In  2001, an AT&L policy memorandum designated the Air Force as the Anti- Tamper Executive Agent. DOD Lacks Departmentwide Direction for Implementing its Anti- tamper Policy

DOD has recently taken several actions aimed at raising awareness about  its anti-tamper policy and assisting program managers in implementing  anti-tamper protection on a weapon system. Despite these actions, DOD  still lacks departmentwide direction to implement its anti-tamper policy. Specifically, DOD has    developed a guidebook that includes a checklist to assist program  managers in identifying security, management, and technical  responsibilities when incorporating anti-tamper protection on a  weapons system;    developed a searchable spreadsheet to assist program managers in    developed a Web site for program managers to provide general anti- tamper information, policy resources, conference briefings,  implementation resources, and current events;    coordinated with Defense Acquisition University to design and launch  an online learning module on anti-tamper protection;  funded Sandia National Laboratories to study anti-tamper techniques  and their general effectiveness; and    sponsored research to develop generic anti-tamper techniques through  Small Business Innovation Research, a research program that funds  early-stage research and development projects at small technology  companies. The Navy is also implementing an initiative: a database intended to capture  the information that programs across DOD components have identified as  critical. Many officials we spoke with pointed to this database as a  potential tool to improve identification of critical program information  across DOD components. The Missile Defense Agency anti-tamper point of contact  stated that its information is classified at a level above what the database  can support and its program managers will not submit information for the  database unless DOD requires submissions by all DOD components. Program Managers Face Several Challenges in Identifying Critical Technologies, Threats, and Sufficient Anti-tamper Solutions

To determine whether anti-tamper protection is needed, program  managers must identify which technologies are deemed critical, determine  the potential threats and vulnerabilities to these technologies, and identify  sufficient anti-tamper solutions to protect the technologies. However, program managers lack  the information or tools needed to make informed assessments at these  key decision points. As a result, some technologies that need protection  may not be identified or may not have sufficient protection. Limited Information and Coordination on What Is Critical Increase the Risk That Some Technologies May Not Be Identified

Determining technologies that are critical is largely left to the discretion of  the program managers. At the same time, there has been limited coordination across programs on  technologies that have been identified as critical—creating a stove piped  process—which could result in one technology being protected under one  program and not protected under another. Despite the risk that some technologies that need protection may not be  identified or may not be protected across programs, no formal mechanism  exists within DOD to provide a horizontal view of what is critical. For the Navy,  critical program information includes software, while hardware is part of  what the Navy defines as critical technologies. The potential impact of contradictory intelligence reports is  twofold: If the threat is deemed to be low but is actually high, the  technology is susceptible to reverse engineering; conversely, if the threat  is deemed to be high and is actually low, the anti-tamper solution is more  robust than needed. Appendix I: Scope and Methodology

To identify actions the Department of Defense (DOD) has taken to  implement its anti-tamper policy since 2004, we reviewed DOD policies  and guidance governing anti-tamper protection on weapon systems and  obtained documents on various initiatives. To determine how program managers implemented DOD’s anti-tamper  policy, we interviewed officials from 14 program offices.
Why GAO Did This Study

The Department of Defense (DOD) invests billions of dollars on sophisticated weapon systems and technologies. These may be at risk of exploitation when exported, stolen, or lost during combat or routine missions. In an effort to minimize this risk, DOD developed an anti-tamper policy in 1999, calling for DOD components to implement anti-tamper techniques for critical technologies. In March 2004, GAO reported that program managers had difficulties implementing this policy, including identifying critical technologies. This follow-up report (1) describes recent actions DOD has taken to implement its anti-tamper policy and (2) identifies challenges facing program managers. GAO reviewed documentation on actions DOD has taken since 2004 to implement its anti-tamper policy, and interviewed officials from the Anti-Tamper Executive Agent's Office, the military services, other DOD components, and a cross-section of program offices.

What GAO Found

Since 2004, DOD has taken several actions to raise awareness about anti-tamper protection and develop resources that provide program managers with general information on its anti-tamper policy. These actions include developing a Web site with anti-tamper information and events, establishing an online learning module on anti-tamper protection, and sponsoring research on generic anti-tamper techniques. However, DOD lacks departmentwide direction for implementation of its anti-tamper policy. Without such direction, individual DOD components are left on their own to develop initiatives. For example, the Navy is developing a database that is intended to provide a horizontal view of what DOD components have identified as critical program information. While many officials we spoke with pointed to this database as a potential tool for identifying critical technologies that may need anti-tamper protection, the database is currently incomplete. Specifically, the Missile Defense Agency is not providing information because its information is classified at a level above what the database can support. Also, the Air Force is not currently providing information because not all commands have provided consent to participate. At the same time, program managers face challenges implementing DOD's anti-tamper policy--due largely to a lack of information or tools needed to make informed assessments at key decision points. First, program managers have limited information for defining what is critical or insight into what technologies other programs have deemed critical to ensure similar protection across programs. Determining whether technologies are critical is largely left to the discretion of the individual program manager, resulting in an uncoordinated and stove piped process. Therefore, the same technology can be identified as critical in one program office but not another. Second, program managers have not always had sufficient or consistent information from the intelligence community to identify threats and vulnerabilities to technologies that have been identified as critical. The potential impact of inconsistent threat assessments is twofold: If the threat is deemed to be low but is actually high, the technology is susceptible to tampering; conversely, if the threat is deemed to be high and is actually low, an anti-tamper solution is more robust than needed. Finally, program managers have had difficulty selecting sufficient anti-tamper solutions--in part because they lack information and tools, such as risk and cost-estimating models, to determine how much anti-tamper protection is needed. As a result, program managers may select a suboptimal solution. Given these combined challenges, there is an increased risk that some technologies that need protection may not be identified or may not have sufficient protection.