United States Government Accountability Office Testimony Before the Subcommittee on Emergency Preparedness, Response, and Communications, Committee on Homeland Security, House of Representatives FIRSTNET For Release on Delivery Expected at 10:00 a.m. ET Thursday, October 12, 2017 Efforts to Establish the Public-Safety Broadband Network Statement of Mark L. Goldstein, Director, Physical Infrastructure Issues GAO-18-187T October 12, 2017 FIRSTNET Efforts to Establish the Public-Safety Broadband Network Highlights of GAO-18-187T, a testimony before the Subcommittee on Emergency Preparedness, Response, and Communications, Committee on Homeland Security, House of Representatives Why GAO Did This Study What GAO Found FirstNet is charged with establishing a In June 2017, GAO reported that the First Responder Network Authority nationwide public-safety broadband (FirstNet) had conducted key efforts to establish the network, namely releasing network that is reliable, secure, and the request for proposal (RFP) for the network and awarding the network interoperable. To inform this work, contract to AT&T. As the contractor, AT&T will be responsible for the overall FirstNet is consulting with a variety of design, development, production, operation, and evolution of the network. stakeholders. In March 2017, FirstNet Additionally, FirstNet consulted with state and local, federal, and tribal awarded a 25-year contract to AT&T to stakeholders. State officials GAO contacted were generally satisfied with build, operate, and maintain the FirstNet’s efforts to engage them. However, tribal stakeholders GAO contacted network. FirstNet’s oversight of AT&T’s expressed concern that FirstNet has not fully engaged in effective performance is important given the communication with tribes. FirstNet engaged tribes through a variety of scope of the network and the duration mechanisms, such as through state points of contact and a working group, but of the contract. tribes noted that individuals with first-hand knowledge of tribes’ experiences are unable to represent tribal views directly among FirstNet’s key decision makers. This testimony provides information on Although FirstNet is required to consult with tribes through state points of (1) FirstNet’s efforts to establish the contact, a key principle of effective tribal communication is to seek full network; (2) stakeholder views on understanding of tribal concerns and reach consensus where possible. By fully network reliability, security, and exploring and proposing actions to address tribal stakeholders’ concerns, interoperability challenges FirstNet FirstNet could help improve its relations with tribes and better meet stakeholders’ faces and its efforts to address them; and (3) FirstNet’s plans to oversee its needs. network contractor. This statement is According to stakeholders GAO contacted, FirstNet faces various challenges to based on GAO’s June 2017 report ensure the network’s reliability, security, and interoperability. For example, (GAO-17-569). For this report, GAO stakeholders raised concerns related to: reviewed FirstNet documentation, key contract oversight practices identified • providing coverage to rural areas, in buildings, or underground; in federal regulations and other • ensuring the network’s overall resiliency and cybersecurity; and sources, tribal communication • managing frameworks for user identity, credentialing of users, access practices identified by federal management, and prioritization of users on the network. agencies, and assessed FirstNet’s efforts and plans against these FirstNet has taken action to address these challenges, such as by opening a test practices. GAO also interviewed lab to test public safety devices and applications before deploying them on the FirstNet officials and a network. The majority of stakeholders GAO contacted were satisfied with nongeneralizable selection of public FirstNet’s efforts but many noted that much uncertainty remains about how the safety, tribal, and other stakeholders network will be implemented. selected to obtain a variety of FirstNet established offices to oversee its network contractor, developed policies viewpoints. and procedures to guide contract administration—including management and What GAO Recommended oversight—and is receiving assistance from another federal agency with contract administration experience, although FirstNet plans to assume full responsibility in In June 2017, GAO recommended that the future. For example, FirstNet established the Network Program Office to FirstNet fully explore tribal oversee the contractor’s performance and facilitate quality assurance of contract stakeholders’ concerns and assess its deliverables, among other things. Although this office will perform essential long-term staffing needs. FirstNet contract-administration functions, FirstNet had not conducted long-term agreed with GAO’s recommendations projections of staffing needs for the office as of April 2017. As a result, FirstNet and described actions to address lacks reasonable assurance that it will have sufficient resources to handle them. increases in its responsibilities over time. Planning for and assigning adequate resources, including people, and assessing resource needs is a key practice for View GAO-18-187T. For more information, planning and executing effective contract oversight. By performing a long-term contact Mark Goldstein at (202) 512-2834 or staffing assessment for the Network Program Office, FirstNet would be in a better goldsteinm@gao.gov. position to fully understand its staffing needs and respond to staffing changes and risks as it assumes full responsibility of contract administration in the future. United States Government Accountability Office Letter Letter Chairman Donovan, Ranking Member Payne, and Members of the Subcommittee: Thank you for the opportunity to discuss our June 2017 report on the First Responder Network Authority (FirstNet). 