******************************************************** NOTICE ******************************************************** This document was converted from WordPerfect to ASCII Text format. Content from the original version of the document such as headers, footers, footnotes, endnotes, graphics, and page numbers will not show up in this text version. All text attributes such as bold, itallic, underlining, etc. from the original document will not show up in this text version. Features of the orginal document layout such as columns, tables, line and letter spacing, pagination, and margins will not be preserved in the text version. If you need the complete document, download the WordPerfect version. For information on downloading documents using File Transfer Protocol(FTP) see the file how2ftp in the following directory path: /pub/Bureaus/Miscellaneous/Public_Notices/ ***************************************************************** TABLE OF CONTENTS I. INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . 2 II. AUDITS . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 III. INVESTIGATIONS . . . . . . . . . . . . . . . . . . . . . . . . 7 IV. MANAGEMENT AND ADMINISTRATION. . . . . . . . . . . . . . . . . . 10 V. SPECIFIC REPORTING REQUIREMENTS OF SECTION 5(a) OF THE INSPECTOR GENERAL ACT . . . . . . . . . . . . . . . . . 12 ATTACHMENTS A. TABLE I: OIG AUDIT REPORTS WITH QUESTIONED COSTS. . . . . . . 15 B. TABLE II: OIG AUDIT REPORTS WITH RECOMMENDATIONS THAT FUNDS BE PUT TO BETTER USE. . . . . . . . . . . . . . . . 16 INTRODUCTION The Federal Communications Commission (FCC) is an independent regulatory agency exercising authority delegated to it by Congress under the Communications Act of 1934, as amended. The FCC is charged with regulating interstate and international communications by radio, television, wire, satellite and cable. The FCC's jurisdiction covers the fifty states, the District of Columbia, and U.S. possessions. The mandate of the FCC under the Communications Act is to make available to all people of the United States a rapid, efficient, nationwide, and worldwide wire and radio communication service. The FCC performs four major functions to fulfill this charge: spectrum allocation; creating rules to promote fair competition and protect consumers where required by market conditions; authorization of service; and enforcement. As of September, 1995, the FCC had 2,128 full-time equivalent employees (FTEs), most of whom are in Washington, D.C. space. FCC Field Offices are located throughout the United States. The Chairman and four additional Commissioners are appointed by the President and confirmed by the Senate. Reed E. Hundt has been the Chairman of the FCC since November 1993. The four Commissioners are James H. Quello, Andrew C. Barrett, Rachelle B. Chong, and Susan P. Ness. On August 17, 1995, in an effort to streamline the Commission, the Chairman proposed a field office restructuring plan that would result in the closure of nine attended frequency monitoring stations and three additional monitoring sites located at FCC field offices. The plan calls for the replacement of these stations with a national automated monitoring network whose network central station will be located at the existing Laurel/Columbia, Maryland facility. The plan also calls for the closure of nine of the 25 existing field offices as well as three of the six regional offices. Two technical staff members will continue to be assigned as resident agents in the nine locations in which field offices will be closed. Subsequent to the close of this reporting period, on October 13, 1995, the Commission voted 4-1 to support the planned organizational restructuring. Overall, authorized staffing within the effected Bureau, the Compliance & Information Bureau (CIB), will decrease by about one-third, from 384 to 254 positions as a result of the restructuring of field operations. The plan will be transmitted to the House and Senate Appropriations Committees for their approval. Upon approval the FCC will begin required negotiations with the Union representing the Commission's employees regarding the implementation and impact of the plan. The Office of Inspector General has dedicated itself to assisting the Commission as it continues to improve its efficiency and effectiveness. The Inspector General reports directly to the Chairman. The OIG is located in Room 752 in the FCC headquarters building at 1919 M Street, N.W., Washington, D.C. 20554. The Office of Inspector General (OIG) is staffed by the Inspector General and four staff members: three auditors and a staff assistant who serves as the hotline technician. H. Walker Feaster was appointed Acting Inspector General on November 14, 1994, and continues to serve in an acting capacity as of the date of this report. On May 25, 1995 the Commission issued a vacancy announcement for the Inspector General position. The vacancy announcement closed on June 23, 1995. Scheduling of interviews is currently underway. On May 6, 1995, Robert G. Andary, who served as the Counsel to the Inspector General and Director of Investigations for this office, accepted the position of Inspector General of the Federal Labor Relations Authority (FLRA). To date the OIG has not made a selection to replace Mr. Andary. Pending this personnel action, Paul Brachfeld has been designated as the Acting Director of Investigations while continuing in his ongoing capacity as the Director of Audits. This report includes the major accomplishments and general activities of the OIG during the period May 1, 1995, through September 30, 1995, in accordance with Section 5 of the Inspector General Act of 1978, as amended 5 U.S.C. App. 3,  5. AUDITS OVERVIEW One