going
over to vote, but when you look at the issues that confronted
the Nation that I mentioned to Mr. Koskinen on the domestic
side, do you have any particular issues that relate to
technology that you think we ought to have that kind of
operation that we have had in the last few years where you have
somebody on behalf of the President pulling these things
together, if it affects the economy and efficiency of the
executive branch, which is the jurisdiction of my particular
subcommittee? So what would your themes be that somebody ought
to be looking at?
Mr. Miller. Well, I have a couple. One we discussed, I
think, at a previous hearing, which is an information security
czar. I think that the Koskinen model is also applicable to the
information security area.
Right now, Mr. Chairman, if someone from academia came up
and put a chart up on the wall of how information security is
handled inside the government, I don't think that wall is big
enough to put all the boxes up there, because it is split over
so many places. Everyone is well intentioned and has good
purposes.
Mr. Horn. With the Chief Information Officer role being
pretty much throughout the 24 major agencies, hasn't that
helped?
Mr. Miller. That is very helpful. But, again, even there,
that is just within the particular agency. We are also talking
about interrelationship with the private sector, and depending
on who you ask, 85 to 90 percent of critical infrastructure we
have to protect is in the private sector. Yet we have to
coordinate with the government. Who do we coordinate with? Do
we coordinate with Mrs. Morella's favorite office, the CIAO
office, or do we coordinate the NIPC, or do we coordinate with
the National Security Council or the Commerce Department? It
goes on and on and on.
So we are looking for simplicity. The great thing about Mr.
Koskinen's office was it was a little bitty office. He couldn't
do a lot. What he could do was he could be an enabler, he could
be a man who cracks the whip and try to get you to move
quickly. But at the end of the day, you had to do it. He was
never going to try to superimpose his own bureaucracy, either
on the private sector or on a government agency. That is what I
mean by a czar, not somebody that literally dictates what the
private sector or the Federal agencies do. Mr. Burbano has to
decide what the State Department does, Mr. Cosgrave has to
understand what the IRS does. But someone who can coordinate
and pull that all together, I think that would be very helpful.
Mr. Horn. Well, they have a council, and I don't know how
active that was before this assignment was given them, but they
certainly ought to be working on the consensual part. Of
course, what I am after is, and I will be putting it in
shortly, is the office of management idea where the President
has somebody there that knows something about management, not
just the budget. Every President puts in a director that is
either an accountant or politician or economist, but they don't
put anybody in that knows a thing about management, that has
the President's ear.
So I want to split that off, and, fine, keep the director
of the budget, but make a director of management. Roosevelt had
that, Truman had it, Eisenhower had it. It went downhill
starting with Kennedy and right through Reagan. They all
politicized the Bureau of the Budget, which were professionals,
and they served every President, whether they were Democrats or
Republicans. It didn't matter. It didn't matter what their
party was. They were professionals. And we have lost that
contingent, until we got into this situation. When we wrote the
President and said look, you have got to put somebody in
charge, because it is going nowhere, and nothing but
procrastination, and he did. He made a good choice.
The same thing I wrote him with Rossotti. I said look,
every President has put in tax attorneys and tax accountants,
how about getting a chief executive for the job. And he did a
great job in getting Mr. Rossotti. So you had two splendid
appointments that turned agencies around.
Mr. Miller. Absolutely. Mr. Cosgrave, who was the CIO of
IRS, was previously a CEO of a company, was actually on my
board of directors, and Mr. Rossotti recruited him to come and
fix the Y2K problem and run that. I certainly agree with you,
Mr. Chairman.
I guess another thing I would say in terms of a theme is
with all due respect to my friends in the Federal Government
who bemoan the fact there are not enough Federal IT workers, I
think they are trying to stop this tide, and they are not going
to win this battle. We try to help them, we meet with CIO
council, et cetera, to try to figure out how the Federal
Government is going to recruit more IT workers. But I think in
the long-term trend they are going to lose.
If they are going to lose, I would rather see them focus
attention on the transition to a world where there is much more
IT functionality outsourced, rather than trying to constantly
refight this battle of what are they going to rejigger in the
OPM manual to somehow recruit a few more IT workers. And that
does not slight the Federal IT work force. I think they are
great people. But I think they are just fighting a losing
trend, because the delta between the Federal sector pay and the
private sector pay is getting bigger and bigger. The benefits
for people going into the private sector are much higher.
