INSPECTOR GENERAL

DEPARTMENT OF DEFENSE
4800 MARK CENTER DRIVE
ALEXANDRIA, VIRGINIA 22350-1500

February 19, 2020

Ref: DODOIG-2020-000516

SENT VIA EMAIL TO: john@greenewald.com

Mr. John Greenwald
The Black Vault
27305 W. Live Oak Road, Suite 1203
Castaic, CA 91384

Dear Mr. Greenwald:

This responds to your Freedom of Information Act (FOIA) request for a copy of report
05-INTEL-10, National Security Agency Data Call Submissions and Internal Control Processes
for Base Realignment and Closure 2005. We received your request on February 13, 2020, and
assigned it case number DODOIG-2020-000516.

The FOIA, Privacy, and Civil Liberties Office conducted a search and found the enclosed
record responsive to your request. We determined that the redacted portions are exempt from
release pursuant to 5 U.S.C. § 552 (b)(6), which pertains to information, the release of which
would constitute a clearly unwarranted invasion of personal privacy.

If you consider this an adverse determination, you may submit an appeal. Your appeal, if
any, must be postmarked within 90 days of the date of this letter. Since you have created an
account in FOIAonline, please log in to your account, retrieve your original request, and then
click on the “Create Appeal” tab in the left-hand column. FOIAonline will populate your request
and contact information automatically. In the “Basis for Appeal” box, provide your explanation,
attach supporting document (if necessary), click on preview, and then click on submit. Your
appeal will automatically be sent to our office via FOIAonline. For more information on
appellate matters and administrative appeal procedures, please refer to 32 C.F.R. Sec. 286.9(e)
and 286.11(a).

You may contact our FOIA Public Liaison at FOIAPublicLiaison@dodig.mil or by

calling 703-604-9785, for any further assistance with your request. Additionally, you may
contact the Office of Government Information Services (OGIS) at the National Archives and
Records Administration to inquire about the FOIA mediation services they offer. The contact
information for OGIS is as follows: Office of Government Information Services, National
Archives and Records Administration, 8601 Adelphi Road-OGIS, College Park, Maryland
20740-6001, e-mail at ogis@nara.gov; telephone at 202-741-5770; toll free at 1-877-684-6448;
or facsimile at 202-741-5769. However, OGIS does not have the authority to mediate requests
made under the Privacy Act of 1974 (request to access one’s own records).
 February 19, 2020
Ref. DODOIG-2020-000516

If you have any questions regarding this matter, please contact this office at 703-604-
9775 or via email to foiarequests@dodig.mil.

Sincerely,

Barbara Gonzalez
Division Chief
FOIA, Privacy and Civil Liberties Office

Enclosure(s):
As stated

2
Thi
sdocumenti
smadeavail
abl
ethrought
hedeclassi
fi
cat
ionef
for
ts
andr
esear
chofJohnGreenewal
d,Jr
.,cr
eatorof
:

T
heB
lac
kVa
ult
TheBlackVaultist
helargestonli
neFreedom ofI
nfor
mationAct(FOIA)
documentcl
ear i
nghouseintheworld.Theresearcheff
ort
shereare
responsi
blef
orthedec l
assi
fi
cati
onofhundredsofthousandsofpages
releasedbytheU. S.Government&Mi l
it
ary
.

Di
scovert
heTr
uthat
:ht
tp:
//
www.
thebl
ackvaul
t.com
 .'

POR OPPICIAL USB ONLY

;,
Report No. OS-INTEL-IO I
May 13,2005 '.
infrastructure and Environment

DEPARTMENT OF DEFENSE
OFFICE OF INSPECTOR GENERAL

, '" , -' .,

DEPUTY INSPECTOR GENERAL FOR INTELLIGENCE

National Security Agency Data Call Submissions

and Internal Control Processes for Base
..... ". Realignment and Closure 2005
. ' "
',..
.., ,, .. -
' ~
'.

SPEQIAL WAR"iII'lG I
'...:.~-~~~ .~. :~. : ." '-<~ ~,~~~:." <....
BRAe '~MI~d Itptlll! fI'~ 6.~mptfi lI!"' ~m~ jjlld~. UcJitJlI ,~(b) (5J , tit~ 5, f:}lIi~d&tI1~~ Cn.k, " F. u .tnlll (}j
hif(Ji IIIf1titJn Jtct," find 8tJB' BiI ed;~~ 5f(}(J,'1, ,!'lJ:tjB F'~mlll offiiJ~ 'lIll1ti"" Jtct Pttlg. 11111, ' . Stpten,bel f99{j
~ .'
-- t·
i
I'IiXeihpOOil
., h"'iI~tib -5, pUiag' ap"'e3i'lJ
. . . . .. ':.. -# ," ,.~.•4 • ~. ' "
I;. .;. ~'.'
' . , ... ~ ...
,(
&>

- .
.
...,-
_ .....
~ .

.,
, ...
.fjIe.? Aftly .'6, 2(}9S;. ~ ~J1 ~II"",e 8eut!fflrjl (!fBefollHpHbf.ielj roekr.Je!I ~~ ;OU6HI",e,,{IMH}II~ fo;o ef83Hroe (I' fWlUglllnellt, \ '.'
tfli!J rtp{n'l i!J "6 fflltpf' eteHtpt /f'fJHI rtltMe . . .. I I

, . POR OPPICIAL USE ONLY \1 I

~.-. . .,.-.",."
. " . .
'~
.
,'
',.. '
 Additional Copies

To obtain additional copies of thi s ,.ennr, cm,!.,,! (b)(6)

(b)(6)
(703) 664_(b)(6) ) (b)(6) (b)(6)
(b)(6)
(DSN6

Suggestions for Future Audits

To suggest ideas for or to request future audits or evaluations of Defense

intelligence issues, contact the Office of the Deputy Inspector General for
Intelligence at (703) 604-8800 (DSN 664-8800) or fax (703) 604-0045.
Ideas and requests can also be mailed to:

Office of the Deputy Inspector General for Intelligence

Department of Defense Inspector General
400 Army Navy Drive (Room 703)
Arlington, VA 22202-4704

DfPARIUeU l OF DEfEnSE
To report fraud, wasle, mismanagement, and abuse of authority.
hn
I IV !ine Send wrht.n complaint. to: D.f.nse Hotline. Th. Pentagon. Washington. IX 20301 ·1900
Phone: 800.424.9098 . ·mall: hotllne@dodlg.osd.mlllWlW.dodlg.mllfhotline

I,,
I,
I

Ii
I
I
!
i

A,:rouyms

BRAC Base Realignment and Closure

COBRA Cost of Base Realignment Actions
DoD OIG DoD Office oflnspector General
lep Internal Control Plan
JCSG Joint Cross-Service Group
NSA National Security Agency
OSD Office of the Secretary of Defen se

~. \'"''
(b)(6) (b)(6) (b)(6) (b)(6)
(b)(6) (b)(6)
 FOR OFFICIAL USE ONLY
BRAG /'ekl!efi l'8p81'ffl 8/'e C3tel'l1p!jr8Mf l'Crettge ','Ile/el ' !JeetifJlI 552 fbi (5), Vllileel 8181(;9 Cruit!,
"l'I'C8fffl17' djhrfor mttlitjJJ Act, " (:/lid £fflD Di, t!c1;9{; 5499. 7, " DoD Pi atiom of/Him mario" Ad
P.regl'BHI, "Seplt',,;bel' 1998 (&templiem Nt.mbel' 5, ",'I.'tlt/tlp;' C3.2. I,5).

Department of Defense Office of Inspector General

Report No. 05-INTEL-IO May 13,2005
(Project No. D2004.D1NTEL.Q073 ,OOO)

National Secu rity Agency Data Call Submission s

and Internal Control Processes for Base
Realignment and Closure 2005

Execut.ive Summary

Who Should Read This Report and Why? Office of the Secretary of Defense
personnel responsible for deciding the realignment or cl osure of military installations
based on the Base Realignment and Closure (BRAC) data calls and National Security
Agency management personnel should read this rep0l1. The report discusses the va lidity,
integrity, and supporting documentation of the data provided by the National Security
Agency to assist the Secretary of Defense in BRAe 2005 recommendation s.

Background. BRAC 2005 is the formal process outlined in Public Law 10 1-510, \,
\ ,,
"Defen se Base Closure and Rea lignment Act of 1990," as amended, under which the
Secretary of Defense may realign or close mi litary insta ll ations inside the United States
and its territories. As part of BRAe 2005. the Under Secretary of Defense for
Acquisition. Technology, and Log istics issued, "Transformation Through Base
Realignment and Closure (BRAC 2005) Policy Memorandum One-Policy,
Respon sibilities, and Procedu res," April 16, 2003, which stated that the DoD Office of
Inspector General would review the accuracy of BRAC data and the certification process.

The BRAC 2005 process was mandated for the United States and its territories and was
divided into the following data call s - capacity analys is, supplemental capacity, Military
value. Cost of Base Realignment Actions, Joint Process Action Team Criterion Number
7, and scenari o specific. The Intelli gence agencies' co llection process was divided into
the fo llowing data calls - capacity ana lysis, Mi litary va lue, and scenario speci fic. We
iss ued site memorandums for the capac ity analysis data call and Mi litary value data call
to summarize the results of the site visits. Thi s report summarizes the data ca lls as of
April 2005, fo r the National Security Agency BRAe 2005 process.