audit report was issued by the Inspector General during this reporting period. In other audit activity, OIG auditors dedicated a significant amount of hours towards performing survey work and subsequent audit fieldwork as relates to Fiscal Year (FY) 1994 Spectrum Auction implementation costs. In performing this complex audit, specific emphasis was placed on (1) examining the system implemented by the Commission to accumulate and report auction related accounting information; (2) validating the timeliness and accuracy of the information that was reported; and (3) identifying areas where improvements could be made. The audit staff projects that the final audit report will be issued in the latter part of November, 1995. During this reporting cycle, OIG auditors facilitated a meeting and subsequent working relationship between the Commission and the Financial Crimes Enforcement Network (FINCEN), Department of the Treasury. OIG representatives serving on a multi- Office/Bureau task force had become aware of the requirements placed on the FCC to perform investigative analysis pertaining to the spectrum auction program. Specifically responsibilities resided within the Commission to determine the validity of entities claiming to meet the definition of a small business or minority owned enterprise. Such prospective bidders could obtain favorable bidding and build-out terms from the Commission. The task force was exploring the mechanisms Commission staff could use in performing these investigations and the likely costs associated with accessing private data networks. OIG staff, who were aware of the unique capabilities of FINCEN and FINCEN's charter to assist Federal agencies in law enforcement related matters, contacted officials at FINCEN to lay the groundwork for a constructive and economical relationship between the FCC and FINCEN. Through the arrangement that was arrived at, FCC staff in the Wireless Telecommunications Bureau and Compliance & Information Bureau will be able to utilize FINCEN resources in order to access information to be used in investigating potential irregularities pertaining to spectrum auction bidders. OIG auditors also continued to assist management in its conversion to an off-the-shelf, widely used financial system, the Federal Financial System, which went on-line October 1, 1995. SIGNIFICANT AUDIT ACTIVITY 1. REPORT ON THE SPECIAL REVIEW: INTERNET PENETRATION ANALYSIS The report was issued May 17, 1995. As part of the on-going OIG effort to ensure protection of the Commissions information resources, this office performed an Internet penetration analysis. The objective of this analysis was to attempt to penetrate the internal Federal Communications Commission (FCC) network from an external source through the internet, identify any potential weaknesses in the system security infrastructure, and document the controls in place to prevent a successful penetration. During the review, auditors used readily available software tools to attempt the exploitation of known weaknesses in internet connections. Among the tools used in this off-site review was the Systems Administrator Tool for Analyzing Networks (SATAN). SATAN was developed as a security tool which systems administrators could use to identify particular vulnerabilities in their networks. However, once released into the public domain on April 7, 1995, SATAN became another tool which could be employed by hackers to attack systems. In general, the review identified that the Commission had established effective controls over access to the internal FCC network from external sources. These controls included the use of a firewall to manage data traffic, control over the use of potentially risky software utility products, and patches to commonly exploited software weaknesses. The auditors identified four areas where improvements in controls were recommended. These recommendations were documented in the Internet Penetration Report (OIG Report Number 95-3). Due to the sensitive information contained in this report which could be used in a manner inconsistent with the normal operations of the Commission, distribution of this report was restricted to persons on a need to know basis. Deployment of Computer Security Software- While performing the Internet Penetration Review, the auditors identified other areas of concern pertaining to internal network security. In order to assess the degree of risk, the auditors obtained a powerful software program specifically developed to assess the security configuration of file servers using Novell's Netware operating system. On June 19, 1995, this program was loaded onto a selected server containing sensitive FCC data. The application was designed to analyze six necessary elements of an effectively secured Novell file server as follow:  User account restrictions  Passwords  Access control  Systems monitoring  Data integrity  Data confidentiality Test results reflected weaknesses in the FCC's network security configuration. For example, network users were not required to use passwords of substantial length nor required to change their passwords on a reasonable periodic basis. In fact 2% of users did not have passwords and simply used a Guest login, while 33% of users had easily guessed passwords. The information provided by this report was used by the Commission's Computer Security Officer to support the implementation of a more robust security configuration. On September 20, 1995, the Commission implemented the new security configuration. Following implementation, testing was again conducted using the software product obtained by the OIG. Test results indicated an increase in the overall Novell security posture. Credit Card Program- In