My members never liked to voluntarily attract someone out
of the Federal marketplace, because they are making their
customers mad at them, but the reality is you can't throw away
a resume when someone sticks one in your hand and says I want
to get paid 25 or 30 or 50 percent more, I want to come work
for your company, than I can make working in the Federal
marketplace.
So I think one of the issues your subcommittee wants to
look at is how do you do that transition. I think it is going
to happen, and to do it smartly rather than constantly trying
to smart stop the tide I think would be a much more productive
use of resources.
Mr. Horn. We would welcome any thoughts you have on this. I
know we are already in touch with you at the staff level for
the computer security hearing coming up soon.
Mr. Beach. Mr. Chairman, I would like to comment briefly on
your summit idea. I think that it is a very good idea and
encourage you to consider submitting an op-ed piece we could
run in CIO Magazine that would bring it to the attention of
about 300,000 people.
I like the idea of director of management for one reason.
Again, I was referencing earlier the CIO Know Pulse Poll that
we recently did that shows within 18 months, 6 in 10 in the
private side of the business are going to have e-business, and
it is going to be their core business model. And how you have
kept the feet to the fire for the Federal agencies here leading
up to Y2K, I think this director of management, whoever he or
she is, should have as one of their tasks to make certain that
all the agencies and the millions and billions of dollars that
the U.S. Government has spent to upgrade its systems, how are
these being used, what new services, what new applications are
you providing for getting our bang for a buck.
Getting back to the previous question, Mr. Rossotti
mentioned I think that in the IRS, they upgrade each year one-
third of their computers. So what happens to the third that are
being thrown out? Where are these going? The other issue is
there is a great opportunity in the junior colleges and the 4-
year schools for the faculty could be adjunct faculty from the
business community. These are the men and women who know most
about its leading technologies. I would encourage a program of
adjunct faculty to our Nation's community colleges are 4-year
schools.
Mr. Horn. You are absolutely correct, because the research
universities are simply too involved in long-term research,
which does have a payoff in many ways. A lot of our industry is
based on that research. But in terms of getting a curriculum
turned around, as you correctly viewed, that can happen much
more easily in a community college. Rather than have the
faculty say let's think about this for 3 years.
So that is part of the problem. This is a national crisis
in skills. On the Clinger-Cohen Act, we are focusing partly on
the information technology human resources issues and the need
for qualified individuals and managers when that comes up.
And that's another one coming up in the next few weeks. So
let me skip to something else that isn't as serious as what
we've had here, but I guess I'd want to ask Ms. Hotka that I'm
just curious with the wonderful technology we have to trace
everything in the stores of America, do you know how many
generators were turned in?
Ms. Hotka. We were sure, Mr. Chairman, that we would see
this mass return of generators which would then be refused at
the store level by stores who said that they wanted to sell it
to you instead of lend it to you. We were amazed instead that
stores used this as a customer retention mechanism. They said
please, come back and return it and while you're here, buy
something else.
Mr. Horn. I was educated yesterday by my staff when I
raised this that there was such a thing as a stocking fee and
tell me about that.
Ms. Hotka. What some of our retailers did was to charge a
restocking fee so that if you brought back the generator after
January 1 in the box because you didn't need it, that they
would charge 20 percent. Some of them did that, did in fact
charge that fee but some of them I think surprised all of us
and used this as a way to get those valued customers back into
the store and while they were there, by the way, why don't you
buy this Christmas tree which is on deep discount and it worked
beautifully. We saw very little demand--that was one of the
things that surprised us too. We thought that the public was
going to flock into stores at the end of the year and buy all
kinds of stuff. We didn't see it at all.
Mr. Miller. If I could make one point about your CIO
elevation on the last question, I want to bring to your
attention a new institution which the Virginia secretary of
technology Don Upson is creating called the CIO Academy. I
don't know if he's publicly rolled this out yet, but I know
he's already recruited several State CIOs to be on the board of
directors.
