This report provides references to analytical reports on cybersecurity from CRS, other government agencies, trade associations, and interest groups. The reports and related websites are grouped under the following cybersecurity topics: policy overview; National Strategy for Trusted Identities in Cyberspace (NSTIC); cloud computing and FedRAMP; critical infrastructure; cybercrime, data breaches and data security; national security, cyber espionage, and cyberwar (including Stuxnet); international efforts; education/training/workforce; and research and development (R&D).

This report focuses on two main National Security Agency (NSA) collection activities approved by the Foreign Intelligence Surveillance Court (FISC) established under the Foreign Intelligence Surveillance Act (FISA) of 1978. The first is the bulk collection of telephony metadata for domestic and international telephone calls. The second involves the interception of Internet-based communications and is targeted at foreigners who are not within the United States, but may also inadvertently acquire the communications of U.S. persons.

This report summarizes legislative actions taken to repeal, defund, delay, or otherwise amend the Affordable Care Act (ACA) since the law's enactment.

A letter report issued by the Government Accountability Office with an abstract that begins "The Army's annual report on its modular force either fully or partially addressed all of the requirements mandated by law. GAO's analysis showed that of the 14 legislative requirements, the report fully addressed 9 and partially addressed 5. The requirements that were fully addressed included an assessment of the modular force capabilities and the status of doctrine for the modular force, among others. Some of the requirements that were partially addressed included information related to risks and mitigation strategies associated with shortfalls; scheduling for repairing, recapitalizing, and replacing equipment; and itemizing information by active-duty and reserve components. The 2013 report provided more thorough information to congressional decision makers on the Army's progress in its modular force transformation than previous reports."

A letter report issued by the Government Accountability Office with an abstract that begins "The Census Bureau (Bureau) has made progress in researching and testing information technology (IT) options for the 2020 Decennial Census, but several of the supporting projects lack schedules and plans, and it is uncertain whether they will be completed in time to inform the decision on the operational design for the 2020 census, planned for September 2015. Specifically, it has begun research on six IT-related projects, such as using the Internet for survey response and using employees' personal smartphones to collect census data. However, four of the projects lacked finalized schedules, and three lacked plans for gauging progress. Moreover, the two projects with completed schedules are not estimated to be completed until after the September 2015 design decision date (see figure)."

A letter report issued by the Government Accountability Office with an abstract that begins "GAO found that the number of advanced diagnostic imaging (ADI) services provided to Medicare beneficiaries in the office setting—an indicator of access to those services—began declining before and continued declining after the accreditation requirement went into effect on January 1, 2012. In particular, the rate of decline from 2009 to 2010 was similar to the rate from 2011 to 2012 for magnetic resonance imaging (MRI); computed tomography (CT); and nuclear medicine (NM), including positron emission tomography (PET) services. These results suggest that the overall decline was driven, at least in part, by factors other than accreditation. The percentage decline in the number of ADI services provided in the office setting was generally similar in both urban and rural areas during the period GAO studied."

A letter report issued by the Government Accountability Office with an abstract that begins "Governmentwide data on the number and type of most National Environmental Policy Act (NEPA) analyses are not readily available, as data collection efforts vary by agency. NEPA generally requires federal agencies to evaluate the potential environmental effects of actions they propose to carry out, fund, or approve (e.g., by permit) by preparing analyses of different comprehensiveness depending on the significance of a proposed project's effects on the environment—from the most detailed Environmental Impact Statements (EIS) to the less comprehensive Environmental Assessments (EA) and Categorical Exclusions (CE). Agencies do not routinely track the number of EAs or CEs, but the Council on Environmental Quality (CEQ)—the entity within the Executive Office of the President that oversees NEPA implementation—estimates that about 95 percent of NEPA analyses are CEs, less than 5 percent are EAs, and less than 1 percent are EISs. Projects requiring an EIS are a small portion of all projects but are likely to be high-profile, complex, and expensive. The Environmental Protection Agency (EPA) maintains governmentwide information on EISs. A 2011 Congressional Research Service report noted that determining the total number of federal actions subject to NEPA …

A letter report issued by the Government Accountability Office with an abstract that begins ".fancybox-wrap{width:760px !important;} .fancybox-inner{width:740px !important;} .fancybox-skin{padding-left:0;} html,body{overflow-x:hidden !important;}"