performing audit survey work related to a planned audit of FCC credit cards use, OIG auditors identified that the U.S. Postal Service had developed a software referred to as ISIS (Inspection Service IMPAC Scanner). This software, which is free to other government agencies, could be employed to more efficiently and effectively, analyze credit card transactions. Specifically, the software can track individual credit card transactions by merchant name, merchant city, date of transaction and dollar value or range of dollar values. Upon identifying this software and its capabilities, a determination was made to issue a memorandum to the Managing Director, notifying him of the existence of this tool and at the same time terminating further audit activity by this office. That Managing Director has initiated activity towards obtaining and subsequently employing the ISIS software. INVESTIGATIONS OVERVIEW Investigative matters pursued by this office are generally initiated as a result of complaints alleging fraud, waste, abuse, corruption or mismanagement by FCC employees, or affecting the programs or operations of the Commission. Upon receipt of a complaint which alleges an administrative or criminal violation, the OIG usually conducts a preliminary inquiry to determine if an investigation is warranted. Investigations may involve possible violations of regulations regarding employee responsibilities and conduct, Federal criminal law, and other regulations and statutes pertaining to the activities of Commission employees. Investigative findings may lead to criminal prosecution, civil prosecution, or administrative action. On August 1, 1995, the FCC OIG instituted a formal hotline. All FCC staff were notified of the establishment of the hotline and a Public Notice was issued by the Commission. The hotline number, 202-418-0473, is serviced by the Special Assistant to the Inspector General. INVESTIGATIVE ACTIVITY During this reporting period, OIG investigative activity focused on two major investigations, one of which remains in an open status at this date pending a determination on the part of the Justice Department. A brief synopsis of these investigations is presented below. Potential Violation of 18 U.S.C.  207 (a) (2) Status: Open On November 4, 1994, the OIG was made aware of a possible violation of the two-year post-employment restriction of 18 U.S.C.  207 (a) (2) by a former high level FCC employee. This matter was initially developed and forwarded on December 5, 1994, to the Public Integrity Section, Criminal Division, Department of Justice. During this reporting period, OIG investigative staff conducted detailed interviews with FCC and former FCC officials in order to obtain information pertinent to this investigative matter. The investigation remains in an open status as of the close of this reporting period. Potential Procurement Irregularities Pertaining to Spectrum Auctions Status: Closed In response to allegations received by the OIG, an investigation of procurement actions involving the FCC's Spectrum Auction Program was undertaken by this office. Specifically, the confidential allegation involved (1) the undertaking of improper contracting procedures by FCC employees and, (2) an attempt by an FCC contractor to direct additional contractual activity to the firm he was employed with. Results of our investigation found no basis to support the aforementioned allegations. However, in a memorandum to the Chief, Wireless Telecommunications Bureau (WTB) dated July 10, 1995, the Inspector General noted that during the investigation, OIG staff identified that an employee within WTB had provided an FCC contractor with access to her login and password to the FCC computer system on the date of his arrival to the FCC. Senior officials within WTB acted expeditiously to address this internal control weakness by meeting with the Computer Security Officer and educating the staff as to proper password control measures. The investigation has been formally closed. Other Investigative Issues OIG staff provided assistance and liaison to investigators from the Federal Deposit and Insurance Corporation (FDIC) during this reporting period. FDIC investigators requested assistance in obtaining Mass Media Bureau documents and conducting interviews pertinent to filings made at this Commission by individuals who were under investigation by the FDIC. OIG staff investigated an allegation that FCC employees received payoffs which resulted in their failure to properly investigate complaints directed against a radio station. OIG staff determined that the allegation lacked basis and the investigation was closed. OIG staff investigated allegations that an FCC employee was deliberately leaking information on pending FCC actions to an individual external to the Commission. In reviewing the allegation, this office determined that sufficient evidentiary matter did not exist to support further action on the part of this office. OIG staff provided assistance and documentation to the Superior Court of the District of Columbia, to be used in the prosecution of an individual who had previously filed a complaint with the OIG regarding the Mass Media Bureau's handling of an application for the transfer of a radio station. MANAGEMENT AND ADMINISTRATION H. Walker Feaster III was appointed Acting Inspector General on November 14, 1994, and continued to serve in that capacity during the reporting period. Mr. Feaster has served the Commission since 1974 in various positions within the Office of Managing Director and within the former Private Radio Bureau. Since 1990, he served as the Associate Managing Director for Program Analysis. In April 1995, the Counsel to the Inspector General and