This report provides references to analytical reports on cybersecurity from CRS, other government agencies, trade associations, and interest groups. The reports and related websites are grouped under the following cybersecurity topics: policy overview; National Strategy for Trusted Identities in Cyberspace (NSTIC); cloud computing and FedRAMP; critical infrastructure; cybercrime, data breaches and data security; national security, cyber espionage, and cyberwar (including Stuxnet); international efforts; education/training/workforce; and research and development (R&D).

This report focuses on two main National Security Agency (NSA) collection activities approved by the Foreign Intelligence Surveillance Court (FISC) established under the Foreign Intelligence Surveillance Act (FISA) of 1978. The first is the bulk collection of telephony metadata for domestic and international telephone calls. The second involves the interception of Internet-based communications and is targeted at foreigners who are not within the United States, but may also inadvertently acquire the communications of U.S. persons.

This report summarizes legislative actions taken to repeal, defund, delay, or otherwise amend the Affordable Care Act (ACA) since the law's enactment.

Testimony issued by the Government Accountability Office with an abstract that begins "The Food and Drug Administration (FDA) spent (obligated) less than half of the $1.1 billion in tobacco user fees it collected from manufacturers and others from fiscal year 2009 through the end of fiscal year 2012; however, FDA's spending increased substantially in fiscal year 2013. Through December 31, 2013, FDA spent nearly 81 percent of the approximately $1.75 billion in fees collected by that time. According to officials in FDA's Center for Tobacco Products (CTP), the center established by the Family Smoking Prevention and Tobacco Control Act (Tobacco Control Act) to implement the act's provisions, the time it took to award contracts contributed to the center spending less than it had planned to spend. In fiscal year 2013, FDA was able to carry out a number of activities that were originally planned for fiscal years 2011 and 2012, such as efforts to educate youth on the dangers of tobacco use. About 79 percent ($1.12 billion) of user fees spent as of December 31, 2013, was spent by three CTP offices: Office of Health Communication and Education, Office of Science, and Office of Compliance and Enforcement."

A letter report issued by the Government Accountability Office with an abstract that begins "The Army's annual report on its modular force either fully or partially addressed all of the requirements mandated by law. GAO's analysis showed that of the 14 legislative requirements, the report fully addressed 9 and partially addressed 5. The requirements that were fully addressed included an assessment of the modular force capabilities and the status of doctrine for the modular force, among others. Some of the requirements that were partially addressed included information related to risks and mitigation strategies associated with shortfalls; scheduling for repairing, recapitalizing, and replacing equipment; and itemizing information by active-duty and reserve components. The 2013 report provided more thorough information to congressional decision makers on the Army's progress in its modular force transformation than previous reports."

Testimony issued by the Government Accountability Office with an abstract that begins "GAO's 2014 annual report identifies 64 new actions that executive branch agencies and Congress could take to improve the efficiency and effectiveness of 26 areas of government. GAO identifies 11 new areas in which there is evidence of fragmentation, overlap, or duplication. For example, under current law, individuals are allowed to receive concurrent payments from the Disability Insurance and Unemployment programs. Eliminating the overlap in these payments could save the government about $1.2 billion over the next 10 years. GAO also identifies 15 new areas where opportunities exist either to reduce the cost of government operations or enhance revenue collections. For example, Congress could rescind all or part of the remaining $4.2 billion in credit subsidies for the Advanced Technology Vehicles Manufacturing Loan program unless the Department of Energy demonstrates sufficient demand for this funding."

Testimony issued by the Government Accountability Office with an abstract that begins "The Department of Defense's (DOD) Missile Defense Agency (MDA) made progress in its goals to improve acquisition management, and accountability and transparency. The agency gained important knowledge for its Ballistic Missile Defense System (BMDS) by successfully conducting several important tests, including the first missile defense system-level operational flight test. Additionally, key programs successfully conducted developmental flight tests that demonstrated key capabilities and modifications made to resolve prior issues. MDA also made some improvements to transparency and accountability. For example, MDA improved the management of its acquisition-related efforts to deploy a missile defense system in Europe and MDA continued to improve the clarity of its resource and schedule baselines, which are reported to Congress for oversight."