The National Security Agency. located in Fort Meade, Mary land. is America 's
·crypto logic organ ization, it coordinates, directs, and perfonns highly special ized
activities to protect the United States information systems and produce fore ign
intelligence information. The Nationa l Security Agency was requ ired to perform only the
capacity analysis. Military value, and scenario specific data calls.

Results. We eva luated the validity, integrity, and supporting documentation of

BRAC 2005 data calls that the Nationa l Security Agency submitted for the capacity

FOR OFFlClAL USE ONLY

BRAG relBted l'epaJ·{.9 sre e,¥:emptji'8111 /'elease wIele" seet;all 552 fb) (5), U"iJet18h,teJ CtJek,
" Pl'eeciam8jJ,-,foIwle.'i8f1 Aet, " 8ml DeD Dilo.eefhe 54(}(}. 7, " DaD FlutJ.am &jbrfm m0'1;1'" Act
ll"ag"9'tl
lry i " /I St'p'e
~"" '~ be-1' '998 (Me'Ii-p';9I'I
i h H r "'1f8e·'
TV" , 5' i'J8"t1gI'ttf"1
I' r C3 . 2 . 1! .5)•
 FOR OFFICIAL USE ONLY
llRAC rel-aleB repe"!!; ere €j(e~lIpt:freH1 rv:f.e8:'J€ wrtkr !leefi(j/l 552 fbj (5), UlI,fed SMej Code,
" Fhefikw ~:l!tlftm"81i9H Acf, " (JI/f/ [)eD Di,'€ctivt! 5U}9. 7, "£ffl9 Freet/"," ~brfo, IIIl:1lioll Act
Prwg1'8Mr... Sep1elfrbe,. 1998 (Exel'lf'lifm MilI/hel 5, pol agl arM C3.1.1.5).

ana lysis, Military value, and scenario specific data ca lls. The Nationa l Security Agency
BRAe 2005 data collection was generally not fully supported. The National Security
Agency collected and submitted responses to 17 question s during the capacity analysis
data call, 7 of which were partially supported and 2 unsupported. The National Security
Agency co llected and subm itted responses to II questions du ring the Military value data
call, 8 of which were partially supported. We also reviewed the National Security
Agency compliance with the Office of the Secretary of Defense and National Security
Agency internal control plans. The Nat ional Security Agency interna l contro l plan
properl y incorporaled and supplemented the Office of the Secretary of Defense internal
control plan. However, the data collection processes generally did not comply with the
National Security Agency and Office of the Secretary of Defense interna l control plans.
Policies, procedures and management of the data collection were not fol lowed.
Responses were not celtified as accurate and complete by responders and nondi sclosure
agreements were not signed and maintained. In addition, several BRAC 2005 documents
used to SUppOit responses were not marked with the appropriate warnings in both the
header and footer, and data collection requirements were not followed. The lack of
adequate sUPpolting documentation for the capacity analysis. Military value, scenario
specific data ca ll s and identified noncompliances with the internal contro l plans cou ld
impact the re li ab ility and integrity of data that the National Security Agency provided for
the BRAe 2005 analysis.

Management Comments. Although no comments were required, the National Security

Agency generally agreed with the overall report. However, regarding the problems
identified, Nat ional Security Agency stated that th is was the first time that intelligence
functions were included in BRAe and there was a steep learning curve. Specifically.
they agreed that BRAe documents were not properly marked and that some question
were not fu lly suppOited. However, the Nat iona l Security Agency disagreed with the
tone of the repOlt, and felt that that no additional support ing documentation cou ld have
bcen provided. In add ition, Nat ional Security Agency felt that all nondisclosure
agreements and cCI1ifications were signed by individuals involved in the BRAe process.
See the Finding section of the repOit for a di scussion of management comments and the
Management Comments section for the complete text of the com ments.

Audit Response, We agree with the National Security Agency that the BRAe 2005
process was new to the Inte lli gence Community. However, the Office of the Secretary of
Defense and the Nationa l Security Agency internal control procedures were not being
followed which resulted in pol icies, procedures and management of the data collection
not being effectivc ly implemented and executed.

We played a pro-active role with the National Security Agency prior to validating the
data calls. We visited the Nat ional Security Agency prior to our validation of data to
discuss, and give cxamples of adequate supporting documentation for each question.
During our validation of the data calls, we recognized that some data was not available;
however, we identified instances were additional supporting documcntation, detailed
methodo logies or amendments to data could have fully supported some National Security
Agency responses. During numerous visits and discuss ions with management little or no
additional documentation was provided.

II

FOR OFFICIAL USE ONLY

BRAG l'elttle6l1'epfJ/'f3 al'e €:JH!IIIfJ'fiVJ1I1 l'eHta3e IHl8t!:'.YeicNth! 552 fbJ (5), Ulli{(;d6rul(;j Code,
" Ji)'ee6Hmr sfMfol'H/6#ifm Aef, "amiDe£) Dil'eeJi~e 5 ~(}(). 7, "0ttD Fr'tt:dfJ>lI tt}/,r,fo. 111(;1'''011 Ae'
h' 1 y ~~If',
... "f' , .L
uep.ell'iDef' y'998/r:'· " mil/fa(;l
p:..~lIrp"611 . , I . "Y, pal (;It. CtJ''', G'iI
~ .. t•.J).
~
 FOR OFFICIAL USE ONLY
BRAG ,'e18tetil'l!p61'f!J tI/'t! f:1temprfi'Mll'e/e(l!/e ~"tk; seelit;J11 552 (bJ (5), UIIUed 8ffliu C(l(h.
"FI eecJrj", &jJ1tfol'N'{Y:(;(J/I Aet, " cmti D6D Di/'t! cli~e 54()(}, 7, "D{;JD Fr eaM", &jlltfo. IIPtltitm At:r
A 6glWfII, "September /998 (Exempti(M f/t,,,,bel 5, pdf~, ttph 03,2. l ,S).

If as stated by National Security Agency. that all nondisclosure agreements and

certification statements have been signed; we are pleased with the correct ive action
taken. However, during oll r validation, we identified and National Security Agency
stated that severa l individua ls who had knowledge of the BRAe process did not sign
nondisclosure agreements. In addition , individuals with substantial involvement in the
preparation and submissions of in formation did not provide celtification statements at
their level as required in the Nationa l Security Agency internal control plan. The lack of
adequate oversight, noncompliance with the internal contro l plan written by National
Security Agency, and the lack of adequate supporting documentation are the basis for
or
questioning the reliability and integrity the data.

'" USE ONLY

FOR OFFICIAL
BIMC l'cf.e{c6l1'€IH:H'M ttl Catcmp:fi CJlIl'el-easC ImdCl' " eeN(;" 552 (h) (5) , Viii/cd iTftiJc., Cuk;,
"N'CctffillP lYf11tfom!tHi(;1I Act, " unrJ DtJD Dil ceN pC 5499, 7, "D(;D FI t!ukm! t}fJttfo, lIla/ioJ! lfd
P'l'eglw;", " 8epo't!lIIht!I' 1998 (&C//lp!i(;t! Nw"btl 5. pdl ttgl ctph eJ.2.1.5).
 FOil OFFICIAL USE ONLY
Blb4C I'td'l':ll'eti 1'q'J(j I'fj ClI'i! aCHlpo'jl'fJlI! 1'e!e(HC h/lclel' 3ec,'iB" 552 fIif (5), Utrile<i OMIts Ctltle,
"FradtM f).lllt/EH l/I(ffi(J1I Act, " tiI"ti DtJD Dil'eco'i'l>'t: 5 49fJ 1Z; " DtJD FI"Ceoffl111 fl/fltj'l'/ IHdfi(J1I Act
P, ~t1I11, .. &p1cNlbcl' 1998 (&C HlpN('l1t Numbel' 5, pal ttgf aph 03.2. i ,5).

Table of Contents

Executive Summary

Background

Objectives 3

Finding
National Security Agency Base Realignment and Closure 2005 Data Call
Submiss ions and Internal Control Processes 4

Appendixes
A. Scope and Methodology 9
Prior Coverage II
B. BRAe 2005 Data Ca ll Questions Not Fully Supported 12
C. Report Distribution 15

Management Comments
Director. Nati onal Security Agency t7

~':

.r
,:.". f'
.I,

,,

FOR OFFICIAL USE ONLY

BRAG related J"ffjJfJl'fS €Ire exernprfi'€ffll r-cka!/c !llptje/' see(itm 552 fh) (5), U"UetlSJtlfcs CfNk,
" Frve6H:J,'," o/f.njrm'H81i8H Ac:, " 81'1(/ DfJEJ !),'/,eelille 5 ~(}(}. 7, "DB!) PJ'eefflm' ttfFltfol ",,,tiM Acl
p"Nlgl'-8H1 , "September 1998 (&e~Hl'li"" ,¥t;mbe;" 5, p(;I'etg1V1ph C3.2.1 .5).
 FOR OFFICIAL USE ONL Y
BIMC I eldleti I'f"/Jojl'fs (1re tBtCJllptji'(mr ;'€lt!tt.vc tmrJCI' .Yceli(m 552 fb) (5), Ullifefl8ttttc!J CtJth,
"FI'cefielll ojfn,l-ol\'1ratiBIP AC1, " 9>,,61 DaD Dil'eeti~e 51{}(). 7, "DBD F ..<eecl811f &jJltjoJ'IIIr!lfiBIl Act
n·.~'tf·1I
1 4. , " 8eple'''~w'
. 1'998 ( . i i i i"I"tribe
(E'ltn'P"8 Th, " 5, "
P " ''tIgtwp/1
, C3.2. 1
! 5)
..