A letter report issued by the Government Accountability Office with an abstract that begins "The Department of Treasury (Treasury) continues to make progress in winding down the Capital Purchase Program (CPP). As of January 31, 2014, Treasury's data showed that 624 of the original 707 institutions, or about 88 percent, had exited CPP. Treasury had received about $225 billion from its CPP investments, exceeding the approximately $205 billion it had disbursed. Most institutions exited by repurchasing their preferred shares in full or by refinancing their investments through other federal programs. Treasury also continues to sell its investments in the institutions through auctions; a strategy first implemented in March 2012 to expedite the exit of a number of CPP participants. As of January 31, 2014, Treasury has sold all or part of its CPP investment in 162 institutions through auctions, receiving a total of about 80 percent of the principal amount. A relatively small number of the remaining 83 institutions accounted for most of the outstanding investments. Specifically, 10 institutions accounted for $1.5 billion or about 73 percent of the $2.1 billion in outstanding investments. Treasury estimated a lifetime gain of $16.1 billion for CPP as of November 30, 2013."

A letter report issued by the Government Accountability Office with an abstract that begins "The United States has played an active role in helping to reform financial regulations to address weaknesses revealed by the 2007-2009 financial crisis. According to Treasury officials, during the acute phase of the crisis, the United States proposed elevating the Group of Twenty (G20) forum—representing 19 countries (including the United States) and the European Union—from the level of finance ministers and central banks to the level of heads of state or government. In 2008, the U.S. President and other G20 leaders held their first summit in Washington, D.C., in part to establish a framework to help prevent financial crises. The G20 leaders established principles for financial regulatory reform and agreed on a series of financial reforms, which they have revised or expanded at subsequent summits. To implement their reforms, the G20 leaders generally have called on their national authorities—finance ministries, central banks, and regulators—and international bodies, including the Financial Stability Board (FSB) and standard setting bodies, such as the Basel Committee on Banking Supervision. In 2009, the G20 leaders established FSB to coordinate and promote implementation of the financial reforms, which typically involves standard setting bodies …

A letter report issued by the Government Accountability Office with an abstract that begins "According to the Internal Revenue Service (IRS), 6 of its19 major information technology (IT) investments were within 10 percent of cost and schedule estimates during fiscal year 2013. The remaining 13 were reported as having significant cost and schedule variances for at least 1 month of the year. Specifically, IRS reported 8 investments as being below cost or ahead of schedule; 3 as behind schedule; and 2 as over cost (see figure). IRS reported a range of reasons for these variances, including cost savings from contract negotiations and scope deferrals for those below cost or ahead of schedule, and procurement delays for those behind schedule. It is important to note that the reported monthly cost and schedule variances are for the fiscal year only. IRS's reporting would be more meaningful if it were supplemented with cumulative cost and schedule variances for the investments or investment segments, consistent with the Office of Management and Budget's guidance for measuring progress towards meeting investment goals."

A letter report issued by the Government Accountability Office with an abstract that begins "The U.S. Agency for International Development's (USAID) reporting on its principal Local Solutions indicator—the percentage of mission program funds obligated to local organizations in partner countries—lacks clarity, complicating the assessment of the agency's progress toward its fiscal year 2015 target of 30 percent. The March 2013 USAID Forward progress report states that these obligations increased from about 10 percent of mission program funds in fiscal year 2010 to about 14 percent in fiscal year 2012—a $465 million increase. However, the agency also has reported progress on the principal Local Solutions indicator in three other ways, depending on whether two key types of funding—cash transfers and certain qualifying trust funds—are included (see figure). These reporting differences make it difficult to compare the indicator from year to year and to quantify the progress needed to achieve the 30 percent target by fiscal year 2015. Moreover, USAID's approach to tracking the Local Solutions indicator has evolved since the launch of the initiative. For example, USAID included funds in Afghanistan and Pakistan, missions the agency previously had planned to exclude. If these missions are excluded, the percentage of mission program …

A letter report issued by the Government Accountability Office with an abstract that begins "The Navy's 2013 report to Congress on the Port Royal 's material condition partially addressed congressional reporting requirements but has likely overstated modernization costs should the ship be retained in service. While the Navy acknowledges that it did not obtain an independent structural assessment as required by one of the mandates, the Navy found the condition of the ship to be comparable to other cruisers when its own technical experts assessed the ship. For example, in addressing the congressional requirements, the Navy assessed the Port Royal 's structure and found the condition of the superstructure and interior hull to be typical of other cruisers in the class, indicating its suitability for continued use. The mandate also required that the Navy's assessments be reviewed by experts. GAO found that the Navy's assessment was reviewed by the Naval Sea Systems Command Engineering Directorate, the Navy's technical authority, and by independent boards of subject-matter experts from the Department of Defense and industry—the Board of Inspection and Survey and the American Bureau of Shipping, respectively. All three reviewers generally concurred with the assessment. Finally, the Navy's report to Congress included …

