From the U.S. Government Accountability Office, www.gao.gov Transcript for: : Federal Legacy IT Systems Description: Audio interview by GAO staff with Dave Powner, Director, Information Technology Related GAO Work: GAO-16-468: Information Technology: Federal Agencies Need to Address Aging Legacy Systems and GAO-16-696T: Information Technology: Federal Agencies Need to Address Aging Legacy Systems Released: May 2016 [ Background Music ] [ Narrator: ] Welcome to GAO's Watchdog Report, your source for news and information from the U.S. Government Accountability Office. It's May 2016. The federal government invests more than $80 billion annually on IT. Much of this money is spent operating and maintaining existing legacy systems. But how well is this money managed? And how old are some of these systems? Dave Powner, a director in GAO's Information Technology team, led a recent review to help answer just those sorts of questions. Jacques Arsenault sat down with Dave to talk about what they found. [ Jacques Arsenault: ] Can you give me a sense of how much the federal government spends on information technology? And where does that money go? [ Dave Powner: ] So the federal government, in any given year, spends annually about $80 billion on IT, and when you look at that $80 billion spent, 75 percent of that goes toward legacy systems, or what we call operations and maintenance. The remaining 25 goes towards new development. So roughly you have about 60 billion going towards the legacy side of the house and then 20 billion going towards new development. [ Jacques Arsenault: ] And so, what defines a legacy? Is that, you know, does that have to be 20 years old or is it something that's 5 years old? [ Dave Powner: ] So anything that's really in operations today that we're no longer developing, if it's in operational use or being used by the federal agencies that we call that O and M or legacy systems. [ Jacques Arsenault: ] Now you mentioned that 75 percent of that money is being spent on these legacy systems. What does that mean for the future of federal IT systems? [ Dave Powner: ] So the big story here, that we highlight this in our report extensively, is not only the 75/25, but if you trend that over time, over time we're spending more money on O and M and less on development. It's actually a worsening situation over time, so what that means is we're really not modernizing our systems at the pace we want the federal government. [ Jacques Arsenault: ] So that money is kind of tied up and can't really be used to move forward. [ Dave Powner: ] Exactly. I mean it's keeping the lights on. It's very critical functions to a lot of these legacy systems if you look at, like systems that process our tax returns.There's one of the systems we highlight, the National Weather Service Telecommunications Gateway, so a lot of these old legacy systems are directly tied to agency's mission and really, folks don't want to tweak those too much, because when you do it, end up swapping these out, typically it's a large data conversion effort, a lot of applications that need to get rewritten and that type of thing, so it's, it's really quite difficult to do. The other key factor here, too, is when you look at some of these large conversion efforts to swap out the legacy systems, CIO tenure in the federal government is only, on average, about 2 years, so when you have CIO's coming into the federal departments and agencies, do they really want to tackle these long problems. Typically they take the low-hanging fruit and don't tackle long complex legacy conversions. [ Jacques Arsenault: ] Well now, I have to ask about floppy disks because I have to reach all the way back to elementary school to remember using a floppy disk, but you found that there are federal systems currently in use that are using floppy disks. Can you tell me about some of the different systems that you looked at and what kind of hardware or software that they're using? [ Dave Powner: ] Yes. So what's interesting is we found systems that were upward of 50 years old, portions of those systems. There was a DOD system that was still using an 8-inch floppy disk to store information on it. Now, if you look at the storage on a floppy disk, you would need about 3 million floppy disks to equate to one average flash drive, so if you do that conversion, so that's how old some of this stuff is. Now DOD tells us they're in the process of replacing that storage medium, but we found some other systems, and the bottom line is with a lot of these old systems, they've got hardware and software that's no longer supported by vendors, so not only are they old and they're difficult and complex to maintain, but you also have security issues because you've got hardware and software that's no longer supported, and there are significant security vulnerabilities associated with these systems. [ Jacques Arsenault: ] The security definitely makes sense. And it sounds like there's also just a chance that they would break from being so old or -- [ Dave Powner: ] Yes. [ Jacques Arsenault: ] -- lose data or get warped or something. [ Dave Powner: ] Absolutely. And you have a human capital challenge when you look at COBAL and Assembly and FORTRAN programmers in the federal government. They're not easy to find, and a lot of these systems built are running on these old archaic languages. [ Jacques Arsenault: ] Now you made 16 recommendations in this report. Can you tell me a little bit about what are some of the higher priority ones? [ Dave Powner: ] Yes, so a couple key ones. There was a key recommendation to OMB. They actually have some draft guidance asking agencies to prioritize their oldest systems that are most in need of replacement. That guidance we think is very important, and then the agencies that we looked at where we identified these old legacy systems we actually said that they need to, one, prioritize their most important replacement efforts, and then put solid plans in place to actually get this done. IRS is a good example. They've done some good work there over the years that we have looked at several of our reviews where they—they’re trying to replace, get off the mainframes and go daily processing of tax returns and the like. They started that process, but we still have the individual master file, which is upwards of 50 years old, running at IRS, and we still don't have a firm date for that system to be decommissioned, so we need better plans in place to really tackle these things. [ Jacques Arsenault: ] So then finally, as it relates to security and sustainability of IT, what would you say is the bottom line of this report? [ Dave Powner: ] Well, I think the key is we spend too much on legacy systems compared to what we're spending on development. We need to kind of shift that trend a little bit, and the important thing is, what our report really does highlight is these things are old, difficult and expensive to maintain. They create security vulnerabilities, and we don't have enough plans in place to replace them moving forward. [ Background Music ] [Narrator:] To learn more, visit GAO.gov and be sure to tune in to the next episode of GAO's Watchdog Report for more from the congressional watchdog, the U.S. Government Accountability Office.