Background
Base Realignment and Closure 2005. Public Law I 0 I-5 10, "Defense Base
Closure and Realignment Act of 1990," as amended, establ ishes the procedure s
under which the Secretary of Defense may realign or close military insta ll at ions
inside the United States and its territories. The law authorizes the establishment
of an independent Commission to review the Secretary of Defense
recommendations for realigning and closing military installations. The Secretary
of Defense established and chartered the Infrastructure Executive Council and the
Infrastructure Steering Group as the Base Realignment and Closure (BRAC) 2005
deliberative bodies responsible for leadership. direction, and guidance. The
Secretary of Defense must subm it BRAC recommendations to the independent
Commission by May 16,2005.

Joint Cross-Service Groups. A primary objective of BRAC 2005, in addition to

realigning base structure, is to examine and implement opportunities for greater
joint activity . The Office of the Secretary of Defense (OSO) established seven
Joint Cross-Service Groups (JCSG) - Education and Training, Headqual1ers and
Support Activities, lndustrial,lntelligence, Medical, Supply and Storage, and
Technical to address issues that are common business-oriented support functions ,
examine functions in the context of facilities, and develop realignment and
closure recommendations based on force structure plans of the Armed Forces and
on selection criteria. To analyze the issues, each JCSG developed data call
questions to obtain information about the functi ons that they reviewed.

BRAC Data Calls. The BRAC 2005 data collection process was mandated for
the United States and its territories. The collection process was divided into the
following data calls - capacity analysis, supplemental capacity, Military value,
Cost of Base Realignment Actions (COBRA), Joint Process Action Team
Criterion Number 7 and scenario specific. The supp lemental capacity analysis,
Military va lue, COBRA, and Joint Process Action Team Criterion Number 7 data
calls are collectively known as the second data call. The Services, Defense
agencies, and Defense-wide Organizations used either automated data collection
tools or a manual process to co ll ect data call responses. Each data call had a
specific purpose as follows.

• The capac ity analysis data call gathered data on infrastructure, current
workload, surge requirements, and maximum capacity.

• The'supp lemental capacity data call clarified inconsistent data

gathered during the initial capacity analysis data call.

• The Military value data call gathered data on mission requirements,

survivability, land and facilities, mobilization, and contingency.

1
FOR OFFICIAL USE ONLY
BRAG i'cffl:ed repfHffl al'e etemptfiv;)IIr loc!edse rmdCl' scc{iem 552 fbi (5), United Stufes CtH}e,
"Preetia/II 8jlnfol'HI.-ttiBII Act, " cmti DBD m, eclitlc 5 1M. 7, "DBD Fi ud6m 8jlnfol """ioll Act
fJ.regI'ClNl, " &p~fflIBel' 1998 (Excmp#8/II¥,q.mBcl' 5, pa,'9gJ'aph 03.2. .'.5). ," .
- '\", tf .

',.: i
.{
\ ,,
\
 • The COBRA data call gathered data to devclop costs, savings, and
payback (formcrly known as return on investment) of proposed
realignment and closure action.

• 111c Joint Process Action Team Criterion Number 7 data call gathered
data to assess the community's abil ity to support additional forces,
missions, and personnel associatcd with individual scenarios. 1

• The scenario spec ifi c data ca ll qucstions gathered data relatcd to

specific scenario conditions for realignment or closure.

BRAC Intelligence Agencies' nata Ca lls. The Intelligence agencies' collection

process was divided into the fo llow ing data calls - capacity analysis, Military
value, and scenario specific. TIle scenario specific data ca ll included COBRA
data. 111e Joi nt Process Action Team collected the data for Criterion Number 7,
which the Intelligence JCSG used to develop its scenario specific data calls. The
National Geospatial-Intelligence Agency was the on ly intelligence agency
required to collect its own data for Criterion Number 7. The Intelligence agencies
used a manual process to collect data call responses.

DoD Office of Insp ector General Responsibility. The Under Secretary of

Defense for Acquisition, Technology, and Logistics ' memorandum,
"Transfonnation Through Base Realignment and Closure (BRAC 2005) Policy
Memorandum One-Policy, Responsibilities, and Procedures," Apri l 16,2003,
requircd the DoD Office of Inspector General (000 OIG) to provide advice and
review the accuracy of BRAC data and the ccrtification process. This report
summarizes iss ues related to the National Sccu rity Agency (NSA) BRAC 2005
process.

Internal Control Plans. Before the BRAC data call s were released to the
Service and Defense age ncies, OSD required thc Se rvices and the DeFense
agenc ies to prepare internal control plans (ICPs) tbat incorporated and
supplemented the OSD ICP. The OSD ICP was issued in the "Transfo nnation
Through Base Real ignment and Closure (BRAC 2005) Policy Memorandum
One--Policy, Responsibilities, and Procedures." The NSA prepared "National
Security Agency 2005 Base Realignme nt and Closure (BRAC) Internal Control
Plan (lCP)" on February 4, 2004, to comply with the OSD requirement.

NSA. The NSA, located in Fort Meade, Maryland, is America's cryptologic

organizati on, it coord inates, directs, and performs highly specialized activities to
protect the United States information systems and produce foreign intelligcnce

, A scenario is a description of one or more potential closure or realignment actions identified for formal
Imalysis by either a JCSG or a Military Department.

2
FOR OFFlCML USE ONLY
BRAG refilled reparl-S fir'S exemptjfflm l'ele{t!Je M(;Jer seelifJII 552 (bj (5), Vlrired St(;tte~ Cork,
"Jlresdem fJj!-r,foI'UI8§iBII Ae§, "(:m« DBD Di/v:eli'lle 5ffJfJ. T; "DoD I'i·eet!o/ll ofbrfm motion Ad
Pr9gI'9Hf, " SeptemBer "998 (lYxeHtp.'i81t ,"fflmhe-;' 5, pttl'tlf!;/aph 03.2 .... 5).
 FOR OFFICIAL USE ONLY
BRAG l'e!etefi I'£P81'(fJ til"€; f!j(;Ullpt;{t'fm'l l'ele9!Je UNdel' .geeNeN 552 (hJ (5), Uni,'ed &,'9105 Cefie,
"F, ttt/om tJjbtjtJIlllMiall Aer, " (mel DaD Di, ee:;~e 5 f()(). 7, " D8D y/,eufflm 9jf.Jtj8lwwii8" Acf
p., 8gt (li/I, " 8epf-eNlbel' 1998 (&temptiBII AAtmhcl' 5, f*JI 'W'6ph GJ.2.1.5).

information. The NSA was required to submit data for the capacity analysis,
Mi litary va lue, and scenario specific data calls . .

Objectives
The overall objective of the audit was to evaluate the valid ity, integrity, and
supporting documentation of data that the NSA collected and submitted for the
BRAC 2005 process. [n addition, we evaluated whether the NSA complied with
the OSD and NSA [CPs. This report is one in a series on data integrity and
internal control processes for BRAC 2005. See Appendix A for a discuss ion of
the scope and methodology and prior coverage related to the audit objectjv~s.

3
FOR OFFICIAL USE ONLY
BRAG I'defe« ''e,''8,'f!J are ~eNlp.'fi'6'" l'eleMe ,tilde}' !Jee/ieff 552 fhj (5), Ulli,'ed 8f.cNe!J Ol'1ck,
" Fl'eed-('JIII ftjfJlfom,a.'i811 Acl, " and DttIJ DiI'£cii'tt! 5 ~()(J. 7, " D8D FI'eeolam ftjl"fimliafitJIl Act
1"''6gI'flIll, '' Sej#t:lllbel' 1998 (&temp{iBII Nl:mrbel 5, pa/'B-gI\tph 03.2.1.5) .
 FOR OFFICIAL USE ONLY
DRAG r6klled t8fi8tts are ae1ftfjo'fi'6111 ;'e(edje Iil/tltl jee1iOll 552 (bj (5), &;;iied&Uie3 Cude.
r.
" F""9f I9W @j!r.fo~·HI8ti8H "el, " (!HId DaD Di, uti'tt: 5/99. "BoB P, eeu'clii vfhrfVl molioli Ad
P"9gl'illII, " S6pteRfher 1998 (!&emfJNtm .\4.mee,' 5, J'dltlg. tlph 0 .2. 1.5).