A letter report issued by the Government Accountability Office with an abstract that begins "The KC-46 program has made good progress over the past year—acquisition costs have remained relatively stable, the critical design review was successfully completed, the program is on track to meet performance parameters, and the contractor started building development aircraft. As shown, total program acquisition costs—which include development, production, and military construction costs—and unit costs have changed less than 1 percent since February 2011."

A letter report issued by the Government Accountability Office with an abstract that begins "GAO has identified five additional risks since its November 2010 report ( GAO-11-103 ) associated with using new technologies in the National Nuclear Security Administration's (NNSA) Uranium Processing Facility (UPF), which is to be built in three interrelated phases. These risks and the steps that NNSA is taking to address them include the following:"

A letter report issued by the Government Accountability Office with an abstract that begins "The Air Force has managed its remotely piloted aircraft (RPA) pilots using some strategic human-capital approaches, such as planning for the different levels of experience that it needs in these pilots. However, it continues to face challenges. High-performing organizations manage human capital to identify the right number of personnel and to target the right sources to fill personnel needs. In 2008, the Air Force determined the optimum number of RPA pilots—the crew ratio—for some units, but it did not account for all tasks these units complete. Air Force officials stated that, as a result, the crew ratio is too low, but the Air Force has not updated it. Air Force guidance states that low crew ratios diminish combat capability and cause flight safety to suffer, but the Air Force has operated below its optimum crew ratio and it has not established a minimum crew ratio. Further, high work demands on RPA pilots limit the time they have available for training and development and negatively affects their work-life balance. In addition, the Air Force faces challenges recruiting officers into the RPA pilot career and may face challenges …

A letter report issued by the Government Accountability Office with an abstract that begins "In fiscal year 2013, the Missile Defense Agency (MDA) made mixed progress in achieving its acquisition goals to develop, test, and produce elements of the Ballistic Missile Defense System (BMDS). For the first time, MDA conducted an operational flight test that involved warfighters from several combatant commands using multiple BMDS elements simultaneously. The agency also successfully conducted several developmental flight tests that demonstrated key capabilities and modifications made to resolve prior production issues. However, the Aegis BMD and Ground-based Midcourse Defense (GMD) continued to experience testing and development challenges."

A letter report issued by the Government Accountability Office with an abstract that begins "The Department of Defense (DOD) met the presidentially announced time frame to deploy initial ballistic missile defense (BMD) capabilities in Europe under the European Phased Adaptive Approach (EPAA) but did not fully identify and plan to resolve implementation issues before deployment. As a result, DOD experienced implementation issues, such as incomplete construction of housing facilities for soldiers arriving at the EPAA radar site in Turkey and incomplete implementing arrangements defining how to operate with allies when certain BMD elements arrived in the host country. U.S. Strategic Command, in coordination with other combatant commands, developed criteria to assess whether a BMD capability is ready for operational use to ensure that BMD capabilities can be used as intended when they are delivered. However, the assessment criteria used during this process focused on effectiveness, suitability, and interoperability areas—such as whether BMD elements can work together to track ballistic missile threats—and did not explicitly require DOD to comprehensively identify and plan to resolve implementation issues prior to deploying these capabilities. DOD plans to continue to use its existing process to accept BMD capabilities planned for Europe in the future. Without …

A letter report issued by the Government Accountability Office with an abstract that begins "Aerospace medical experts GAO interviewed generally agreed that the Federal Aviation Administration's (FAA) medical standards are appropriate and supported FAA's recent data-driven efforts to improve its pilot medical-certification process. Each year, about 400,000 candidates apply for a pilot's medical certificate and complete a medical exam to determine whether they meet FAA's medical standards. From 2008 through 2012, on average, about 90 percent of applicants have been medically certified by an FAA-designated aviation medical examiner (AME) at the time of their medical exam or by a Regional Flight Surgeon. Of the remaining applicants, about 8.5 percent have received a special issuance medical certificate (special issuance) after providing additional medical information to FAA. Approximately 1.2 percent were not medically certified to fly. According to an industry association, the special issuance process adds time and costs to the application process, in part, because applicants might not understand what additional medical information they need to provide to FAA. Officials from FAA's medical certification division have said that technological problems with the aging computer systems that support the medical certification process have contributed to delays in the special issuance process. FAA's …