1 We have previously reported and testified on FirstNet, including most recently in a July 2017 hearing held by the Senate Committee on Commerce, Science, and Transportation’s Subcommittee on Communications, Technology, Innovation, and the Internet. 2 Whether conducting daily operations, overseeing planned events, or responding to emergencies, public safety officials—especially first responders such as police officers and firefighters—rely on communications systems to gather and share information and coordinate their efforts. However, first responders often have difficulty communicating with their counterparts in other agencies and jurisdictions because existing systems lack interoperability. The Middle Class Tax Relief and Job Creation Act of 2012 (the 2012 Act) created FirstNet and required it to establish a nationwide, interoperable public-safety broadband network (hereafter, the network)—setting aside spectrum for the network to operate on and providing FirstNet with $7 billion to fund the network’s initial build-out. 3 FirstNet must be self-funding beyond this initial $7 billion. Key to the network’s success, given its purpose, is its reliability, security, and interoperability. To inform its work, FirstNet must consult with state and local, federal, and tribal stakeholders. 4 Since 2012, FirstNet has completed a number of tasks to plan for the build-out of the network, the most significant of which was the issuance of a request for proposal to solicit proposals from private companies to build, operate, and maintain the network. From these 1 GAO, Public-Safety Broadband Network: FirstNet Has Made Progress Establishing the Network, but Should Address Stakeholder Concerns and Workforce Planning, GAO-17-569 (Washington, D.C.: June 20, 2017). 2 GAO, FirstNet: Efforts to Establish the Public-Safety Broadband Network, GAO-17-702T (Washington, D.C.: July 20, 2017). See also GAO, Public Safety Communications: Preliminary Information on FirstNet’s Efforts to Establish a Nationwide Broadband Network, GAO-15-380T (Washington, D.C.: Mar. 11, 2015); GAO, Public-Safety Broadband Network: FirstNet Should Strengthen Internal Controls and Evaluate Lessons Learned, GAO-15-407 (Washington, D.C.: Apr. 28, 2015). 3 Middle Class Tax Relief and Job Creation Act of 2012. Pub. L. No. 112-96, 126 Stat. 156 (2012). FirstNet is an independent authority within the Department of Commerce’s (Commerce) National Telecommunications and Information Administration (NTIA). 4 Pub. L. No. 112-96, § 6206(c)(2)(A), 126 Stat. at 213. Page 1 GAO-18-187T proposals, FirstNet selected AT&T as its network contractor and awarded it a multi-billion dollar, 25-year contract. Due to the size of the project and duration of the contract, the oversight mechanisms that FirstNet plans to use to monitor AT&T’s progress and performance in building, operating, and maintaining the network are important. My remarks today are based on our June 2017 report and like the report, addresses (1) FirstNet’s efforts to establish and finance the network; (2) stakeholder views on network reliability, security, and interoperability challenges FirstNet faces and its research and other efforts to address them; and (3) FirstNet’s plans to oversee the deployment of the network by its network contractor. In our report, we recommended that FirstNet fully explore tribal stakeholders’ concerns and assess its long-term staffing needs. FirstNet agreed with these recommendations and, in September 2017, reported to us on the actions it has taken to implement them. For our report, we reviewed the 2012 Act, FirstNet documentation, and documentation from other federal entities involved in FirstNet’s efforts, such as FirstNet’s key research partner, the Public Safety Communications Research (PSCR) program. 5 We compared FirstNet’s efforts to respond to tribal stakeholders’ concerns with the applicable key principle of effective tribal communication on federal infrastructure decisions developed by several federal agencies. 6 We assessed the PSCR’s and FirstNet’s research activities against our previously identified criteria on key phases of sound research programs. 7 We assessed FirstNet’s contract oversight plans against key acquisition and contract oversight practices and actions established in federal acquisition regulations, the Department of Commerce’s (Commerce) acquisition 5 The PSCR is a joint program between Commerce’s National Institute of Standards and Technology and NTIA. 6 U.S. Departments of the Interior, the Army, and Justice, Improving Tribal Consultation and Tribal Involvement in Federal Infrastructure Decisions (January 2017). 7 GAO, Employment and Training Administration: More Actions Needed to Improve Transparency and Accountability of Its Research Programs, GAO-11-285 (Washington, D.C.: Mar. 15, 2011). Page 2 GAO-18-187T manual, prior GAO reports, and other academic and industry sources. 