National Security Agency Base

Realignment and Closure 2005 Data CaU
Submissions and Internal
Control Processes
The responses provided by NSA for the BRA e 2005 data ca lls were
genera lly not fully supported. The NSA collected and submitted
responses to 17 questio ns during the capacity analysis data call, 7 of
which were partially sUPP0l1ed and 2 unsupported . The NSA co llected
and su bmitted responses to J I questions during the Military value data
call, 8 of whic h were pattially su pP0l1cd. T his occ urred because the N SA
provided inconsistent and inadequate supporting documentation.

The data collecti on processes for the capac ity ana lysis, Military value, and
scenario specific data ca ll s generally did not comply with applicable (CPs
as follows.

• Policies, procedures and management of the data co llection

were not fo llowed.

• Indiv idual s with substa ntial in volvement in the preparatio n and

submiss ions of info rmatio n did no t prov ided certification
statements.

• Nondisclosure agreements were not sig ned and ma intained.

• BRA C documents were not marked properly .

• Data co llection requireme nts were not foll owed.

The lack of adequate suppo rting docu me ntatio n for the capacity analysis,
Military value, scenario specific data calls, and identified no ncompliances
with the lCPs could impact the re li ability and integrity o f data that NSA
provided for the BRAC 2005 analysis.

NSA BRAC 2005 Data Call Submissions

The BRAe 2005 data call responses provided by the NSA [or the capacity
ana lysis, Military value, and scenario specific data ca lls were gene ra lly not fu lly
supported. The NSA headquarters forwarded all data call questions a nd co llec ted
the supporting documentation for each of its s ites. We eva luated the validity and
4
FOR OFFICIAb USE ONLY
D~4C "(JUr'f¥1 "8/3S"I-I; 8"S &L" 'Ip' j:f8111 uc'efI!Je I'ml€" sce"eJ'l 55:2 4J7 /5)
• • '.dJ • J W 'J /. \ / (/ i ! 1 , UIII"aJ8', .... ........ (7J
v .... ",

" li'reei<!.e,Y/ ejlr/arllltlti8n Ac(, " a"t/lJ8D Di/'eeN'It! 5 ffJf).~ "eda n eedvili v/btjo.liJuliolJ Acr
J'r9gft;,m, " S-ep'e~hel' 1998 (ae"/'f3.'';8,. Hlm,be,' 5, ~,\ig, tifJN 03.2. 1.5).
 FOR OFFICIAL USIO ONLY
BRAG l'el9lM r<epf:Jf'ffl 81'e fiY:8mptj,.,:mt l'ele8fJe f#rge " !JeetitJlf 552 (b) (5), Ull ileri Sktfe!J 0Jtie,
"p,.eet'km 6jJ1t/tJ1'IIlCi;Jtm Ael, " (m« DfJD Oil eeti-pt: 5 4 {)(}, r; "DoD PI e:r:dtJm afhifVi malioll Ad
P1<&g1'ffflI, " Sep:-emhel' 1998 (EJeelHp{itnl ",,,,,,bet' 5, peH'r':tf;, tiP" C3.2.1.5).

integrity of the supportin g documentation at the NSA headquarters. Specifi ca lly,

for the capacity analysis, Mil itary value, and scenario specific data ca ll s, we
compared responses to supporting documentation. As we identifi ed problems
with data submjssions, we worked w ith management to correct the data.

Capacity Analysis Data Call. T he NSA co llected and respond ed to 17 questions

for the capacity analysis data cali, 7 of which were partially supported and
2 unsupported. T he NSA identifi ed 16 of 17 questions that appl ied to its office.
We concluded that questions I, 2, 4, 6, 9, 10, and 11 were supported, questions 7,
8, 12, 13, 14, 15, and 17 palt ially supp0I1ed, and questions 3 and 5 were
unsupported (see Appendi x B fo r details on those questions) . In addition, we
reviewed the one question that NSA determined was "Not Applicab le" and agreed
with the NSA conclus ion. Based on our review and discuss ions with NSA
management, we recorruTIended that NSA prov ided additional supporting
documentation and methodology to correct the issues. However, NSA
management stated that no additional supporting documentation would be
prov ided.

Militar y Va lue Data Call. The NSA collected and responded to I I questions for
the Military va lue data calls, 8 of which were partially supported. The Mil itary
value data call consisted of 11 questions with multi ple parts; if one segment of the
question was not supported, the overall question would be partia lly SUppOited.
We rel ied on the agency responses when they answered "no," "zero," and
" unknown" to applicable quest ions because all BRAe data were cert ified as
accurate and complete to the best o f the celtifiers knowledge and belief. We
concluded that questions 23, 25, and 28 were supported and questions 18 thro ugh
22, 24,26, and 27 were part ially supported (see Appendix B fo r detai ls on those
questions). Based on our review and discussions with NSA management, we
recommended that NSA prov ided additional supporting documentation and
methodology to correct the issues. However, NSA management stated that no
additional su pporting documentation would be provided.

Sce na rio Specific Data Ca ll. The NSA scenario data call prov ided inadequate
supporting documentation to va lidate the responses. We reviewed onc scenario
speci fi c data caU at NSA; each scenario contained 9 screens (Tables of data). We
eva luated the responses and supporting documentation at NSA and identifi ed 2 of
the 9 screens that lacked reasonable supporting documentation and methodology
that would allow us to reconsttuct the cost and contractor responses. Based on
our rev iew and discussions with NSA management, we recommended that NSA
provided additional s upporting documentation and methodo logy to correct the
issues. However, NSA management stated that no add itional supporting
doc umentation would be provided.

5
FOR OFFICIAL USIO ONLY
DRAG I'sl6rted rep9>"11i 81'e e:Jte>"lrplfi'8H' reletffje foIIltle,. see{i(jj! 552 (h) (5), United 81(j (es Cad!:,
"F reed9>w o/h",fOI'Hl8fi8H 046'1, " tutti DeD Dil't!t!tive 54f)(}.1; "D6D F1 u:ti"JII rlj'btjm mofi611 A d
Pr9gf'9HI," $efHel-HgeP 1998 (Exe/'flpti!9/t NUo·,.,eel' 5, p61'8f;loeph 0 .2.1.5).
 FOR OFFICIAL USE ONLY
DRAG /'fJI8!e6lI'ep8/'f.8 sire t!:*etltpl:ft'91H Ivd-etiSl ti"tIt; suN"" 552 (b) (5), U nited SM ej Code.
"/Lrssr,Hnll 9jlnjol'Hf8!iBJf Aef, " 6H'I6I OeD Di, ee,:'e $ !66.1; "DaD FJ eed"lII vfhJfo, Illation Ael
Pt9g1'QHI) " Sepl6JlIge·r 199-8 (E:teltfpNBIl Mil/tbe" $, ptfl tfgl't1pN 0 .2. ; .5).

Internal Control Processes

The NSA generally did not comply with the NSA ICP during the capacity
ana lysis, Military value, and scenario specific data call s. We evaluated whether
the NSA fCP properly incorporated and supplcmented the OSD ICP and
determined that it properly incorporated and su ppl emented the OSD ICP. We
evaluatcd the NSA compliance with the NSA ICP for all BRAe data call s.
Specifica lly, wc eva luated whether sites co mpleted nondisclosure agreements and
properly collected, marked, safeguarded, certified and maintained BRAC data.

Completeness of ICP. The NSA BRAC 2005 fCP provides a unifonn set of
contro ls designed to prov ide accountabil ity information and ana lys is used in the
BRAC 2005 process. The NSA ICP establishes organ izational respons ibilities
that ensure the accuracy and completeness of data collection, ana lyses, and
control mechanisms to safeguard the BRAC information. Specifically, the NSA
ICP provides gu idance on the responsibilities ofNSA orga nizations, and direction
on documentation requirements to address responses.

Compliance with [CPs. The NSA dal'a collection and certification processes fo r
the capac ity analys is, Military value, and scenario specific data calls genera lly did
not comply with the NSA and OSD ICPs policies, procedures, and management
of data collect ion. The NSA ICP identified key ro les and responsibilities to be
carried out by the Alternate BRAC Representative, which included exercising
oversight and authority for implementation and adherence to the NSA ICP. The
NSA did not designate the Alternate BRAC Representative; as a result, the NSA
ICP was not effectively implemented and executed during the capacity analysis,
Military value, and scenario specific data call s. Also. ind ividuals with substantial
invo lvement in the preparation and submi ssions of information did not provide
certification sta tements.

During the capacity analys is and scenario speci fi c data calls some nondisclosure
agreements were not signed and maintained with the master file. BRAC
documents used to support answers wc re not properly marked in the header or
footer with the "Del iberative Document - For Discussion Purposes Only - Do
Not Re lease Under FOIA." In addition, requirements listed in the NSA (CP.
"NSA Data Co llect ion Plan," which included listing the sources of data, methods
of collection, and titles of individuals who co llected the data were not included
with the responses.