He's recruited Jim Flyzik who is the CIO of the Department
of Treasury who was kind enough to ask me to do it. He's got
some other people from the private sector. I think this relates
to the whole issue that you, of course, implemented within
Clinger Cohen which is elevating the whole position of the CIO
within the organization.
And obviously one of the major roles that Mr. Beach's
publication does is it also creates a network through his
publication, his polls, his meetings he sponsors. I think
Secretary Upson tends to do this in a much more educational
level. I think you're going to see more and more where this is
going.
Now, the challenge, and I think, Mr. Beach, you had an
article in your publication recently about whether the CIO job
will even exist in 5 years. You had some futurists discussing
that. I think one of the conclusions was there would be no such
position, maybe a chief knowledge officer or something else
like that but there wouldn't be a CIO because technology will
become so ubiquitous that the idea that you have a specialist
would be like saying you have a telephone specialist. That
won't exist anymore.
Generally, I think business and government are paying a lot
more attention to the whole role of the CIO and part of it is
because of Y2K again. It all rolls back to the fact that Y2K
suddenly brought to the attention of the CIO and the CFO and
board of directors that this guy or gal who ran the technology
wasn't some person who you could just put off on the side of
the back room, that he or she was fundamental to your strategic
business or strategic government delivery of services.
Mr. Horn. In educating a CIO, what is your percentage of
technology versus management skills?
Mr. Miller. I'd say knowledge of technology is somewhere
between 5 and 10 percent, management understanding business,
understanding the core operation is probably about 90 percent.
I think the same way as a CFO. I don't think you expect the CFO
to be your bookkeeper. The CFO is your financial planner,
business organizer. I think the same thing is true of your CIO
you don't expect him or her to be necessarily the chief
technical person, that he or she is the person who is looking
at how the technology fits into the business organization. Mr.
Beach probably has some surveys on that I'm sure.
Mr. Beach. We've got lots of them. It's along with what
Harris said. I mentioned it several times here today that what
has happened is that technology and e-business and e-commerce
and the overuse of the letter ``E'' but what has happened is
that there has got to be an extension to a company's business
model. So technology has gone from being an extension of how we
govern to being the core--a core part of that infrastructure of
how we govern.
I would agree with the percentages of Harris that the more
successful CIOs that I see are those men and women who have a
keen understanding not of technology but of their customers
because then they could always use technology to service that
customer need rather than saying I know everything about fiber
and all this other stuff, you say let's go find a customer to
satisfy that. So they are more customer-focused, and smart
businesses and smart governments are realizing that technology
is going to be a core platform in terms of how they provide a
good or service.
Mr. Horn. Does your magazine take a look at how Y2K made us
learn that we can now better manage the operation once we had
to get in and say let's merge this system with that system or
let's just get rid of it? To what degree do you see that
movement in the executive branch?
Mr. Beach. In the executive branch here in Washington?
Mr. Horn. Right or the field.
Mr. Beach. I think the lesson learned from the CIOs in the
private sector, what Y2K taught them is that no one is an
island, that all these businesses are connected in these global
supply chains. And I can't comment particularly on the question
of executive branch, but I would say that you--no one aspect of
the government, whether it's legislative, the judicial, or the
executive is--it's never been that way, but technology is
giving each of those branches a better opportunity to
communicate and share information and govern in ways that we
haven't thought of.
Ms. Hotka. If I can expand on that too. I think one of the
things that we found was Y2K was such a flash point, that if I
called up someone from a company who's not a member and said I
need to talk to you about Y2K, I could get that person on the
phone instantly. It cut across all kinds of company barriers.
There was no competitiveness at all. We had an immovable
deadline and an issue that everybody understood and so everyone
was willing to talk to everyone. If we can come to some kind of
goal like that, obviously we'll not have this again. And thank
God for it, but if we could come up with some kind of goal for
technology literacy and for good corporate use of IT, we could
again get to that point where I could pick up the phone and get
anybody on the phone and be able to cooperate. It was useful.
If we can harness that again it would be terrific.
Mr. Horn. I think you're right. I've got just one or two
things to say here, and then I'm going to leave and Mrs.
Morella, she reminds me we have a conference, all of us at 1
p.m. Let me say without objection, I want to file within the
testimony when after Mr. Koskinen, an exchange of letters
between the Secretary General of the United Nations and myself.
