Summary

The Department of Defense (DOD), in its response to unconventional threats from terrorists, uses biometrics technologies that identify physical attributes, including fingerprints and iris scans. However, coordinating the development and implementation of biometrics and ensuring interoperability across DOD has been difficult to achieve. Biometrics also is an enabling technology for identity management, a concept that seeks to manage personally identifiable information to enable improved governmentwide sharing and analysis of identity information. GAO was asked to examine the extent to which DOD has established biometrics goals and objectives, implementing guidance for managing biometrics activities, and a designated budget. To address these objectives, GAO reviewed documentation, including DOD biometrics policy and directives, and interviewed key DOD officials involved with making policy and funding decisions regarding biometrics.

DOD established, in October 2006, the Principal Staff Assistant, who is the Director of Defense Research and Engineering, and an Executive Committee as part of its attempts to improve the management of its biometrics activities. However, as of August 2008, it had not established management practices that include clearly defined goals and objectives, implementing guidance that clarifies decision-making procedures for the Executive Committee, and a designated biometrics budget. First, while DOD has stated some general goals for biometrics, such as providing recognized leadership and comprehensive planning policy, it has not articulated specific program objectives, the steps needed to achieve those objectives, and the priorities, milestones, and performance measures needed to gauge results. Second, DOD issued a directive in 2008 to establish biometrics policy and assigned general responsibilities to the Executive Committee and the Principal Staff Assistant but has not issued implementing guidance that clarifies decision-making procedures. The Executive Committee is chaired by the Principal Staff Assistant and includes a wide array of representatives from DOD communities such as intelligence, acquisitions, networks and information integration, personnel, and policy and the military services. The Executive Committee is responsible for resolving biometrics management issues, such as issues between the military services and joint interests resulting in duplications of effort. However, the committee does not have guidance for making decisions that can resolve management issues. Past DOD reports have noted difficulties in decision making and accountability in the management of its biometrics activities. Third, DOD also has not established a designated budget for biometrics that links resources to specific objectives and provides a consolidated view of the resources devoted to biometrics activities. Instead, it has relied on initiative-by-initiative requests for supplemental funding, which may not provide a predictable stream of funding for biometrics. Prior GAO work on performance management demonstrates that successful programs incorporate such key management practices, and for several years, DOD reports and studies have also called for DOD to establish such practices for its biometrics activities. Similarly, a new presidential directive issued in June 2008 supports the establishment of these practices in addition to calling for a governmentwide framework for the sharing of biometrics data. DOD officials have said that DOD's focus has been on quickly fielding biometrics systems and maximizing existing systems to address immediate warfighting needs in Afghanistan and Iraq. This focus on responding to immediate warfighting needs and the absence of the essential management practices have contributed to operational inefficiencies in managing DOD's biometrics activities, such as DOD's difficulties in sharing biometrics data within and outside the department. For example, in May 2008 GAO recommended that DOD establish guidance specifying a standard set of biometrics data for collection during military operations in the field. These shortcomings may also impede DOD's implementation of the June 2008 presidential directive and the overall identity management operating concept.

Recommendations

Our recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Implemented" or "Not implemented" based on our follow up work.

Recommendations for Executive Action