Testimony issued by the Government Accountability Office with an abstract that begins "The Internal Revenue Service's (IRS) authority to regulate the practice of representatives before IRS is limited to certain preparers, such as attorneys and certified public accountants. Unenrolled preparers—those generally not subject to IRS regulation—accounted for 55 percent of all preparers as of March 2014. In 2010, IRS initiated steps to regulate unenrolled preparers through testing and education requirements; however, the courts ruled that IRS lacked the authority."

A letter report issued by the Government Accountability Office with an abstract that begins "The Census Bureau (Bureau) has made progress in researching and testing information technology (IT) options for the 2020 Decennial Census, but several of the supporting projects lack schedules and plans, and it is uncertain whether they will be completed in time to inform the decision on the operational design for the 2020 census, planned for September 2015. Specifically, it has begun research on six IT-related projects, such as using the Internet for survey response and using employees' personal smartphones to collect census data. However, four of the projects lacked finalized schedules, and three lacked plans for gauging progress. Moreover, the two projects with completed schedules are not estimated to be completed until after the September 2015 design decision date (see figure)."

Correspondence issued by the Government Accountability Office with an abstract that begins "Although the October 2012 and the August 2013 versions of the U.S. Civil-Military Strategic Framework for Afghanistan have similarities, the two versions differ in several aspects. These differences reflect, among other things, the U.S. government's heightened emphasis on the transition, through the end of 2014, of security responsibility for Afghanistan to Afghan security institutions and the Afghan National Security Forces as well as the transition in U.S. policy toward a more traditional diplomatic and development model. Both versions of the framework address four categories of U.S. efforts in support of U.S. national goals in Afghanistan, with security, the first category, as the foundation for the other three categories, or "pillars"--governance, rule of law, and socioeconomic development. Both versions also address the same crosscutting issues. Differences between the two versions include the following:"

A letter report issued by the Government Accountability Office with an abstract that begins "GAO found that the number of advanced diagnostic imaging (ADI) services provided to Medicare beneficiaries in the office setting—an indicator of access to those services—began declining before and continued declining after the accreditation requirement went into effect on January 1, 2012. In particular, the rate of decline from 2009 to 2010 was similar to the rate from 2011 to 2012 for magnetic resonance imaging (MRI); computed tomography (CT); and nuclear medicine (NM), including positron emission tomography (PET) services. These results suggest that the overall decline was driven, at least in part, by factors other than accreditation. The percentage decline in the number of ADI services provided in the office setting was generally similar in both urban and rural areas during the period GAO studied."

A letter report issued by the Government Accountability Office with an abstract that begins "Governmentwide data on the number and type of most National Environmental Policy Act (NEPA) analyses are not readily available, as data collection efforts vary by agency. NEPA generally requires federal agencies to evaluate the potential environmental effects of actions they propose to carry out, fund, or approve (e.g., by permit) by preparing analyses of different comprehensiveness depending on the significance of a proposed project's effects on the environment—from the most detailed Environmental Impact Statements (EIS) to the less comprehensive Environmental Assessments (EA) and Categorical Exclusions (CE). Agencies do not routinely track the number of EAs or CEs, but the Council on Environmental Quality (CEQ)—the entity within the Executive Office of the President that oversees NEPA implementation—estimates that about 95 percent of NEPA analyses are CEs, less than 5 percent are EAs, and less than 1 percent are EISs. Projects requiring an EIS are a small portion of all projects but are likely to be high-profile, complex, and expensive. The Environmental Protection Agency (EPA) maintains governmentwide information on EISs. A 2011 Congressional Research Service report noted that determining the total number of federal actions subject to NEPA …

A letter report issued by the Government Accountability Office with an abstract that begins ".fancybox-wrap{width:760px !important;} .fancybox-inner{width:740px !important;} .fancybox-skin{padding-left:0;} html,body{overflow-x:hidden !important;}"

A letter report issued by the Government Accountability Office with an abstract that begins "The Department of Treasury (Treasury) continues to make progress in winding down the Capital Purchase Program (CPP). As of January 31, 2014, Treasury's data showed that 624 of the original 707 institutions, or about 88 percent, had exited CPP. Treasury had received about $225 billion from its CPP investments, exceeding the approximately $205 billion it had disbursed. Most institutions exited by repurchasing their preferred shares in full or by refinancing their investments through other federal programs. Treasury also continues to sell its investments in the institutions through auctions; a strategy first implemented in March 2012 to expedite the exit of a number of CPP participants. As of January 31, 2014, Treasury has sold all or part of its CPP investment in 162 institutions through auctions, receiving a total of about 80 percent of the principal amount. A relatively small number of the remaining 83 institutions accounted for most of the outstanding investments. Specifically, 10 institutions accounted for $1.5 billion or about 73 percent of the $2.1 billion in outstanding investments. Treasury estimated a lifetime gain of $16.1 billion for CPP as of November 30, 2013."