Conclusion
The responses provided by NSA for the BRAe 2005 data calls were genera lly not
fully supp0l1ed. The NSA collected and submitted responses to 17 questions
6
FOR OFFICMb USE ONLY
IJRAG ref.a{ed 1'I:;'fJ6I'1!J tII'C e.' Wltplji Bill' efetur: rmJei sat;..", 552 fb) (5), Uili/ed Stutes Code,
"Pl'ee6iem e.fln/8I'1tftKi6" .fe,', " (jilt! DBD DiI,t:t:Ii~c 5,(66.7, "DoD Fi e:edt111l t"{[hrjUlmatioIJ Act
Pregr6N1, " &epf.el1lbcl' 1998 (E:~eNtfHi(m AAilllbcl' $, tKI/\tgl Clpl! OJ.2.}. 5).
 FOR OFFICIAL USE ONLY
BlMe ,·tdtH-eell'ep(jI'/a .11 e cJremptji'dlll "t:(-e£13C wIdeI' SCC,'i8!1 552 (bJ (5), U"i:-ed Ot{;jf(;s CB'*',
"Fl'eed81ff 8fht/m 11ft/IiBff Act. " fflld D8D Di"cc.'iw: SI(}{). 7, "lJtjD Freet/8m Q/hrfiJl'17'(;ItieJ/J Act
JlJoegl'fll7l, " 8epfe",bcl' J998 f&tH'rp.'i81f l¥!Hfl8CI' 5, fJ~'{tt;l't1pJt 0.2. J.5).

during the capacity ana lysis data ca ll , 7 of which were part ially sUPIX>rted and
2 unsupported, The NSA coll ected and submitted responses to 11 questi ons
during the Military value data call , 8 of which were partially supported. The data
collection processes for the capacity analysis, Military value, and scenario
specific data calls generally did not comply with applicable ICPs. During the
capac ity analysis, Military value, and scenario specific data calls we identified
noncompliances with the OSD and NSA ICPs.

We discussed ollr findings with NSA management after each data ca ll. NSA
management concurred with the findings, but stated that no additional supporting
documentation would be provided.

We believe that the lack of adequate supporting documentation fol' the data calls
and identified noncompliances with ICPs could impact the reliability and integrity
of data that NSA provided for the BRAC 2005 analysis.

Management Comments and Audit Response

NSA Comments, The Director, NSA generally agreed with the overa ll report.
However, regarding the problems identified, NSA stated that this was the first
time that intelligence functions were included in BRAC and there was a steep
learning curve. Specifically, NSA agreed that BRAC documents were not
properly marked and that some question were not fu lly supported. However, the
NSA disagreed with the tone of thc report, and fe lt that that no additional
supporting documentation could have been provided. In addition, NSA stated
that all nondisclosure agreements and certifications statements were signed by all
individual s involved in the BRAe process.

Audit Response. We agree with the NSA that the BRAC 2005 process was new
to the Inte lligence Commun ity. However, the OSD and the NSA internal control
procedures were not being followed which resulted in po licies, procedures and
management of the data collection not being effectively implemented and
executed.

The DoD OIG played a prowactive role with the NSA prior to validating the data
calls. We visited the NSA prior to our va lidation of data to discuss, and give
examples of adequate supporting documentation for each question . During our
validation of the data calls, we recognized that some data was not available;
however, we identified instances were add itional supporting documentation,
detailed methodologies or amendments to data could have fully supported some
NSA responses. During numerous visits and discuss ions with management little
or no additiona l documentation was provided .

7
FOn OFFICIAL USE ONLY
BH:AC /'eltited l'eptjl fj are ~el1rpffi'dI1' /'el-et4:1t: Ii'llci-t1 Jeclit1ll 552 fb) (5), (hlitcd Statu Code,
"Freedom ojltr/(J/'/'HfJliott Ac~, " and DoD Directive 5 ~()(). 7, "DoD FI't!Ctffll1P ofhrfm /'IId/im' Act
Pi'6gl'tlm," 8eplenlbcl' /998 (E)(t!"rp{-jtm Ntll1Pbel' 5, ptlltW"ttf'h C3.2.1.5).
 FOil OFFICIAL USE ONLY
DRAG i'8klllMi rSfJ8rta are BeHtfJ'}10fJ", /"e!-e89t: Mf6h!1' Jc:c:ti"" 552 (b) (5), Uilded Stafe3 Code,
"r;:,'fl9d9M4 9f/':fimNilNsll AeJ, .. ami DBD Di~'ee{j'N! 5499.11; "{)(}D P, u(/n", ofhrfVJ mulio,. Ad
Pr9gnolf, " i)qJ.·eo'/fBe~ 1998 (&emptimr l'IlIIlIlw 5, pdl ltg. t1J'" CJ.2.) .5).

If as stated by NSA , that all nondisclosure agreements and certification statements

have becn signed ; we are pleased with the corrective action taken. However,
during OllT validation. we identified and NSA stated that several individuals who
had knowledge of the BRAe process did not s ign nondisclosure agreements. In
addition, individuals with substantial involvement in the preparation and
su bmi ss ions of information did not provide certification statements at their level
as required in the NSA Ie? The lack of adequate oversight, noncompliance with
the inte rnal control plan written by NSA, and the lack of adequate supporting
documentation are the basis fOl' questioning the reliability and integrity of the
data,

8
FOR OFFICIAL USE ONLY
II/MG 1'8[-811;'61 l'epf)f{!J are ~e'il'tp!fi'fJH' l'ete81Jt! untkl' !1eefitm 552 ~ (5), Unifed 5ttl~~3 C()d~,
r.
"[i:l'ee€"I81T'1 e/lr/8IWf6lt.i8J4 .461, " and DaD D;l'cclJ'YI;' 5 fee. "{)(JD FJ'f!t!dO/lf tifl1tfo, mali()lj Ad
llt'fJt:l'flHf, " SefJ."eIllBel' /998 (&emplidif /'h""",, 5, f'tt16gJ ttpf1 S.l. J.5).
 FOR OFFICIAL USE ONLY
8J'bfC J (;{tJled I t:pC>1 f"J m (! ext! II tpt jt C>1II It;/!d~e blick, !Jeetitm 55} (bj (5), UlliJed S1atea (Jrjrie,
" P, eet/(jl1f Off.,.tftH~IJ(jli(HI AeI, " f1I1S Dc>D Di,.ective H(}{). 7, "DoD FI"eef:/tJl'tf e/J1rfo,..""tltifflt Aet
P/'(J!t"fHll, " Se[Nember /998 (Exemp(-joll Nwllhe~ 5, fKll'tWoapH C:U.l.5).

Appendix A. Scope and Methodology

We evaluated the va lidity and integrity of all data call respo nses and the
associated supporting documentation ofNSA BRAe 2005 data. Specifically, we
performed the foll owing audit steps during the capacity analysis, Military value,
and scenario speci fic data calls.

• Interviewed the personnel responsible for preparing and certify ing the
respon ses to the data ca ll s.

• Reviewed all data ca ll responses and associated supporting

documentation.

• Compared the adequacy of responses to the supporting documentation.

• Reviewed «Not Applicable" question responses to determine whether

they were reasonable.

• Reviewed the NSA ICP to detennine whether the NSA incorporated

and supplemented the OSD ICP and established and implemented
procedures and processes to dissem inate, coil ect, safeguard, and
maintain supporting documcntation. In addition, we reviewed whether
the NSA des ignated the appropriate personnel to certify that data and
information coil ected were accurate and complete to the best of the
certifier's knowledge and belief.

• Relied on Military value responses when they answered "no," "zero,"

o r "unknown" to appl icable questions because all BRAC data were
certified by the Director, NSA as accurate and complete.

• Reviewed NSA 's responses to the combined scenari o HSA-0099.

• Worked with management to correct identified problems to data call

responses.

We could not validate that the NSA was consistent in reporting all sites during the
capacity analys is data ca ll . Also, because of time constraints, we validated only
the NSA COBRA and scenari o data calls for potential cand idate
recommendations that were approved by the Infrastructure Steering Group.

Capacity Analysis Data Call. The NSA headquarters received the capacity
analysis data call questions 1 through 17 from the Intelligence JCSG. NSA
headquarters then forwarded all questions to each of its sites and co llected
supporting documentation and responses at NSA headq uarters. Al l su pporting
9
FOR OFFICIAL USE ON'..,Y
BRAG , t;{ttfed , t:pdl I~ Cf, e eJee",ptfi dill I duue hilde, $ec.'i(jll 552 fhJ (5), United h"'tIt f~ Odele,
"Fi"eedm/l fJjllrfol'lIItitiml Act, "tllla DoD Dil'eetit'e 54()().7, " DoD Fl'eedoM! ojfnfiJI'lntl.'ioll Ac,
PI'BgI'tIm, "8eptembt:l· 1998 (Exempfim l Nttmhcr 5, ptll'ttgl'tlph 0.2.1.5).
 FOR OFFICIAL USE OI'l'LY
BRAG !'eIRte6lrepfJl'11; ere c*,t!""ptji'fmf I'ek(Y.Je ,meltl ~ee(i"jl 552 fbj (5), Unj(edSlares Code,
eflr.jor'H'lHtifJl'I • let, " a/ttl IJ6D Dl,.ee{ive 5 tf)(}. 7, " DoD {A, eed<"1II ofh(o; /ilafion Act
" p:,'88«fJ'll
PY9gr8H'l. " ~te;"BeJ' 1998 (&empNtJlf Nt.mbel 5, IX'll d8' tip}, 0 .2. f .5).

documentation was maintained at headqual1ers for vaJidation. We reviewed all

data call questions and responses at NSA headquarters for accuracy , appropriate
markings, and adequacy. We issued one capacity analys is site memorandum to
summarize the site visit resu lts . Specifically, we rev iewed the following
responses and supporting documentation.