8 We also interviewed FirstNet and Commerce officials. To obtain stakeholder views on all our objectives—particularly the challenges FirstNet faces—we selected and contacted 33 stakeholders, including public safety, state and local government, and tribal associations and organizations; the Department of Homeland Security, the Federal Communications Commission, and the National Institute of Standards and Technology (NIST) and the National Telecommunications and Information Administration; and state government and public safety officials. We selected these stakeholders to obtain a variety of viewpoints from a cross section of interests and geographic locations; their views are not generalizable. Further details on our scope and methodology are included in our report. The work on which this statement is based was conducted in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. In our June 2017 report, we found that FirstNet has conducted key efforts FirstNet’s Progress to establish the network, namely releasing the request for proposal for the Establishing and network in January 2016 and awarding the network contract to AT&T in March 2017. As the contractor, AT&T will be responsible for the overall Financing the design, development, production, operation, and evolution of the network, Network and as well as the marketing, product management, sales, distribution, and customer care. Further, we found that FirstNet has established a Consulting framework to meet the financial requirements established in the 2012 Act, Stakeholders as depicted in figure 1. This framework focuses on leveraging FirstNet’s 8 Commerce, Selecting Contract Types, Commerce Acquisition Manual, 1316.1, 6.3 (March 2016); GAO, Joint Information Environment: DOD Needs to Strengthen Governance and Management, GAO-16-593 (Washington, D.C.: July 14, 2016); GAO, National Science Foundation: Steps Taken to Improve Contracting Practices, but Opportunities Exist to Do More, GAO-13-292 (Washington, D.C.: Mar. 28, 2013); GAO, Information Technology Investment Management, A Framework for Assessing and Improving Process Maturity, GAO-04-394G (Washington, D.C.: Mar. 1, 2004); Software Engineering Institute/Carnegie Mellon, Capability Maturity ModeI® Integration (CMMI®) for Acquisition, Version 1.3, CMU/SEI-2010-TR-032 (Pittsburgh, PA: November 2010); Project Management Institute, Inc., The Standard for Program Management—Third Edition (Newtown Square, PA: 2013); Project Management Institute, Inc., A Guide to the Project Management Body of Knowledge (PMBOK® Guide)—Fifth Edition (Newtown Square, PA: 2013). PMBOK is a trademark of Project Management Institute, Inc. Page 3 GAO-18-187T spectrum through the use of payments and fees with the aim of ensuring that the network is financially sustainable over the life of the contract and that FirstNet sustains self-funding operations. Figure 1: First Responder Network Authority’s (FirstNet) Financial Framework a AT&T’s expected investment in the network includes its annual minimum payments to FirstNet. By establishing a single, dedicated network for public safety use, FirstNet’s network is expected to foster greater interoperability and meet public safety officials’ reliability and other needs. However, the actual use (or “adoption”) of the network by public safety users will be voluntary. Thus, even with the establishment of this framework, substantial unknowns remain regarding how many public safety users will adopt the Page 4 GAO-18-187T network, the extent to which AT&T will be successful in monetizing the spectrum to retain revenue from commercial users, and the extent to which this revenue will be sufficient or appropriate in relation to the capital needed to build, operate, and maintain the network. Therefore, we noted that, at the time of our report, we could not assess the viability of this framework and whether FirstNet’s structures for overseeing the contractor’s use of the spectrum for commercial users will be appropriate. We also found that FirstNet has made progress consulting with state and local, federal, and tribal stakeholders through a variety of mechanisms. State officials we contacted were generally satisfied with FirstNet’s efforts to engage them. However, tribal stakeholders we contacted expressed concern with FirstNet’s efforts to consult with tribes per the 2012 Act’s requirements. In particular, four of the five tribal organizations we contacted said that FirstNet has not fully engaged in effective communication or has relied on state points of contact too much as opposed to engaging directly with tribes; the other tribal organization was not aware of FirstNet or its mission at all. Further, tribes noted that individuals with first-hand knowledge of tribes’ experiences are not able to represent tribal views directly among FirstNet’s key decision makers. FirstNet has stated that, indeed, the 2012 Act requires that it consult with tribes through state points of contact. Nevertheless, several federal agencies have identified seeking a full understanding of tribal concerns— and reaching consensus where possible—as a key principle of effective tribal communication, noting that agencies should adapt to changing circumstances, contemplate creative problem solving, identify options for addressing concerns, and exhaust alternatives to achieve mutually agreeable solutions. 