FBI Loses More Computers

March 20, 2006. The Government Accountability Office (GAO) released a report [PDF] titled "Federal Bureau of Investigation: Weak Controls over Trilogy Project Led to Payment of Questionable Contractor Costs and Missing Assets".

This is another is a series of studies and testimonies that report that the Department of Justice's (DOJ) Federal Bureau of Investigation (FBI) has outdated information technology (IT), that it is incapable of managing its adoption of new technology, that it is wasting taxpayers' money in its attempts, and that much equipment and any data stored therein is lost or stolen.

This latest report focuses on FBI mismanagement, waste of taxpayer money, and loss of sensitive equipment.

The report finds that the FBI "was unable to locate over 1,200" pieces of IT equipment purchased as part of its Trilogy project. The report states that these lost items are valued at approximately $7.6 Million, and include items such as "computer desktops, laptops, printers, and servers".

One table in the report provides more details. One line item is 35 lost "Data storage equipment" valued at $2,404,853. Another item is 5 lost "Data storage equipment" valued at $1,012,666. While the report states that the GAO identified 1,205 pieces of missing equipment, almost half of the dollar value of the lost equipment is from 40 items categorized as "Data storage equipment". (See, Table 6 at page 39.)

The report does not state what data, if any, has been lost, and if so, to whom. The report states that "According to FBI policy, for items in PMA that cannot be located during the inventory, a ``Report of Lost or Stolen Property´´ must be submitted to FBI headquarters. Due to security concerns, FBI did not provide us copies of these reports for the property items that were not located during the 2003, 2004, and 2005 inventories. Therefore, it is unclear what type of security risk if any these lost/stolen assets represent." (PMA is Property Management Application.)

The report also identifies lost CPUs, servers, desktops, laptops, and encryption equipment. The report also identifies the loss of 272 switches, valued at over $1.5 Million.

The report states that the FBI's IT systems are "archaic and inadequate for efficiently and effectively investigating criminal cases".

It continues that the FBI recognizes this, and is attempting to upgrade through its Trilogy project, which was initiated in mid-2001.

The report faults the FBI's management of this project. It states that the "FBI’s internal controls did not provide reasonable assurance that payments to contractors for unallowable costs would not be made or would be detected in the normal course of business. Our review found that FBI’s review and approval process for Trilogy contractor invoices, which included GSA’s review in its role as contracting agency, did not provide an adequate basis to verify that goods and services billed were actually received by FBI or that the amounts billed were appropriate."

The report further finds that "once FBI took possession of the Trilogy equipment, it did not establish adequate physical control over the assets. FBI failed to record accountable assets -- equipment with a value of $1,000 or more, or deemed by FBI to be susceptible to theft -- into its property system in a timely manner, did not properly use its bar codes to individually track accountable assets, and did not effectively use its inventory process to identify all potentially missing assets. These breakdowns in control over Trilogy assets created an environment in which equipment could be lost or stolen without detection. "

It concludes that "the lack of accountability for Trilogy equipment calls into question FBI’s ability to adequately safeguard its existing assets as well as those it may acquire in the future."

On August 5, 2002, the DOJ's Office of the Inspector General (OIG) released a series of reports on the control of laptop computers and weapons at five DOJ components. It stated that there were a total of 400 missing laptops, and 775 missing weapons. For the FBI, it reported 317 missing laptops and 212 missing weapons. Moreover, the OIG found that the FBI does not know if sensitive data was lost. See, story titled "FBI Loses 317 Laptops" in TLJ Daily E-Mail Alert No. 485, August 6, 2002.

See also, story titled "FBI Employee Pleads Guilty to Computer Crime" in TLJ Daily E-Mail Alert No. 791, December 3, 2003.