Capacity Analysis Data Call Q uestio ns Reviewed

Ouest ion Number

NSA Site Answered Not Appl icable
NSA headquarters 1-1 5 and 17 16

Military Value Data Call, The NSA headq uarters received Mil itary value data
caB questions 18 through 28 rrom the Intelligence JCSGs. Most Mil itary value
questions had multiple parts. The NSA then rorwarded all questions to each of its
sites and co llected supporting documentation and responses at NSA headquarters.
All supporting documentation was maintained at headquarters for va lidation. We
reviewed the data ca ll questions and responses at NSA headquarters for accuracy,
appropriate markings, and adequacy for each site. We issued one Military va lue
site memorandum to summarize the site visit results.

Scena r io Specific Data Call. NSA headquarters received scenario and COBRA
data call questions from the Intell igence JCSGs. Specifica lly, we reviewed one
scenario specific data call for NSA. We reviewed the data call responses at NSA
headquarters for reasonableness and supporting documentation. Specifica lly. we
rev iewed NSA responses to the combined scenario HSA-0099.

We performed this audit from February 2004, through Apri l 2005 , in accordance
with generally accepted government auditing standards.

Reliability of Computer-Processed Data. We did not test the accuracy of the

computer-processed data used to support an answer to a data call question.
Potential inaccuracies in the data could affect the results. However, all BRAC
data were certified as accurate and complete to the best orthe certi fier's
know ledge and belief.

Governm ent Accountability Office High-Risk Areas. The Government

Accountability Office ha s identified several high-risk areas in DoD. Th is repOlt
provides coverage of the DoD Support Infrastructure Ma nagement and Federal
Real Property high-risk areas.

10
FOR OFFICIAL USE ONLY
BRAG "eltaed 1'81'6,"16 6M'e &eNlfltfi'61t1 1'elefH1e lllltie, !JeetitJlI 552 (b) (5), Ullift!tl8fth'(;J CtJde,
"Freedeltl 6/htjonllfilitJl1 Aet, " tnl" DtJD Dil't'etiwt 54fJf).7, "DoD F/ (;etWm ofh./UI illt:li'i(>'llfd
Pr6gr9M, "Se-p$eHie81' [998 (ExemptifJlI N·tHfIBel" 5, pfllttgl 01'" C3.2. 1.5).
 FOR OFFICIAL USE ONLY
RlMe I·t:.fflft:.t/ l'tpfH'fj tire ~erllfJ(fi'8l11 1'ef.e9fJe INltlel' seetielt 552 fh) (57, CAirtet/ BMes G6t1e,
"N eftffllfl .'tjhpfo1'ttT6h'iBI1 Ael, " tll1ci DeD Dil'eefi'tf? J 4(}(}.;z, "D8D Fl'eetfflm 9J4I1fm'Hltl1iel1 Ae,'
l'1f1g> {1m," &p:t:illhtl' 1998 (ExelltpH8IT Ntunlm 5, fJBIY3IfJI'tlph C3.2.1 .5).

Management Control Program Review

We did not review the NSA management control program because its provisions
did not apply to the one-time data collection process; however, we evaluated the
NSA internal controls for preparing, submitting, documenting, and safeguarding
information associated with the BRAC 2005 data calls, as directed by the OSD
and NSA rcps, to determine whether the NSA complied with the ICPs .
Specifically, we eva luated the procedures that NSA used to develop, submit, and
document its data call responses, Internal controls were generally inadequate as
they applied to the audit objective (see the Finding section for additional detai ls).

Prior Coverage
During the last 5 years, the 000 010 issued 2 site memorandums discussing the
NSA BRAe 2005 data call submissions and internal control processes,

Site Memorandums

00010 Memorandum, "Audit on the Military Value Data Call Submission from
all National Security Agency Sites to the National Security Agency Headquarters
for Base Realignment and Closure 2005," March 3, 2005

000 IG Memorandum, "Audit on the Capacity Analysis Data Ca ll Submission

from Nationa l Security Agency Headquarters for Base Realignment and
Closure 2005 ," September 2 1,2004

II
FOR OFFICIAL USE ONLY
BRAC l'et-ateti repel\'§ tll'e eteHlptfi'6f/1 l'el-eCY.Je I.Heler seefien JJ2 (b) (5), Uniletl GJale§ Cede,
"Frea/en' vjbtjtH'IlIaliell Ac!, " anti OeD Dil'ecfiye 54(}(}. 1; " OeD FI'€etl8/J1 o:/lnfonlT(}fiBII ,fef
PI'9f#'tI/1I, " ~fe/llbel 1998 (E,\'elllp!;(J>I M.l/lbel J, pe!,ttglwph 0 .2.1.5).
 FOR OFFICIAL USE ONLY
IJRAC fl'eH~!e61 r ep9rt9 81'e €*emptfivmr ;vde(Jse ""del ;u:cJitJII 552 (hi (5), U,,;/edSh,le3 Code,

Appendix B. BRAC 2005 Data Call Questions Not

Fully Supported
Capacity Analysis Data Call. For the capacity ana lysis data ca ll, NSA prov ided
data that were generall y not fully supP0l1ed. We identifi ed responses during the
capacity analysis data call that did not provide adequate supporting
documentation or completely answer the BRAe question.

• The response to question number 3 was unsupported. The questions

required the NSA to provide personnel by subfunction and attri bute.
The NSA did not provide adequate methodologies to track
documentation to the responses. The NSA did not provide
documentation to validate contracting personnel. In add ition, the
responses NSA provided did not agree with the doc umentation
provided.

• The response to question number 5 was unsupported. The question

required the NSA to provide authorized personne l at the Pentagon by
subfunction and attribute. The NSA prov ided a summary sheet,
without supporting documentation to support the answers prov ided. In
add ition, the responses NSA provided did not agree with the
documentation prov ided.

• The response to question 7 was parti ally suppol1ed . The question

required work years for management activities by building. The NSA
provided the responses in total by locat ion.

• The response to questi on 8 was partially supported. The question

required accountin g and fin ance transactions by bu il ding. The NSA
prov ided the responses in total by locat ion.

• The response to question 12 was partially supported. The question

requi red the number of personnel serviced by Headq uarters Human
Resources by bui lding. The NSA provided the responses in tolal by
location.

• The response to question 13 was partially supported. The question

required the NSA to provided new hire processing information. The
NSA did not provide complete supporting documentation to supp0l1
, responses to applicants hired and resumes received.
I ,

\,I
12
FOR OFFICIAL USE ONLY
-.... BRAG rehlted /'ep8 /'f{J ere ~e:;rptfi dill "td-efflJ€ IfmJel'lJet:t;tJ/I 552 fh) (5), Ui/ired Stules Code,
"Frct'6i6111 6j1; tj3 I'11wfhm ,leI, " till" J)"D Di, eeJi'Pt! 54()(). 7, "DoD Pi eedlhil vfhifVi marion Acl
PI'8gl'6»t, " &p,'eHlhel' 1998 (&empfit'lll NttI"bC:;i 5, pol t'lgltlph C3.2.I.S).
 FOR OFFICIAL USE ONLY
B/Me I'elated 1'f:tJ8/,ffl tHY! ffltempt pam I't!.1.e8!J€ Hlrde/' seeHtJ1l 552 fb) (5), U"i.W 8Mt~ (;(;de,
"FI'1!t:6ffl/l/ ojJ"jal'llltlliell Act, " {filii DeD D;Ioeetive 5 4{){}. 7; "lJ6D Fl'eetffltfl ajlnftJl'tl18ti81' Aet
Pi Btl a>ll, "September /998 (EUlI/pU8" Ntlillbel 5, P8/'tlKI'ttf'11 C3.2.1.5).

• The response to question 14 was partially supported. The question

required the NSA to provided training and education information. The
NSA did not provide supporting documentation for sevcra llocatiolls.

• T he response to question 15 was partially supported. The question

required the NSA to provide student training cou nts and completions.
The NSA did not provide supporting documentation to support
e-learning population.

• The response to question 17 was partially supported. The question

required the NSA to list projected student population totals fo r
FY 2004 through FY 2009 by building. The NSA did not respond to
the BRAe question by location.

Military Value Data Call. For the Military value data call, NSA provided data
that were genera lly not fully supported. We identified responses during the
Military Value data call that did not provide adeq uate supporting documentation
or completely answer the BRAe question.

• T he response to question18 was partially supported. The question

required the NSA to document the facility capabi lities. The NSA did
not provide adequate supporti ng documentation to support parking
space counts. The NSA did not provide complete documentation to
support generator power usage.

• The response to question 19 was partially supported. The question

required the NSA to list the faci lity conditi on. The NSA did not
provide documentation to support several NSA buildings.