A letter report issued by the Government Accountability Office with an abstract that begins "Although the Securities and Exchange Commission (SEC) had implemented and made progress in strengthening information security controls, weaknesses limited their effectiveness in protecting the confidentiality, integrity, and availability of a key financial system. For this system's network, servers, applications, and databases, weaknesses in several controls were found, as the following examples illustrate:"

A letter report issued by the Government Accountability Office with an abstract that begins "Governmentwide data on the number and type of most National Environmental Policy Act (NEPA) analyses are not readily available, as data collection efforts vary by agency. NEPA generally requires federal agencies to evaluate the potential environmental effects of actions they propose to carry out, fund, or approve (e.g., by permit) by preparing analyses of different comprehensiveness depending on the significance of a proposed project's effects on the environment--from the most detailed Environmental Impact Statements (EIS) to the less comprehensive Environmental Assessments (EA) and Categorical Exclusions (CE). Agencies do not routinely track the number of EAs or CEs, but the Council on Environmental Quality (CEQ)--the entity within the Executive Office of the President that oversees NEPA implementation--estimates that about 95 percent of NEPA analyses are CEs, less than 5 percent are EAs, and less than 1 percent are EISs. Projects requiring an EIS are a small portion of all projects but are likely to be high-profile, complex, and expensive. The Environmental Protection Agency (EPA) maintains governmentwide information on EISs. A 2011 Congressional Research Service report noted that determining the total number of federal actions subject to NEPA …

A letter report issued by the Government Accountability Office with an abstract that begins "The Army has a standard process to manage litigation costs of its Military Housing Privatization Initiative (MHPI) projects that are not accounted for in the annual budget process. Army officials indicated that there is one case between four Army MHPI projects and Pinnacle Property Management (Pinnacle) that met the dollar threshold criteria and that would have been approved through this process. However, Army officials did not use the standard process because the Army determined that it needed to limit access to Pinnacle litigation information to avoid disclosing any information material to the litigation strategy. As a result, the Army used an alternative process to review and approve litigation costs for Pinnacle that is consistent with MHPI operating agreements. Had the standard process been followed, litigation and litigation cost information would have been shared with the MHPI projects construction company, Clark Realty Capital (Clark), and four different offices within the Army. Army and Clark officials decided to use the alternative process allowed by the MHPI’s operating agreements so that fewer personnel would be aware of ongoing litigation information involving Pinnacle. The alternative process allows the Army and …

A letter report issued by the Government Accountability Office with an abstract that begins "The Internal Revenue Service (IRS) continued to make progress in addressing information security control weaknesses and improving its internal control over financial reporting; however, weaknesses remain that could affect the confidentiality, integrity, and availability of financial and sensitive taxpayer data. During fiscal year 2013, IRS management devoted attention and resources to addressing information security controls, and resolved a number of the information security control deficiencies that were previously reported by GAO. However, significant risks remained. Specifically, the agency had not always (1) installed appropriate patches on all databases and servers to protect against known vulnerabilities, (2) sufficiently monitored database and mainframe controls, or (3) appropriately restricted access to its mainframe environment. In addition, IRS had allowed individuals to make changes to mainframe data processing without requiring them to follow established change control procedures to ensure changes were authorized, and did not configure all applications to use strong encryption for authentication, increasing the potential for unauthorized access."

A letter report issued by the Government Accountability Office with an abstract that begins "The Department of Labor's Mine Safety and Health Administration (MSHA) appropriately did not use recent trend data on coal workers' pneumoconiosis (CWP) as a basis for its proposal to lower the permissible exposure limit for respirable coal mine dust. These recent data from the Department of Health and Human Services' National Institute for Occupational Safety and Health (NIOSH) are inappropriate for this purpose because they do not include the types of detailed information about individual miners needed to estimate the likelihood that miners would develop CWP at different exposure levels, such as historical dust exposures. MSHA primarily based its proposed new limit on two reports and six epidemiologic studies, which each concluded that lowering the limit on exposure to coal mine dust would reduce miners' risk of developing disease. MSHA's proposed coal mine dust limit was supported by these reports and studies because, unlike recent CWP trend data, they included information needed to conduct a reliable epidemiological analysis of disease risks associated with different levels of exposure to coal mine dust."