Mrs. Morella. Without objection, so ordered.
Mr. Horn. No. 2, I would like to thank the following people
that have been involved and not just in this hearing but in
most of our hearings. From the subcommittee on Government
Management, Information, and Technology, J. Russell George,
staff director and chief counsel; Matthew Ryan, senior policy
director; Bonnie Heald, director of communications and
professional staff member; Chip Ahlswede, chief clerk and
unfortunately it's his last hearing with us; Deborah Oppenheim,
intern; and minority staff, Trey Henderson, the counsel; and
Jean Gosa, minority staff assistant; and for the Technology
Subcommittee of the House Committee on Science, Jeff Grove,
staff director; Ben Wu, counsel; Vicki Stackwick, staff
assistant; the technical minority staff is Michael Quear, the
professional staff member; and Marty Ralston, staff assistant;
and our two court reporters today are Bob Cochran and Laurie
Harris. And we thank you all for what you're doing.
In closing on my behalf, I would say governments and
industries worldwide have benefited from this experience. I
think that testimony was very clear today. This problem has
many silver linings as our witnesses have described. There are
equally as many if not more people who have worked tirelessly
in an effort to solve the year 2000 computer problem, and we
saw some of them before us today. Obviously Mr. Koskinen is
Assistant to the President and Chair of the Council on the Year
2000 Conversion. The General Accounting Office staff,
particularly that staff headed by Mr. Willemssen, who was here
today. Federal, State, and local government personnel, the
private sector, individual grass roots organizations, and the
two staffs I've mentioned and the technology subcommittee which
has been our partner in overseeing this massive and unique
experience and we thank them and this success demonstrates what
can be accomplished with leadership, focus, and dedication, and
it's a great legacy to begin this new millennium and we thank
all of you for your hard work. I thank the chairwoman.
Mrs. Morella. I thank you, Mr. Horn. You've expressed it
very well for all of us. Hardly a time to ask another question.
I guess my final one is now as we look into the near future,
any comments about February 29 and this concept of windowing?
Has that been taking place and is it anything that we should be
looking into, comment on, enlighten the public on? Mr. Miller.
Mr. Miller. The companies would take the same attitude that
you heard expressed by Mr. Koskinen and the panel this morning.
They don't expect very many problems with February 29, but they
are maintaining diligent oversight of the problem. Every leap
year there's a problem.
I hate to tell you, whether it's supposed to be or not
supposed to, there's problems so it's not unique. I think there
will be diligence, but I wouldn't expect any major problems. As
far as windowing again, in a way it's postponing the problem. I
think the expectation is it's been postponed long enough. It
will be OK, but we got fooled last time around. There's another
windowing problem which you may know about, which is not
necessarily this subcommittee's concern, which there is a
gentleman who has a patent on windowing who wants a lot of
companies to pay him a lot of money for that. But that right
now is a matter before the patent office and perhaps a matter
before the court so probably Congress doesn't want to touch
that one right now.
Ms. Hotka. When we did our testing, when retail companies
went through and tested all the systems they thought were fine,
the No. 1 thing that came up with was leap year. We don't
expect the world to come to an end. We think you'll still be
able to shop, but if I had to pick one thing that I thought was
going to be funky that is it. We'll be in the ICC again.
Mr. Beach. I would just make a comment on the windowing
that I believe Eduardo and the previous panel mentioned it that
keeping an inventory of those applications that have been
windowed might be wise. I'd like to know where those are in 20
years. I don't think we should make the mistake that we made in
the 1960's and 1970's that these applications are not going
to----
Mrs. Morella. Exactly. Even when you think of the 1980's,
the 20-year span whoever thought we would now be in the year
2000. Any final comments that you'd like to make? I want to
thank you all very much for again being here, sharing your
expertise, and also for all that you have done to make this Y2K
millennium bug be squashed. I thank you very much. So we now
adjourn the meeting.
[Whereupon, at 1:07 p.m., the subcommittee was adjourned.]
[The prepared statement of Hon. James A. Barcia follows:]
[GRAPHIC] [TIFF OMITTED] T6711.075