• The response to question 20 was partially supported. The question

required the NSA to provide responses to survivab ility and force
protection responses. Several NSA locations did not provide
supporting documentation to support responses. In addition, the NSA
did not provide adequate methodologies to track documentation to the
responses.

• The response to question 21 was partially supported. The question

required the NSA to identify the type of specialized equipment at each
building. The NSA provided supporting documentation based on
physical observation only and not verifiable data. Also, the NSA did
not provide supporting documentation for several locations.

• The response to question 22 was partially supported. The question

required the NSA to report sensitive compartmented intelligence
facility space. The NSA did not provide adequate and reasonable

13
FOR OFFICIAL USE ONLY
RIM G I'elate« /'tpfJJ«:J al'e ew;lIrptfi'fJtI' I'cf.t:tfflt ~dldt:,· :Jee/i"" 552 fh) (5), U."ilt!d OMkJ C"tk:,
"Fl'eetfflm ttl/lifo/·tI'fH/f)" Act, " and Df)D D;,'ut;.'e 5499.;; "DtJ D FI uddlf! (tfhrftJl "'(lfi"f! At:I
J2fflgi'8ffl, " Sepletll8el" J998 (E~ctllfJtilm NI:NUbcl' 5, pm'tlK''tIph 03.2.1.5).
 FOR OFFICIAL USE ONLY
llR,,4G ret!#ed fep6/'t!J til'S e:rempt}Vj,,, ,'elf!(t:U! tlitd-e,' "aHem 552 {Ii} (5), UnitEd StuteJ Code,
.. Freed6"., 9j!r:j'GM19Ii81'1 Act, " "me lJ6D DireeliYe 5496, ~ "0.,0 PI um,m ofh1f;; marion Ad
!Q'8g1'6/'H, " SerJ,el'lf8eJ' 1998 (Exen'plitJll M1ll lbt:1 5, ptll t:lg'l t:lph C3. 2. " ,5).

documentation to support responses. The NSA prov ided accreditation

letters generated during our review.

• The response to question 24 was partially supported . The question

requil'ed the NSA to identi fy the type of continuity of operations
planning al each building. No supportin g doc umentati on was provided
to support NSA site responses.

• The response to question 26 was partia ll y supported. The question

required the NSA to the provide perso nnel intellec tua l ex.pertise. The
NSA did not provide documcntatiollto SlIpport Military and contractor
data.

• The response to question 27 was partially slipP0l1ed. The question

required the geograph ic and profess iona l relationship to NSA. The
NSA provided inconsistent and duplicate responses for colleges,
universities and commerc ial firm s located near the NSA sites.

14
FOR OFFICIAL USE ONLY
DRAG :<e!8Ietil'epBI'f:j (U'e ~e "lfJ{fi'BJtl/'f!.I.eLl~e tmdt:r' 3t:t:liBII 552 fbi (5), Ulli1e() 61tlre:3 Ct,*-,
"FrefJtlBHI e/b-/eIYH8fifHl As,', "(mti OtJD Dil'f!cli~e 5~(H). :;; "DtJD FreedtJm ttflllfJj llloeim. Ad
Pr8grmn, " 8epJelfl8eJ' 199& fE.1Ce"f"P,' i!m j\lt;",hei' 5, p(IJ·fIti tiP'!' C3.2. 1.5).
 FOR OFFICIAL USE ONLY
BEMe 1't?{T1t-erir-ep.31'ffl al'e etemptfi'fj;" re{-ef1.~e ffl,riel'seefiBI' 552 fh) (5), UlliJetlSt(lles CAlie,
"F,t::etfflm fJjIJ,rfo, ",,,tidll Ad, " (JIJ(;) DdD Dil eon pt 5oJf)f), 7, "DBD Pi eetffllll tlflnf(jj //IUriB" Ae(
flI'6f!;I'f11f', " &:pleJtlBer 1998 (E!IltHfrptiBIf NtlmiJer 5, {Jtl1'f1t;I'8pH C3. 2.1.5) .

Appendix C. Report Distribution

Office of the Secretary of Defense

Director, Base Realignment and Closures (I nstallations and Environment)

Other Defense Organizations

Director, National Security Agency

Non-Defense Federal Organization

Govemment Accountability Office'

'Only Government Accountabi lity Office personnel involved in the BRAe process are to receive the
repo rt.

15
FOR OFFICIAL USE ONLY
BRAG re!£llefi rep8rls ffi'e exemp1ft'8'" l'ef.e(lst: tJfIda' aeeri,,,, 552 (-bJ (5), U"ifed o/(:t,'es CtJtie,
"Freeci8;'f1 e/JII;fo;'}jlflliBII Act, "cmti DBD Dil eeli~e 54()(}. 7, "DdD FJ eedBm ttfhtfol IIIt/lidl' A.tt
PI'BgI'8R'/," &P'liIf'l8lil' /998 (E)CliHlpri81'1 ,¥ttH,8eJ' 5, (J9-I'9gI'ttPH O3,2,},5),
National Security Agency Comments

-
,\\l\~
UNCLASSIPIEDlIPOR GFFIGlAb !JaB GIIIN
NATIONAL SECURITY AGENCY
FOln O lO.-G1: G. MCADe . .... "'.,~ ..... o 207Sa-6QOO

~
I

12 May 2D05

MEMORANDUM FOR OEPllTY ASSISTANT INSPECTOR GENERAL FOR

INTELLIGENCB EVALUATIONS

SUBJECT: (U) CLOSB HOLD DoD 10 Report on NSA D,la CIlII Submlulons and
Internal Control Proceues Cor BRAe 2006 - Commenu to to

IU) Four problem ant.. in th, BRAe 2005 Cap.cit.y Analyail D.... C.nere
identified by the a"bjtct draft to report: improper document markin,s, unBignedl
un-majntain6Cl Non·DiacIOlUle ""Iementl (NOAa), mlu.ina responder
certiOeationl, and unlupported dlt•. We 8(tW with the .udil.Ors that .ome
hudcopy .,..•• are ineorreetl, marked or art not muktd. Or...t ell'ort. wu
npencied to ensure 1~ compliance in thlt art. and the volume of Piper plua the
Ju' minute QuIT)' of replacelMnt P.... contributed to the I,.. than l00"A0
conformance. Non. onh, dcda pare. we,.. unmarked, but. few certification .heela
or NDAa ellll b, fOl.lnd without the proper or complet.e BRAC dbc.lalmer, The initial
NDA and Cart.ifieaLioo Forma w, received (rom DoD ware not. properly m...,ked and
proliferated in the IYat.eIn. We did not track down eVlllryone who had aillled an
,.,ly venion to have them ",aien I newer (orm, Nor did we achieve 1()C}ll, But'Clllal
by .tampin, the oricin~1 (orml,

(u) W. blve .iened c.rtification, (rom "Iponciera (or 'feb oiLhe 16 Capacity
An.lysil Data Can quntiona NSA anlwered. Individuals who participated in
vettina: Lb, Data Call information .imed the OIrtillcltlons ronu Perhapi thete
cert.incaLion atawmentll wIre prOVided .ubMqI.l.nL to the auditor',lalt. review day
and tbat i, why tha report statll, tha,. ant milrin, certJficaLion. fot 80m. questions.

(U) W. did al thoroulb a job u pOlaibl1 to ttc\I.tt an the NDN that NSA.
emplOYHaI_nice members limed. Whan the 000 orilioaUy initiated the BRAe
2005 Intellilence Capedty Analysis Dat. C.1I, NOAa (or NSA employee. WOnt
.Ianed and retained by the Ooo...deaignat.ed Group Leacia (or SUUI"CH I: Methods.
CW. and Headquu1en Manll,ement. To our knowledco ttloee NDAt are slill in
their pouHlion. NSA h .. NOAa (or .n
the NSAlCSS individual. whom wo bcli.v@
participated in the Capacity Anal,.ll Data Call. PIl"IOnl WhOOl WI queried about
data or the e:rillence o(dlta, but WII,.. not informed why or (or what. purpose the
d.ta was needed were not ••ked \II lim NOM. W••re unaware oreny individual.
who actively participat.ecl In thill pha.. o(BRAC who did not .Im at lea... one NO".

UNCLASSlJl'lElVlFGR QPFICJM USB ()NlrY

DeliberaLj"e Peawa.a' Per 9i ...... ie" .... 01'11,. ,,11'"
rorODiei.1 Uell 0.1,. De NIIt Rel,ue Ul'ldar FOil.

17
 ,I'"
I

UNCLASSIFIEDWOR OFFICI ...'. vag QNl.Y

(u) The fin.l problem are. i. the most problem.tie to .ddre.. - Data
Supportebilh.y. Ofth. 17 C,plCi~ Analylil Dat, Call qu"Uonl, NSA found that
16 were applitllble. or thOI8 16 the auditor. found 7 (u.lly I UpPOrt.ed, 7 par'ially
,upported. and 2 ",,.,uppo,.I.d. In addiUon. the auditors fouod that the hardcopy
data did not alway. IIcree with the data cnt.red by Oracle into the DoD Intell
d.tab....

