The not-so-good news: unchecked foreigners did some of the critical work

Air Safety Week, Jan 10, 2000

Not 24 hours after this self-congratulatory press conference, the Federal Aviation Administration (FAA) was blasted for failing to ensure that background security checks were conducted on some of the foreign nationals who were doing the Y2K work. The slipshod security was documented in a Dec. 23, 1999 report by the General Accounting Office (GAO), the investigative arm of Congress. The oversight could have exposed critical air traffic systems to sabotage. For example, Chinese, Ethiopian, Irish and Ukrainian citizens worked on one traffic-flow management program. The GAO report generated a sharp letter from the chairman and the ranking minority member of the House Science Committee to Sandy Berger, the president's national security advisor. In their Jan. 4 missive, Reps. James Sensenbrenner (R, WI) and Ralph Hall (R, TX) asked for an "assessment of the risks to the FAA software and to the travelling public associated with the FAA's failure to follow its own security procedures by January 15, 2000."

Exposed

Extracts of the GAO report on computer security:

"...the fact that some foreign nationals did not undergo background searches have increased the risk that inappropriate individuals may have gained access to FAA's facilities, information or resources. As a result, the air traffic control system may be more susceptible to intrusion and malicious attacks."

"The Y2K computing challenge provides a vivid example of the need to protect critical systems...and their vulnerability to disruption."

Source: Computer Security: FAA Needs to Improve Controls Over Use of Foreign Nationals to Remediate and Review Software, GAO. For the full text of the report, go to the GAO's website, http://www.gao.gov/new.items/newtitle.htm, and scroll to report number AIMD-00-55.