Director of Investigations, Robert Andary, accepted a position as Inspector General of the Federal Labor Relations Authority, effective May 8, 1995. Mr. Andary had served the OIG since May 1992. On August 11, 1995, the Acting Inspector General submitted the FY 1997 Budget Resource Request for the OIG. Office of Management and Budget (OMB) Circular A-11, Section 15.11 provides that "each agency designated to establish an Office of Inspector General in the Inspector General Act Amendments of 1988 will submit information on budget authority and FTE levels for PY through BY for its Office of Inspector General." In the OIG request to the Chairman, the office requested two additional positions over the current FTE level. The OIG presently has the same number of FTEs as existed in FY 1992 prior to the establishment of a new Bureau to address new mission requirements (most notably in the spectrum auction program), significant internal FCC automation initiatives, National Performance Review and the Government Performance Review Act activities and requirements. On August 29, 1995, the OIG was informed by the Managing Director that "the Chairman will be submitting a level staffing request for the entire Commission including the IG." On June 30, 1995, OIG staff presented a briefing to Compliance & Information Bureau (CIB) staff from around the country. The briefing was taped and will be provided to FCC staff throughout the country. The briefing focused on why the FCC has an OIG, the mission the OIG performs, and how the OIG can provide the FCC staff with unique audit and investigative tools and resources. During a free flowing question and answer period, OIG staff responded to questions and concerns, some which are unique to personnel serving in field locations. In the coming months, the OIG intends to offer similar sessions to other Bureaus and Offices within the FCC. During this reporting period, OIG auditors continued to work with management in the implementation of the new financial accounting system and have participated in ongoing training exercises. An OIG auditor attended a detailed on-site working session at the FCC's provider agency, the Bureau of Reclamation. SPECIFIC REPORTING REQUIREMENTS OF SECTION 5(a) OF THE INSPECTOR GENERAL ACT The following summarizes the Office of Inspector General response to the twelve specific reporting requirements set forth in Section 5(a) of the Inspector General Act of 1978, as amended. 1. A description of significant problems, abuses, and deficiencies relating to the administration of programs and operations of such establishment disclosed by such activities during the reporting period. No such problems, abuses, or deficiencies were disclosed during the reporting period. 2. A description of the recommendations for corrective action made by the Office during the reporting period with respect to significant problems, abuses, or deficiencies identified pursuant to paragraph (1). No recommendations were made. See the response to paragraph (1). 3. An identification of each significant recommendation described in previous semiannual reports on which corrective action has not been completed. No significant recommendations remain outstanding. 4. A summary of matters referred to prosecutive authorities and the prosecutions and convictions which have resulted. An investigation which was opened during the previous reporting period and referred to the U.S. Department of Justice pursuant to section 4(d) of the Inspector General Act remains in an open status. The investigation involves a potential violation of post-employment restriction of 18 U.S.C.  207 (a) (2). 5. A summary of each report made to the head of the establishment under section (6)(b)(2) during the reporting period. No report was made to the Chairman of the FCC under section (6)(b)(2) during the reporting period. 6. A listing, subdivided according to subject matter, of each audit report issued by the Office during the reporting period, and for each audit report, where applicable, the total dollar value of questioned costs (including a separate category for the dollar value of unsupported costs) and the dollar value of recommendations that funds be put to better use. Each audit report issued during the reporting period is listed according to subject matter and described in part III, above. 7. A summary of each particularly significant report. Each audit report issued during the reporting period is summarized in part III, above. 8. Statistical tables showing the total number of audit reports with questioned costs and the total dollar value of questioned costs. The required statistical table can be found at Attachment A to this report. 9. Statistical tables showing the total number of audit reports with recommendations that funds be put to better use and the dollar value of such recommendations. The required statistical table can be found at Attachment B to this report. 10. A summary of each audit report issued before the commencement of the reporting period for which no management decision has been made by the end of the reporting period (including the date and title of each such report), an explanation of the reasons such management decision has not been made, and a statement concerning the desired timetable for achieving a management decision on each such report. No management decisions fall within this category. 11. A description and explanation of the reasons for any significant revised management decision made during the reporting period. No management decisions fall within this category. 12. Information concerning any significant management decision with which the Inspector General is in disagreement. No management decisions fall within this category.