(U) A bit ofback(l'Ound i. nec....ry to und....Und the difficulty both. NSA

, and the .uditora enOOW'l\ared Lryin, to determine lilte support.bilil)'. In the Fall of
I
2003 DoD reqUIRed that Deren .. Int.elliauee .,encil' participate in wotkin,
\ rroupi to ereatAI queatioo, and attribute. for the Intelliience J)Ot1.ion of BRAe 2005,
,. \ nu, WII \he tint time thet InteUicencI function. wen included in BRAe and there
""at • ltec!p leamin,. curve. In addition, the relt oelhe DoD had been WOtkin, on
th.lr BRAe d ... c.1I for .orne 9 montha befor. It ""at determintd that lnt.ell"ence
would p.rticipat.e, _ there wa. much to do in a compreMed tima frame. 'Ib,
Int.elliaenee Workin. Groups (Soureu • Mathods, C2A.2, and Headquarters
Man,,,m~nt) I,bored for two month. craftiol que.tionaanclaUribute. fot the
CapaclQo Data Ca.LI. At the eod orCY2003 DoD determined thet the dell can would
uee traditional BRAe qua.Uoni ",aullina in the I'i' Cap,adty Analyail Datil C.II
QUlltione. Th.t w . . fine ncept that it w .. aim datarmined that the .ttributea
IdenUOed by lh, IfOUPI (that on'y weN ,.elevant to their oririn.1 queationd would
alao 'ot uNCI. The locic r,n eput quiek.ly and it wu truly an applu and oran.,.
,.erd .. In roany CII. . . . Here ill one e.ample. Capacity An,lyaia Data Call
Questjoo '3, which wal audited as Munlupported-, faquired NSA to provide
penonnel poeilion data by aubrunct.ion ('.1. Soureu" M,thode) and penon no)
poeition data by attribute (e.a. lAvyinllnt.e1 ColleetJoo Requinnaenb -
Requir9m,ntl V.Udation and Prioritiution Lon, term, Lovyinllntel Collection
Raquirlmentl- a.quiraments ValidaLion and Prioritization Short Tann). Thia
lIleant th.l NSA needad to be abl. to look at ita tabl, of cU.u;bution and jd~ti{y
how many positionl levy Intellicence mllec:tion requirtmenta Ihon "rm and how
man), poaitionlll'Vy lnteJJiIt.Gte collection requirtmenta 10"1 It"". The apple. and
oran ..a navOl' Mould have become clear by now. 10 this e..mple, NSA doem't
dHTettoUete it.e position. bued upon ""beth.,. the poIition i. dealine with a lonl Of
ahort term. collection requiremenL The data call wu r,.aulht with the.. problema.
In order to provida the information NSA roUod th. aUriblolw up to the Sub·
Function level and attempted to report the position data that w.y. It was not I
perf.ct solution u lb. auditon have DOted. Tbataaid the .uditoN hIve ......d th't
81 .t.i~ of all qu .. tion, were IUPpotWd CGmplet.ely or partially by data. In thOle
cuell where we tould not put a round pee into a tQuare apertuN. wa deICribed Lbe

UNCLASSlII'I!OIIFOR OFFIGW:. USE 9Nb¥

Dlm•• Nt-i·"t Dontlll."t Fer BilCll_O.. Pl:aIPO'" OnI,
Fer Om.i,1I liM 0111, Do Net. Rei.... Under FOrA

18
 UNCLASSIP'lEDlII'OR QFflIC •.tb !l88 (lNIX

methodo)OIiet and deduction. uNCI to obt.in the rllwlt. NSA i. confident that.1I
data i. accounted ror and could be used to IUpport the oyararthlne objectivo. oflhi.
Capacity nata Call.

(U) The auditors are eonec:t that ditcrtlpllDCiel "xJat bttween the data call
documented. in hardtopy and tho Oracle O.teb..... The ,ealOn fot this i8 the Oracle
Conuact.on were ulin, software with which tba), WI" unr.miliar. The lof\wa,..
WIU not .dequ.~ly documented and the contractor. learned how it worked by trial
and IrTOr. A. th.~ attempted to load our data they would emount.er problem.....ith
format, naminl conventions or tpecial charader limitaLiona. Th. contractor. then
adviltd NSA when and how we had to chtu\le the uta to make it 1000d i.nto the
d.t.b.... The chan", in the main did nat chan... the data. In each eaM NSA
providCMl an e"ata .beet with ..ell new Compact Oil( iodieaUna how the lIOftcopy
data differed from the h.rdcopy. P.rh.pt 'he .uditor. we... not .ble \0 reyiew !.hat
inform.tion.

(u) Soyer,l times throullhout the dr.ft. IG report the followinl wordinl i8
UMd: MBuod on our (the auditor.) review .nd dilCuqiona with NSA mUl'illment,
we recommended th.t NSA provide .ddILlon.llupportinc documentation and
methodoloey to correct the ilsun However, NSA m.nacement It.al.ed that no
addltion.1 ,uppomnl doeumentation would be providod.- While tbeac worda are
true, they do not pplain the bans for NSA not providinl .ddltlonal information.

"ated .bm.
NSA did no' provid••ddition.lsupportinl data bee.UIG wa h.d no way ta do so. N
in order ta IU1fWer My'ral of the quotlonl NSA had to aureealot dllt.
iJ\.IUad oru.inl the attribute. that had ~om. artillcial conltrutta. While NSA
documonted the 'liumptione and method. uMd to perrorm the calculatione, clearly
'he auditara are correct that the,.. wa' not _plicit . upportinr data, The data
,..,ulled from arithmetic calculation. and di.trihution auumption • . The report
amvey. the imprenion lb.t NSA could have providod. additional.upportinl
documentation but ju.t. chON not to. That i. far from the can.
NSA worked diliienlly to providll ,upporti.oC data, bllt.1 explained above the data
W8I unknowable.

(U) Probl.m U'eU in the BRAe 2005 NSA. Military V.I ... II Dtta Call
,ubmiuion an identified In lbe .... bjact draft 10 r~rt. The report identilie,
leYer.J q...utiona that were Dot fully ,upport.d. Althoulh the audita" and the NSA
Military Value Team roviawed end diKu.Md the luditora' findinl' at Ihe end of the
audit, \h. report doe. not clearly uplain the in.bUlty or NSA. to pnwide dditional
.upportin, docum.nt.etion to partially ,upported nt' ponte,. Thll auditor' reviewed
,h.11 que.tion. to which NSA responded. 'Th... 11 Milit.llry Value qUMtion. broke

UNCLASSIFIEDlJF9R. QF!PIClAL USB GHb¥

Dali"eM,lore DeeHIIlII"t Fer 9iael:laeion P'larpo.n 0111,
¥OF QUiai.IUM Only 90 NM ...... bI"der FOIA

19
 UNCl.ASSlfIEOIIroR OFFIGIAb ~1IIl ONLY
( ,
\ down into 61 individuafdata re.ponsea. Three quution. wore fully lupport.ed t
i
Jeavini 8 questions partially supported.
1
.J
.~ (ll) As w .. the case in the Capadty An,lYlil data c.U. what tho raport d~1i
not do i. oxpleJn the buis for NSA not providi ng additionallnfomlatlon for
6Upporiinc doc:umente.tion. NSA did not provide additionalaupportinr data becau.I
it WI' non-exiatant. Savara' quutjon. in the Military Valuo Oau. Call required
supportlnl docvmentalion that I, not tracked or recot'ded in the format required to
IInlM'at the que,tiona. While NSA provided •• much aupportinl documentatlnn Btl it
could for each question •• well.s the methodoloKiu for ,II of the data, it w . .
impouible to provide supporting documentation that wa. at:eaptabl. to the
auditor • . For ...mple. the report lItIIIt.ea NSA did not provide lupportinr
documentation for parkin(lpace count. (quHtion 181. But. the auditor. oould not.
aC«!pla 'pecific, physiul count. oflha .pace. a ••upportin. documentation, makin,
the rupon.. only partially R1Pport9d_Qutltion 19 wa. partially .upporttd bee.UN
I\Ot all buildin,. had been . urvey.d to provide the (adlitie. C1IndiUona.

(0) The NSA BRAe team membtn lpent many lon, hOUR and went to pal.
I.n,tha obtainine all w.ting data necealaZ) to anlWer the data tall. NSA aeree:a
with lb, lIuditoT1l that each qu.lf.ion wu not an.wered and .upported lOO9Co.
However. the report conveys the imprenion that NSA could have provided
addlUonalaupportinr documentation butjuat (hOM not to. That I. rar tram the
cue. NSAworked dilirentJy to provide lupportinr dati. but. .. explained above.
the data was non-exiltent.

(U) We apprl!oClaw the time tbeauditor'lpenl workinr with UI at NSA and

th' patience &lDd information they pNWided to UI in an IIUempt to meet a II)(Yjf,
.upportable aubmiaeion. Thank you for the opportunity to comment on thie dr.1\
teport.

1\

UNCLASSJFJEDlIFOROFFICIA:b USB QNL'i

Delilt.,.~'J'
Deeltt'fteftt Fer DiICUHio.. PUI pUMa Dnly

20
(b)(6)
FOR OFFICIAL USE ONLY

FOR OFFICIAL USE ONLY