9 We concluded that, by fully exploring and proposing actions to address tribal stakeholders’ concerns, FirstNet could help improve its relations with tribes and better meet stakeholders’ needs. As such, we recommended in our report that FirstNet fully explore tribal concerns and propose actions, as needed, to address those concerns. FirstNet agreed with this recommendation and, in September 2017, described to us the actions it has taken to implement it. For example, according to FirstNet, in September 2017 it began a process to formally explore the tribal outreach concerns raised in our report and expects to propose improvements by 9 U.S. Departments of the Interior, the Army, and Justice, Improving Tribal Consultation and Tribal Involvement in Federal Infrastructure Decisions (January 2017). Page 5 GAO-18-187T the end of this year. FirstNet has also said that it adopted an organization-wide tribal consultation policy which it expects to take effect towards the end of this year. If implemented as planned, these actions should address the intent of the recommendation. In our report, we found that—according to stakeholders we contacted— FirstNet’s Network FirstNet faces various challenges to ensure the network’s reliability, Reliability, Security, security, and interoperability. For example, stakeholders raised concerns related to: and Interoperability Challenges and • providing network coverage to rural areas, in buildings, or underground; Efforts to Address • ensuring the network’s overall resiliency and cybersecurity; and Them • managing frameworks for user identity, credentialing of users, access management, and prioritization of users on the network. However, we also found that both FirstNet and the PSCR have begun research and other efforts to help ensure the reliability, security, and interoperability of the network and address the challenges raised by stakeholders. For example, in November 2016, FirstNet opened an Innovation and Test Lab at its technical headquarters in Boulder, Colorado. According to FirstNet documentation, FirstNet plans to use— and allow AT&T to use—the lab to test public safety devices and applications before deploying them on the network. Additionally, the PSCR has conducted research on behalf of FirstNet and, using $300 million in funds provided to NIST by the 2012 Act, is also planning for and implementing other research activities to support FirstNet. For instance, in January 2016, PSCR launched its Public Safety Innovation Accelerator Program to support these research activities, and in December 2016, NIST issued a funding announcement to fund research in several areas. At the time of our report, we found that PSCR’s research process generally aligned with key phases of sound research programs identified by leading national organizations, including the American Evaluation Association and the National Academy of Sciences. 10 For example, PSCR has established a structured process for developing research priorities that includes both internal and external stakeholders, and has identified criteria it uses to help it select the research areas to fund and 10 GAO-11-285. Page 6 GAO-18-187T procedures to help it guide and monitor its research. Similarly, FirstNet has determined its research priorities to date based on its network- planning needs and in consultation with internal and external stakeholders, and worked with the PSCR to define criteria to help it select research areas. Further, we found that the majority of stakeholders we contacted were satisfied with the planning efforts to ensure the reliability, security, and interoperability of the network. However, many stakeholders also said that there is much remaining uncertainty about how this will be implemented in practice. Additionally, one public safety official we contacted told us that FirstNet and its contractor will have to balance the costs associated with implementing features that make the network reliable and secure with the need to establish compelling and competitively priced service packages and fees that will encourage user adoption of the network. 11 Indeed, numerous stakeholders we contacted cited the cost of subscribing to the network as a key factor affecting user adoption, noting that the pricing must be comparable to what they pay for commercial service now, that budgets are constrained in the public safety community, or that local governments do not want costs to increase. Further, commercial carriers could choose to compete with FirstNet. FirstNet has stated that it expects AT&T to provide services at a competitive price and deliver affordable, high-quality services that will encourage public safety users to adopt the network. Ultimately—because the network must be self-funding and FirstNet has stated that revenue from network users will be critical to this funding—the success of the network depends on whether FirstNet and AT&T generate enough revenue to operate it over the long term and whether public safety users adopt it, no matter how reliable and secure it is. FirstNet must manage and oversee the implementation of the network FirstNet’s Contract contract to build, operate, and maintain the network. 12 Federal internal- Oversight control standards also state that an entity’s management retains responsibility for the performance of processes assigned to service Mechanisms 11 For additional discussion of factors that may affect user adoption, see GAO-15-407. 12 Pub. L. No. 112-96, § 6206 (b)(1)(D) 126 Stat. at 212. Page 7 GAO-18-187T organizations (such as contractors) and that management should hold these organizations accountable for their performance. 