A letter report issued by the Government Accountability Office with an abstract that begins "The United States has played an active role in helping to reform financial regulations to address weaknesses revealed by the 2007-2009 financial crisis. According to Treasury officials, during the acute phase of the crisis, the United States proposed elevating the Group of Twenty (G20) forum—representing 19 countries (including the United States) and the European Union—from the level of finance ministers and central banks to the level of heads of state or government. In 2008, the U.S. President and other G20 leaders held their first summit in Washington, D.C., in part to establish a framework to help prevent financial crises. The G20 leaders established principles for financial regulatory reform and agreed on a series of financial reforms, which they have revised or expanded at subsequent summits. To implement their reforms, the G20 leaders generally have called on their national authorities—finance ministries, central banks, and regulators—and international bodies, including the Financial Stability Board (FSB) and standard setting bodies, such as the Basel Committee on Banking Supervision. In 2009, the G20 leaders established FSB to coordinate and promote implementation of the financial reforms, which typically involves standard setting bodies …

A letter report issued by the Government Accountability Office with an abstract that begins "According to the Internal Revenue Service (IRS), 6 of its19 major information technology (IT) investments were within 10 percent of cost and schedule estimates during fiscal year 2013. The remaining 13 were reported as having significant cost and schedule variances for at least 1 month of the year. Specifically, IRS reported 8 investments as being below cost or ahead of schedule; 3 as behind schedule; and 2 as over cost (see figure). IRS reported a range of reasons for these variances, including cost savings from contract negotiations and scope deferrals for those below cost or ahead of schedule, and procurement delays for those behind schedule. It is important to note that the reported monthly cost and schedule variances are for the fiscal year only. IRS's reporting would be more meaningful if it were supplemented with cumulative cost and schedule variances for the investments or investment segments, consistent with the Office of Management and Budget's guidance for measuring progress towards meeting investment goals."

Correspondence issued by the Government Accountability Office with an abstract that begins "GAO found that the Navy continued to make progress in the past year toward (1) establishing a knowledge-based program that generally aligned with acquisition best practices and (2) meeting corresponding statutory certification requirements for entering the Department of Defense (DOD) acquisition process in the engineering and manufacturing development phase. The Navy has met or expects to meet requirements relating to assessment of technology readiness, making appropriate trade-offs to achieve affordability and getting approval of requirements, and development of an independent cost estimate. DOD has, however, waived a requirement for competitive prototyping and the Navy plans to defer a system level preliminary design review (PDR) until after the start of development. GAO reviewed DOD’s waiver of competitive prototyping for the VXX program last year and found that it addresses one of the two bases provided in Weapon Systems Acquisition Reform Act of 2009 for such waivers; that is, that the cost to provide competitive prototypes exceeded the expected benefits. In addition, while the Navy’s plan to defer a system level PDR until after the start of system development deviates from acquisition best practices and is a waiver of a …

A letter report issued by the Government Accountability Office with an abstract that begins "The U.S. Agency for International Development's (USAID) reporting on its principal Local Solutions indicator—the percentage of mission program funds obligated to local organizations in partner countries—lacks clarity, complicating the assessment of the agency's progress toward its fiscal year 2015 target of 30 percent. The March 2013 USAID Forward progress report states that these obligations increased from about 10 percent of mission program funds in fiscal year 2010 to about 14 percent in fiscal year 2012—a $465 million increase. However, the agency also has reported progress on the principal Local Solutions indicator in three other ways, depending on whether two key types of funding—cash transfers and certain qualifying trust funds—are included (see figure). These reporting differences make it difficult to compare the indicator from year to year and to quantify the progress needed to achieve the 30 percent target by fiscal year 2015. Moreover, USAID's approach to tracking the Local Solutions indicator has evolved since the launch of the initiative. For example, USAID included funds in Afghanistan and Pakistan, missions the agency previously had planned to exclude. If these missions are excluded, the percentage of mission program …

