State Department Lags on Y2K

The General Accounting Office finds that the State Department is making progress in fixing its Y2K mess, but glitches could still disrupt diplomacy and let terrorists in. By Spencer E. Ante.

The US State Department is no longer deemed a worst offender, but it's still in the doghouse. That was the conclusion reached Friday by the General Accounting Office in a report that reviewed the department's progress in solving its Year 2000 computer problem.

"They've taken action to elevate the problem," said John De Ferrari, an assistant director of accounting and information management at the GAO, who helped author the four-month-long study. "The question is, what impact is that action going to have?"

A recent congressional report card had singled out the State Department -- an agency of the executive branch that handles relations with foreign countries -- as one of the government's worst performers in fixing Y2K glitches. Government watchdogs worry that the department's inability to fix its computer date issues could lead to visas being issued to terrorists, disruption of communication with US embassies, and hold-ups in passport processing.

In Friday's report, the GAO says the State Department has taken some positive steps. The department has increased awareness and is encouraging its far-flung bureaus to share information about how to fix Y2K problems.

On the downside, the GAO criticized the department for its inadequate contingency planning, for being slow to renovate its mission-critical systems, and for poorly managing the renovation of its system interfaces that link the department to a host of other federal agencies.

Most important, the GAO said that the State Department only recently began drawing up plans to ensure continuation of everyday operations in case there is a catastrophic failure.

In the absence of a "mission-based perspective," says the GAO, the State Department has no means of ranking individual bureaus' priorities, some of which may not be essential to its core mission.

"If you have a large bureaucracy, it tends to look at things in a stovepipe fashion," says De Ferrari. "But Y2K cannot be addressed in a piecemeal, bottom-up fashion."

The biggest worry is how the State Department's Consular Lookout and Security System (CLASS) would function past 31 December 1999. The US government relies heavily on CLASS to screen visa applicants for a criminal or terrorist background. Furthermore, the department's messaging systems, a critical element of diplomatic missions, could fail if telecommunications devices are not replaced or upgraded.

Fixing Y2K problems could be a nightmare. The State Department oversees 262 types of computer systems that contain about 35 million lines of code written in 17 programming languages. The department operates a network of information platforms at posts throughout the world, including 250 Wang VS minicomputers, 20,000 personal computers, and several hundred local area networks. The price tag for fixing these systems is US$153 million, according to a May 1998 quarterly report the State Department submitted to the Office of Management and Budget (OMB). However, the department is revising that figure up.

Of the 40 systems that it has identified as mission critical, it claims to have renovated 17 of them. But a May 1998 report found that five of the mission-critical systems reported to OMB as compliant were, in fact, not fixed.

What's more, the State Department is concentrating on fixing the non-urgent code first, instead of focusing its resources on the crucial systems, the GAO concluded.

In its defense, the State Department, which has generally accepted the findings of Friday's report, notes that it has already begun to respond to the concerns raised by the GAO. In April, for example, the department contracted auditor KPMG Peat Marwick LLP to work alongside State Department personnel and outside contractors.

Furthermore, the State Department claims to have identified its mission-critical business functions, but it doesn't plan to re-evaluate the 198 systems previously identified as non-mission-critical. Without applying this new mission-based perspective to all of its systems, the GAO predicts that the State Department's critical functions will be disrupted by the millennium bug.

"They've started to devote more energy to the Year 2000 but a lot of work needs to be done," warned De Ferrari.