13 In our report, we found that FirstNet has taken a number of steps to establish contract oversight mechanisms, but has not fully assessed the staffing needs of its oversight workforce. FirstNet’s oversight mechanisms include developing policies and procedures to guide contract administration and establishing offices to oversee its network contractor. In particular, FirstNet established the Network Program Office to oversee the contractor’s performance and facilitate quality assurance of contract deliverables, among other things. FirstNet is also receiving assistance from the Department of the Interior, which has experience with contract administration, although FirstNet plans to assume full responsibility for contract administration in the future. We also found that FirstNet’s efforts to develop contract oversight mechanisms aligned with several key actions that we identified as contributing to effective contract oversight. However, although FirstNet’s Network Program Office will perform essential contract administration functions, FirstNet had not conducted long-term projections of staffing needs for the office as of April 2017. Planning for and assigning adequate resources, including people, and performing an assessment of the resources needed to oversee projects is one of the key actions we identified for planning and executing effective contract oversight. We concluded that FirstNet lacks reasonable assurance that it will have sufficient resources to handle increases in its responsibilities over time and that, by performing a long-term staffing assessment for the Network Program Office, FirstNet would be in a better position to fully understand its staffing needs and respond to staffing changes and risks as it assumes full responsibility of contract administration in the future. As such, we recommended in our report that FirstNet assess the long-term staffing needs in the Network Program Office prior to assuming full responsibility for administering the network contract. FirstNet agreed with this recommendation and, in September 2017, described the actions it has taken to implement it. According to FirstNet, in August 2017 the Network Program Office adopted a strategic workforce plan for fiscal years 2018 to 2022, which it expects to update annually. According to FirstNet, this plan provides a comprehensive view of current and future human capital 13 GAO, Standards for Internal Control in the Federal Government, GAO-14-704G (Washington, D.C.: September 2014). Page 8 GAO-18-187T needs required to support the implementation of the network and identifies strategies the office will employ to fill gaps between current and future needs, among other things. If implemented as planned, this action should address the intent of the recommendation. Chairman Donovan, Ranking Member Payne, and Members of the Subcommittee, this concludes my prepared statement. I would be pleased to respond to any questions that you may have at this time. If you or your staff have any questions about this testimony, please GAO Contact and contact Mark L. Goldstein, Director, Physical Infrastructure Issues at Staff (202) 512-2834 or goldsteinm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page Acknowledgments of this statement. GAO staff who made key contributions to this testimony are Sally Moino and Nalylee Padilla. Other staff who made contributions to the report cited in this testimony are identified in the source product. (102359) Page 9 GAO-18-187T This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. The Government Accountability Office, the audit, evaluation, and investigative GAO’s Mission arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability. The fastest and easiest way to obtain copies of GAO documents at no cost is Obtaining Copies of through GAO’s website (http://www.gao.gov). Each weekday afternoon, GAO GAO Reports and posts on its website newly released reports, testimony, and correspondence. To have GAO e-mail you a list of newly posted products, go to http://www.gao.gov Testimony and select “E-mail Updates.” Order by Phone The price of each GAO publication reflects GAO’s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO’s website, http://www.gao.gov/ordering.htm. Place orders by calling (202) 512-6000, toll free (866) 801-7077, or TDD (202) 512-2537. Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information. Connect with GAO on Facebook, Flickr, LinkedIn, Twitter, and YouTube. Connect with GAO Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts. Visit GAO on the web at www.gao.gov and read The Watchblog. Contact: To Report Fraud, Website: http://www.gao.gov/fraudnet/fraudnet.htm Waste, and Abuse in E-mail: fraudnet@gao.gov Federal Programs Automated answering system: (800) 424-5454 or (202) 512-7470 Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-4400, Congressional U.S. Government Accountability Office, 441 G Street NW, Room 7125, Relations Washington, DC 20548 Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800 Public Affairs U.S. Government Accountability Office, 441 G Street NW, Room 7149 Washington, DC 20548 James-Christian Blockwood, Managing Director, spel@gao.gov, (202) 512-4707 Strategic Planning and U.S. Government Accountability Office, 441 G Street NW, Room 7814, External Liaison Washington, DC 20548 Please Print on Recycled Paper.