Different Interpretations of Critical Technologies May Increase the Risk of Some Going Unprotected

DOD officials acknowledged that the identification of critical  technologies—a basis for determining if anti-tamper protection is  needed—is subjective, which can result in different conclusions regarding  what needs protection. While different conclusions can be reached regarding what is critical,  various organizations can serve as a check on a program manager’s  assessment. However, no organization has complete information or  visibility of all programs across the services and agencies. While it was apparent that the systems had critical technologies, some  program managers needed assistance to determine which specific  technologies were critical. Generally, anti-tamper  implementation is treated as an added requirement that is not separately  funded for most programs. Most programs we visited experienced or estimated cost increases, and  some encountered schedule delays as they attempted to apply anti-tamper  techniques. DOD is  working to oversee the development of generic anti-tamper techniques and  tools to help program managers identify potential techniques, but many of  these efforts are still in progress and it is uncertain how they will help  program managers. Problems in applying anti-tamper techniques typically arose when the  programs were already in design or production or when the techniques  were not fully developed or specifically designed for the system. According to Air Force Research  Laboratory and Sandia National Laboratories officials, generic anti-tamper  techniques can be considered, but program managers have to design and  incorporate the techniques needed for their unique systems. For program managers expected to implement anti-tamper  protection, the policy can compete with their goals of meeting cost and  schedule objectives, particularly when the anti-tamper requirement is  identified late in the system development process. To help minimize the impact to program cost and schedule objectives, the  Secretary of Defense should direct the Under Secretary for Acquisition,  Technology, and Logistics to work with program managers to ensure that  the cost and techniques needed to implement anti-tamper protection are  identified early in a system’s life cycle and to reflect that practice in  guidance and decisions. DOD’s letter is reprinted in the appendix. Appendix: Comments from the Department of Defense
Why GAO Did This Study

The U.S. government has invested hundreds of billions of dollars in developing the most sophisticated weapon systems and technologies in the world. Yet, U.S. weapons and technologies are vulnerable to exploitation, which can weaken U.S. military advantage, shorten the expected combat life of a system, and erode the U.S. industrial base's technological competitiveness. In an effort to protect U.S. technologies from exploitation, the Department of Defense (DOD) established in 1999 a policy directing each military service to implement anti-tamper techniques, which include software and hardware protective devices. This report reviews DOD's implementation of the anti-tamper policy as required by the Senate report accompanying the National Defense Authorization Act for Fiscal Year 2004.

What GAO Found

Program managers have encountered difficulties in implementing DOD's anti-tamper policy on individual weapon systems. First, defining a critical technology--a basis for determining the need for anti-tamper--is subjective, which can result in different conclusions regarding what needs anti-tamper protection. While different organizations can check on program managers' assessments, no organization has complete information or visibility across all programs. Some program managers said they needed assistance in determining which technologies were critical, but resources to help them were limited or unknown and therefore not requested. Second, anti-tamper protection is treated as an added requirement and can affect a program's cost and schedule objectives, particularly if the program is further along in the acquisition process. Programs GAO contacted experienced or estimated cost increases, and some encountered schedule delays when applying antitamper protection. Officials from one program stated that their existing budget was insufficient to cover the added cost of applying anti-tamper protection and that they were waiting for separate funding before attempting to apply such protection. Finally, anti-tamper techniques can be technically difficult to incorporate in some weapon systems--particularly when the techniques are not fully developed or when the systems are already in design or production. One program that had difficulty incorporating the techniques resorted to alternatives that provided less security. While DOD is overseeing the development of generic anti-tamper techniques and tools to help program managers, many of these efforts are still in progress, and program managers ultimately have to design and incorporate techniques needed for their unique systems.