A letter report issued by the Government Accountability Office with an abstract that begins "The Navy's 2013 report to Congress on the Port Royal 's material condition partially addressed congressional reporting requirements but has likely overstated modernization costs should the ship be retained in service. While the Navy acknowledges that it did not obtain an independent structural assessment as required by one of the mandates, the Navy found the condition of the ship to be comparable to other cruisers when its own technical experts assessed the ship. For example, in addressing the congressional requirements, the Navy assessed the Port Royal 's structure and found the condition of the superstructure and interior hull to be typical of other cruisers in the class, indicating its suitability for continued use. The mandate also required that the Navy's assessments be reviewed by experts. GAO found that the Navy's assessment was reviewed by the Naval Sea Systems Command Engineering Directorate, the Navy's technical authority, and by independent boards of subject-matter experts from the Department of Defense and industry—the Board of Inspection and Survey and the American Bureau of Shipping, respectively. All three reviewers generally concurred with the assessment. Finally, the Navy's report to Congress included …

A letter report issued by the Government Accountability Office with an abstract that begins "The KC-46 program has made good progress over the past year—acquisition costs have remained relatively stable, the critical design review was successfully completed, the program is on track to meet performance parameters, and the contractor started building development aircraft. As shown, total program acquisition costs—which include development, production, and military construction costs—and unit costs have changed less than 1 percent since February 2011."

A letter report issued by the Government Accountability Office with an abstract that begins "GAO has identified five additional risks since its November 2010 report ( GAO-11-103 ) associated with using new technologies in the National Nuclear Security Administration's (NNSA) Uranium Processing Facility (UPF), which is to be built in three interrelated phases. These risks and the steps that NNSA is taking to address them include the following:"

A letter report issued by the Government Accountability Office with an abstract that begins "The Air Force has managed its remotely piloted aircraft (RPA) pilots using some strategic human-capital approaches, such as planning for the different levels of experience that it needs in these pilots. However, it continues to face challenges. High-performing organizations manage human capital to identify the right number of personnel and to target the right sources to fill personnel needs. In 2008, the Air Force determined the optimum number of RPA pilots—the crew ratio—for some units, but it did not account for all tasks these units complete. Air Force officials stated that, as a result, the crew ratio is too low, but the Air Force has not updated it. Air Force guidance states that low crew ratios diminish combat capability and cause flight safety to suffer, but the Air Force has operated below its optimum crew ratio and it has not established a minimum crew ratio. Further, high work demands on RPA pilots limit the time they have available for training and development and negatively affects their work-life balance. In addition, the Air Force faces challenges recruiting officers into the RPA pilot career and may face challenges …

A letter report issued by the Government Accountability Office with an abstract that begins "In fiscal year 2013, the Missile Defense Agency (MDA) made mixed progress in achieving its acquisition goals to develop, test, and produce elements of the Ballistic Missile Defense System (BMDS). For the first time, MDA conducted an operational flight test that involved warfighters from several combatant commands using multiple BMDS elements simultaneously. The agency also successfully conducted several developmental flight tests that demonstrated key capabilities and modifications made to resolve prior production issues. However, the Aegis BMD and Ground-based Midcourse Defense (GMD) continued to experience testing and development challenges."

Testimony issued by the Government Accountability Office with an abstract that begins "The Inspector General Act of 1978, as amended (IG Act), originally established inspectors general (IG) appointed by the President and confirmed by the Senate in 12 major departments and agencies of the government to conduct and supervise independent audits and investigations; recommend policies to promote economy, efficiency, and effectiveness; and prevent and detect fraud and abuse in their departments' and agencies' programs and operations. Based in part on GAO's findings that the internal audit offices of small federal agencies lacked independence and provided inadequate coverage of important programs, the Congress passed the IG Act Amendments of 1988 to establish IGs in designated federal entities (DFE), which are generally smaller agencies established in various statutes as commissions, boards, authorities, corporations, endowments, foundations, institutions, agencies, and administrations identified by the act. The DFE IGs are appointed by their respective entity heads with duties and responsibilities similar to those of IGs appointed by the President. The Congress used a budget threshold of $100 million to help determine which DFEs should have IGs. However, additional DFEs below this threshold were also included for specific reasons."