To inform these design decisions, the Bureau held several major  operational tests, including  the 2014 Census test, which was conducted in the Maryland and  Washington, D.C., areas to evaluate new methods for conducting self- response and non-response follow-up;  the 2015 Census test in Arizona, which evaluated, among other  things, (1) the use of a field operations management system to  automate data collection operations and provide real-time data, (2)  the ability to reduce the non-response follow-up workload using  information previously provided to the government, and (3) the use of  personally owned mobile devices by the field-based enumerators who  go door to door to collect census data;  the 2015 Optimizing Self-Response test in Savannah, Georgia, and  the surrounding area, which was intended to explore methods of  encouraging households to respond using the Internet, such as by  using advertising and outreach to motivate respondents, and enabling  households to respond without a Bureau-issued identification number;  and  the 2016 Census tests in Harris County, Texas and Los Angeles,  California, which evaluated, among other things, the efficiency of non- response follow-up using contractor-provided mobile devices. This project is called the Enterprise Censuses and Surveys  Enabling (ECASE) initiative. The Bureau Lacks Processes for Effectively Managing Interdependencies between the CEDCAP and 2020 Census Programs

In August 2016, we reported that the CEDCAP and 2020 Census  programs were intended to be on parallel implementation tracks and had  major interdependencies; however, the interdependencies between these  two programs had not always been effectively managed. Nevertheless, while both programs had taken a number of steps to  coordinate, such as holding weekly schedule coordination meetings and  participating in each other’s risk review board meetings, they lacked  processes for effectively integrating their schedule dependencies,  integrating the management of interrelated risks, and managing  requirements. The Bureau agreed with this  recommendation and indicated it would be taking actions to address  it. The Bureau agreed with these  recommendations and reported that it planned to take actions to  address them. Census Bureau Faces Several Information Security Challenges in Implementing the 2020 Census

While the Bureau plans to extensively use IT systems to support the 2020  Census redesign in an effort to realize potentially significant efficiency  gains and cost savings, we reported that this redesign introduces critical  information security challenges related to the following: minimizing the threat of phishing aimed at stealing personal  information, which could target 2020 Census respondents, as well as  Census employees and contractors; ensuring that individuals gain only limited and appropriate access to adequately protecting approximately 300,000 mobile devices; ensuring adequate control of security performance requirements in a  cloud environment, such as those related to data reliability,  preservation, privacy, and access rights; adequately considering information security when making decisions  about the IT solutions and infrastructure supporting the 2020 Census; making certain that key IT positions are filled and have appropriate  information security knowledge and expertise; ensuring that contingency and incident response plans are in place  that encompass all of the IT systems to be used to support the 2020  Census; adequately training Bureau employees, including its massive  temporary workforce, in information security awareness; making certain that security assessments are completed in a timely  manner and that risks are at an acceptable level; and properly configuring and patching systems supporting the 2020  Census. For example, the introduction of an option for households to respond  using the Internet puts respondents more at risk for phishing attacks. More details on each of these  challenges can be found in our recently issued report. Uncertainty about the Bureau’s Readiness for the 2018 Test Remains

Looking forward, there is uncertainty as to whether the Census Bureau  will be ready for the 2018 end-to-end test. We have ongoing work for this  committee that is evaluating the significant challenges the Bureau faces  in developing, testing, and integrating systems prior to the 2018 test. For example, as of  October 2016, only 3 of the 50 systems (6 percent) had been  delivered. The Bureau is relying on contractor support in many key  areas, including the technical integration of all of the key systems and  infrastructure, and the development of many of the data collection  systems. Additionally, while the large-scale technological changes for the 2020  Decennial Census introduce great potential for efficiency and  effectiveness gains, it also introduces many information security  challenges, including educating the public to offset inevitable phishing  scams. Continued focus on these considerable security challenges will be  important as the Bureau begins to develop and/or acquire systems and  implement the 2020 Census design. In our ongoing work for this committee, we plan to address key questions  about the Bureau’s ability to develop, integrate, test, and secure the IT  systems and infrastructure in time for the end–to-end test. Given the short  window of time before the test begins, it is important that the Bureau  continue to focus its attention on implementing and securing the systems  that will collect and store the personal information of millions of American  people.
Why GAO Did This Study

The U.S. Census Bureau (a component of the Department of Commerce) plans to significantly change the methods and technology it uses to count the population with the 2020 Decennial Census, such as by offering an option for households to respond to the survey via the Internet. The Bureau's redesign of the Census program relies on the acquisition and development of many new and modified systems. Several of the key systems are to be provided by an enterprise-wide initiative called CEDCAP.
This statement summarizes the report GAO issued in August 2016 on the challenges the Bureau faces in managing the interdependencies between the 2020 Census and CEDCAP programs, as well as challenges it faces in ensuring the security and integrity of Bureau systems and data. GAO also updated key information based on its ongoing work for this committee by, among other things, reviewing the updated 2020 Operational Plan and systems lists provided by the Bureau, and by interviewing agency officials.

What GAO Found

The U.S. Census Bureau's (Bureau) 2020 Decennial Census program is heavily dependent upon the Census Enterprise Data Collection and Processing (CEDCAP) program to deliver the key systems needed to support the 2020 redesign. CEDCAP is a complex modernization program intended to deliver a system-of-systems for the Bureau's survey data collection and processing functions. In August 2016, GAO reported that while the two programs had taken steps to coordinate their schedules, risks, and requirements, they lacked effective processes for managing interdependencies. Officials acknowledged weaknesses in managing interdependencies and reported that they were taking steps to address them. Until these interdependencies are managed more effectively, the Bureau will be limited in its ability to meet milestones, mitigate major risks, and ensure that requirements are appropriately identified.
While the large-scale technological changes for the 2020 Decennial Census introduce great potential for efficiency and effectiveness gains, they also introduce many information security challenges. For example, the introduction of an option for households to respond using the Internet puts respondents more at risk for phishing attacks (requests for information from authentic-looking, but fake, e-mails and websites). The Bureau had begun efforts to address a number of these challenges; as it begins implementing this decennial census' design, continued focus on these considerable security challenges will be critical.
Looking forward, there is uncertainty as to whether the Census Bureau will be ready for the 2018 end-to-end test, set to begin in August 2017. GAO has ongoing work for this committee that is evaluating the significant challenges the Bureau faces in developing, testing, integrating, and securing systems prior to the 2018 test. For example, of the 50 systems to be included in the end-to-end test, half of them are to be delivered after the start of the test or lack a firm delivery date (see figure). In addition, key dates for the integration of the systems have not yet been defined. Given the short window of time before the test is to begin, it is important that the Bureau continue to focus its attention on implementing and securing the data collection systems that are to collect and store the personal information of millions of American people.

What GAO Recommends

In its August report, GAO made eight recommendations to the Department of Commerce. The recommendations addressed, among other things, deficiencies in the Bureau's management of interdependencies related to schedule, risk, and requirements. The department agreed with all eight recommendations and indicated that it would be taking actions to address them.